Privacy Statement

GoDARTS Privacy Statement for Patient’s Personal Data in Research

Who are GoDARTS

DARTS stands for Diabetes Audit and Research in Tayside Scotland which is a register of people in Scotland with diabetes.  GoDARTS is the Genetics of DARTS which is a consented bioresource where patients who are already on the DARTS register have given consent for their blood samples along with clinical and lifestyle information to be used for research purposes. Patients have provided this information through questionnaires and clinical examinations. By registering with GoDARTS, patients are volunteering to help researchers identify genetic and environmental factors which contribute to the onset and progression of diabetes and to understand how people respond differently to different treatment of the disease.

GoDARTS at the University of Dundee respects that the privacy and safety of personal data is important to its volunteers. This privacy notice describes what types of personal data GoDARTS collects from consenting patients and how we keep this personal data private and secure. It also explains the reasons we keep and process personal data as there are only certain reasons that are allowed under the laws that protect people’s personal data and its security. Each reason is called a “lawful basis for storing and processing personal data”. Lastly, the notice describes the ways personal data can be used in research, what kind of organisations may be allowed to use your data and what rights consenting patients have over the use of their own data.

What is the lawful basis for GoDARTS storing and processing people’s personal data?

The data protection laws describe 6 different lawful bases (or reasons) why people’s personal data can be store and processed. The lawful basis for storing and processing volunteer’s personal data by GoDARTS under the data protection laws is that:

Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

GoDARTS only ever uses consenting patient’s personal data for research in a form that prevents any individual from being identified.

When a patient agrees to contribute to GoDARTS they are accepting and consenting to the practices described in this privacy notice. If they change their mind and no longer wish their blood samples and information to be used in research, they can withdraw from the programme at any time. Patients do not need to give a reason and this notice describes how they can do this. Refusing or withdrawing consent does not affect the treatment or health care available to them at that time or in the future.

What types of personal data does GoDARTS store and process?

GoDARTS collects the following personal data from consenting patients:

For an explanation of the biochemistry and biometric data we collect, click here

For details of the lifestyle data we collect, see a copy of the lifestyle questionnaire

The patient’s consent at the time of recruitment allows the data collected to be linked anonymously to datasets derived from consenting patients’ medical records. The types of data GoDARTS can link to are listed in the table below.

GoDARTS can also link personal data to other data collections. The collections we can link to are in the table below.

For more information on these other data sets click here.

How does GoDARTS keep personal data private and secure?

When a researcher makes a request for personal data, there are a number of steps in place to ensure that the request is justified and that the data will remain protected and anonymous.

All personal data is processed within a “safe haven” – that is a server within a restricted, secure IT environment, where the data processor (the researcher) is given secure remote access to carry out their analysis. You can find out more about the safe haven environment by clicking here. A remote access “Safe Haven” environment stores consenting individuals’ personal data in a database that assigns a unique number called a Pro-CHI to each individual. This Pro-CHI allows a data manager to retrieve the health records of volunteers and to prepare the data for researchers using only the Pro-CHI while removing any personal data that could identify individuals. The data manager ensures that the researchers only get access to the data they requested, and the researchers cannot request any data that could identify patients.

How is personal data used?

When GoDARTS receives an application to access data for a new study, this study undergoes careful scrutiny by the GoDARTS access group of doctors and researchers who decide if the study is worthwhile and will only approve access if it is clear what data is requested, why it is needed and if the study is worthwhile. Once this is approved, the researcher heading the study must apply to the data managers in the safe haven for access to the data they need for the study.

For example, if a study is looking for people within a certain age range who have type 2 diabetes, and heart disease and are being prescribed specific medicines. Each of those conditions and the medicines have a code and the data managers within the safe haven will ask the NHS database to find people who have these codes in their health records. So, if a patient has consented, is in that age range, has type 2 diabetes, and heart disease and is taking that medicine regularly, their records will be included in the data search. The data manager can compile a data set of all patient records where the patients have given consent and who meet the conditions requested. Each patient record will be given a Pro-CHI (a number) which will replace all the information which could identify the patient and only this number will appear in the data set along with the data from the health records.

When a patient gave consent to use their personal information in research, they also gave permission to allow GoDARTS to keep a blood sample. The blood sample can be used for genetic and biochemical analysis and the results of each analysis can be linked to other patient data. The blood samples are stored in a government licensed Biorepository which controls access to the blood samples. When a new study includes a request to carry out an analysis of blood samples, a technician in the biorepository uses the same Pro-CHI to link the blood samples and the patient records. This enables the new study to link the results of the blood analysis to the data the researchers requested from the patient’s records. Using the same Pro-CHI for the blood samples also ensures that neither the blood samples nor the data obtained from the blood samples can identify individuals in a study.

What kind of organisations use personal data?

Researchers in higher education (Universities) and in the NHS can apply to GoDARTS for permission to use the data. The data can be used in national and international studies. Commercial companies such as biotech companies and pharmaceutical companies sometimes provide financial assistance for research projects and in return, they may require the commercial rights to benefits arising from the discoveries. When a patient gives consent to use their personal data and blood sample in research, they are asked to waive any right to future financial gain from participating in studies. In this respect, it should be noted that it is the whole collection of many thousands of samples that is of value and each individual sample has no commercial value on its own. Individual samples cannot be identified by commercial companies. It should also be noted that the kind of analysis carried out on blood samples does not constitute a “genetic test” as defined by insurance companies. Data obtained from blood analysis will never be released to insurance companies unless in the exceptional circumstance that a high court injunction asks us to do so.

Withdrawal from GoDARTS research.

Consenting patients have the right to withdraw their consent at any time without providing a reason why by contacting GoDARTS at GoDARTS@dundee.ac.uk. If an individual chooses to withdraw their consent, the request is sent to the data manager and the flag associated with their details is removed from their records which means their records will no longer appear in future data searches. The blood sample associated with that individual will be destroyed. Note, it is not possible to withdraw consent for projects which have finished or have already processed personal data as it is not possible to identify a specific individual’s data.

If you have any concerns about the content of this privacy statement or would just like more information please contact us at GoDARTS@dundee.ac.uk.