VAC4COVID.com

University of Dundee

Information Governance – Data Protection

Privacy Notice for Participants

The SARS-CoV-2 vaccination for COVID-19 disease safety study (VAC4COVID), run by The University of Dundee, respects that the privacy of your personal information is important to you. We have developed this privacy notice to let you know about the types of personal information (as defined below) we may collect from you and how your personal information will be maintained and used.

How we use your information

The VAC4COVID Study, run by the University of Dundee, respect that the privacy of your personal information is important to you. We have developed this privacy notice to let you know about the types of personal information we will use in the study and how and where your person information will be used and stored.

How we use your information

To carry out the VAC4COVID Study we require some of your personal data. The personal data provided will be used to keep in touch with you by sending you email follow-ups and to gather health information about any new hospital admissions, outpatient appointments and A&E attendances from your GP, hospital or centralised electronic health records. Your anonymised information will be shared with the Medicines and Healthcare products Regulatory Agency (MHRA) to help them make informed decisions about vaccine programmes. The University will keep your personal data for 12 months after the end of the study. It will then be anonymised and retained for audit and research purposes.

Personal data

We will collect personal data such as NHS or CHI number, date of birth, postcode, gender and use this to link with hospital or centrally held electronic health records to gather information on hospital admissions and outpatient appointments if required.

Special categories of personal data

The sensitive personal data required for the study is Health information: vaccine details, medications, medical conditions, details of admissions to hospital, outpatient appointments and A&E attendances.

Data controller

The data controller for your personal information is the University of Dundee. Your data may be processed by the University’s nominated agents such as software or service providers. Providers used for the purpose are:

MEMO Research - an approved academic unit within the University of Dundee that has a lot of experience in handling patient data for clinical studies and undergoes regular audits and inspections. The data relating to the VAC4COVID Study will be stored and analysed by MEMO Research at the University of Dundee.

For front-end hosting and back-end storage we use Microsoft Azure. All data is stored within UK datacentres. All interactions with the website are secured by the use of Transport Layer Security (TLS), the successor and improved version of Secure Sockets Layer (SSL). You can view their policies on their website:

https://azure.microsoft.com/en-gb/support/legal

We also use third-party vendors such as Google Analytics and Microsoft Azure Analytics to provide analytic data to allow us to monitor the performance and usage of the website through the use of first party cookies and third-party cookies in order to make adjustments to improve access and usability. By accessing the site you consent to the collection and use of your information by these third-party vendors. However, if you do not want any information to be collected and used, you can visit the third-part vendor or use the Network Advertising Initiative Opt-Out Tool or Digital Advertising Alliance Opt-Out Tool.

For email communications we use MailJet who are ISO27001 certified and General Data Protection Regulation (GDPR) compliant. You can view their Privacy Policy on their website.

https://www.mailjet.com/security-privacy

For address lookup and autocompletion we use getAddress(). Only the postcode that you enter is shared and data is never shared by them with any 3rd parties. You can view their Privacy Policy on their website.

https://getaddress.io/PrivacyPolicy

Lawful processing

The University asserts that it is lawful for it to process your personal data for the purposes detailed above.

The lawful grounds for processing personal data for VAC4COIVD are:

(Article 6 (1)(e)), Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
The data subject has given explicit consent to the processing of those personal data for one or more specified purposes

The University asserts that it is lawful for it to process your sensitive personal data for the purposes detailed above.

The lawful grounds for processing special categories of personal data for VAC4COVID are:

(Article 9 (2)(j)), Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The data subject has given explicit consent to the processing of those personal data for one or more specified purposes

Your rights

The University respects your rights and preferences in relation to your data. If you wish to update, access, erase, or limit the use of your information let us know by emailing vac4covid@dundee.ac.uk and the University will consider your request appropriately.

If you wish to complain about the University’s use of your information please contact the University’s Data Protection Officer in the first instance by emailing dataprotection@dundee.ac.uk. You may also wish to contact the Information Commissioner’s Office. Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by email at casework@ico.org.uk

University of Dundee

Information Governance – Data Protection

Privacy Notice for nominated contacts

How we use your information

To carry out the VAC4COVID Study we require some of your personal data. The personal data provided may be used to contact you should the person who provided your details does not respond to our emails. The University of Dundee will keep your personal data for 5 years. It will then be anonymised and retaind for audit and research purposes.

Personal data

Name, telephone number and email address.

Special categories of personal data

None.

Data controller

MEMO Research an approved academic unit within the University of Dundee that has a lot of experience in handling patient data for clinical studies and undergoes regular audits and inspections. The data relating to the VAC4COVID Study will be stored and analysed by MEMO Research at the University of Dundee.

For email communications we use MailJet who are ISO27001 certified and General Data Protection Regulation (GDPR) compliant. You can view their Privacy Policy on their website.

https://www.mailjet.com/security-privacy

Lawful processing

The University asserts that it is lawful for it to process your personal data for the purposes detailed above.

The lawful grounds for processing personal data for VAC4COIVD are:

(Article 6 (1)(e)), Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
The data subject has given explicit consent to the processing of those personal data for one or more specified purposes

The University asserts that it is lawful for it to process your sensitive personal data for the purposes detailed above.