Privacy Notice: ASCEND

The Data Controller and the Sponsoring organisation for ASCEND is the University of Oxford. This means that we, as the University of Oxford researchers, are responsible for looking after your information and using it properly in accordance with the UK General Data Protection Regulation (UK GDPR).

Personal information about people taking part in ASCEND comes mainly from the questionnaires that you completed on a regular basis during the trial (between 2005 and 2017). We may receive information from your GP or your hospital records about serious illnesses such as heart attacks, cancers or severe bleeding episodes. 

We also receive information from NHS health registries such as NHS England which hold national health and social care records. We provide your details (name, date of birth, NHS number or CHI number in Scotland, gender and postcode) to NHS health registries in order to receive information about study participants in return. From NHS England we receive information about: 

• Hospital attendance and admissions
• Dates and causes of death
• Cancers
• Diabetes
• Diagnostic imaging
• Prescriptions
• Eye health

Similar information is requested from Public Health Scotland and the NHS Central Register (NHSCR) about Scottish patients, and from Digital Health and Care Wales (DHCW), and SAIL (the Secure Anonymised Information Linkage databank) for patients in Wales. 

Finally, we obtain information about your eye health from the NHS Diabetic Eye Screening Programme (DESP). 

The processing of health registry data enables accurate coding of the medical events experienced by study participants, ensuring that high quality information is available for analysis. 

We are using your data for the long-term follow-up phase of the ASCEND study to assess whether the benefits or harms of aspirin seen within the first phase of the trial, continue long term or whether additional benefits or harms (of aspirin or omega-3) emerge during longer-term follow-up. This will include assessing the occurrence of major vascular events (such as heart attack or stroke) and cancers.

We may use information collected about ASCEND participants to help with identifying specific outcomes within NHS Registry data. This could include improving how we identify certain cardiovascular events such as heart attacks and heart failure, or major bleeds. While some of this work will be directly related to the ASCEND trial, it will also be relevant to current and future trials (at the University of Oxford) that rely largely on routine healthcare data provided by NHS Registries to collect information about participants.

We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason that is compatible with the original purpose.

We do not use your personal data for any form of automated decision-making or public profiling, and we will not use your data for any unrelated purposes.

As a publicly funded organisation, we have to ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research. 

The legal basis for the processing and storage of your personal data for ASCEND and its sub-studies is that it is ‘a task in the public interest’ (Article 6(1)(e) UK General Data Protection Regulation (UK GDPR)). In addition, a required condition under the UK GDPR to process your special category (sensitive) personal data is met as it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)(j) UK GDPR). 

This means that when you agree to take part in a research study, we will use your data (including your health data) in the ways needed to conduct and analyse the research study. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. To ensure we carry out the research to the highest standards we comply with the Clinical Trials Regulation 536/2014 and the UK Policy Framework for Health and Social Care Research.

The Sponsor will retain your personal data for at least 25 years after the end of the study (when the last piece of health data is collected about study participants, which will be many years after everyone stops the study medications), in line with Good Clinical Practice (GCP) and relevant legislation. The treatment phase ended in 2017. We intend to collect linkage data for 20-years after this. Because the study is continuing after the initial treatment phase to assess the long-term effects of the treatments, your direct identifiers will be stored until at least 2037 and your other personal data may be stored for a longer period (typically 25-years in-line with Clinical Trials Regulations). At the end of the retention period, your personal data will either be deleted or pseudonymised. The need to retain your data will be reviewed regularly. 

We may need to retain your personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements. We may also retain personal data for further research for which a legal basis exists, but this will always be done in accordance with data protection laws. Article 5(1)(e) allows the University to store personal data for a longer period than necessary for the purposes for which it is procured, where the processing is solely for research purposes. 

General information about how long different types of information are retained by the University can be found in the University’s Policy on the Management of Research Data and Records, available at https://researchdata.ox.ac.uk/university-of-oxford-policy-on-the-management-of-data-supporting-research-outputs/.

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption, and destruction. 

We use technical measures such as encryption and password protection to protect your data and the systems in which they are held, and the information that we receive is stored securely in a study database. Access to the study database is by unique combinations of usernames and passwords and only authorised study personnel can access information about participants. The University building is also secure with authorised swipe card access only. 

We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held. And whenever possible, your personal identifiers (name, date of birth, NHS number (or CHI number in Scotland) and address) will be removed and replaced by a unique trial ID number. Your data is treated in the strictest confidence and is used solely for academic research purposes. Importantly, no individuals will be identified in any publications arising from this work. 

We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice.

Any personal data that identifies you are collected and managed by the ASCEND team at the University of Oxford and will not be shared with anyone else, except to obtain health information about you from the health registries as described. 

At the end of the trial (when we have stopped collecting new data and reported our results), de-identified data (from which you cannot be identified) may be shared with other research groups who are doing similar research. This information will not identify you and will not be combined with other information in a way that could identify you. The information will only be used for the purpose of health and care research, and cannot be used to contact you or to affect your care. It will not be used to make decisions about future services available to you, such as insurance. 

On your final follow-up questionnaire, we asked if you would be willing to be invited to take part in future research studies coordinated by the Clinical Trial Service Unit, NDPH, at the University of Oxford. All such invitations will come from the NDPH and your details will not be passed to any third parties.

Your data is securely stored at our premises within the UK, and your identifiable data will not be transferred outside of the EEA. 

As part of our ongoing research, however, we may send samples – collected from participants during the main trial – to laboratories outside the UK for analysis. Such analyses will be governed by a collaborative contract between the laboratory and the University of Oxford. Any such samples will be sent with a pseudonymised identifier and any analyses results will be transferred using secure methods.

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights in relation to the information that we hold about you (your ‘personal data’): 

• The right to request access to your data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.
• The right to request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• The right to request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
• The right to object to the processing of your data. This enables you to oppose our using your data where we are processing it to meet our public tasks or legitimate interests (or the legitimate interests of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your data for direct marketing purposes.
• The right to request that the processing of your data is restricted. This enables you to ask us to suspend the processing of your data, for example, if you want us to establish its accuracy or the reason for processing it.
• The right to access, change or move your data. Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.

If you wish to exercise any of these rights, please contact the trial at ascend@ndph.ox.ac.uk.

If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. For further information, see: https://compliance.admin.ox.ac.uk/individual-rights.

We reserve the right to update this privacy notice at any time. Updated versions will be provided on the ASCEND website. Note: the original website (as provided on the study documents you were given during the trial) was www.ctsu.ox.ac.uk/ascend. This address still works and will redirect to the current website location which is: https://ascend.medsci.ox.ac.uk/.

If you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer (data.protection@admin.ox.ac.uk), who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO) by visiting their website at https://ico.org.uk/make-a-complaint/ or by calling their helpline on 0303 123 1113.

If you wish to raise any queries or concerns please e-mail us at ascend@ndph.ox.ac.uk or write to:

Professor Jane Armitage, ASCEND, Clinical Trial Service Unit, Nuffield Department of Population Health, Richard Doll Building, University of Oxford, Old Road Campus, Oxford OX3 7LF. 

You can also phone: 0800 585 323

You can download the ASCEND Privacy Notice as a PDF.