How we will protect your personal information

Who is responsible

The University of Bristol is the sponsor for this study. We will be using information from you in order to undertake this study and will act as the data controller for this study. This means that we are responsible for looking after your information and using it properly.

Your GP practice is the data processor for this study. This means that they will process your data under the instruction of the sponsor (University of Bristol). The University of Bristol research team will not know your name or be able to see your medical record and your GP practice will only share information from your medical record with the researcher where you have given prior consent for this information to be shared. Your GP practice will always keep your name, NHS number, address and other contact details confidential and will not pass this information to the University of Bristol.

How long we will keep your information for 

The University of Bristol will keep identifiable information about you for three months after the study has ended. We will keep consent forms, which contain your signature, for five years after the study has ended. We will also keep anonymised information (which cannot be linked to you in any way) for five years after the study has ended, unless you give express permission for us to keep it for longer.

How we will store your information and what we will use it for

All information collected during the research will be kept confidential in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679.

As a university, we use patient information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

Information collected through interviews or the online forms completed by study participants will be stored on secure University of Bristol servers, and will only be accessed by your GP practice and the University of Bristol research team, unless you give express permission for it to be shared with other researchers. If you provide a phone number, this will be stored separately from the information on the forms. The information provided by you or shared from your medical record may be reviewed for monitoring and auditing purposes by individuals from the University of Bristol or regulatory authorities.

What to do if you wish to make a complaint

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).

Who to contact for further information

You can find out more about how we use your information by contacting the chief investigator for this study (mairead.murphy@bristol.ac.uk) and/or the University of Bristol Data Protection Officer (data-protection@bristol.ac.uk).