Privacy Notice: ASCEND

The University of Oxford, as sponsor, is the data controller. This means that we, as the University of Oxford researchers, are responsible for looking after your information and using it properly.

Information about people taking part in ASCEND comes mainly from the questionnaires that you completed on a regular basis during the trial. In addition, we may receive information from your GP or your hospital records about serious illnesses such as heart attacks, cancers or severe bleeding episodes.

We also receive information from health registries and NHS bodies, such as NHS Digital, which hold national health and social care records. We provide your details (name, date of birth, NHS number or CHI number in Scotland, and postcode) to health registries in order to receive information about study participants in return. This includes hospital attendance and admissions, and in future will include data on mental health, primary care (data from GPs), diabetes audits, and prescriptions. Similar information is requested from Public Health Scotland and the NHS Central Register (NHSCR) about Scottish patients, and from Digital Health and Care Wales (DHCW) (previously NHS Wales Informatics Service) for patients in Wales. In addition, NHS Digital provides us with information relating to cancer registrations on behalf of Public Health England (PHE).

NHS Digital, or similar bodies in Scotland and Wales, also provide us with information about people who may have passed away, which includes date and cause of death. This is supplied on behalf of the Office for National Statistics (ONS) and is sourced from civil registration data. Finally, we obtain information about your eye health from the NHS Diabetic Eye Screening Programme (DESP). The processing of health registry data enables accurate coding of the medical events experienced by study participants, ensuring that high quality information is available for analysis. 

We are using your data during the long-term follow-up phase of the ASCEND study to assess whether the balance of benefits versus hazards of aspirin observed within the first phase of the trial, relating to major vascular events such as heart attack or stroke, continue long term or whether additional benefits emerge during longer-term follow-up. We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason that is compatible with the original purpose. We do not use your personal data for any form of automated decision-making or public profiling, and we will not use your data for any unrelated purposes.

As a publicly funded organisation, we have to ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research.

The legal basis for the processing and storage of your personal data for ASCEND and its sub-studies is that it is ‘a task in the public interest’ (Article 6(1)(e) UK General Data Protection Regulation (UK GDPR)). In addition, a required condition under the UK GDPR to process your special category (sensitive) personal data is met as it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)(j) UK GDPR).

This means that when you agree to take part in a research study, we will use your data (including your health data) in the ways needed to conduct and analyse the research study. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. To ensure we carry out the research to the highest standards we comply with the Clinical Trials Regulation 536/2014 and the UK Policy Framework for Health and Social Care Research.

The Sponsor will retain your personal data for at least 25 years after the end of the study (when the last piece of health data is collected about study participants, which will be many years after everyone stops the study medications), in line with Good Clinical Practice (GCP) and relevant legislation. Because the study is continuing after the initial treatment phase to assess the long-term effects of the treatments, your direct identifiers will be stored until at least 2037 and your other personal data may be stored for a longer period. At the end of the retention period, your personal data will either be deleted or rendered anonymous (non-identifiable).

We may need to retain your personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements. We may also retain personal data for further research for which a legal basis exists, but this will always be done in accordance with data protection laws.

General information about how long different types of information are retained by the University can be found in the University’s Policy on the Management of Research Data and Records.

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption, and destruction.

We use technical measures such as encryption and password protection to protect your data and the systems in which they are held, and the information that we receive is stored securely in a study database. Access to the study database is by unique combinations of usernames and passwords and only authorised study personnel can access information about participants. The University building is also secure with authorised swipe card access only.

We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held. And whenever possible, your personal identifiers (name, date of birth, NHS number and address) will be removed and replaced by a unique trial ID number. Your data is treated in the strictest confidence and is used solely for academic research purposes. Importantly, no individuals will be identified in any publications arising from this work.

We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice.

Any personal data that identifies you are collected and managed by the ASCEND team at the Clinical Trial Service Unit (a part of the Nuffield Department of Population Health (NDPH)) and will not be shared with anyone else, except to obtain health information about you from the health registries as described.

At the end of the trial, anonymized data (from which you cannot be identified) may be shared with other research groups who are doing similar research. This information will not identify you and will not be combined with other information in a way that could identify you. The information will only be used for the purpose of health and care research, and cannot be used to contact you or to affect your care. It will not be used to make decisions about future services available to you, such as insurance.

On your final follow-up questionnaire, we asked if you would be willing to be invited to take part in future research studies coordinated by the Clinical Trial Service Unit, NDPH, at the University of Oxford. All such invitations will come from the NDPH and your details will not be passed to any third parties.

Your data is securely stored on our secure computers and/or at our premises within the UK, and your identifiable data will not be transferred outside of the EEA.

As part of our ongoing research, however, we may send samples – collected from participants during the main trial – to laboratories outside the UK for analysis. Such analyses will be governed by a collaborative contract between the laboratory and the University of Oxford. Any such samples will be sent with a pseudonymised identifier and any analyses results will be transferred using secure methods.

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights in relation to the information that we hold about you (your ‘personal data’):

• The right to request access to your data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.
• The right to request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• The right to request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
• The right to object to the processing of your data, where we are processing it to meet our public tasks or legitimate interests (or the legitimate interests of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your data for direct marketing purposes.
• The right to request that the processing of your data is restricted. This enables you to ask us to suspend the processing of your data, for example, if you want us to establish its accuracy or the reason for processing it.
• The right to access, change or move your data. Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.

If you wish to exercise any of these rights, please contact the trial at ascend@ndph.ox.ac.uk.

If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. For further information, visit the University's Compliance pages.

If you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer (data.protection@admin.ox.ac.uk), who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO) by visiting their website at https://ico.org.uk/make-a-complaint/ or by calling their helpline on 0303 123 1113.

It helps ASCEND produce reliable results if we are able to follow up with as many participants as possible by accessing their electronic NHS records. If you decide you do not want your study data to be linked in this way you can withdraw without affecting your current medical care. This can be done by contacting the study team who will require identification in order to inform NHS Digital and other data sources that you no longer wish to be included. You are free to do this at any time and do not have to give us a reason. If you have any questions, please contact the study team using the following details:

You can download the ASCEND Privacy Notice as a PDF.