Surrey Clinical Research Facility volunteer privacy notice
Surrey Clinical Research Facility (CRF), formerly Surrey Clinical Research Centre, and Surrey Sleep Research Centre (SSRC) are based in the Clinical Research Building, part of the University of Surrey. Both SCRF and SSRC, use personally-identifiable information (personal data) to conduct research to improve health, care and services. When you agree to take part in a research study in the Clinical Research Building, managed by SCRF or SSRC, we will use your data in the ways needed to conduct and analyse the research study. Your rights to access, change, move or remove your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep and continue to use the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.
All health and care research involving participants must receive a favourable opinion from an independent ethics committee who ensure that participants’ interests are protected. This includes arrangements for collecting and processing personal and special category data.
If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO). Further information can be found at the Information Commissioner’s Office website. We would request that you address any concerns to us first before contacting the ICO.
The University of Surrey is registered as a Data Controller with the Information Commissioner’s Office (our notification number is Z6346945), and we are committed to ensuring that the data we process is handled in accordance with data protection legislation.
We have a Data Protection Officer who can be contacted via firstname.lastname@example.org.
One of our responsibilities is to tell you about the different ways we collect and use your personal data. This statement provides details about these uses. In addition to this statement, you may be given further information about the uses of your personal data when you use certain services offered by the University of Surrey.
SCRF/SSRC holds and processes data about research participants and patients taking part in clinical trials and research studies.
SCRF/SSRC also holds data about individuals who have expressed an interest in participating in future research and who have registered to join our participant recruitment database.
SCRF/SSRC processes both personal data (data that can be identified as relating to an identifiable person) and special category data (personal data that is more sensitive, for example health data).
Data is obtained in several ways:
- Research participants or individuals expressing interest in future research: Data is provided by interested individuals as part of the SCRF or SSRC registration / screening process. If participating in a study, data may also be obtained from a participant’s GP (e.g. medical history) using the Egress* system. Data is generated throughout the study (e.g. from clinical procedures or sample analysis) and is processed by SCRF or SSRC. Your consent will always be obtained before collecting and processing this data.
- NHS patients: ·Data is provided by the referring physician/hospital team. Data is generated throughout the study and processed by SCRF or SSRC (e.g. from clinical procedures or sample analysis). Your consent will always be obtained before collecting and processing this data.
- Some areas of the Clinical Research Building housing SCRF and SSRC have CCTV monitoring for safety. Images are not recorded and are not stored.
All data is held in confidence and is processed in accordance with the Data Protection Act, the University of Surrey’s Data Protection Policy and relevant ethical and legal frameworks.
Study data is retained according to University, regulatory or sponsor (i.e. client) retention period requirements, either in a secure area at the University or at a secure off-site archiving facility and will be destroyed after this time. In some cases study data will be retained for at least 25 years.
Further information on the data processed during a research study (including how long we will retain the data) will be provided in study-specific participant information sheets that you will receive before consenting to take part in a study.
We process personal data to facilitate clinical research. All personal data must be processed under a legal basis.
When you sign up to our volunteer database we will process your personal data according to your explicit consent. We will also request your explicit consent to hold any pertinent special category data that may emerge during a study and that may be used to update our database record.
If you progress to screening or taking part in a research study we will process your personal data under a different legal basis depending on the type of study:
- When we are conducting research that has been sponsored by a University or public body funder, we will process your data for the performance of a task carried out in the public interest.
- When we are conducting research that has been sponsored by a charity or commercial organisation we will process your data for the legitimate interests of the sponsor.
We process special category data for scientific research purposes. The personal data processed by SCRF/SSRC may include the following (non-exhaustive list):
Reason for processing
Verify inclusion and exclusion criteria for the study are met.
Targeted advertising to individuals in our participant recruitment database who have expressed interest in future studies.
Photo Identification (e.g. copy of passport)
Work permit (non-EU citizens)
Verify right to work in the UK (depending on individual circumstances, study compensation may be liable to income tax)
National Insurance number (UK citizens) /passport number and country (non-UK citizens)
Register on national TOPS database (“The Over volunteering Prevention System”) to verify any previous clinical trial involvement at other units
Clinical data obtained during the study (e.g. blood/urine analysis, vital signs, ECG, physical examination)
Verify inclusion and exclusion criteria for study are met.
Ongoing safety monitoring.
Study endpoints (i.e. data collected for analysis against study objectives).
Target individuals expressing interest in future studies.
Ongoing communication during a study
Reimbursement of study compensation and expenses.
We may also process personal data for purposes not directly related to research:
Reason for processing
Facilitate medical diagnosis and/or treatment.
For example, if our screening assessments indicate or suggest a medical condition that has not previously been diagnosed we will refer you to your GP or other health professional for further follow up.
Medical history, next of kin details and/or clinical data
In the case of a medical emergency, we will provide medical information to the ambulance service and/or the Royal Surrey County Hospital. If you are unable to provide your consent, we will act to protect your vital interest.
If the data we collect suggests a diagnosis that may affect other individuals we have a professional obligation to protect the public interest. This may involve corresponding with other parties without your consent.
For example, if an assessment suggests a medical condition that could affect your ability to carry out your job safely or impair your ability to drive, we will inform your GP.
In relation to legal proceedings or for obtaining legal advice.
Within SCRF/SSRC personal data is only shared with colleagues who legitimately need the information to carry out their duties.
We apply The Caldicott Principles to all health and patient data that we handle.
At the start of the study, every research participant is assigned a unique reference number (study number). Your study number is your main identifier within the research study and is used at every opportunity possible in place of your name when processing and sharing your data.
SCRF/SSRC will share your data with third parties, when applicable and necessary. Your data may be shared with study sponsors, external laboratories, regulatory authorities or contractors.
Occasionally we may be required to share data with other University departments.
In addition, most studies require that GPs are informed of their patient’s participation in research, and we may share further data with GPs or other health professionals, using the Egress system, when appropriate.
All data sharing is carried out strictly in accordance with Standard Operating Procedures (SOPs).
Where possible your study number will be used when communicating with third parties. Following the completion of the study, data is anonymised (i.e. can no longer identify you) before any transfer to study sponsors or publication of study results. You will not be identified in the results or publication unless you have given your consent for this. However, SCRF/SSRC will be able to link your study number to you and will retain other identifying information (e.g. photo identification) in our archive for the full study retention period.
Further information on any data sharing during a research study will be provided in study-specific participant information sheets that you will receive before consenting to take part in a study.
SCRF/SSRC acts as both a data controller (with responsibilities for determining the reasons for processing data) and a data processor (processing data on behalf of the data controller) for different sets of personal data.
We act as a data controller for the data collected and held within our volunteer database.
We act as a data processor for most other data collected in the course of a commercially sponsored study. We may act as ‘controllers in common’ when we process data requiring our specialist or expert knowledge (e.g. sleep data). This means that both SCRF/SSRC and another data controller (e.g. the study sponsor) are jointly responsible for determining the purposes for which and the manner in which data is processed.
Other studies (i.e. non-commercially sponsored studies) will have more information provided in the study-specific participant information sheet.
You have certain rights with respect to the data held about you by SCRF/SSRC. You can make a written request to obtain access to the data held about you by the University, subject to certain exemptions. This is called a Subject Access Request. All requests should be made following the instructions in our guide to data subject rights information. If we have to refuse to respond to a request, we will explain the reasons to you.
If your personal data is held within our recruitment database for more than 7 years and you have not been enrolled in a study we may remove your details from our database. You will still have the option to register again for future studies.
You also have the right to have errors and omissions corrected or out of date or irrelevant information removed, subject to certain exemptions.
Minor day-to-day requests for information and corrections can be taken up with our in-house recruitment team who can be contacted on email@example.com or Freephone: 0800 269 847.
You also have the right to object to processing likely to cause damage or distress, subject to certain exemptions. To exercise this right you must put your objection to the processing in writing and be able to show that our processing is causing you unwarranted and substantial damage and distress.
You have the right to withdraw consent to processing at any time, subject to certain exemptions. If you withdraw your consent prior to participating in a research study, we will not collect any further personal data from you. If you are or have participated in a research study, we will retain and may continue to process personal data collected up to the point of your withdrawal from the study. This may include sharing with third parties.
Details on university-wide measures surrounding IT security can be found in Our Data Policy Statement (PDF) (incorporating Information Security Policy).