An audio version of the following document is available below:
This privacy notice explains what to expect when we collect your personal information, whether you contact us, use our website or take part in the study.
In this notice, we tell you:
- how we use your information;
- our legal basis for using it;
1) How we use your information
The University of Edinburgh is the lead organisation in the DecodeME research study, and is the ‘Data Controller’ as defined in the Data Protection Act. In DecodeME, we follow data protection laws when we collect, process, store and disclose personal information.
We collect information from people who visit our website. We also gather information for DecodeME about study participants from questionnaires, samples and (if participants consent) NHS electronic health records.
We check the data to deal with typing errors, inconsistencies, impossible values and so on. We then process (anonymise) it to make sure no one could be identified from it when it’s used in research, including in DecodeME.
We’ll analyse the data in DecodeME for our health research. For those people who consent, we’ll share the data with other qualified researchers to analyse in their health studies.
This document explains how we’ll use any data that you share with us. It applies to information we collect when you: phone, post or email us.
It also applies to the way we handle, process and store your information when we:
- store questionnaires and consent forms;
- receive data from NHS health records;
- provide research data to others for use in scientific research.
If you’re taking part in DecodeME, we may also provide you with further information on privacy, confidentiality and anonymity via post and/or email when we ask you to complete questionnaires.
2) Our legal basis for using your information
Under the law, we can use your information – including sensitive personal information – if we’re performing a public task carried out in the public interest for scientific or statistical purposes, which is the case with DecodeME.
You can ask us to stop using your data or samples at any time. The Participant Information Document explains how.
We might ask some study participants if we can use some of their personal information publicly – for example, if they would like to tell their story to the media – but their consent for that would be separate from them taking part in our research.
For example, if you give us your email address to join our mailing list for newsletters, you’d be consenting to us having, processing and using that information and sharing it with Action for M.E. And because you’d given us that information on the basis of consent, you could withdraw your consent for this use of your information at any time. That’s because the laws of consent allow consent to be withdrawn.
Visitors to our website
This privacy notice doesn’t cover our DecodeME website. For more information on our website privacy notice please consult www.DecodeME.org.uk/Privacy-Policy/.
When you visit our website, Action for M.E. collects standard internet log information and details of what you did on the site on our behalf, but they do it in a way that doesn’t identify you. The purpose is to find out things such as the number of visitors to various parts of the site, and to help us monitor and improve our site.
We don’t try to identify you and we won’t link any such data gathered from our site with any information that might identify you, from any source. If we want to collect such information through our website, we’ll be upfront about it. We’ll make it clear when we collect personal information and we’ll explain what we’re going to do with it.
Posting information on social media
DecodeME is on several social media platforms, including Facebook, Twitter, YouTube and Instagram. Any information you post on those platforms is covered by their own terms and conditions and is in the public domain. DecodeME takes no responsibility with what data is captured or how it may be used on those platforms.
The charity Action for M.E. administers our social media on our behalf.
Newsletters and other communications
If you give us your personal data so that we can send you our news, we keep that data in a database. We welcome you sending us updates or corrections to your details.
We store your information on our contact management system, which is held securely by the University of Edinburgh. The data is password-protected and only the University of Edinburgh employees in the DecodeME team can access it.
Your email address will also be held by the charity Action for M.E., which is a partner in DecodeME. Action for M.E. will use your email address to send you the newsletters with progress updates about the study and its findings.
Each newsletter we send you will give you the option to unsubscribe from future newsletters. You can also get in touch with us via the contact details at the end of this document and ask us to unsubscribe you.
Accessing personal information
You have the right under the data protection laws to update or correct the personal information we hold about you. You can ask us to remove your personal information from our records. You can also ask for information from us, including a description of the personal data that we hold on you. For more information about this, please contact us.
You can ask us whether we hold any personal information about you at all. If we do, we’ll then:
- describe it;
- tell you why we’re holding it;
- tell you who it could be disclosed to;
- let you have a copy of it in an intelligible form.
If you’d like to request any personal information that we may hold, please contact us. We’ll try to deal with your request, if you agree, by giving you the information you need over the phone or by email.
Our commitment to you
You won’t be identified from the research. Researchers don’t see your name with your information, just your barcode ID number. The DecodeME team, both at the University of Edinburgh and our partner institutions, are bound to keep your information confidential. So are any researchers on projects using (with your consent) anonymised data from DecodeME for other studies.
We don’t do research for commercial gain – it’s all to benefit society. This could include collaborations with researchers working in other countries or with commercial companies who want to create new treatments or lab tests.
Changing your mind
If you want to leave the study and have us stop using your data, you can do so at any time. Please contact us to let us know. Please note that we can’t stop using any of your information that’s already being used by researchers. But no new research will use your data. We’ll keep a simple record about you on our database so that we know not to contact you.
Phoning or emailing us
When you phone or email us, we’ll confirm your identity and make sure that you’re a study participant before we carry on. We’ll record information that you give us in our contact management system. We’ll also record relevant details (such as the date or time) of the phone call or email message.
Completing questionnaires via our website
When you log in to the questionnaire portal, we collect information on how people are accessing different parts of the questionnaire. We’ll also use this information to see whether you’ve completed your questionnaire. If you haven’t, we’ll contact you after a time to remind you about it.
If we want to collect, through our portal, information that could identify you, we’ll make it obvious. For example, at the start of the questionnaire, we’ll make it clear when we ask for your sex at birth and we’ll explain what we intend to do with it.
When you complete your questionnaire online, all the information you provide is confidential. We keep your research data and personal details separately. No researcher will see your name linked to your research data.
We work with Qualtrics to capture and process participants' data through our questionnaire portal. As a result, Qualtrics is a data processor in the DecodeME study. Online questionnaires are administered on computer systems controlled by the University of Edinburgh.
Returning written information
How we’ll use your personal details
Some research projects need to know roughly where you live (in which broad postcode area, for example). If you’ve given consent for your data to be used in such a project, we’ll provide that data but we’ll never give your exact home address.
How we’ll mail things to you
We use the Royal Mail to post questionnaires, sample kits, invitations to take part in the study, and other correspondence.
Where we store your data
DecodeME will use industrial-standard, third-party computer platforms hosted within the UK and/or the Eurozone to store your data. We’ll make sure that it’s held securely and safely, in a way that follows best practice and obeys data protection laws.
How we’ll use your research data
We’ll only collect your data with your permission, for example by asking you to complete a questionnaire. Once we’ve collected the data, we’ll process it for research use. We’ll store it securely and confidentially. We’ll remove any details from your data that could identify you.
For general information about how we use your data, please go to www.ed.ac.uk/about/website/privacy.
Your DNA data
We won’t give you a copy of the raw genetic data derived from your DNA. This is because we have to stick closely to the detailed description of our research plans as approved by the university and NHS regulators. This exemption to your rights over your personal data is in line with data protection laws.
Sometimes, we may approach a study participant to see whether they might like to tell their story on social media. But we won’t use their personal information on social media without their explicit approval. We received a favourable ethical opinion from the NHS Research Ethics panel that we’re responsible to, and approval from our Data Access Committee, before we approach anyone.
Outside of this, we’ll only use social media to communicate with you. We may store your Facebook web address, Facebook email address or Twitter or Instagram username so that we can keep communicating with you. We’ll store this data securely in our contact management database, along with your other contact details that you gave us.
The charity Action for M.E. administers our social media on our behalf.
Collecting data from NHS records
You can choose to let DecodeME receive information from your NHS electronic health records. If you agree, we’ll give the NHS your NHS or Community Health Index number, and they’ll give us information from your records.
We won’t give the NHS any of the health information you’ve given us.
Who we share data with
Researchers working at universities, in government departments, at charities or other organisations (including commercial companies) across the world can apply to access our research data.
Our Data Access Committee will assess each application. We’ll only let researchers have access to our data if they’re from reputable scientific institutions and are doing approved projects. Our committee will decide whether the researcher needs the requested data to conduct the research, and whether they’ll do the project in line with the commitments we’ve made to you. We’ll only share data in a way that protects your confidentiality and we’ll only do it with your consent.
Who controls the use of our data?
The University of Edinburgh is the ‘Data Controller’ for the data that DecodeME directly collects. This legal term means the university controls the use of the data. The university’s Data Protection Officer advises the university on following the data protection laws. You can contact them via email at firstname.lastname@example.org or by writing to:
Data Protection Officer
Governance and Strategic Planning
The University of Edinburgh
Complaints or queries
This privacy notice aims to be clear and not too long, and so doesn’t cover every nuance of how we handle your personal details. However, we’re happy to provide further information on request.
We aim to meet the highest standards when collecting and using personal information. Please tell us if you think that our collection or use of information is unfair, misleading or inappropriate. We also welcome any suggestions for improving how we handle your personal details.
If you’d like to complain about our handling of your data, you can contact the university’s Data Protection Officer via the contact details in the previous section.
How to contact us
0808 196 8664, Mon–Fri, 9am–5pm (answerphone outside working hours)
@DecodeMEstudy (Twitter, Facebook, Instagram)
Institute of Genetics and Cancer
University of Edinburgh
Western General Hospital
Crewe Road South
This document applies when researchers complete a data transfer agreement, material transfer agreement, or confidentiality agreement, or submit a manuscript for review.
The collaboration proposal form and supporting documents include the name and contact details of the Principal Applicant, and those of any co-applicants and any other data users on the proposal and supporting documents. Our legal basis to use this data is that we have a contractual obligation to you. We also need this data to communicate with you about your proposal.
We may also collect your personal details on a number of supporting documents related to your proposal. These include data access agreements, data transfer agreements, material transfer agreements, confidentiality agreements and data-user responsibilities agreements. We may also collect your personal details when you submit a manuscript to us for review.
We will never sell your personal information to other organisations. The accuracy of your information is important to us. If you believe any information we hold concerning you is out of date, please let us know.
About this Privacy Notice: We reserve the right to make changes to this privacy notice. The most recent modification was made on 8 April 2022 (v2.0)