DESTINY Privacy Notice

This page explains how health researchers use information from patients. If you are asked to take part in research, you can ask what will happen in the study.

Who we are

Please follow the link to the page and select More Information tab to find out regulatory bodies that govern the trial. Contact details for DESTINY trila can be found on Contact page.

Processing of personal data

Please read below to find out what personal data is, how we manage it and which personal data we collect of the trial participants.

 

Legal basis for processing

Any information we hold about the study participants is processed for the purposes of ‘the performance of a task carried out in the public interest’ (the Article 6(1)(e)) of the Data Protection Act 2018, and ‘scientific research’ (the Article 9(2)(j)) of the Data Protection Act 2018.

The EU General Data Protection 2016/679 (GDPR) came into regulation from 25 May 2018, which was thereafter supplemented by the DPA 2018.  The DPA 1998 covers how personal data may be lawfully processed (collected, used and shared).  This is referred as a “data protection law”.  The data protection law regulates how we process participants “personal data”.  The University of Birmingham determines the purpose and means of data processing, i.e. acts as a “data controller”. 

What is personal data?

Personal ‘data’ is information that relates to an identified or identifiable individual.  It does not include information relating to dead people, groups or communities of people, organisations or businesses. Nonetheless, the DESTINY study team will ensure to keep information confidential, safe and secure after the death of any individual taking part in the study.

What is data processing?

“Data processing” is any operation performed on the data such as collection, use, management or disclosure.

What personal data will be processed?

The information we collect on the study participant may include and not limited to:

  • Name, date of birth, NHS number and some other identifiers, i.e. hospital number
  • GP/hospital name and contact details
  • Medical information relevant to the study
  • participant contact details (these details will be deleted when they are no longer needed)

During the study we will process further details on participants.  This may include:

  • Details about participation in the study
  • Outcomes of any procedures, tests, questionnaire undertaken as part of the study

How we manage personal information?

The Data Protection Act 2018 (DPA 2018) regulates the management of personal information.  This is how we look after personal information on study participants.  When we ask participant’s personal information we:

  • make sure that the participant knows why it’s needed
  • ask only minimum and sufficient information that is required and do not collect too much or irrelevant information
  • protect it and make sure no unauthorised person has access to it
  • let participant know if we share it with other organisations, which is necessary to improve public services
  • do not keep it for longer than it is necessary
  • inform participants that they can withdraw from the study any time
  • Give contact details of a person/department/body where to direct enquires or complaints 

Patients receive an ethically approved Patient Information Sheet (PIS) upon invitation to take part in the trial.  The PIS will detail information about the study, how patient information will be collected and handled and where it would be collected from.  The PIS will also explain what their involvement in the study would be.  In addition, the document will explain if other organisations will be involved in the study and what their roles are.

Potential participants will be given plenty of opportunity to ask the study related questions to a member of the research team.  In return we ask participants to:

  • give us accurate information
  • tell us as soon as possible if there are any changes to their personal circumstances such as contact details to enable to keep the information reliable and up-to-date

Purpose of processing

We collect participants’ personal and healthcare data in order to answer the study questions.  Collecting personal information is necessary for traceability and collection of further data. 

The target population of DESTINY trial is children aged 0-16 undergoing cardiac surgery.  The data will be collected directly from the trial participants, medical records and may also be collected from NHS agencies.  The data will be directly relevant to answer trial specific question.  The study also explores pros and cons of both treatments in terms of success and safety.  More information about the study can be found on the trial main page.

 

Where do we collect data from?

The data will be normally collected either directly from participants or from medical records from the hospitals, GP practices and healthcare agencies such as NHS digital.

To safeguard participants’ rights, we collect the minimum personally-identifiable information possible.

Some of the data we process is classed as ‘special category’ or sensitive personal data. This data may include information concerning health, racial or ethnic origin. 

Methods of obtaining data

Data will be obtained directly from the trial participants, medical notes from hospitals or GP practices.  It may also be collected from the Health and Social Care Information centre, NHS digital and other current and future NHS bodies (e.g. NHS Digital).  We will not use automated processing of participant’s personal data at any stage of data processing.

Data from NHS Digital

We may collect data from NHS Digital. NHS Digital is designed to enable other non-clinical uses, such as researchers to obtain aspects of NHS care.  

The data supplied by NHS Digital will contain sufficient information to ensure that the information is assigned to the correct patient record on the database.  Once imported into the non-backed up location/database the information will be linked to the study fields.  The information obtained will be modified to ensure that participants cannot be identified by non-study members of the University.

The University of Birmingham is subject to strict contractual standards imposed by NHS Digital, as the data provider. These include storing the data provided by NHS Digital on an encrypted drive connected to a separate and dedicated server, access to which is restricted.

As contractually required, data supplied by the NHS Digital will not be kept for longer than required.  The data will be stored on a non-backed-up location which will then be destroyed as requested by the NHS digital.

The data from NHS Digital will be supplied to the University of Birmingham, Birmingham Clinical Trials Unit (DESTINY trial office).  

From GP records and hospitals

We may also collect data from UK General Practices and hospitals.  This will include medical information related to the study.  

What will we do with the NHS Digital data?

The data supplied by the NHS Digital will be matched up with DESTINY participants’ trial numbers outside of the trial database on a non-backed up location and will then be deleted as agreed contractually.  The data will be combined with other information before the dataset is anonymised.  

What will we do with data obtained?

The study statisticians will analyse the data according to the statistical analysis plan.  The aggregate data will be published and disseminated among professionals.  Primarily, the study participants will be informed about the results of the study.

With whom will we share the data?

The DESTINY study involves many organisations such as hospitals recruiting participants, GP practices, the sponsor (University of Birmingham), the study oversight committees and study management group, as well as national registries such as NHS digital.  For the purposes of assessment and analysis of the study data or safety issues it may become necessary to share participants identifiable (e.g. date of birth) and healthcare information with these organisations during the study. 

The study team at the sites (hospitals) or authorised personnel from the sponsor and other regulatory bodies may look at the participants medical records.  This is necessary to ensure that the study is being conducted and managed to the highest possible standards.

Participant information may be occasionally shared with researchers of other ethically approved studies.  They may be based at the University of Birmingham, or any other universities, NHS organisations or companies involved in healthcare research in the UK, Europe or elsewhere.  The access to information will be strictly controlled and anonymised before being shared.  Participants will not be identified in any way in any report, presentation or publication arising from this data sharing agreement.  The study team will ensure that appropriate safeguards are in place to protect the confidentiality and security of the participants’ data.

On some occasions, the study may be inspected by a third party organisations to make sure that it is conducted in accordance with relevant requirements and legislations.  This may, for example, include NHS digital or the Information Commissioner’s Office.  In such circumstances data sharing becomes necessary to meet legal and regulatory requirements and is only for the purposes of the audit.

How long will we keep the data?

The information collected on the study participants will be kept within the Birmingham Clinical Trials Unit (BCTU) and the hospital for 25 years after the completion of the study.

Participant's right in relation to their data

The details on participants rights can be found on the University Privacy Notice page. 

What happens if participants change their mind?

During the course of the study participants may change their mind their data being included in the DESTINY study analysis.  The inclusion of their data is entirely up to the participant and choosing to do so will not disadvantage them in any way.  However, because the study is being conducted as a ‘task in the public interest’ and ‘scientific research’ according to the data protection law, participant’s right to change or remove information may be limited.  This is because we need to process information in such ways that the research we carry out is at the highest standard, reliable, accurate and verifiable.  This means that we will keep the data that has already been obtained before participant’s withdrawal from the study.

"Right to be forgotten"

Under the article 17 of GDPR the study participants have right to request “right to be forgotten” (aka “the erasure”) of their personal data without undue delay.  The trial subjects can request this verbally or in writing.  We have the obligation to erase the personal data without undue delay and will respond to this request typically within one month.  

DESTINY data protection


When we ask you for information we will keep to the law, including the Data Protection Act 2018. Through appropriate management and strict controls, we will follow the 8 principles of data protection described in the act. Also see the Information Commissioners general guidance on the implementation of data protection.

We will also ensure that:

  • there is someone with specific responsibility for data protection in the organisation (the nominated person is called the Data Protection Coordinator)
  • everyone managing and handling personal information understands that they are contractually responsible for following good data protection practice, is appropriately trained to do so and is appropriately supervised
  • we deal with enquiries about how we handle personal information promptly and courteously
  • we describe how we handle personal information clearly, regularly review and audit how we manage personal information, and regularly assess and evaluate methods of handling personal information

 

Who to contact about personal data?

Details of how we use personal data are set out in the Information Commissioner’s Register of Data Controllers.