Privacy information for participants in MyMelanoma

MyMelanoma is a collaborative research project led and sponsored by the University of Oxford. The data controller is the University of Oxford.

The MyMelanoma project is designed to collect data to support research into the causes of melanoma, factors modifying recurrence, response to treatment and outcome, as well as the effects that a melanoma diagnosis has on quality of life and general health. Related aims are to discover tests which can be used to better predict prognosis, response to treatment and drug toxicity and finally, in research led by the University of the Highlands and Islands, research will be carried out on risk of cancer in families at increased risk of melanoma. To conduct our research, we collect and process data in electronic databases. Paper records may be used by the research group at the University of the Highlands and Islands to construct family trees although these will not carry names. These data are personal data according to UK Data protection regulation.

What types of personal data do we process?

We process the following types of personal data under articles 6 and 9 of UK GDPR on the legal basis that it is ‘In the Public Interest’ as our database will facilitate research designed to help individuals make choices about how they may reduce their risk of developing certain diseases or improve their likelihood of surviving them:

• Health related information obtained directly from people participating in our research.
• Health related information about people participating in our research which is obtained from healthcare providers which, depending upon the research project can include laboratory data and genetic sequencing data.
• Health related information obtained from government data providers such as NHS Digital and Public Health agencies in England, Wales, Scotland and Northern Ireland and other research organisations, provided that we have obtained written consent from participants.

Why do we use personal data?

We use personal data to conduct important research to improve health, care, and services. As a publicly funded organisation, we ensure that the data are used in such a way as to be in the public interest: that is that the data participants provide will be analysed resulting in benefit from people suffering from melanoma in the future both in the UK and overseas. All research in the NHS is looked at by an independent group of people, called a Research Ethics Committee, to protect participants’ interests. MyMelanoma has been reviewed and given a favourable opinion by South Central Oxford Research Ethics Committee.

Any change to the project will be subject to review by that committee.

Different data are required to address the aims of MyMelanoma and to this end participants will be asked to take part in different “arms”. Each arm will therefore require different detailed information to be made available to people who are considering taking part in the projects which include details of the types of data to be collected, how it will be used and who will have access to it. In general, MyMelanoma processes personal data:

• In the process of recruiting eligible participants who contact MyMelanoma via the portal
• To collect data provided by participants themselves and to match up that data with NHS data.
• To correctly track participants so that we can identify changes in health after recruitment e.g., whether another cancer has occurred, what operations have been carried out, what test results showed.
• To correctly identify samples and data donated by participants.
• To collect and clean data for use in statistical analyses.
• To satisfy other ethical, legal, and regulatory requirements which apply to the conduct of our research projects.

If you would like to know more about the contribution that people make when participating in our research projects, and how personal data is used by universities and the NHS to help improve treatments and healthcare services, this video provides more information:

https://www.datasaveslives.info/

How do we protect the personal data that we hold?

We only use the minimum personally identifiable information possible and ensure that this is held securely with strict arrangements about who can access it. All identifiers such as name and date of birth will be stored separately from data contributed by the participant, produced using samples provided by the participant or obtained from the NHS about that participant. All MyMelanoma participants will be designated a unique numerical code following their registration. Throughout the study, including during any data analysis, all data and information relating to the participant will be labelled only with this code. This practice (known as pseudonymization) is adopted to ensure that the identity of participants is continuously protected.

We are collecting information that scientists will use to research long term issues for melanoma patients eg long term side effects of treatment. MyMelanoma will therefore need to keep those identifiers (names, dates of birth or NHS numbers) so that NHS records can still be linked to information you have provided for many years.

Who has access to the personal data that we hold?

Authorised people working on MyMelanoma within the Universities of Oxford and the Highlands and Islands in Inverness and who are working directly on participant recruitment will be given access to personal data, but it will be limited to what they need to access to undertake their role. These workers are predominantly those who will liaise directly with the participants, and part of their role will be to provide information to public health bodies who will join up the information participants themselves contribute with NHS data on their health.

If we have sought a participant’s permission to access and receive additional information about them and their diagnosis then we may need to share data with other organisations including the Office of National Statistics, Cancer Registries, and other central NHS registers (such as Public Health England or NHS Digital). Data supplied by these bodies will relate to their health changes over time and we will do this for a variable length of time following their participation in the study. The duration is normally up to 20 years but very occasionally the period of time can be up to 30 years for work looking at long term side effects of treatment or risks of second cancers in melanoma patients. Participants can, at any time, withdraw their consent from participating or to their records being accessed.

Additionally, to conduct the data collection properly we are required to report certain information to the following organisations. All personal identifiers such as name and date of birth will be removed prior to sharing:

• National Cancer Research Network
• We publish the results of our analyses in scientific journals and produce lay summaries of these for our web site, however these do not contain any identifiable information.

Finally, responsible members of the University of Oxford and the relevant NHS Trust(s) may be given access to data for monitoring and/or audit of the study to ensure that the research is complying with applicable regulations.

Do we use personal data for other purposes?

MyMelanoma will make data available to researchers in universities, NHS organisations or companies involved in health and care research in this country or abroad. This data is only used to conduct research in accordance with the UK Policy Framework for Health and Social Care Research and this is done to maximise the value of data collected for the greater good of cancer patients. This information will not identify participants and will not be combined with other information in a way that could identify them. The information will be used for the purpose of health and care research and cannot be used to affect their care. It will not be used to make decisions about future services available to them, such as insurance. They will always have the right to withdraw from the study even if they have previously given consent, they can later change their mind without that affecting their rights or care. If they do withdraw from this they can request that we destroy their data and/or samples they have donated up to that point and we will endeavour to do that. This, however, may not be possible after anonymised data has been used in an analysis or publication.

Where can you get further information?

The information documentation which is provided prior to consenting describes precisely what personal information we collect from participants, how we process that information and how long we keep it for. It also details how participants can notify us of their desire to withdraw from the study and how they can request that we destroy any of the information and/or samples they have given us, if that is possible.

How do we deal with complaints?

Data protection regulation provides you with control over your personal data and how it is used. When you agree to your information being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available at https://compliance.admin.ox.ac.uk/individual-rights or by contacting the study team using the details below. The University’s data protection officer can be reached at data.protection@admin.ox.ac.uk.

If you have further questions or are not happy with the way your data has been handled, please contact the study team using the contact details below. Alternatively, you can contact the study sponsor on 01865 616480 or ctrg@admin.ox.ac.uk. You have the right to lodge a complaint with the Information Commissioner’s Office on 0303 123 1113 or www.ico.org.uk.