RE-BLEED: A digital platform for identifying bleeding patients – a feasibility study
Who is responsible for your data?
The data controller for this study is the Sponsoring organisation, University of Oxford.
How will the study collect and process data?
This study does not change or affect patient care. This study has been reviewed and approved by South Central, Hampshire A Research Ethics Committee (21/SC/0290).
Data protection regulation requires that we state the legal basis for processing information about you. Research is a task that we perform in the public interest. The University of Oxford, is the sponsor for this study, is based in the United Kingdom and is the data controller. This means that we, as University of Oxford researchers, are responsible for looking after your information and using it properly. We will use the minimum personally-identifiable information possible.
The study relies on accessing a large number of patient records. The first phase (retrospective cohort) of the study uses already anonymised data, whilst the second phase (prospective cohort) of the study requires access to health records gathered without individual patient consent. This is justified on the basis that in order to advance our understanding of bleeding, we need to detect as many early signs of bleeding as possible and this can happen at any time of the day or night. It would therefore not be feasible to ask all patients in the hospital for their consent to be screened for possible bleeding, as this could occur at any point during their stay in hospital.
The study will use data, collected as part of patients’ routine care, to construct a research database of patients who have likely experienced bleeding. Data for those who are screened but who are not identified as having experienced bleeding during their hospital admission will be deleted.
The legal basis for the processing and storage of personal data for The RE-BLEED Study is that it is ‘a task in the public interest’ (article 6(1)(e)) and, that sensitive personal data is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (article 9 (2) (j), based on Article 89(1)).
The data provider (Oxford University Hospitals NHS Foundation Trust) will anonymise all participants’ data before transferring it securely to the study office at the University of Oxford. The Oxford University Hospitals NHS Foundation Trust will extract participants’ personal information (date of birth, NHS number, postcode and gender – known as direct identifiers) and create a unique (pseudonymous) study ID. No direct identifiers (e.g., name, date of birth, NHS number) will be communicated to the study office / sponsor at any time and will not be retained in the study database. The study office will only hold the pseudonymous study ID. The pseudo-anonymised record will contain other data from the time you were in hospital (such as lab records, treatments and drugs etc.).
Importantly, whilst the information received is specific to each study participant, no individual person will be identifiable in any publication arising from this work. Your personal data will not be shared with any 3rd parties and will not be used for any automated decision making or profiling.
Under Section 251 of the NHS Act 2006, we have permission to conduct this study without consent.
We have special permission to conduct the RE-BLEED Study without study-specific consent (i.e. link, transfer, process and analyse the data) from the Confidential Advisory Group. This permission is required for the second phase of the study where the This permission is given under Section 251 of the National Health Service Act 2006 and its current regulations, the Health Service (Control of Patient Information Regulations 2002) (CAG reference number: 21/CAG/0123).
How we use your personal data
Research is a task that we perform in the public interest. The University of Oxford, as sponsor, is the data controller. This means that we, as University of Oxford researchers, are responsible for looking after your information and using it properly. We will use the minimum personally-identifiable information possible.
The legal basis for the processing and storage of personal data for the REBLEED study is that it is ‘a task in the public interest’ (article 6(1)(e)) and, that sensitive personal data is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (article 9 (2) (j), based on Article 89(1)).
How long we keep your data
The Sponsor will keep a record of your direct identifiers (e.g. data of birth, NHS number) until the end of the study. Your other (anonymised) personal data will be retained for at least five years, in line with the MRC Retention Framework for Research Data and Records and relevant legislation.
Further information on how long research information is retained by the University can be found in the University’s Policy on the Management of Research Data and Records, available via http://researchdata.ox.ac.uk/university-of-oxford-policy-on-the-management-of-data-supporting-research-outputs/.
How we protect your data
The Sponsor has security policies in place to protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. These policies are reviewed regularly to ensure best practice.
The study will use secure computer systems, secure networking, NHS standard encryption and electronic records, secure disposal of confidential waste and computer storage media, and staff with a contracted obligation to ensure data protection.
The anonymised personal data collected and managed by the Sponsor will only be used for research purposes. The anonymised data will not be combined with any data sources that could identify you.
Under the UK General Data Protection Regulation (UK GDPR), you have the following rights over your personal information/data that we hold:
• The right to request access to your data
• The right to request correction of your data
• The right to request your data is deleted
• The right to object to processing or restrict processing of your data
For more information, please see: https://compliance.admin.ox.ac.uk/individual-rights. If you wish to exercise any of these rights, please contact the study at email@example.com.
Dissent and withdrawing from the study
If you decide you do not want your data to be linked in this way you can withdraw from the study at any time, without affecting your current medical care, by contacting the study team (details below).
If you have previously completed the National NHS Opt-Out, we will have automatically excluded your data from all phases of the study. Please feel free to contact us if you have any questions.
Data protection regulation provides you with control over your personal data and how it is used. When your health care information is being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available at https://compliance.admin.ox.ac.uk/individual-rights or by contacting the study team using the details below. The University’s data protection officer (DPO) can be reached at firstname.lastname@example.org .
If you have further questions or are not happy with the way your data has been handled, please contact the study team using the contact details below. Alternatively, you can contact the study sponsor on 01865 616480 or email@example.com. You have the right to lodge a complaint with the Information Commmissioner’s Office (0303 123 1113 or www.ico.org.uk.
Professor Peter Watkinson
Kadoorie Centre for Critical Care Research and Education, Level 3, John Radcliffe Hospital, Headley Way, Headington, Oxford OX3 9DU
+44 (0)1865 223101