Data Protection

email: info-cap-code@bristol.ac.uk

The University of Bristol is the data controller for the CAP study.  At the University of Bristol, we are committed to keeping the personal, health and research data about you used in the CAP study safe and confidential.

As a university, we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest – as laid out in the University Charter – when we use personally-identifiable information in research. This means that when you are part of the CAP research study, we will use your data in the ways needed to conduct and analyse research into prostate cancer. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.

How we use your data

The CAP study has approval from the Confidentiality Advisory Group to use your name, date of birth and NHS number to find your hospital records, in order to collect information about your health and care for the study. The CAP study will also securely share your name, date of birth and NHS number with organisations that hold official health data (e.g. Public Health England’s cancer registry and the NHS). We do this to obtain information from these public organisations about your health and care not easily accessible directly from the hospital. We will not use this data to make decisions about your care or contact you. We do not make decisions using automated processing, such as profiling, that have legal or similarly significant effects. In all cases your data will be stored securely and with access strictly on a need-to-know basis. For more information about cancer registration and your rights please visit https://www.ndrs.nhs.uk/.

The CAP study reached an average follow-up of 15 years in 2021 and continues to hold official health data from organisations as noted above to help us understand your health and care.  We intend to lengthen follow up to 2027 allowing us greater understanding of PSA testing for prostate cancer on health and care ensuring that groups who make decisions about introducing screening or who write guidelines for doctors and the public can be confident of the results.

On completion of the study, your name and NHS number will be securely destroyed. Your de-personalised health data will be retained for 20 years after the completion of the study, in line with trial conduct regulations.

The CAP study collaborates with researchers around the world where the research serves the public interest. These approved researchers have access to limited, de-personalised sub-sets of the data in the study, and do not have access to your name, contact details or NHS number.

For more information about how your data is used in research visit http://www.understandingpatientdata.org.uk.

For more information about how the University of Bristol uses research participants’ personal data visit http://www.bristol.ac.uk/secretary/data-protection/policy/research-participant-fair-processing-notice/

Your rights

Under General Data Protection Regulations (GDPR) you have a number of important rights, free of charge. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. Further information about these rights can be found on the Information Commissioners website, www.ico.org.uk/for-the-public/.

If you wish to raise a complaint on how we have handled your personal data, you can contact the University of Bristol’s Data Protection Officer who will investigate the matter, using data-protection@bristol.ac.uk. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO; www.ico.org.uk/concerns/).