Surrey Clinical Research Facility volunteer privacy notice

SCRF/SSRC holds and processes data about research participants and patients taking part in clinical trials and research studies.

SCRF/SSRC also holds data about individuals who have expressed an interest in participating in future research and who have registered to join our participant recruitment database.

SCRF/SSRC processes both personal data (data that can be identified as relating to an identifiable person) and special category data (personal data that is more sensitive, for example health data).

Data is obtained in several ways:

• Research participants or individuals expressing interest in future research: Data is provided by interested individuals as part of the SCRF or SSRC registration / screening process. If participating in a study, data may also be obtained from a participant’s GP (e.g. medical history) using the Egress* system. Data is generated throughout the study (e.g. from clinical procedures or sample analysis) and is processed by SCRF or SSRC. Your consent will always be obtained before collecting and processing this data.
• NHS patients: ·Data is provided by the referring physician/hospital team. Data is generated throughout the study and processed by SCRF or SSRC (e.g. from clinical procedures or sample analysis). Your consent will always be obtained before collecting and processing this data.
• Some areas of the Clinical Research Building housing SCRF and SSRC have CCTV monitoring for safety. Images are not recorded and are not stored.

*Egress is the NHS approved way of safely transferring personal data. View the Egress Privacy Policy.

All data is held in confidence and is processed in accordance with the Data Protection Act, the University of Surrey’s Data Protection Policy and relevant ethical and legal frameworks.

Study data is retained according to University, regulatory or sponsor (i.e. client) retention period requirements, either in a secure area at the University or at a secure off-site archiving facility and will be destroyed after this time. In some cases study data will be retained for at least 25 years.

Further information on the data processed during a research study (including how long we will retain the data) will be provided in study-specific participant information sheets that you will receive before consenting to take part in a study.

We process personal data to facilitate clinical research. All personal data must be processed under a legal basis.

When you sign up to our volunteer database we will process your personal data according to your explicit consent. We will also request your explicit consent to hold any pertinent special category data that may emerge during a study and that may be used to update our database record.

If you progress to screening or taking part in a research study we will process your personal data under a different legal basis depending on the type of study:

• When we are conducting research that has been sponsored by a University or public body funder, we will process your data for the performance of a task carried out in the public interest.
• When we are conducting research that has been sponsored by a charity or commercial organisation we will process your data for the legitimate interests of the sponsor.

We process special category data for scientific research purposes. The personal data processed by SCRF/SSRC may include the following (non-exhaustive list):

We may also process personal data for purposes not directly related to research:

Within SCRF/SSRC personal data is only shared with colleagues who legitimately need the information to carry out their duties.

We apply The Caldicott Principles to all health and patient data that we handle.

At the start of the study, every research participant is assigned a unique reference number (study number). Your study number is your main identifier within the research study and is used at every opportunity possible in place of your name when processing and sharing your data.

SCRF/SSRC will share your data with third parties, when applicable and necessary. Your data may be shared with study sponsors, external laboratories, regulatory authorities or contractors.

Occasionally we may be required to share data with other University departments.

In addition, most studies require that GPs are informed of their patient’s participation in research, and we may share further data with GPs or other health professionals, using the Egress system, when appropriate.

All data sharing is carried out strictly in accordance with Standard Operating Procedures (SOPs).

Where possible your study number will be used when communicating with third parties. Following the completion of the study, data is anonymised (i.e. can no longer identify you) before any transfer to study sponsors or publication of study results. You will not be identified in the results or publication unless you have given your consent for this. However, SCRF/SSRC will be able to link your study number to you and will retain other identifying information (e.g. photo identification) in our archive for the full study retention period.  

Further information on any data sharing during a research study will be provided in study-specific participant information sheets that you will receive before consenting to take part in a study.

SCRF/SSRC acts as both a data controller (with responsibilities for determining the reasons for processing data) and a data processor (processing data on behalf of the data controller) for different sets of personal data.

We act as a data controller for the data collected and held within our volunteer database.

We act as a data processor for most other data collected in the course of a commercially sponsored study. We may act as ‘controllers in common’ when we process data requiring our specialist or expert knowledge (e.g. sleep data). This means that both SCRF/SSRC and another data controller (e.g. the study sponsor) are jointly responsible for determining the purposes for which and the manner in which data is processed.

Other studies (i.e. non-commercially sponsored studies) will have more information provided in the study-specific participant information sheet. 

You have certain rights with respect to the data held about you by SCRF/SSRC. You can make a written request to obtain access to the data held about you by the University, subject to certain exemptions. This is called a Subject Access Request. All requests should be made following the instructions in our guide to data subject rights information. If we have to refuse to respond to a request, we will explain the reasons to you.

If your personal data is held within our recruitment database for more than 7 years and you have not been enrolled in a study we may remove your details from our database.  You will still have the option to register again for future studies.

You also have the right to have errors and omissions corrected or out of date or irrelevant information removed, subject to certain exemptions.

Minor day-to-day requests for information and corrections can be taken up with our in-house recruitment team who can be contacted on crc-recruitment@surrey.ac.uk or Freephone: 0800 269 847.

You also have the right to object to processing likely to cause damage or distress, subject to certain exemptions. To exercise this right you must put your objection to the processing in writing and be able to show that our processing is causing you unwarranted and substantial damage and distress.

You have the right to withdraw consent to processing at any time, subject to certain exemptions. If you withdraw your consent prior to participating in a research study, we will not collect any further personal data from you. If you are or have participated in a research study, we will retain and may continue to process personal data collected up to the point of your withdrawal from the study. This may include sharing with third parties.  

Details on university-wide measures surrounding IT security can be found in Our Data Policy Statement (PDF) (incorporating Information Security Policy).