GDPR at the Nottingham Clinical Trials Unit
The Nottingham Clinical Trials Unit (NCTU) is part of the University of Nottingham, and uses personally identifiable information to conduct research to improve health, care and services. As a publically funded organisation, the NCTU must ensure that use of personally identifiable information from research participants is in the public interest.
Health research should serve the public interest, which means that research has to demonstrate that it serves the interests of society. Research in the public interest must follow the UK Policy Framework for Health and Social Care Research. Research must also have a legal basis for the use of any personally identifiable information.
Health and care research may explore prevention, diagnosis or treatment of disease or the promotion of wellbeing. All research undertaken by the NCTU is approved as being in the public interest by the Health Research Authority (HRA) and a Research Ethics Committee. Each NCTU trial is sponsored by either a NHS organisation or University, which maintain oversight of the trial. These research sponsors decide what information will be collected for the trial and how it will be used. Under the General Data Protection Regulation (GDPR) the Data Controller for each trial is the sponsoring organisation. The NCTU acts as the data processor (and in some instances, both the data controller and processor) for the trial.
Information about the way your data is collected, stored, shared and archived in a trial is described in a privacy statement developed by each trial sponsor. The privacy notices for all sponsor organisation with which NCTU are in collaboration with, should be detailed within individual trial participant information sheets which are issued prior to consent. These privacy notices can also be acccessed via the links below:
For trials where contact is made via text message, the third party service provider Esendex, has issued a separate privacy notice for how contact details are processed in this instance, which can be found here https://www.esendex.co.uk/information-security-statement. The details of all Esendex subprocessors is detailed here https://www.esendex.co.uk/subprocessors
For further information on how your data is processed in research, please visit the HRA website https://www.hra.nhs.uk/information-about-patients/
If you wish to raise a complaint on how your personal data has been handled, you can contact the University of Nottingham Data Protection Officer who will investigate the matter. The Data Protection Officer can be contacted by emailing dpo@nottingham.ac.uk