• Version 4.0, 28 March 2023.
• Privacy Notice also available as a PDF here.

The information published here applies to the use of your personal information as part of the Fenland studies (Phase 1, 2, 3 and Fenland COVID-19) coordinated by the University of Cambridge. This study is being run by a research team based at the MRC Epidemiology Unit, School of Clinical Medicine, University of Cambridge.

The University of Cambridge is the sponsor for this study based in the United Kingdom. We will be using information from you and your medical records in order to undertake this study and will act as the data controller for this study. This means that we are responsible for looking after your information and using it properly. The University of Cambridge will keep identifiable information about you for 15 years after the study has finished.

Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. You can find out more about how we use your information here: www.information-compliance.admin.cam.ac.uk/data-protection/medical-research-participant-data

1. Who will process my personal information?

The University of Cambridge is the data controller of any data that is collected as part of the Fenland studies by the research team in Cambridge.

Further information about the University’s data protection policy, and about how the
University uses your personal data as a research participant, can be found at:
www.information-compliance.admin.cam.ac.uk/data-protection/research-participantdata

This study is part of the University of Cambridge and as such the legal basis to hold and use personal data is covered under the General Data Protection Regulation “Article 6(1) (e) processing is necessary for the performance of a task carried out in the public interest”. To hold special categories of personal data our lawful basis is for pursuing scientific research under “Article 9(2)(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.”.

2. What information do we collect?

The research team collected information about you when you visited our clinics for your Fenland appointment or remotely via online data capture. This included information about your activity levels, diet and body measurements. We also collected blood and urine samples, some of which were analysed straight away and others that are stored for future research.

The research team also request information about you from NHS England. This includes your recent address and GP information to enable us to keep in touch as people move over the years.

NHS England can also provide us with information on your health, such as any hospital
admissions or causes of death. This health information can then be linked with the research information we have obtained through your participation in the Fenland study to help us make connections between the factors measured in our research and health outcomes.

3. How we use the information we collect

We collect personal (identifiable) information about you so we can let you know what the next steps are in the Fenland study and to offer you the chance to either stop taking part or carry on helping us with our research.

The research data we collect is pseudonymised (in other words de-personalised, i.e. coded with a unique ID number, with the key to those ID numbers stored separately and securely so you cannot be identified in the data set) and linked with other data that you have provided in order to help investigate the interaction between genetic and lifestyle factors in determining diabetes, obesity, and related metabolic disorders. These conditions are a considerable public health concern, but their causes and predicting factors are not completely understood.

Collecting this data is necessary for the research we carry out in the public interest. We do not perform automated decision-making, including profiling (making a decision solely by automated means without any human involvement).

4. Sharing your information

We always aim to limit the amount of information provided outside of the research team to the minimum needed to confirm we’ve got the right record for you. This includes your name, date of birth, address, NHS number and GP details.

With your permission, we will share your clinically relevant results (which can include blood results and other measurements taken on the day of your visit) with your GP. This will also contain personal information as described above so it can be matched to your medical records.

The contact information you provide such as email address and phone number(s) will be used by the research team to keep you informed about your participation in the study. In the event that is necessary for the study team to use an external company to manage this process, for example an SMS service, the company will be GDPR compliant

We are committed to making our pseudonymised data as widely available as possible whilst safeguarding the privacy of our volunteers. Your pseudonymised information and samples will be available only to bona fide researchers who have relevant scientific and ethics approvals for their planned research. This could include researchers who are working in other countries and in commercial companies who are looking for new treatments or laboratory tests. Our Data Access and Sharing Policy defines the principles and processes for accessing and sharing our data.

5. Keeping your data confidential and safe

Any personal data we hold is kept securely in a safe-haven (i.e. deemed to have the
appropriate safeguards in place to process and store personal information securely) at the MRC Epidemiology Unit, University of Cambridge which is part of the School of Clinical Medicine. Within the safe haven, personal data is on a secure research server within separate study databases. Access to the server and databases are controlled by the use of unique usernames and passwords which are not used to access other Unit systems. Access to the secure research server is further protected by two-factor authentication. All databases are encrypted. Physical access to the IT infrastructure and study offices are controlled by building card access and internal rooms where confidential paper information is stored are locked when not in use.

The Fenland Study app is accessed via unique username and pin number. The app is
GDPR compliant

When sharing any personal data for specific purposes of record linkage, a secure file
transfer protocol (SFTP) is used with encryption and data sharing agreements are in place to limit the use of our data further.

All other data collected about you is coded with a unique identity number that is held
separately from any personal data we hold.

Your identifiable data will be kept for 15 years after the end of the study, in line with the Medical Research Council (MRC) policies. The need to keep holding your data after study formal closure will be reviewed regularly, as well as its pseudonymisation in line with Data Protection requirements.

6. The Fenland Study’s involvement with the UK Longitudinal Linkage Collaboration (UK LLC)

The Fenland study is one of many UK longitudinal research studies contributing to the
Longitudinal Health & Wellbeing National Core Study for COVID-19 research. This has been designed by the UK’s top scientists to allow longitudinal studies – such as The Fenland study – to fully contribute to the national research programme and policy development. To do this, many studies need to put their COVID-19 relevant data into a single secure research environment to build scale and numbers across diverse population groups, occupations and other factors associated with COVID-19 risk, and from all over the UK. It is also necessary to link these participants to their health and wellbeing, administrative and environmental records to follow changes in status (e.g. who has had COVID-19, who has been vaccinated during the pandemic). This research programme looks at the big picture which includes COVID-19 itself, but also the impact that lockdown and other restrictions have had on wider health (such as mental health, or cancer care and other ongoing health needs), education and families.

To achieve this the Longitudinal Health & Wellbeing National Core Study is establishing the UK Longitudinal Linkage Collaboration (UK LLC). This is a secure research server, run by the University of Bristol (Data Controller) and supported by the University of Swansea (Data Processor for the University of Bristol). The Fenland study will provide the UK LLC with deidentified copies of your data – including data collected during the pandemic, but also relevant data collected before the pandemic so we can look at how health and other factors have changed, To establish the linkage to health and wellbeing and other records we will provide a list of your personal identifiers only (e.g. name, NHS ID, address) to the NHS Wales Informatics Service (they will never see your study data). This NHS organisation will send identifiers to the groups conducting the linkages:

• The UK NHS authorities who share records with researchers (including NHS England in England, Public Health Scotland/eDRIS/National Records of Scotland in Scotland, SAIL databank in Wales, NHS Northern Ireland Business Development Organisation in NI);
• The UK statistical agencies (including the Office for National Statistics in England and Wales, eDRIS/National Records of Scotland in Scotland, Northern Ireland Statistics & Research Agency in NI);

The data is stored on secure servers controlled by the University of Bristol (the servers are located and run by the University of Swansea). The UK LLC will make available a full list of researchers using the UK LLC data and the purpose for this, which can be obtained by emailing project-ukllc@bristol.ac.uk. The UK Data Protection Act 2018 provides individuals with rights over how their data are used. The UK LLC supports these rights.

The Fenland study team at the University of Cambridge remains the Data Controller for your data. At all times, we will determine whose records should be used in the UK LLC, which linkages can be established and which research teams can use your data and for which purposes. In this way, we make sure that all the principles of the Fenland study are upheld.

How to contact us

If you have any questions about the study, the information we hold about you or if you would like to opt out of the study (which you can do so without providing a reason and without your medical care being affected) please contact us on:

Fenland Study team

Email: fenlandstudy@mrc-epid.cam.ac.uk
Or write to us at: Fenland Study, MRC Epidemiology Unit, University of Cambridge
School of Clinical Medicine, Box 285 Institute of Metabolic Science, Cambridge Biomedical Campus, Cambridge, CB2 0QQ
Tel: 0800 085 6183 (ask to speak to a member of the Fenland Study team)

University of Cambridge Data Protection team

Email: data.protection@admin.cam.ac.uk
Tel: 01223 764142