Privacy Notice

An audio version of the following document is available below:

This privacy notice explains what to expect when we collect your personal information, whether you contact us, use our website or take part in the study.

In this notice, we tell you:

1. how we use your information;
2. our legal basis for using it;
3. our privacy policy as it affects everybody;
4. our privacy policy for study participants in particular.

We also explain our privacy policy as it applies to researchers, in the appendix at the end of the document.

1) How we use your information

The University of Edinburgh is the lead organisation in the DecodeME research study, and is the ‘Data Controller’ as defined in the Data Protection Act. In DecodeME, we follow data protection laws when we collect, process, store and disclose personal information.

We collect information from people who visit our website. We also gather information for DecodeME about study participants from questionnaires, samples and (if participants consent) NHS electronic health records.

We check the data to deal with typing errors, inconsistencies, impossible values and so on. We then process (anonymise) it to make sure no one could be identified from it when it’s used in research, including in DecodeME.

We’ll analyse the data in DecodeME for our health research. For those people who consent, we’ll share the data with other qualified researchers to analyse in their health studies.

This document explains how we’ll use any data that you share with us. It applies to information we collect when you: phone, post or email us.

It also applies to the way we handle, process and store your information when we:

• store questionnaires and consent forms;
• receive data from NHS health records;
• provide research data to others for use in scientific research.

If you’re taking part in DecodeME, we may also provide you with further information on privacy, confidentiality and anonymity via post and/or email when we ask you to complete questionnaires.

 

2) Our legal basis for using your information

Under the law, we can use your information – including sensitive personal information – if we’re performing a public task carried out in the public interest for scientific or statistical purposes, which is the case with DecodeME.

You can ask us to stop using your data or samples at any time. The Participant Information Document explains how.

We might ask some study participants if we can use some of their personal information publicly – for example, if they would like to tell their story to the media – but their consent for that would be separate from them taking part in our research.

For example, if you give us your email address to join our mailing list for newsletters, you’d be consenting to us having, processing and using that information and sharing it with Action for M.E. And because you’d given us that information on the basis of consent, you could withdraw your consent for this use of your information at any time. That’s because the laws of consent allow consent to be withdrawn.

 

3) Our privacy policy for everybody

Some aspects of our privacy policy apply to everyone who contacts us or uses our website.

Visitors to our website

This privacy notice doesn’t cover our DecodeME website. For more information on our website privacy notice please consult www.DecodeME.org.uk/Privacy-Policy/.

When you visit our website, Action for M.E. collects standard internet log information and details of what you did on the site on our behalf, but they do it in a way that doesn’t identify you. The purpose is to find out things such as the number of visitors to various parts of the site, and to help us monitor and improve our site.

We don’t try to identify you and we won’t link any such data gathered from our site with any information that might identify you, from any source. If we want to collect such information through our website, we’ll be upfront about it. We’ll make it clear when we collect personal information and we’ll explain what we’re going to do with it.

We don’t give any personal information about users of our website to third parties or other users, unless we have a duty to do so to follow the law, or to enforce or apply our terms of use and other agreements, or to protect the rights, property, or safety of DecodeME, or others.

Posting information on social media

DecodeME is on several social media platforms, including Facebook, Twitter, YouTube and Instagram. Any information you post on those platforms is covered by their own terms and conditions and is in the public domain. DecodeME takes no responsibility with what data is captured or how it may be used on those platforms.

The charity Action for M.E. administers our social media on our behalf.

Newsletters and other communications

If you give us your personal data so that we can send you our news, we keep that data in a database. We welcome you sending us updates or corrections to your details.

We store your information on our contact management system, which is held securely by the University of Edinburgh. The data is password-protected and only the University of Edinburgh employees in the DecodeME team can access it.

Your email address will also be held by the charity Action for M.E., which is a partner in DecodeME. Action for M.E. will use your email address to send you the newsletters with progress updates about the study and its findings.

Each newsletter we send you will give you the option to unsubscribe from future newsletters. You can also get in touch with us via the contact details at the end of this document and ask us to unsubscribe you.

Accessing personal information

You have the right under the data protection laws to update or correct the personal information we hold about you. You can ask us to remove your personal information from our records. You can also ask for information from us, including a description of the personal data that we hold on you. For more information about this, please contact us.

You can ask us whether we hold any personal information about you at all. If we do, we’ll then:

• describe it;
• tell you why we’re holding it;
• tell you who it could be disclosed to;
• let you have a copy of it in an intelligible form.

If you’d like to request any personal information that we may hold, please contact us. We’ll try to deal with your request, if you agree, by giving you the information you need over the phone or by email.

 

4. Our privacy policy for participants in DecodeME

Some extra aspects of our privacy policy apply to you if you take part in the study itself.

Our commitment to you

You won’t be identified from the research. Researchers don’t see your name with your information, just your barcode ID number. The DecodeME team, both at the University of Edinburgh and our partner institutions, are bound to keep your information confidential. So are any researchers on projects using (with your consent) anonymised data from DecodeME for other studies.

We don’t do research for commercial gain – it’s all to benefit society. This could include collaborations with researchers working in other countries or with commercial companies who want to create new treatments or lab tests.

Changing your mind

If you want to leave the study and have us stop using your data, you can do so at any time. Please contact us to let us know. Please note that we can’t stop using any of your information that’s already being used by researchers. But no new research will use your data. We’ll keep a simple record about you on our database so that we know not to contact you.

Phoning or emailing us

When you phone or email us, we’ll confirm your identity and make sure that you’re a study participant before we carry on. We’ll record information that you give us in our contact management system. We’ll also record relevant details (such as the date or time) of the phone call or email message.

Completing questionnaires via our website

To take part in our study, you will need to register on our questionnaire portal at www.DecodeME.org.uk/portal/ which can be accessed through our website www.DecodeME.org.uk.

When you log in to the questionnaire portal, we collect information on how people are accessing different parts of the questionnaire. We’ll also use this information to see whether you’ve completed your questionnaire. If you haven’t, we’ll contact you after a time to remind you about it.

If we want to collect, through our portal, information that could identify you, we’ll make it obvious. For example, at the start of the questionnaire, we’ll make it clear when we ask for your sex at birth and we’ll explain what we intend to do with it.

When you complete your questionnaire online, all the information you provide is confidential. We keep your research data and personal details separately. No researcher will see your name linked to your research data.

We work with Qualtrics to capture and process participants' data through our questionnaire portal. As a result, Qualtrics is a data processor in the DecodeME study. Online questionnaires are administered on computer systems controlled by the University of Edinburgh.

Returning written information

When you send us an item in writing (such as a questionnaire, consent form or letter), we’ll treat the information in it as confidential. We’ll keep your personal details separate from your research data. We won’t pass your personal details to third parties without your consent unless we have a duty to do so to follow the law, or to enforce or apply our terms of use and other agreements, or to protect the rights, property, or safety of DecodeME, or others.

How we’ll use your personal details

We’ll keep your personal details confidential, and separate from your research data. Your personal details won’t be shared with third parties, except for certain service providers contracted to work on our behalf, or unless we have a duty to do so to follow the law, or to enforce or apply our terms of use and other agreements, or to protect the rights, property, or safety of DecodeME, or others.

Some research projects need to know roughly where you live (in which broad postcode area, for example). If you’ve given consent for your data to be used in such a project, we’ll provide that data but we’ll never give your exact home address.

How we’ll mail things to you

We use the Royal Mail to post questionnaires, sample kits, invitations to take part in the study, and other correspondence.

Where we store your data

DecodeME will use industrial-standard, third-party computer platforms hosted within the UK and/or the Eurozone to store your data. We’ll make sure that it’s held securely and safely, in a way that follows best practice and obeys data protection laws.

How we’ll use your research data

We’ll only collect your data with your permission, for example by asking you to complete a questionnaire. Once we’ve collected the data, we’ll process it for research use. We’ll store it securely and confidentially. We’ll remove any details from your data that could identify you.

For general information about how we use your data, please go to www.ed.ac.uk/about/website/privacy.

Your DNA data

We won’t give you a copy of the raw genetic data derived from your DNA. This is because we have to stick closely to the detailed description of our research plans as approved by the university and NHS regulators. This exemption to your rights over your personal data is in line with data protection laws.

Social media

Sometimes, we may approach a study participant to see whether they might like to tell their story on social media. But we won’t use their personal information on social media without their explicit approval. We received a favourable ethical opinion from the NHS Research Ethics panel that we’re responsible to, and approval from our Data Access Committee, before we approach anyone.

Outside of this, we’ll only use social media to communicate with you. We may store your Facebook web address, Facebook email address or Twitter or Instagram username so that we can keep communicating with you. We’ll store this data securely in our contact management database, along with your other contact details that you gave us.

The charity Action for M.E. administers our social media on our behalf.

Collecting data from NHS records

You can choose to let DecodeME receive information from your NHS electronic health records. If you agree, we’ll give the NHS your NHS or Community Health Index number, and they’ll give us information from your records.

We won’t give the NHS any of the health information you’ve given us.

Who we share data with

Researchers working at universities, in government departments, at charities or other organisations (including commercial companies) across the world can apply to access our research data.

Our Data Access Committee will assess each application. We’ll only let researchers have access to our data if they’re from reputable scientific institutions and are doing approved projects. Our committee will decide whether the researcher needs the requested data to conduct the research, and whether they’ll do the project in line with the commitments we’ve made to you. We’ll only share data in a way that protects your confidentiality and we’ll only do it with your consent.

How to find out more about our privacy policy

If you’d like more information about our privacy policy, please get in touch. Our contact details are in the “How to contact us” section. You can also get further information from the University of Edinburgh’s Information Security Policy at www.ed.ac.uk/information-services/about/policies-and-regulations/security-policies.

Who controls the use of our data?

The University of Edinburgh is the ‘Data Controller’ for the data that DecodeME directly collects. This legal term means the university controls the use of the data. The university’s Data Protection Officer advises the university on following the data protection laws. You can contact them via email at dpo@ed.ac.uk or by writing to:

Data Protection Officer
Governance and Strategic Planning
The University of Edinburgh
Old College
Edinburgh
EH8 9YL

Note that this privacy policy document relates to the University of Edinburgh as the Data Controller, but if you register to take part in the study, Action for M.E. will also hold your email address on DecodeME’s behalf.

Complaints or queries

This privacy notice aims to be clear and not too long, and so doesn’t cover every nuance of how we handle your personal details. However, we’re happy to provide further information on request.

We aim to meet the highest standards when collecting and using personal information. Please tell us if you think that our collection or use of information is unfair, misleading or inappropriate. We also welcome any suggestions for improving how we handle your personal details.

If you’d like to complain about our handling of your data, you can contact the university’s Data Protection Officer via the contact details in the previous section. 

How to contact us

Phone:
0808 196 8664, Mon–Fri, 9am–5pm (answerphone outside working hours)

Email:
info@DecodeME.org.uk

Website:
www.DecodeME.org.uk

Social Media:
@DecodeMEstudy (Twitter, Facebook, Instagram)

Post:
DecodeME Study
Institute of Genetics and Cancer
University of Edinburgh
Western General Hospital
Crewe Road South
Edinburgh
EH4 2XU