Privacy Notice

The NIHR BioResource manages a large panel of participants who can be invited to take part in research related to health, on the basis of the data we hold about them. Studies often require participants to be in a particular age range, or living near a particular hospital, or living with a particular condition. In each case, we search the databases for likely candidates, then our team of experts carefully check known preferences and availability before sending out invitations. Participants always have a right to decline these invitations, and have a right to see, correct or delete data we hold about them, as described below.

Participants are recruited from patient groups, from blood donor centres, in hospital clinics and from the general population, including via schools.

The studies we support are run by independent academic researchers, clinicians or industry partcners.  If a study requires that we contact participants – for an additional sample, or to complete an online survey – separate ethical review is required before we approach participants on behalf of the researchers. If a study can be performed without re-contact – for example, a new analysis of an existing sample, or research using existing data that has been de-personalised – we can report it to the ethics committee as part of our annual progress report. In either case, we sit between the researchers and the participants: we do not do the research, nor give clinical care, but instead broker study contributions and contacts.

A list of approved studies is available online, identifying for each study the lead researcher, the institution for which they work, a title and (for more recent studies) a plain language summary.

For the re-contact part of the BioResource to work, we need to know who you are.

Personal information can be held in a variety of formats, including electronically, in our secure databases, in other computer systems, in video and audio files and in paper format.

Our main use of your personal data is to contact you to invite you to participate in studies. However, we also use your NHS number and other personal details to request additional data from the NHS and other medical agencies that already hold it in central records: this is why we ask for your consent to access your medical and health-related records, including social care.

Your identifiable personal information (e.g. name, date of birth, NHS number, contact details) will only be passed to others, for instance, to invite you to further research studies, with your explicit consent.

What we may do with your personal information

The personal information we collect about you may also be used to:

• remind you about your appointments in relation to the BioResource and research studies, and send you relevant correspondence
• prepare statistics on our performance
• report and investigate any complaints, claims and untoward incidents
• report events to the appropriate authorities, e.g. when we are required to do so by law
• contact you for feedback on your experiences as a participant in BioResource studies
• create a profile for you on the BioResource Portal to give you the opportunity to activate your account.

The BioResource would also like to inform you of our activities, and how your de-personalised data and samples have contributed to medical research, and may send you correspondence from time to time that you may find of interest. You may opt-out of this type of correspondence if you wish.

Where possible, we will always look to de-personalise your personal information to protect confidentiality.

Personal information you provide to the NIHR BioResource in confidence will only be used for the purposes explained to you and to which you have consented. However, there may be exceptional circumstances as listed below, where we may be obliged to share data with other official bodies.

• There are occasions where the BioResource is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, e.g. in order to prevent and detect fraud.

• There may also be situations where we are under a duty to share your information, due to a legal requirement. This includes, but is not limited to, disclosure under a court order, sharing with the Health & Safety Executive if you are involved in a reportable accident whilst taking part in one of our studies, the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to others and other public bodies (e.g. HMRC for the misuse of public funds).

The BioResource is required to protect your personal information, inform you of how your personal information will be used, and allow you to decide if and how your personal information can be shared.

UK National Research Ethics Committees can allow health researchers, including from universities, the NHS or companies to use clinical information including samples, images or data (with identifiable personal information removed) for medical research where this does not require any additional contact with participants. All such cases of approved research on de-personalised samples or data from BioResource participants is listed on our website. Annual checks are performed to confirm whether continued data retention is required. If your identifiable personal information (the information that identifies you) is to be used in research you will be asked for your consent, and separate review by a Research Ethics Committee will be sought.

Your name and contact details may be shared with a limited number of staff at Sano Genetics, when needed, for resolving technical issues with the BioResource Portal. Sano Genetics will not have access to your genetic information. Sano Genetics is the technology company managing the BioResource Portal under contract to the BioResource. See BioResource Portal section for further details.

Your personal information is held in both paper and electronic forms. The NIHR BioResource will hold data for 10 years beyond the end of our funding, which currently runs until November 2024, subject to renewal.

We hold and process your information in accordance with the Data Protection Act 2018 as amended by the General Data Protection Regulation (GDPR) 2016, as explained above. In addition, everyone working for the BioResource must comply with the Common Law Duty of Confidentiality and take appropriate training in data protection and cyber security.

We have a duty to:

• maintain full and accurate records
• keep records about you confidential and secure
• provide information in a format that is accessible to you

The following staff groups at the BioResource may have access to the personal information we hold about you:

• Study coordinators
• Research nurses
  
• IT staff who support these staff members
• Medical legal staff
  
• Senior management team
  

Use of Email - Some services in the BioResource provide the option to communicate with participants via email. This could include invitations to research studies or BioResource-related events, as well as emailing BioResource newsletters. Please be aware that we cannot guarantee the security of this information whilst in transit, and by accepting this service you are accepting this risk.

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. The Data Protection Act 2018 gives you certain rights, including the right to:

• request access to the data we hold about you. This is described below
• request the correction of inaccurate or incomplete information recorded in our records. This is also explained on our website
• refuse/withdraw consent to the sharing of your records, or to the BioResource as a whole. The process is explained on our “Leave Us” page
• Please note that the BioResource is not part of the NHS opt-out provisions, and exercising your right to opt-out of NHS data sharing, will not impact your membership of the BioResource
• Request that we delete your personal data, subject to certain safeguards. This is also explained further on our website.

If you wish to discuss how we handle your personal data, you can contact us:

Telephone: 0800 090 22 33

Email: nbr@bioresource.nihr.ac.uk

To request a copy of the data we hold on you, please email us as above, or write to:

NIHR BioResource
Box 299
University of Cambridge and Cambridge University Hospitals NHS Foundation Trust
Cambridge Biomedical Campus
Hills Road
Cambridge CB2 0QQ

We will confirm receipt of your request as soon as possible. We may need to ask you whether you can narrow down your request to help us collate the information. However, the data we hold should be with you within 30 days.

If you wish to raise a complaint on how we have handled your personal data, you can raise this with us, as above, or you can contact the Trust’s Data Protection Officer who will investigate the matter.

The Data Protection Officer is the Information Governance Lead at Cambridge University Hospitals NHS Foundation Trust:

Michelle Ellerbeck
Information governance lead/Data Protection Officer
Cambridge University Hospitals NHS Foundation Trust
Box 153
Hills Road
Cambridge
CB2 0QQ

Or email: gdpr.enquiries@addenbrookes.nhs.uk