Privacy notice

Public and Patient Involvement / Engagement: Fair Processing Notice

 

Who are we?

The UK DRI Care Research & Technology Centre at Imperial College London are exploring the use of technology in the future delivery of health and social care services.

Patient and public involvement in research refers to the partnership of researchers with patients and members of the public to conduct research. It is “Research being carried out ‘with’ or ‘by’ members of the public rather than ‘to’, ‘about’ or ‘for’ them” (NIHR, Involve).

At the Care Research and Technology Centre we consider this partnership to be essential for delivering high quality research. Patients and members of the public bring valuable and diverse perspectives, experience, skills, and knowledge. We aim to work collaboratively throughout the research process: prioritising areas for research, designing study protocols and materials, collecting and analysing data, and sharing our findings. In doing so, we hope to ensure our research is ethical, meaningful, relevant, and well communicated.

Imperial College London has a strong commitment to the protection of your information and confidentiality. A Data Privacy Impact Assessment (DPIA) has been conducted in compliance with the EU’s General Data Protection Regulation (GDPR) requirements. This means that the data protection risks of this project have been carefully identified and evaluated, and any possible mitigation measures have been put into place in order to address and minimise them.

 

Summary Information sheet (for use only if you are using a summary information sheet)

In this project will use information from you. We will only use information that we need for the project. We will let very few people know your name or contact details, and only if they really need it for this project.

  • Everyone involved in this project will keep your data safe and secure. We will also follow all privacy rules.
  • At the end of the project, we will save some of the data in case we need to check it AND for future projects.
  • We will make sure no-one can work out who you are from the reports we write.

 

HOW WILL WE USE INFORMATION ABOUT YOU?

Project Title: Minder Patient Public Involvement and Engagement (PPIE)

Summary sheet

Imperial College London is the sponsor for this project and will act as the data controller for this project. This means that we are responsible for looking after your information and using it properly. Imperial College London will keep your personal data for:

  • 10 years after the project has finished in relation to data subject consent forms.
  • 10 years after the project has completed in relation to primary research data.

We will need to use information from you for this project. 

This information will include your: your name, address, date of birth and email address, specific areas of interest (eg dementia studies, social care, diagnostics, technology design), specific needs / preferences – communication needs / physical assistance / dietary needs (when arranging face to face and virtual workshops and focus groups).

People within the College and project team will use this information to undertake the project or to check your records (see information to be collected) to make sure that the project is being done properly and the information held (such as contact details) is accurate.

OPTION where applicable: People who do not need to know who you are will not be able to see your name or contact details. Your data will have a unique project number instead.

We will keep all information about you safe and secure.

Once we have finished the project, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the project.

LEGAL BASIS

As a university we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research.  This means that when you agree to take part in a project, we will use your data in the ways needed to conduct and analyse the project. Our legal basis for using your information under General Data Protection Regulation (GDPR) and the Data Protection Act 2018, is as follows:

  • Imperial College London - “performance of a task carried out in the public interest” (Article 6(1)(e) in the GDPR); Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.
  • Where special category personal information is involved, Imperial College London relies on “scientific or historical research purposes or statistical purposes (Article 9(2)(j) in accordance with Article 89(1)in the GDPR)”.

INTERNATIONAL TRANSFERS

There may be a requirement to transfer information to countries outside the United Kingdom (for example, to a research partner) either within the European Economic Area (EEA) or to other countries outside the EEA. Where this information contains your personal data, Imperial College London will ensure that it is transferred in accordance with data protection legislation. If the data is transferred to a country which is not subject to a European Commission (UK) adequacy decision in respect of its data protection standards, Imperial College London will enter into a data sharing agreement with the recipient organisation that incorporates UK approved standard contractual clauses or utilise another transfer mechanism that safeguards how your personal data is processed.

 

SHARING YOUR INFORMATION WITH OTHERS

We will only share your personal data with certain third parties for the purposes referred to in this privacy notice and relying on the bases for processing your data as set out above.

  • Other Imperial College London employees (including staff involved directly with the project or as part of certain secondary activities which may include support functions, internal audits, ensuring accuracy of contact details etc.), Imperial College London agents, contractors and service providers (for example, suppliers of printing and mailing services, email communication services or web services, or suppliers who help us carry out any of the activities described above). Our third party service providers are required to enter into data processing agreements with us. We only permit them to process your personal data for specified purposes and in accordance with our policies.

POTENTIAL USE OF (project) DATA FOR FUTURE RESEARCH

When you agree to take part in a project, the information collected either as part of the project or in preparation for the project(such as contact details) may, if you consent, be provided to researchers running other at Imperial College London and in other organisations which may be universities or organisations involved in research in this country or abroad. Your information will only be used to conduct research in accordance with legislation.

This information will not identify you and will not be combined with other information in a way that could identify you. It will not be used to make decisions about you, such as for insurance policies.

 

COMMERCIALISATION

Data from the project may also be provided to third parties e.g. commercial organisations or non-commercial organisations for the purposes of undertaking the current project, future research studies or commercial purposes such as development by a company of a new test, medication or treatment. The project will ensure your name and any identifying details will NOT be given to these third parties, instead you will be identified by a unique project number with any sample analysis having the potential to generate ‘personal data’.

Aggregated (combined) or anonymised data sets (all identifying information is removed) may also be created using your data (in a way which does not identify you individually) and be used for such research or commercial purposes where the purposes align to the legislation and wider aims of the project. Your data will not be shared with a commercial organisation for marketing purposes.

 

WHAT ARE YOUR CHOICES ABOUT HOW YOUR INFORMATION IS USED?

You can stop being part of the project at any time, without giving a reason, but we will keep information about you that we already have because some research using your data may have already taken place and this cannot be undone.

  • If follow up data will be collected after withdrawal: If you choose to stop taking part in the project (also known as opting out), we would like to keep the collected information so far. If you do not want this to happen, please tell us and we will stop.
  • We need to manage your records in specific ways for the research to be reliable. This means that we won’t be able to let you see or change the data we hold about you.
  • If data will be used for future research: If you agree to take part in this project, you will have the option to take part in future research using your data saved from this project.

 

WHERE CAN YOU FIND OUT MORE ABOUT HOW YOUR INFORMATION IS USED

You can find out more about how we use your information

 

COMPLAINT

If you wish to raise a complaint about how we have handled your personal data, please contact Imperial College London’s Data Protection Officer via email at dpo@imperial.ac.uk, via telephone on 020 7594 3502 and/or via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ.

If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO). The ICO does recommend that you seek to resolve matters with the data controller (us) first before involving the regulator(ICO).