Tier 3 Sub-study Privacy notice

Privacy Notice for PHOSP COVID 19 Tier 3 Sub-Study

Information you need to know

The University of Leicester Department of Health Sciences, are conducting research to understand NHS care pathways for survivors of a Covid 19 hospital admission.

The sub-study is part of the national Post-hospitalisation COVID-19 study (PHOSP COVID 19) that aims to identify whether there are longer-term health problems of COVID-19 for those who were admitted to hospital. The University of Leicester is the sponsor for the PHOSP COVID 19 Research and this sub-study is being funded by the National Institute for Health Research UK Research and Innovation.

The University of Leicester is the Data Controller for your information. Further information about the University can be found here: https://le.ac.uk/

The University’s Interim Data Protection Officer Parmjit Singh Gill can be contacted by post addressed to Data Protection Officer, The University of Leicester, University Road, Leicester, LE1 7RH or by email dpo@leicester.ac.uk

This privacy notice is supplemental to the main PHOSP COVID 19 Privacy notice and explains what information we are collecting, how we will use this information in this sub-study and what rights participants have in relation to their information.

What information are we collecting or using?

In this sub-study we are collecting information from existing PHOSP participants and other people who are:

  • Aged 16 and over and are either :
    • Clincians working in healthcare settings providing healthcare pathways or
    • Health care staff responsible for developing and implementing post hospitalisation healthcare pathways for COVID-19 Patients in their organisations or
    • COVID-19 Patients who ahve experiences these healthcare pathways.

We will only collect and use your information if you have voluntarily agreed to participate in this sub-study and have completed participant consent forms in accordance with ethical requirements and to meet legal obligations relating to confidentiality.

The information we will collect directly from you in agreeing to participate and in consent forms includes:

For Clinicians and healthcare staff:

  • First and last name and contact information including email address
For Patients:
  • First and last name and contact information including your email address
  • Health/healthcare information you share in the interviews

For Clinicians only, your responses to the Online Survey (JISC) about your organisation’s post-hospitalisation pathway services.

For all participants invited to an interview with one of our researchers, the information we may document from your views expressed during interviews includes the following:

  • For Clinicians, healthcare professionals and managers’ your experiences of designing and delivering post-hospitalisation pathway services; or
  • For Patients, your experiences of post discharge care following a hospital stay with COVID-19.

Why are we collecting your data for this Sub-Study?

As COVID-19 is a new disease, the main purpose of this PHOSP COVID 19 sub-study is to explore healthcare staff and managers’ experiences of designing and delivering post-hospitalisation services and, patients’ experiences of post discharge care following a hospital stay with COVID-19. The data will also be used to inform the National Institute for Health Research funded evaluation of support in post-hospitalisation for COVID19. The data will inform service development to help achieve holistic, integrated, equitable and cost effective services.

The aim of research is to understand:

  • The range of care pathways implemented for COVID-19 patients after discharge from hospital.
  • The experiences of healthcare professionals and managers of implementing such pathways, including barriers and facilitators and lessons learned.
  • The experiences patients have of care pathways post hospitalisation with COVID-19, including how such care pathways are integrated with other healthcare they may be receiving.

How we will use this data?

We will use your information to enable us to answer the research questions for this sub- study we have set out above.

We will do this in a way that protects your identity as follows:

  • Data collected from interviews these will only be recorded with participants’ permission.
  • Where we have your permission to record, the recordings will be professionally transcribed by a third party with whom we have a contract and anonymised upon transcription. Original recordings will be deleted once they have been transcribed.
  • Any views or opinions used in our research findings or publications will be anonymised so it will not be possible to identify you from those comments.

The University of Leicester has technical and organisational measures in place to ensure that the data used in this research are securely stored and only used for the purposes of this research, as described in this notice.

Individuals from regulatory authorities may look at data collected during the study; these bodies have their own technical and organisational measures in place to comply with Data Protection Legislation.

We will not be using the data to record, learn or decide something about you.

This research sub-study does not involve automated decision-making or profiling.

What is the legal basis for processing the data?

The legal basis for the processing of participant information that we are collecting and using for this sub-study is for the performance of a task in the public interest (Public Task) as set out in the Data Protection Act 2018 and GDPR Article 6.1(e). Research is a public task that the University of Leicester performs in the public interest, and is part of its core functions as a University.

Our additional legal basis for processing special category health information is that processing is necessary for scientific research as set out in the Data Protection Act 2018 and GDPR Article 9.2.j.

If we are sharing your data with others, who are we sharing it with?

Access to original transcripts or any files containing identifiable and/or potentially sensitive information will be limited to members of the research team comprising staff from the University of Leicester.

We will be sharing information with:

  • Our third party provider who will transcribe and anonymise information from the audio recording of interviews. We have a contract with the third party for these services that includes terms relating to confidentiality to protect your privacy.
  • Online Surveys (JISC) who are our third party processor contracted to administer the surveys to be carried out with participating Clinicians.
  • The University of Edinburgh our PHOSP COVID 19 research consortium member and who are providing the main data centre services for this research and are a Joint data Controller for the data held in the data centre.
  • Other third party providers of technology we use to support recruitment, communications and virtual interviews for e.g. Microsoft Teams and related back-up systems.
  • Bona Fide researchers outside the PHOSP COVID study team who successfully apply to our PHOSP COVID 19 access committee. They will only have access to anonymised research data.
  • Participant information may be required to be disclosed to regulatory authorities and public health agencies though most will only require anonymised information.
  • Direct access will be granted to authorised representatives from the University as sponsor, host institution, and the regulatory authorities to permit monitoring, audits and inspections.

We are also required to provide progress reports and summarised, anonymised research information to our grant funders the National Institute for Health Research UK for their related research purpose as described in this notice but this will not include any information about individual participants.

We will only share with all these parties the minimum information that is necessary for them to undertake the task they are performing. We will not share information that identifies participants such as their name and contact information with people who do not need to know this.

Anonymised information means that a person can no longer be identified from the information and it is not personal information for the purposes of Data Protection Legislation.

How long will we process your data for?

All the identifiable information being collected in this sub-study will be processed and unless otherwise stated, the information will be held for and deleted after 5 years:

  • Your consent to participate forms:
  • Anonymised transcripts of audio recordings, held in our research file store
  • Encrypted original audio recordings which will be deleted as soon as they have been transcribed;

Anonymised and summarised research data, analysis, outcomes and reports will be kept indefinitely and are not considered to be personal data so they are not covered by the Data Protection legislation.

What are your rights and how can you enforce them?

Under Data Protection legislation, individuals normally have rights in relation to the personal information we hold about them. For the purposes of research, where such individual rights would seriously impair research outcomes, such rights are limited.

In this PHOSP COVID Sub-study, and specifically in respect of patient health and healthcare we need to limit participants’ rights and are relying on the exemptions in Schedule 2 Part 6 paragraph 27 of the Data Protection Act 2018 because we are processing this information for scientific research in accordance with GDPR Art. 89(1) and Approved Medical Research covered by s19 Data Protection Act 2018.

Prior to applying these exemptions, we have carried out a Data Protection Impact Assessment and taken into account:

  • That this scientific research is of public interest and national significance because it relates to COVID -19, a new disease classed as a pandemic because it has affected people in many countries;
  • That the results of our research will only be published in an anonymised or summarised basis;
  • We have taken appropriate measures to safeguard participant information we collect or receive and to protect the rights and freedoms of all participants including patients whose information we will be using in our research by use of anonymisation techniques in respect of the identifiable personal or pseudonymised information from the survey questionnaires and transcripts of interviews;
  • We, our partners and data processors are under an obligation to maintain confidentiality in our handling of identifiable and pseudonymised participants’ information;
  • We are making information about our research and use of information available to participants and the public through this privacy notice which is available on the PHOSP COVID 19 website phosp.org.
  • We have concluded that the exercise of rights by participants would seriously impair the achievement of the Study objectives and the exemptions are necessary to enable us to fulfil our scientific research purposes.

How will this affect the rights of participants?

Whilst participants involved in this research may withdraw from the study at any time they will not be able to exercise their rights to access their personal information, to request correction of inaccurate information or erasure of their information, to restrict processing of information or to object to our processing of their information even if they leave the study. GDPR Articles 15,16,17,18 and 21 will not apply.

If you withdraw from the project, we will keep the information we have already obtained but we will protect your rights in our research analysis since this will only involve processing information that has been anonymised or the use of anonymised transcripts.

If you wish to ask questions about our research please contact Dr Charlotte Overton, one of the researchers, by email charlotte.overton@leicester.ac.uk

What right do you have to complain to the Information Commissioner’s Office?

If you have concerns or wish to complain about our use of this data in this research or your rights, please first contact Information Assurance Services by email at ias@leicester.ac.uk or the University’s Data Protection Officer by email at dpo@leicester.ac.uk . In any communication, please provide the project title (“PHOSP COVID 19 Sub-study”) and detail the nature of your concern or complaint.

Anyone can raise concerns about how their information has been processed with the Information Commissioner’s Office (ICO).

The ICO may currently be contacted:

By Post addressed to:Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

By Email: contact can be made by accessing www.ico.org.uk

Approved Version: IAS/v1/25/08/2021