Who is responsible for your data?
The data controller for this study is the Sponsoring organisation, University of Oxford.
Under Section 251 of the NHS Act 2006, we have permission to conduct this study without consent.
The study relies on accessing a large number of historical patient records. The study requires access to these health records without individual patient consent, on the basis that the scale data needed to address its aims would otherwise be reasonably unobtainable.
OPTIC-19 has support from the Health Research Authority following advice by the Confidentiality Advisory Group (England and Wales) under Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 to conduct the study without study-specific consent (i.e. link, transfer, process and analyse the data) (CAG reference number: 21/CAG/0017).
Personal data we collect about you
This study will follow up survivors for 1 year after discharge from hospital using several different sources of patient data. Linking these different sources together will allow us to estimate a range of health risks faced by survivors of severe COVID-19. We will compare these risks to patients treated on an ICU for other conditions.
The study will use the following data sources:
- Intensive Care National Audit and Research Centre (ICNARC) – Case Mix Programme audit database
- NHS Digital – Hospital Episode Statistics (HES), Civil Registration (deaths), GPES Data for Pandemic Planning and Research (COVID-19)
- Patient Episode Database for Wales (PEDW)
- UK Renal Registry (UKRR)
- National Institute for Cardiovascular Outcomes Research (NICOR)
- Stroke Sentinel National Audit Programme (SSNAP)
- UK Obstetric Surveillance System (UKOSS)
Eligible participants will be identified from data collected by the Intensive Care National Audit and Research Centre (ICNARC). ICNARC will extract participants’ personal information (date of birth, NHS number, postcode and gender – known as direct identifiers) and create a unique (pseudonymous) study ID. ICNARC will transfer the direct identifiers and study ID to NHS Digital and national audit databases to obtain follow-up data. This data exchange will occur in a secure manner. NHS Digital and other data providers will anonymise participants’ data before transferring it securely to the study office at the University of Oxford. NHS Digital will remove any participants who have indicated that they do not wish their data used for research purposes (https://digital.nhs.uk/services/national-data-opt-out). No direct identifiers will be communicated to the study office at any time and will not be retained in the study database. The study office will only hold the pseudonymous study ID linked to ICU and follow-up data (e.g. subsequent hospital admissions). The study database will store information on your local area, which has been derived from your postcode.
The pseudonymous data received from ICNARC, NHS Digital and other national audits will be imported into a database held securely by the University of Oxford and used solely for academic research purposes. Importantly, while the information received is specific to each study participant, no individual person will be identifiable in any publication arising from this work. Your personal data will not be shared with any third parties (other than ICNARC) and will not be used for any automated decision making or profiling. If you would like to have this data withdrawn, please contact the study team using the details given below.
How we use your personal data
Research is a task that we perform in the public interest. The University of Oxford, as sponsor, is the data controller. This means that we, as University of Oxford researchers, are responsible for looking after your information and using it properly. We will use the minimum personally-identifiable information possible.
The legal basis for the processing and storage of personal data for the OPTIC-19 Study is that it is ‘a task in the public interest’ (article 6(1)(e)) and, that sensitive personal data is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (article 9 (2) (j), based on Article 89(1)).
How long we keep your data
The Sponsor will keep a record of your direct identifiers (e.g. data of birth, NHS number) until the end of the study. Your other (anonymised) personal data will be retained for at least five years, in line with the MRC Retention Framework for Research Data and Records and relevant legislation.
Further information on how long research information is retained by the University can be found in the University’s Policy on the Management of Research Data and Records, available via http://researchdata.ox.ac.uk/university-of-oxford-policy-on-the-management-of-data-supporting-research-outputs/.
How we protect your data
The Sponsor has security policies in place to protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. These policies are reviewed regularly to ensure best practice.
The study will use secure computer systems, secure networking, NHS standard encryption and electronic records, secure disposal of confidential waste and computer storage media, and staff with a contracted obligation to ensure data protection.
The deidentified personal data collected and managed by the Sponsor will only be used for research purposes. These data will also be shared with ICNARC as they are part of the study analysis team. The deidentified data will not be combined with any data sources that could identify you.
Under the General Data Protection Regulation (GDPR), you have the following rights over your personal information/data that we hold:
- The right to request access to your data
- The right to request correction of your data
- The right to request your data is deleted
- The right to object to processing or restrict processing of your data
For more information, please see: https://compliance.admin.ox.ac.uk/individual-rights. If you wish to exercise any of these rights, please contact the study at firstname.lastname@example.org.
Complaints and withdrawing from the study
If you decide you do not want your data to be linked in this way you can withdraw from this follow-up, without affecting your current medical care, by contacting the study team, who would require your identifiers to then inform NHS Digital that you no longer wish to be part of the cohort. NHS Digital will not provide us with data for anyone who has withdrawn consent.
Data protection regulation provides you with control over your personal data and how it is used. When your health care information is being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available at https://compliance.admin.ox.ac.uk/individual-rights or by contacting the study team using the details below.
If you have further questions or are not happy with the way your data has been handled, please contact the study team using the contact details below. Alternatively, you can contact the study sponsor on 01865 616480 or email@example.com. You have the right to lodge a complaint with the Information Commissioner’s Office (0303 123 1113) or www.ico.org.uk.
If you require any further information on the use of your data or any aspect of the study, please email firstname.lastname@example.org