Privacy Notice - reduce website
This Privacy Notice explains how University Hospitals of Derby and Burton NHS Foundation Trust (UHDAB), the Universities of Nottingham, York, Edinburgh, Swansea, Southampton and King’s College London (REDUCE researchers), and the website developer (Global Initiative Limited) collects, stores and uses your personal data (information about you).
What is personal data?
Under data protection law, ‘Personal data’ means any information that relates to and is capable of identifying a living individual.
What data are you using?
- Your name and email address will be collected to provide your user access to the website.
- We will collect website usage data. We use website analytics which collect as standard:
- your IP address,
- location data (e.g. longitude, latitude, town/city, country),
- type of device (phone, tablet, computer) used to access the website,
- browser (e.g. Internet Explorer, Chrome) used to access the website,
- time and date of your website visit(s)
- duration of your visit(s) (in total and visits to each page)
- which pages you visited
Why are you using my data?
To help to carry out the REDUCE trial. We have developed a new way of helping people with diabetes who have had a foot ulcer previously. Our new way is a package called ‘REDUCE’. The package includes 8 one hour sessions with a healthcare professional, such as a diabetes nurse, and support through a new website (the REDUCE website).
We would like to see if the package can reduce the chances of people getting another foot ulcer and, if they do get an ulcer, help people get the right support quickly. As part of this, we would like to see how people use the website. We would like to know which pages are visited and how long you are spending looking at the website.
How will you use my data?
REDUCE researchers will use the information about how you use the website to carry out the research study. Only researchers at the Universities of Nottingham, York and Edinburgh, University Hospitals Derby and Burton NHS Foundation Trust and the company who have built the website (Global Initiative Limited) will be able to see your names and email addresses. The University of Nottingham researchers will download the website usage data. Before sharing via secure University drop-off systems with other REDUCE researchers, your personal details (name, email address, IP address and longitude and latitude of the device used to access the website) will be removed and replaced with a participant identifier. The REDUCE researchers at Swansea University, King’s College London and University of Southampton will only have access to the website usage data with your personal details removed. REDUCE researchers will use the website usage data with the other study data to analyse the results of the research study.
The University of Nottingham research team will use the email address you provide to set up your account. When you register on the website you will automatically be opted-in to receive weekly motivational emails related to REDUCE. You will also have the option to opt-in to receive daily foot checking reminder emails. You can stop these emails at any time by changing your settings in the REDUCE website.
To safeguard your rights, only the minimum information about you necessary for these purposes will be used. Responsible members at the sponsoring organisation, University Hospitals of Derby and Burton NHS Foundation Trust (UHDAB), may be given access to data about you to check the research study is managed properly, for monitoring purposes and/or to carry out an audit of the study to ensure that the research is complying with applicable regulations.
As well as UHDAB, regulatory organisations, may also look at your personal data and study-related sections of your medical notes to carry out the research study or to check that the research study has been conducted correctly. To safeguard your rights, only the minimum information about you necessary for these purposes will be used.
Information about you may be used for research or teaching purposes once personal details that could identify you (like names, and email addresses and IP addresses) are removed. Once the research study is finished, the data will be available to other research teams, without any details that could identify you. This is to make sure that the research study results are used in a way that will have the most benefit to other people while ensuring your rights are safeguarded.
You can find out more about how your personal data is used by contacting the REDUCE research team by email to reduce@nottingham.ac.uk or by phoning 0115 8230455.
Who is responsible for my data?
University Hospitals Derby and Burton NHS Foundation Trust is responsible for your data (the official name for this role is ‘data controller’). This means that the University Hospitals of Derby and Burton NHS Foundation Trust is responsible for looking after your personal data and using it properly.
Global Initiative Limited, a web software development company, is working with the REDUCE researchers to run this research study by collecting and securely storing your personal data from the REDUCE website on behalf of the REDUCE researchers (the official name for this role is ‘data processor’). Global Initiative Limited and REDUCE researchers at the organisations listed above are data processors.
Is my data kept private and secure?
The REDUCE researchers have a legal duty to keep information about you confidential. There are strict codes of conduct in place to keep your information safe. The REDUCE researchers will abide by the Data Protection Act 2018, the UK General Data Protection Regulation (GDPR), and the University/NHS Data Protection Policy.
The privacy notices for research participants provide more information on how the REDUCE researchers collect and use your personal data when you take part in one of our research projects.
For copies of the University and NHS privacy notices, please email reduce@nottingham.ac.uk or telephone 0115 8230455.
The REDUCE researchers will keep your personal data for a minimum of 5 years after the research study has finished.
What are my rights?
You have the right to contact the University Hospitals of Derby and Burton NHS Foundation Trust to ask to be informed about the data held about you.
Your rights relating to erasure of your data and to objecting to the use of your data are limited under the UK General Data Protection Regulation (GDPR). This is because your data is used for scientific research purposes and needs to be managed in specific ways in order for the research study’s results to be concluded in a reliable and accurate fashion.
Please contact the REDUCE researchers by emailing reduce@nottingham.ac.uk if you would like to make a rights request.
What is the lawful basis for collecting, storing, and using my data?
Data protection law requires us to have a valid legal reason (‘lawful basis’) to process and use your Personal data. The lawful basis for processing personal information in this research study is for the performance of a task carried out in the public interest. Personal data collected for research will not be used for any other purpose.
Are you using special category data about me?
Special category data regarding your health and ethnicity will be used as part of this research study. This data is collected from the questionnaires you have completed and from your medical records. Please refer to the participant information sheet and consent form you were given at the start of the study. You can request a copy by emailing reduce@nottingham.ac.uk. This use of special category data satisfies the condition for ‘scientific research purposes’, as set out by data protection laws.
How can I raise a complaint?
If you would like to raise a complaint on how your personal data is being handled, you can contact the University Hospitals of Derby and Burton NHS Foundation Trust Data Protection Officer, who will investigate the matter. You can contact the Data Protection Officer via email to uhdb.dataprotectionofficer@nhs.net.
You can also find information here: https://www.uhdb.nhs.uk/research-how-we-use-your-information
If you are not satisfied with the response, or if you believe that your personal data is handled in a way that is not lawful, you can complain to the Information Commissioner’s Office (ICO). See their website at ico.org.uk.
