Dementias Platform UK ("DPUK") is a public-private partnership made up of 19 academic and industrial partners. A full list of the partners is available here: https://www.dementiasplatform.uk/about.
This policy describes how we (DPUK) will use your personal data if you agree to participate in the DPUK Great Minds ("GMR"), in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Further information about the GMR can be found in the frequently asked questions, available here.
Who is using your personal data?
The information you provide as part of your participation in the GMR is the research data. Any research data from which you can be identified (e.g. your name, date of birth), is known as personal data. It does not include data where the identity has been removed (anonymous data).
Swansea University, one of the DPUK partners, will initially process the personal data you provide during your registration to join the GMR. This data will be pseudoanonymised or de-identified before being shared with other DPUK partners who will use it for investigating patterns in data that might be used to select Great Minds members for clinical trials or studies.
The cognitive and memory/mood tasks offered by the GMR are run by our partners Cambridge Cognition and the University of Oxford's Big Data Institute. If you decide to participate in these tasks, any personal data you provide will be processed and stored by Cambridge Cognition and/or the University of Oxford before being shared with Swansea University for storage and pseudoanonymisation.
Types of data we collect about you
You will provide the following categories of personal data when you participate in the GMR:
- Contact details
- Summary medical history relating to brain health
- Health information arising from mood and memory assessments and cognitive tasks
- Genetic information (if you have opted to take part in genetic testing)
- Preferences for trial or study selection
We may also collect personal data about you from the researchers who ran previous medical studies you participated in. This type of data includes:
• Genetic information
• Scans, or other imaging
• Information from blood or other samples
• Results from cognitive tests or memory tasks
• Data collected through wearable-devices including thinking tasks, changes in movement.
How we use your data
If you agree to participate in the GMR we will process your data for the purpose of the research as explained in the Participant Information Sheet. Research is a task we perform in the public interest. Your information may also be used for further research where this is in the public interest or where necessary for the purposes of our legitimate interests.
As explained further in the Participant Information Sheet, you may change your mind about taking part in the GMR at any time by contacting us at firstname.lastname@example.org. Please note that if you decide to no longer participate this will not affect the lawfulness of any previous data processing in the context of the GMR or any further research activities, and data collected before you withdraw from the GMR may continue to be used for research purposes.
In addition, if you have consented to receive marketing communications from us or our partners we will use your data to contact you about events related to dementia and brain health research which you may be interested in. Communications may be sent to you by post or by email, depending on the consent that you have provided and the preferences you have expressed. You can withdraw your consent to receive such communications at any time by contacting email@example.com. If you withdraw your consent, we will stop the processing as soon as we can. However, this will not affect the lawfulness of any processing carried out before your withdrawal of consent.
Sharing your data with third parties
We will share your data with the DPUK partners and regulatory authorities where it is relevant to your participation in the GMR and/or for further research.
We may share your data with companies who provide services to us, such as for mailing purposes. We will seek to share the minimum amount necessary. These companies are required to take appropriate security measures to protect your data in line with our policies. We permit them to process your data only for specified purposes and in accordance with our instructions.
We will also share pseudoanonmomised data (health data where personal information is replaced by a numeric code so that an individual cannot be identified) more widely with researchers interested in offering studies relevant to dementia or brain health research. This may include the information and samples being transferred to, and stored at, a destination outside the European Economic Area. Such transfers will only take place with appropriate safeguards in place to ensure the confidentiality and security of your personal information. If you require any information about these safeguards, you may contact us (see data protection officer email address below).
Where we store or use your data
We will store the majority of your data securely in DPUK servers at the University of Swansea, and if you have participated in any GMR tasks, your data from your participation in these will be processed and stored by our partners the University of Oxford (at its Big Data Institute) and Cambridge Cognition.
Cambridge Cognition, its Group, agents, and sub-contractors may use aggregate information and statistics for the purposes of monitoring the CANTAB Connect Application and to develop the CANTAB Connect Application and other current or future products and services. Where this takes place, the information will be de-identified so that the information cannot be used to identify you.
Cambridge Cognition does not use your Personal Information for marketing purposes.
Cambridge Cognition uses the term "Group" to refer to the family of companies that are under it's control or (where applicable) under the control of the Researcher, such as subsidiary companies and parent companies.
Personal Information will be collected, stored and accessed from Cambridge Cognition's servers and the servers of it's data processors.
Your data within the CANTAB Connect Application is stored in a HIPAA (Health Information Portability and Accountability Act) and GDPR (General Data Protection Regulation) compliant data centre which is HITRUST certified. Data is encrypted when it is (a) stored locally on the electronic device used to collect your Personal Information; and (b) when the data is transmitted to or from Cambridge Cognition's data processors.
Cambridge Cognition's data processors are currently located in the United States of America and they reserve the right to change data processors and also to add or remove locations and countries where the Personal Information is processed. Cambridge Cognition will ensure appropriate safeguards are in place to ensure the confidentiality and security of your personal information whenever it is transferred outside of the EEA.
Retaining your data
We will retain and store your data for as long as necessary for the purposes of the GMR, and for further research in accordance with applicable data protection laws.
You may request access to any of your data, request that our processing is restricted, object to our processing or request that your data be corrected or transferred to another party, subject to certain restrictions.
You may also request that your data be deleted or ask for us to stop using it (withdraw your consent), and we will comply with your request as soon as possible. Depending on the circumstances, however, we may have legal grounds for continuing to process your data, for example where processing is necessary for the performance of a task carried out in the public interest or for our legitimate interests, or where the data is being further processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in accordance with applicable data protection laws.
Data protection regulation provides you with control over your personal data and how it is used. When you agree to your information being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available at: https://compliance.web.ox.ac.uk/individual-rights. You can find out more about how we use your information by contacting firstname.lastname@example.org.