Data Protection (GDPR) Privacy Notice
Does NIGHT-time dialysis improve quality of LIFE? (NightLife)
University of Leicester Privacy Notice
Information you need to know
Leicester Clinical Trials Unit is the central co-ordinating centre for the NightLife study and is part of the University of Leicester. Further information on the institution can be found here:
https://le.ac.uk/. The University of Leicester is the Data Controller for your information.
The Data Protection Officer is: Elisabeth Taoudi, Data Protection Officer and Commercial Lawyer, University Of Leicester, University Road, Leicester, LE1 7RH. Tel: 0116 229 7640. Email:
This privacy notice explains how we use your personal information and your rights regarding that information.
What information are we collecting?
- NHS patient number
- Email address
- Date of birth
- Medical history
- Medical records - weight, heart rate, blood pressure, monthly blood results and routine clinical data
- Questionnaire data
- Urine and blood samples
Why are we collecting your data?
Your personal data will be used to support the existing observational data and help to design improved treatments for other kidney patients in the future. The NightLife study is a consortium of leading kidney researchers and clinicians from across the UK, working together to understand whether six-months of overnight dialysis, performed three times a week in a hospital or satellite centre, improves the quality of life of patients with kidney failure, as compared to those who have shorter dialysis sessions during the day. Although some dialysis units already offer extended hours night-time dialysis, relatively little is known about its benefits and disadvantages compared to shorter sessions of standard daytime dialysis
How we will use this data?
We will use the data collected from you for the following;
- Medical history, medications and demographics: at baseline, we will ask you about your medical history, medications you are taking, as well as your age, gender and ethnicity. In
addition we will collect information from your medical records including (but not limited to) Data Protection (GDPR)
Privacy Notice weight, heart rate, blood pressure and fluid removal for each dialysis session and the results of your usual monthly blood tests.
- Questionnaires: We will give you some simple multiple choice questionnaires to assess your quality of life, your levels of tiredness and sleep quality (at baseline, 1-month, 3-months and
6-months), your cognitive health (at baseline, 3 months and 6 months), your work status, travel arrangements for dialysis sessions and caring responsibilities (at baseline), and your use of health services at a hospital, if applicable (at 1-month, 3-months and 6-months).
- Urine sample and blood sample: you will be asked to provide a urine sample (if you still produce urine) at baseline and 6-months and a blood sample at baseline and each month for
6 months (7 samples in total of up to 10ml or 2 teaspoons of blood) which will be used to test the ability of your kidneys to get rid of water and toxins. Blood samples will be obtained at
the same time as your routine clinical blood samples. We will not be sharing these results with you.
- Cardiac MRI scan and extra blood sample: if you agree to take part in the optional cardiac MRI sub-study, you will be offered the opportunity to have an MRI scan of your heart atbaseline and 6-months to see if extended hours night-time dialysis is beneficial for patients’ hearts and blood vessels. Participants who have the MRI scan will also be asked to give some
extra blood for testing at baseline and 6-months to measure for markers of heart disease in the blood. This will be the equivalent of 30ml (6 teaspoons) of blood taken at baseline and 6-months and will be taken when you are on dialysis. These test results will be analysed at the end of the study and will not be shared with you or alter your clinical care.
- Capture of routine clinical data: during the 6-months of your daytime or night-time dialysis, we will review your routine clinical data, usually taken during the first week of the month. This includes the number of sessions you have attended, the results of your monthly blood results and your blood pressure results. Three years after the last participant finishes the
study, we will review your health condition using national health and renal registry records. NHS record linkage services (or equivalents in Scotland and Wales) allow us to access health information about you. In order to do this we will ask for your consent to provide these services with some of your personal details (including NHS number, date of birth, sex and ethnicity). With this information, the NHS record linkage services will be able to provide us with simple health information (such as medical events and hospital admissions) about you. Your personal information will be provided to these services in strict confidence, will be kept securely, and will not be released to any third parties.
What is the legal basis for processing the data?
The legal basis for the processing of participant information that we are collecting and using for the study is Public Task as set out in the Data Protection Act 2018 and GDPR Article 6.1(e). Research is a public task that the University of Leicester performs in the public interest, and is part of its core functions as a University. Where special category data will be collected ,our additional conditions for processing information relies on:
Article 9.2(i); and that it is necessary for ‘scientific research or statistical purposes’ as set out in the Data Protection Act 2018 and GDPR Article 9.2(j).
If we are sharing your data with others who are we sharing it with?
Your personal data will be pseudonymised and shared with the following;
- Leicester Clinical Trials Unit, which will provide the main data centre facilities (remote data capture system, access to which will be through password-protected log-ins) for the duration of the study. They will carry out data linkage services whereby participant data collected by the NHS Trust hospitals will be combined with participant information held by others partners such as NHS Digital.
- Hospital Episode Statistics (HES)
- Office for National Statistics (ONS)
- Information Services Division (ISD- Scotland)
- UK Renal Registry (UKRR) • Scottish Renal Registry (SRR)
- University of Bristol
Relevant sections of your medical notes and/or study data may be looked at by individuals from the study and clinical team, the Sponsor, Leicester Clinical Trials Unit, regulatory authorities or other NHS host organisations where it is relevant to your taking part in the study.
We are also required to provide progress reports and summarised research information to our grant funder (National Institution of Health Research) and the Department of Health and Social Care but this will not include any information about individual participants.
We will only share with all these parties the minimum information that is necessary for them to undertake the task they are performing. We will not share information that identifies participants such as their name and contact information with people who do not need to know this. In such cases, we will replace name and contact details with a code number which will now be pseudonymised data.
In contrast, anonymised information means that a person cannot be identified from the information and it is not personal information for the purposes of Data Protection Legislation. The following data will be completely anonymised:
- Handwritten field notes from observations on dialysis units
- Researcher reflections(audio-recorded in a private area, after observations have taken place)
- Quotations or descriptions used in study reports/publications
- Extracts from interviews with staff and patients/visitors
- Photographs used in reports
- Cardiac MRI scan data
- Consent logs
Each enrolled participant will also be allocated a unique participant ID so that the data on the clinical data management system remains anonymous.
Anonymous data may be shared with our collaborators at the University of Edinburgh.
How long we will process your data for?
We will only keep your data for according to our retention schedules and to fulfil our research objectives.
We will keep your personal data, such as your name and email address until we have completed all the actions that require us to hold them, for example, sending you a copy of the study results if you have requested this, and then the data will be destroyed. This will take no longer than 12 months from when the study ends. The total study duration is 5 years and it is due to finish in December 2024. Data and essential study records, including the final study report and pseudonymised data generated as part of the study, will be stored for at least 15 years after the completion of the study, in accordance with the University of Leicester and Leicester Clinical Trials Unit’s standard procedures. The data will be stored at a University of Leicester approved archiving facility which will ensure that it is stored securely and accessed only by authorised individuals.
What are your rights and how to enforce them?
You have the right to:
- Right to withdraw consent
- Right to be informed
- Right of access - access your personal information
- Right of rectification - correct any inaccurate information
- Right to erasure
- Right to data portability
- Right to object or restrict
However, please note that some of these rights may be restricted if the exercise of these may seriously impair research outcomes. It is also important to understand that these rights will only apply if the research project holds identifiable information about you. Where your information has been completely anonymised this information is no longer accessible and is therefore not classed as personal data for the purposes of the Data Protection Legislation. Therefore the rights specified above apply will no longer apply.
How to complain to the Information Commissioner’s Office?
The Information Commissioner can be contacted on:
Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF. Tel: 0303 123 1113.
Email contact can be made by accessing www.ico.org.uk
University of Bristol Privacy Notice
About this notice
The University of Bristol needs to collect and process the personal data of individuals who take part in research projects in order to fulfil its statutory functions and operate effectively. Personal data is processed for a variety of reasons relating to research (as set out below) and all personal data will be collected and processed in accordance with the requirements of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
In this notice:
- Personal data means any data which can identify you directly or indirectly (whether itself or when combined with other data), regardless of the format or media on which the data are stored. This includes data that can identify you when combined with other data that is held separately (pseudonymous data) but does not include data that has been manipulated so that you can no longer be identified from it (anonymous data).
- Processing means any activity relating to your personal data including collection, use, alteration, storage, disclosure and destruction.
You must read this notice alongside the specific participant information sheet you will be given by the research team. In the unlikely event that there is any contradiction between the general information provided here and the participant information sheet, the participant information sheet takes precedence.
The University of Bristol is a ‘data controller’ in relation to your personal data for the NightLife Communication Study (workstream 3 of the overall NightLife study) and is registered as such with the Information Commissioner’s Office (ICO), under registration number Z6650067.
The Qualitative Research Integrated within Trials (QuinteT) research group will lead a ‘communication study’ which looks at how doctors and nurses explain clinical research studies to patients. This communication study forms part of the main NightLife Study (https://www.isrctn.com/ISRCTN87042063).
Further information about the QuinteT research group can be found here: https://www.bristol.ac.uk/population-health-sciences/research/groups/social-sciences-health/quintet/
Changes to this notice
The University of Bristol may update this notice at any time and may provide you with further notices on specific occasions where we collect and process personal data about you. You should check this notice regularly to be aware of any changes. However, where any change affects your rights and interests, we will do our best to make sure we bring this to your attention and clearly explain what this means for you.
Questions or comments
If you have any questions or comments regarding this notice or the research study that you are participating in, or you wish to exercise any of your rights (see below), you should contact the research team responsible for the study (details will be provided in the participant information sheet). You could also contact the University of Bristol’s Data Protection Officer by email at [email protected] or by phone at (0117) 394824.
How we collect your personal data
Most of the personal data covered by this notice will have been provided by or observed about you in the course of your application and recruitment to, or during your time as a participant in, a research project. However, all research projects are different and the information we collect will vary. You will be provided with a participant information sheet which will specify the personal data that we will need to collect from you for the research project, or the source of the data if it is not obtained directly from you. Researchers will only collect the minimum amount of personal data required to meet the project’s aim.
Taking part in the communication study will involve three optional things:
- We will ask your permission to audio-record appointments during which doctors and nurses explain the NightLife study and what taking part involves.
- If you agree, a researcher may also sit in on the appointments above to observe the discussion and take notes.
- After you have made a decision about whether or not to take part in the NightLife study, we may invite you to be interviewed at a location of your choice (or over the telephone, if you prefer). If you agree, your interview will be audio-recorded. The researcher will ask about your views on the information explained to you by doctors and nurses, and how you came to a decision about whether or not you would like to take part in NightLife.
Some data, such as interview data, is de-identified, therefore there will be restrictions around withdrawing data you have already provided. We will be able to destroy recordings and transcripts of your data if you request this, but we will not be able to destroy any reports or materials we have already produced that include your de-identified data. We will remind you of this on the consent form.
Types of personal data processed
The participant information sheet will specify the personal data that is being collected, but it may include some personal details and identifiers (e.g. name and contact details), and information relevant to the research project, i.e. audio recordings of clinical consultations and/or research interviews you take part in.
This information that the University of Bristol may collect and process about you can include special categories of personal data, which are particularly sensitive and require us to take additional steps to ensure their security and confidentiality.
How the University of Bristol uses personal data about you
Depending on your role, the University of Bristol may process personal data (including special categories of personal data) about you for the following purposes:
- the recruitment and selection process for the research project
- the administration and management of the project and your role in it
We will need to use information from you for the communication study. This will include:
- Your name
- Your contact details (if you consent to an interview)
- Audio recordings of clinical consultations or research interviews you take part in.
People will use this information to do the research or to check your records to make sure that the research is being done properly. People who do not need to know who you are will not be able to see your name or contact details. Your data will have a code number instead. We will keep all information about you safe and secure.
Lawful grounds for processing your personal data
We will only use your personal data when we are permitted to do so by law. Most commonly, we will use your personal data:
- for purposes pursuant of the University’s public task (the University of Bristol is a public research institution established by royal charter to advance knowledge and education through its teaching and research activities; as such, personal data is processed on the basis that doing so is necessary for our public task, is for scientific and historical research purposes which are in the public interest, and is subject to necessary safeguards).
Please note that the legal basis on which your personal data is processed under data protection law is separate from ethical consent requirements and any common law duty of confidentiality that may apply.
Research in the University of Bristol is strictly governed by policies and procedures, and all research involving human participants undergoes ethical scrutiny to ensure that the research is conducted in a manner that protects participants. For more information see our ethics pages: (http://www.bristol.ac.uk/red/research-governance/ethics/).
Sharing your personal data with third parties
To communicate our research to the public and the academic community, your anonymised data (e.g. quotes from interviews or audio-recorded consultations) is likely to form part of a research publication or conference presentation or public talk. We may also play clips of recordings during presentations and teaching/training events. Any audio-recordings and quotes will be de-identified (e.g. through voice modification, avoiding use of names/places), so that neither you nor any other individuals can be recognised.
Your personal data may be shared with project team members who are authorised to work on the project and access the information. This may include staff at the University of Bristol or collaborators at other organisations.
The University of Bristol may be undertaking a research project in collaboration with another organisation, for instance another university, research institution, health authority or other external party. Personal data may need to be shared with authorised personnel acting for these parties in such circumstances, but it will be made clear on the participant information sheet if this is the case.
It is also possible that personal data held for the purpose of a research project may need to be shared with the funders and sponsors of the research or other regulatory bodies. On very rare occasions, it may be necessary to disclose personal data to other parties where there is a legal obligation to do so.
Where the University uses third parties to process personal data on its behalf for the purpose of a research project (acting as data processors), a written contract will be put in place to ensure that any personal data shared will be held in accordance with the requirements of data protection law and that such data processors have appropriate security measures in place in relation to your personal data.
Where necessary, your personal data may also be made available in confidence to auditors or to a named person in the case of allegations of research misconduct.
Please note that we may need to share your personal information with a regulator or to otherwise comply with the law, and the list above is not necessarily exhaustive.
Where your personal data are stored
Some of your personal data may be held in hard copy files stored in secure locations. Most personal data about you will be stored digitally on secure servers within the UK. The participant information sheet will provide further details if required. The University of Bristol will ensure that all personal data is held securely, however it is held.
The QuinteT research group will hold electronic recordings and transcripts of your data on University of Bristol encrypted drives for a maximum of 10 years, to conduct analyses of the data for this study and future ethically approved studies conducted by their research group at the University of Bristol.
In addition, the QuinteT research group will also ask for your separate permission to make any transcripts of your recordings “Controlled Data”. This means that transcripts will be stored in a secure online database indefinitely (i.e. they will not be deleted), so that other researchers may apply for permission to access these to conduct their own analyses as part of other research studies. These individuals will need to submit an application to do this, which will be assessed by an independent ethics committee at the University of Bristol. We will have no control over how these data are used by other researchers, if their application is approved. However, all data will be de-identified before they are made available. Sharing access of research data is considered good practice and is a requirement of many funding bodies and scientific journals. Sharing data helps to maximise the impact of money invested into studies and can encourage new avenues of research. You will be asked if you are happy for your data to be used in this way on the consent form.
How the University of Bristol keeps your personal data secure
The University of Bristol has put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost or used, accessed, altered or disclosed in any unauthorised way. In addition, the University limits access to your personal data to the persons and organisations, including those described above, who have a lawful and legitimate need to access it. For further information, visit the University of Bristol’s Information Security webpages.
The University of Bristol has also put in place procedures to deal with any suspected personal data security breach and will notify you and any applicable regulator of a suspected breach where we believe it is fair to do so or we are required by law.
How long the University will retain your personal data
The participant information sheet will provide details about the long-term use (and where applicable, re-use) and retention of your personal information in connection with the specific research study you are participating in. If a study is funded, the research funder may define the period of time for which data will be retained. Otherwise, it will be kept in accordance with the University of Bristol’s Records Retention Schedule for a specified period of time after your research participation with us ceases.
Research data is normally anonymised as quickly as possible after data collection so that individuals cannot be identified and their privacy is protected. You will not be able to have your personal data withdrawn after this point.
In addition to data we collect from you or generate through interactions with you as part of the research activity, we will also hold your personal data within project governance documentation (in particular participant agreements or consent forms) and records of any communications with you via email, letter or other means. These will need to be retained for audit purposes even if you decide not to take part or withdraw from participation at a later date.
You have a number of rights in relation to the processing of your personal data by the University of Bristol:
- Access: You have the right to request access to and be provided with a copy of the personal data held about you together with certain information about the processing of such personal data to check that the University is processing it lawfully and fairly.
- Correction: You have the right to request correction of any inaccurate or incomplete personal data held about you.
- Deletion: You have the right to request erasure of any personal data held about you where there is no good reason for the University to continue processing it or where you have exercised your right to object to the processing of your personal data.
- Restriction: You have the right to request restriction of how the University processes your personal data; for example, to confirm its accuracy or the University’s reasons for holding it or as an alternative to its erasure.
- Objection: You have the right to object to the University’s processing of any personal data which is based on the legitimate interests of the University or those of a third party based on your particular circumstances. You also have the right to object to the University processing your personal data for direct marketing purposes.
- Portability: You have the right to receive or request that the University transfers a copy of your personal data in an electronic format where the basis of the University processing such personal data is your consent or the performance of a contract, and the information is processed by automated means.
- Complaints: You have the right to complain to the Information Commissioner’s Office (ICO) or any other EU supervisory authority in relation to how the University processes your personal data.
To exercise any of these rights you must contact the University of Bristol’s Data Protection Officer at [email protected]. The University of Bristol may be entitled to refuse any request in certain circumstances and where this is the case, you will be notified accordingly.
Where the lawful ground relied upon by the University to process any of your personal data is your consent, you have the right to withdraw such consent at any time without having to give any reason. However, if you do so, the University of Bristol may still be entitled to retain any information you have already provided if it would undermine the research project to delete it. Steps will be taken to anonymise any of your data where possible in these circumstances.
You will not have to pay any fee to exercise any of the above rights, though the University may charge a reasonable fee or refuse to comply with your request if any request is clearly unfounded or excessive. Where this is the case, you will be notified accordingly.
To protect the confidentiality of your personal data the University may ask you to verify your identity before fulfilling any request in relation to your personal data.