Participant Privacy Information

Your survey data (and cognitive assessment data if you take part in this aspect) will be held on secure servers at Imperial College London linked to your earlier data collected during the REACT study and given a unique study code so that your identity remains confidential.

If you have consented to health data linkage, Imperial College London will also use information from your medical records held by NHS England and other UK public health bodies for this research project. This information will be linked by your NHS number.

Investigators will use this information to monitor the long-term health status of participants from this study. Unless they really need to know who you are, they will not be able to see your name or contact details. Your data will have a code number instead. The number of people who access this information will be kept to a minimum.

We will keep all information about you safe and secure.

Once we have finished the study, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the study.

Imperial College and other research institutions both academic and commercial may continue to carry out research using the de-identified data collected during the study. The results of any research that is published, whether by Imperial College or anyone else, will never identify you. See ‘Do you share my information with others’ to learn more. From time to time we may invite you to other research studies that you might be interested in participating in. Even if you receive invitations to future studies, there is no obligation to take part and you can drop out at any time.

The information you share with us as part of this study will only be used for the purpose of health and care research or to contact you about future opportunities to participate in research. It will not be used to make decisions about your healthcare or future services available to you, such as insurance.

Your name, address, email will be kept separate from your study data and only linkable by your unique study code. This is in case the Imperial College study team need to contact you about research that your data has been used in. Your contact details will never be passed to another organisation without your permission and will not be visible to the investigators performing the analysis. The results of any research that is published, whether by Imperial College or anyone else, will never identify you. See p6 ‘Do you share my information with others’ to learn more.

Imperial College London is the sponsor for this study and will act as data controller for this study. This means that we are responsible for looking after your information and ensuring that the processing complies with the General Data Protection Regulation (GDPR).

Imperial College London will keep your personal data for 20 years after the study has finished.

Imperial College London has regular internal and external audits of their information security controls and working practices and are accredited to the International Standard for Information Security, ISO 27001.

So that the maximum information can be obtained from your participation in this study we may make the deidentified data available to other researchers.

It is important that researchers understand as broadly as possible the factors concerning your health now, and in the future to identify as accurately as possible what puts people at greater risk of developing COVID-19, experiencing severe illness or suffering from ongoing ill health. We therefore require your consent for Imperial College London to link data (such as your GP health records) held by NHS England and other UK public health bodies to the REACT study data. This will provide information on the long-term health status of the participants. An example of the use of this information would be to enable the monitoring of the longer-term effects of COVID-19 on health. You can
withdraw this consent at any point.

Researchers in the UK and overseas who wish to access the data from this study and/or to contact participants about future research will have to apply to a Data Access Committee composed of at least three of the study investigators and at least one public representative.

You can find out more about how we use your information

• at www.hra.nhs.uk/information-about-patients/ 
• by sending an email the research team: react.study@imperial.ac.uk 

Your personal data will never be available to the general public in any circumstances. The results of this research are likely to be published but will not contain personal information which could identify you such as name, age, gender, ethnicity. Please keep this information sheet for reference.

There may be a requirement to transfer information to countries outside the United Kingdom (for example, to a research partner). Where this information contains your personal data, Imperial College London will ensure that it is transferred in accordance with data protection legislation.

For the purposes referred to in this participant information sheet and relying on the bases for processing as set out above, we will share your personal data with certain third parties:

• Other College employees, agents, contractors and service providers (for example, suppliers of printing and mailing services, or suppliers who help us carry out any of the activities described above). Our third party service providers are required to enter into data processing agreements with us. We only permit them to process your personal data for specified purposes and in accordance with our policies and they are required to delete the data when no longer needed to provide the service.

As a university we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research. to carry out analysis and conduct the research study.
This means that when you agree to take part in a research study, we will use your data in the ways needed

Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.

Our legal basis for using your information under General Data Protection Regulation (GDPR) and the Data Protection Act 2018, is as follows:

• Imperial College London -“performance of a task carried out in the public interest” (Article 6(1)(e) in the GDPR);
• Where special category personal information is involved, Imperial College London rely on “scientific or historical research purposes or statistical purposes (Article 9(2)(j) in accordance with Article 89(1) in the GDPR)”.

Your usual statutory rights to be able to access, change or move your information are limited, because of exceptions applicable to some types of research, and also because we need to manage your information in specific, lawful ways in order for the research to be reliable and accurate.

f you are harmed by taking part in this research project, there are no special compensation arrangements. If you are harmed due to someone’s negligence, then you may have grounds for a legal action. Regardless of this, if you wish to complain, or have any concerns about any aspect of the way you have been treated during the course of this study then you should immediately inform the Principal Investigator Professor Paul Elliott at react.study@imperial.ac.uk. The normal National Health Service complaints mechanisms are also available to you. If you are still not satisfied with the response, you may contact the Imperial College Research Governance and Integrity Team at rgitcoordinator@imperial.ac.uk.

If you wish to raise a complaint on how we have handled your personal data, please contact:

• The REACT Study Team at: react.study@imperial.ac.uk 
• Imperial College London’s Data Protection Officer via email at dpo@imperial.ac.uk, via telephone on 020 7594 3502 and/or via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ.

If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO). The ICO does recommend that you seek to resolve matters with the data controller (Imperial College London) first before involving the regulator. You can find details about how to contact the Information Commissioner’s Office at https://ico.org.uk/global/contact-us/ or by sending an email to: casework@ico.org.uk