Privacy Policy
The research team are committed to protecting and respecting your privacy and aim to conduct research to the highest standards of research integrity.
We are always looking to improve the information we provide to our users so if you have any feedback on this Privacy Policy, please let us know at [email protected]
Our research is underpinned by policies and procedures that ensure we comply with regulations and legislation that govern the conduct of research; this includes data protection legislation such as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).
The OverSight application uses personal data for research to improve health, care and services. The team work at University College London, a publicly-funded organisation incorporated under a Royal Charter. This means that it is in the public interest when we use personal data from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your personal data in the ways needed to conduct and analyse the research study.
1. What data do we collect?
The OverSight app is a smartphone app available for most Apple iPhones. The app collects two types of data. The first type of data consists of responses to questionnaires on the app. The second type of data is automatically collected through built-in sensors on the smartphone without any requirement of the user. An example of this is recording the number of steps taken using the smartphone accelerometer. A full description of the data metrics collected by the OverSight application are provided in the table below.
2. What is ‘personal data’?
‘Personal data’ means any information which relates to or identifies an individual. This includes information which may not explicitly identify you (e.g. where your name has been removed) but which does make it possible to identify you if it is combined with other information that is readily available.
For example, this might be because the information available contains your gender and date of birth, and in these circumstances it might be possible to identify you by using other information available elsewhere. We would therefore treat the details we hold as personal information and protect it accordingly.
3. Our approach to research and personal data
We respect the confidentiality of personal information relating to research participants, including where this information is provided to us directly and where it is obtained from other organisations. We will be clear with you when your information is collected about how we intend to use that information. We will not do anything with your personal information that you wouldn’t reasonably expect. We will use your information only for the purpose of the research you are participating in and we will not usually use your information or contact you for any purpose other than research unless you have agreed to this. We commit to keeping your personal information secure.
All of our research uses pseudonymisation (removing identifiers such as your name and replace this with a unique code or key) or we delete personal information collected as part of this research at the earliest opportunity. All personal information is kept in line with University College London policies or any regulatory requirements.
You can find out more about how we use your information:
· by asking one of the research team · by visiting www.ucl.ac.uk/data-protection/
4. Our principles
In accordance with data protection law, we will comply with the principles set out below when processing your personal data.
In accordance with the additional ‘Accountability’ principle, UCL must also be able to demonstrate compliance with each of the above principles.
5. Your rights
Under data protection legislation you have certain individual rights in relation to the personal information we hold about you. For the purposes of research where such individual rights would seriously impair research outcomes, such rights are limited. However, subject to certain conditions, you have the following rights in relation to your personal data:
Right 1: A right to access personal data held by us about you.
Right 2: A right to require us to rectify any inaccurate personal data held by us about you.
Right 3: A right to require us to erase personal data held by us about you. This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below).
Right 4: A right to restrict our processing of personal data held by us about you. This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims.
Right 5: A right to receive personal data, which you have provided to us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.
Right 6: A right to object to our processing of personal data held by us about you.
Right 7: A right to withdraw your consent, where we are relying on it to use your personal data.
Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop.
It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances your rights may be restricted.
If you notify us (using the contact details on this website) that you wish to exercise any of the above rights and it is considered necessary to refuse to comply with any of your individual rights, you will be informed of the decision within one month and you also have the right to complain about our decision to the Information Commissioner’s Office.
Please also note that we can only comply with a request to exercise your rights during the period for which we hold personal information about you. If that information has been irreversibly anonymised and has become part of the research data set, it will no longer be possible for us to access your personal information.
6. What will happen to my data?
All the information about your participation in this study will be kept confidential. We will keep all information about you safe and secure.
If you consent to take part in this study, the records obtained while you are in this study will remain strictly confidential at all times. The information will be held securely on paper, and electronically at University College London under the provisions of the General Data Protection Regulation and the Data Protection Act. Your name will not be passed to anyone else outside the research team or the sponsor, who is not involved in the study. You will be allocated a unique study ID number, which will be used as a code to identify you on all study documents.
Your data, only recognisable by your study ID number, will be shared with the research team at OverSight. All members of the OverSight team are employed by University College London and adhere to the General Data Protection Regulation and the Data Protection Act.
If you withdraw, your data will remain on file and will be included in the final study analysis, unless you request for this information to be deleted.
In line with Good Clinical Practice guidelines, at the end of the study, your data will be securely archived for a minimum of 5 years. Arrangements for confidential destruction will then be made according to the Sponsor’s local policy and procedures.
The information collected about you may also be shown to authorised people from the Health Research Authority and the independent Ethics Committee to ensure that the study is carried out to the highest possible scientific standards. All will have a duty of confidentiality to you as a research participant.
We will need to use information from you and your records for this research project. This information will include your initials, name and contact details. The research team will use this information to do the research and approved personnel may check your records to make sure that the research is being done properly. People who do not need to know who you are will not be able to see your name or contact details – OverSight will not know this information. Your data will have a study ID number instead.
Once we have finished the study, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the study. You can stop being part of the study at any time, without giving a reason, but we will keep information about you that we already have.
7. How do I contact you?
Our point of contact is Kishan Devraj
To contact Kishan about anything to do with your Personal Data and data protection, including to make a subject access request or to withdraw consent at any time, please contact us by email at [email protected].
8. Changes to this Privacy Policy
We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects Personal Data protection.
This is Version 1.0 of the Privacy Policy and was drafted on 18th November 2022.