Privacy notice for the EASi-KIDNEY trial participants
The University of Oxford is a world-leader in developing systems to ensure that information is stored safely for studies like the EASi-KIDNEYTM study. Information held about participants is only used for medical research purposes and for routine regulatory and audit purposes.
What happens to participant information?
There are an increasing number of data protection regulations that we are required to follow. These laws require us to disclose participant rights and how we will use participant data.
There are two parties involved in this study who will be responsible for deciding how any personal data collected during this study are processed and will ensure data protection laws are followed (i.e. they will be the “Data Controllers”). These parties are (1) the University of Oxford, whose full legal name is “The Chancellor, Masters and Scholars of the University of Oxford”, and (2) Boehringer Ingelheim International GmbH (the drug company who make empagliflozin and vicadrostat, also known as BI 690517). Both parties are bound by a duty of confidentiality. In an exception to this, only for data that Oxford receives from NHS England, the University of Oxford will be sole Data Controller.
Where the University of Oxford is using information for research purposes, it will only process personal data as necessary for the performance of such research being carried out in the public interest. This is known under data protection law as our “legal basis” for processing personal data (UK General Data Protection Regulation (GDPR) Article 6(1)(e) and Article 9(2) (j)).
In this study personal data that directly identifies participants such as name, address, or date of birth (so-called personal identifiers) can be accessed by the EASi-KIDNEYTM doctors and nurses who are running the study at local hospitals. Health regulators (such as the UK Medicine and Healthcare Regulatory Agency and U.S. Food and Drug Administration) and auditors from Boehringer Ingelheim could also access these data if they were to ever perform an audit by visit to your local hospital or "virtually" (e.g. due to Covid-19 travel restrictions) to check that the study is being carried out properly. These people are also all bound by a duty of confidentiality.
During the study, a member of the University of Oxford or other EASi-KIDNEYTM staff may ask permission to be present during a participant clinic appointment. This helps us ensure study procedures are being followed.
In the UK, name, date of birth, sex, NHS number (or CHI number in Scotland and H&C number in Northern Ireland) and postcode will also be stored securely by the University of Oxford to link participants with data held by NHS England (or other central NHS bodies or the UK renal registry). Oxford University will not send these personal identifiers to anyone else (including Boehringer Ingelheim).
To help keep information confidential, information recorded about participants in this study as well as any samples collected are “de-identified”. De-identified means that health information and blood/urine samples are labelled with unique numbers linked inside a computer and not by your name.
As already explained above, it would be very difficult for anyone to re-identify participants after de-identification as we use special measures to protect data, but it remains theoretically possible.
The “de-identified” data in this study are to be used for the following purposes: analysis of the study results, to help learn more about how the study treatment works in the body, to do future research, to write scientific articles on kidney diseases and associated health problems, and to help design and conduct future studies.
Oxford will provide Boehringer Ingelheim with a copy of the study database containing de-identified data only. It may be necessary for copies of the de-identified database to be shared with health regulators and ethics committees, and it may be shared with other bona fide researchers.
Oxford and Boehringer Ingelheim (including Boehringer Ingelheim Group of Companies) may process and combine data from this study with data from other sources (always using appropriate safeguards) and may carry out these activities alone or in collaboration with public or commercial private partnerships (i.e. third parties) in the areas of research described above.
The University of Oxford will safely keep the study data and Boehringer Ingelheim will safely keep the copy of the de-identified database for at least 25 years after the end of the study, and perhaps longer if required by the law or other research needs. These data will be securely destroyed once no longer required.
How is information about participants collected?
During participation in the study, individuals will provide personal data about themselves, such as information on medical conditions and medical history, to the study nurses/doctors at study visits (and relevant blood and urine test results held at local hospitals). We will also record and store your contact details, such as your email address, to communicate with you about the EASi-KIDNEYTM trial and we will ask you if these contact details can be used after the study has ended to ask you updated information about your health and to invite you to future studies. These data will be entered into a computer system managed by the University of Oxford and stored securely.
The University of Oxford is a world-leader in developing systems to ensure that information is stored safely for studies such as EASi-KIDNEYTM. Only staff with appropriate training and permission can access this computer system.
In addition, for participants based in the UK, the coordinating centre in Oxford will ask for information about participant health from participants' doctors, registries (e.g. the UK Renal Registry), NHS England (or other central NHS bodies) and the NHS Diabetic Eye Screening Programme (if you have diabetes). The EASi-KIDNEYTM team send your name, date of birth, NHS number (or CHI number in Scotland and H&C number in Northern Ireland) and postcode to NHS England (or other central NHS body) who can link this information to individual participants in the study. NHS England and other central NHS bodies together provide information about admissions to hospital (called Hospital Episode Statistics) and about people who have died. Having this information will help the study team minimise contact and cause any distress to relatives, as this information includes date and cause of death supplied on behalf of the Office for National Statistics. Similar information will be requested from the relevant bodies for participants living in Scotland. Participants outside of the UK should ask their local study nurse/doctor if they require more information and local teams can clarify this with their Regional Coordinating Centre according to regional legislation.
Data protection rights for participants
If a participant stops taking the study pills and does not wish to have further blood samples to be collected at their study clinic, we would like to keep in touch by phone. However, you can also decline to be contacted again. In this case, we would like to continue to follow how you are getting on by contacting your local doctor or through national registries or other publically available sources of data.
If you decide you do not want any new information about you to be collected and used for the study (known as “withdrawal of consent”), we will ask you or your local clinical team to sign a form and will not collect any further information from you. All information collected, including analysis results from blood and urine samples that have been already collected, will still be kept and used for the study.
If you have previously given consent for us to use leftover blood and urine samples and related information which had been collected in the study, you may also separately withdraw your permission for this optional part of the study at any point in time, without affecting your participation in the main part of the study. Any samples that you no longer wish for us to store or use will be destroyed.
You have the right to know what personal data the University of Oxford and Boehringer Ingelheim hold about you and to have a copy of that data. Your local study nurse/doctor could provide this, however, to ensure the study’s scientific integrity, participants may not be able to review such data until after the study has been completed.
You also have the right to correct wrong or outdated personal data and request the deletion of your data. However, the study site and Boehringer Ingelheim (as the study’s sponsor) may be obliged by law to keep data to ensure consistency and reproducibility of the results and we cannot delete data that has already been used in analyses (note that analyses are run regularly throughout the study).
You also have the right to restrict or object to what we do with your data, or to request that your data be transferred elsewhere. However, sometimes the Data Controllers may not be able to (or have grounds not to) follow a request, for example, if we consider that deleting data would seriously harm the research. If you would like to exercise any of these rights, please contact us. The data protection officer for the University of Oxford can be contacted by email.
If you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. You also have the right to complain to the Information Commissioner’s Office (ICO).
Contact Us
EASi-KIDNEYTM, Clinical Trial Service Unit and Epidemiological Services Unit, Oxford Population Health, Richard Doll Building, University of Oxford, Roosevelt Drive, Oxford, OX3 7LF, UK.
Phone: 0808 164 4060 (Freephone within the UK) or +44 (0)1865 743868 (outside the UK)