PHOSP-COVID study data protection privacy notice

Information you need to know

The Post-Hospitalisation COVID -19 Research Study (PHOSP-COVID) is a consortium of leading researchers and clinicians from across the UK working together to understand and improve long-term health outcomes for patients who have been in hospital with confirmed or suspected COVID-19. Find more information about the PHOSP-COVID Research Study.

The research study is being organised and funded by the NIHR Leicester Biomedical Research Centre and supported by a grant to the University of Leicester from MRC-UK Research and Innovation and the National Institute for Health Research (NIHR). The Study has received ethical approval from the Yorkshire and Humber - Leeds West Research Ethics Committee and approval from the Health Research Authority.

The University of Leicester (Leicester) is leading the Consortium of 26 UK Universities and approximately 44 NHS Trusts who are involved in this national research study.

Leicester is the Data Controller for the participant personal information we will process as part of this research study. Find further information on the University.

Leicester’s Data Protection Officer is: Parmjit Singh Gill, Information Assurance Services Manager and Data Protection Officer, University of Leicester, University Road, Leicester, LE1 7RH. +44 (0)116 229 7946 / dpo@leicester.ac.uk.

The University of Edinburgh (Edinburgh) is a Joint Data Controller with Leicester in respect of the management of the PHOSP–COVID Data Centre based at the Usher Institute Edinburgh. Get further information about Edinburgh and their Data protection Officer can be contacted at dpo@ed.ac.uk.

This privacy notice explains what information we are collecting, how we will use this information in this study and what rights participants have in relation to their information.

What information are we collecting or using?

NHS Trust Hospitals and NHS Digital and other partners who are supporting this study will be providing personal information obtained directly from or about adult patients who have been admitted to Hospital with confirmed or suspected COVID-19 symptoms and subsequently been discharged from hospital.

We will only collect and use information about those patients who have voluntarily agreed to participate in this study and have completed patient consent forms in accordance with ethical requirements and to meet legal obligations relating to confidentiality.

The information collected from or about participants includes:

• Their personal information such as full name, address, telephone/mobile numbers and email address. Street and postcode information will be used to access environmental data (for example, air pollution) that is required for the research.
• Demographic information including age, sex and special category personal information concerning ethnicity and health.

Personal information and Special category information relating to health will be collected from or about participants who have agreed to participate at one or more of three research stages (called Tiers) as follows:

Tier 1

We will collect routine healthcare records and samples including:

• signs and symptoms, current medications, results from blood tests, questionnaires, laboratory results or imaging ordered by their doctors;
• all clinical records and case notes relating to their Covid-19 hospitalisation, as well as GP, health and social care records from before and after their Covid-19 hospitalisation;
• leftover blood samples from tests ordered by doctors which may be used to measure DNA; and
• saliva samples, which may be used to measure DNA where there are no blood samples.

We will only be collecting information that is required for this research but, since this is a long term Public Health study, it is our intention to continue to collect information from participant’s electronic patient records held by NHS Digital for 25 years.

Tier 2

We will continue to collect updated participant Tier 1 health information but we will also collect additional information for this research study from some participants including:

• where these have not already been requested as part of their clinical care, further blood tests for clinical testing for example a blood count, kidney and liver function, a hormone from the heart, a test for diabetes, tests similar to cholesterol, vitamin D levels;
• additional research samples including blood, oral and urine samples;
• carrying out additional tests such as ‘activity monitoring’; and
• information gathered in the form of questionnaires (for example, Quality of Life questionnaires).

As part of this study, we will use the samples obtained in both Tier 1 and Tier 2 to look at how the body is affected by COVID-19. We will use samples to analyse DNA (genetic variation), RNA (how genes work) and other molecules.

Tier 3

We will seek participants’ agreement to keep their personal details so we can contact them about participating in additional research studies.

Personal information is information that relates to and enables a living individual to be identified from that information.

Special Category Information: Health and demographic information such as ethnicity relating to participants is classed as a special category of personal information and we are required by law to take additional care to protect it.

Leicester has technical and organisational measures in place to ensure that the data used in this research is securely stored and only used for the purposes of this research. It also requires the other universities who are collaborating with us in this study, the NHS Trust hospitals, NHS Digital and other partners who will provide, or process participant information to have their own technical and organisational measures in place to comply with Data Protection Legislation.  Edinburgh has technical and organisational measures in place to ensure that the data it collects, links and manages in the PHOSP COVID data centre used in this research is securely stored and only used for the purposes of this research.

What is the purpose for processing participant information in the research study?

As COVID-19 is a new disease, the main purpose for processing participant information in this research study is to identify whether there are longer-term health problems of COVID-19 for those adults admitted to hospital.

We want to understand:

• why some people experience more severe COVID-19 than others
• why some people recover more quickly than others
• why some patients develop other health problems later on
• which treatments or interventions patients received in hospital or afterwards were helpful
• how we can improve the care of patients after they have been discharged from hospital.

Our additional Public Health purpose is to develop a resource of data and samples that other researchers can use to answer their questions quickly to help improve outcomes in future. This will provide the best use of the time, information and samples patients participating in this study provide.

How will we use the participant information we are collecting/receiving?

We will use patient information to:

• enable us to study the progress of the recovery of COVID-19 patients and to understand the full impact this virus has on them in terms of health and well-being;
• identify whether there are longer-term health problems of COVID-19 for those who were admitted to hospital;
• look at how the human body is affected by COVID-19 by using samples obtained in both Tier 1 and Tier 2 to analyse DNA (genetic variation), RNA (how genes work) and other molecules;
• create a national database of COVID-19 patient information. This will involve linking the patient information we collect directly from patients with other information held by other organisations for e.g. NHS digital;
• help our researchers to identify priority areas for further research in the Tier 3 stage and beyond.

We will not be using the data to record, learn or decide something about the individual patients whose information we are using.

Due to the nature of the study, there will be “profiling” of patient information relating to demographics, patients who have multiple medical conditions at the same time and all patients who are in specific at-risk groups. This will allow us to be more precise in the way we study the impact of COVID-19 on, and to improve our understanding of different patient groups in term of the purposes of the study.

The research study does not involve automated decision-making.

What is the legal basis for processing the information?

The legal basis for the processing of participant information we are collecting and using for the study is that it is ‘necessary for the performance of a task in the public interest’ (Public Task) as set out in the Data Protection Act 2018 and UK GDPR Article 6.1(e). Research is a task that the University of Leicester performs in the public interest, and is part of its core functions as a University.

Our additional lawful bases for processing special category information are:

1. processing ‘is necessary for reasons of public interest in the area of public health’, specifically relating to COVID-19, as set out in the Data Protection Act 2018 and UK GDPR Article 9.2(i); and
2. that it is necessary for ‘archiving in the public interest, scientific research or statistical purposes’ as set out in the Data Protection Act 2018 and UK GDPR Article 9.2(j).

If we are sharing information with others, who are we sharing it with?

This is a complex study and involves many research and delivery partners, such as Universities, Hospitals. Laboratories, information processing and logistics operations. The following is a list of some of the organisations we are sharing participant information with, but is not an exhaustive list of all those who we may need to involve over the life of the study:

• 26 universities who are part of the Consortium carrying out this study for analysis of the participant data provided by their local NHS Trust Hospitals.
• The University of Edinburgh who will provide the main data centre facilities for the duration of the study. They will carry out data linkage services whereby participant data collected by the NHS Trust hospitals will be combined with participant information held by others partners such as NHS Digital, NCIMIS (CT scans and X-rays) and other Studies such as ISARIC (Oxford and Edinburgh Universities).
• Royal Mail services contracted by Leicester to Deliver Sample DNA Saliva test kits to eligible participants.
• The Wellcome Trust Clinical Research Facility, University of Edinburgh, who will receive the research samples being collected from participants by Leicester and carry out the DNA analysis for the Study. This will also be covered by a materials transfer agreement between Edinburgh and Leicester.
• Oxford University who will provide us with True Colours Quality of Life Questionnaire services for all participants.
• Leicester Diabetes Research Centre who will provide Tier 2 Activity monitoring services.
• Public Health Scotland (PHS) who are managing personal data relating to this study in its Data Safe Haven and providing study team researchers with access to anonymised datasets via a virtual desktop within its Trusted Research Environment (TRE). No data will leave the PHS data safe haven.
• We will act on any test results including questionnaires that require follow-up, most commonly this will be by informing the participant and their GP of a particular result. Other than this, we will not be sharing information with participants or their GP about any test results or assessments.
• Other third party providers of technology and software we use to support our research processing activities and related back-up systems.
• Bona Fide researchers outside the PHOSP-COVID study team who successfully apply to our Executive Board and Steering Committee and whose application for access to the research data will be overseen by the External Scientific Advisory Board (this body comprises senior, independent people who will not be involved in the collection or analysis of the PHOSP-COVID samples or participant information).
• In the long term, either the Health Data Research UK Digital Innovation Hub and The Health Data Research Hub for Respiratory Health (BREATHE) based in Swansea, or a similar trusted research data storage facility, will hold a copy of the PHOSP-COVID database with access governed by a data access committee. This is to ensure that this important database is available for future research projects in the public interest.
• Participant information and samples may be disclosed to regulatory authorities and public health agencies.

We are also required to provide progress reports and summarised research information to our grant funders and the Department of Health and Social Care but this will not include any information about individual participants.

We will only share with all these parties the minimum information that is necessary for them to undertake the task they are performing. We will not share information that identifies participants such as their name and contact information with people who do not need to know this. In such cases, we will replace name and contact details with a code number – this is called pseudonymised information.

In contrast, anonymised information means that a person cannot be identified from the information and it is not personal information for the purposes of Data Protection Legislation.

For how long will we process this participant information?

The PHOSP-COVID research is a long-term study this means that, subject to funding, we will be processing participant data for 25 years after the initial 18 months of the study. The national database of participant information we are creating will be transferred to a trusted long term data facility and will be kept for a further 25 years to enable it to be used for any future research which has appropriate approvals.

What rights do participants (data subjects) have?

Under Data Protection legislation, individuals normally have rights in relation to the personal information we hold about them including the right to access, to rectification, to erasure, to restrict or object to processing. However in this research study these rights are limited in respect of this research in the following circumstances:

• a) Because our research is being carried out as a public task in the public interest under Art 6.2.e and also for reasons of public interest in public health under Art 9.2.i the rights to erasure and to object to processing do not apply.
• b) in respect of special category data because it is being processed for archiving in the public interest, scientific research and for statistical purposes under Art 9.2.j and we consider individual rights would seriously impair research outcomes, these rights are limited. We are relying on the exemptions in Schedule 2 Part 6 paragraph 27 of the Data Protection Act 2018 because we are processing this information in accordance with UK GDPR Art. 89(1) and Approved Medical Research covered by s19 Data Protection Act 2018.

Prior to applying the exception in a) and the exemptions in b) above, we have carried out a Data Protection Impact Assessment and taken into account:

• That this public health and scientific research is long term and is of national significance because it relates to COVID -19, a new disease classed as a pandemic because it has affected people in many countries;
• That the results of our research will only be published in an anonymised or summarised basis;
• We have taken appropriate measures to safeguard participant information we collect or receive and to protect the rights and freedoms of the patients whose information we will be using in our research;
• We and our partners are under an obligation to maintain confidentiality in our handling of participants’ information;
• We are making information about our research and use of their information available to participants and the public through this privacy notice which is available on the website of the study and the University’s website.

We have concluded that the exercise of rights by participants would seriously impair the achievement of the study objectives and the exemptions are necessary to enable us to fulfil our public health and scientific research purposes.

How will this affect the rights of participants?

Participants involved in this research will not be able to exercise their rights to access their personal information, to request correction of inaccurate information (where they cannot do this themselves) or erasure of their information, to restrict processing of information or to object to our processing of their information even if they leave the study. UK GDPR Articles 15,16,17,18 and 21 will not apply.

What right do people have to complain to the Information Commissioner’s Office?

If you wish to ask questions about our use of this data or your rights, you may contact Information Assurance Services by email at ias@leicester.ac.uk or the University’s Data Protection Officer by email at dpo@leicester.ac.uk.

Anyone can raise concerns about how their information has been processed with the Information Commissioner’s Office (ICO). The ICO may be contacted:

• Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• 0303 123 1113
• ICO website