Information you need to know:

The University of Leicester's Department of Respiratory Sciences is leading the UK Research Study into Ethnicity and COVID-19 Outcomes in Healthcare Workers (UK-REACH). Our research team is carrying out a sub-study called the DIRECT study.

The University of Leicester is the Data Controller (the University) for your information collected for the purpose of the DIRECT study. Further information about the University can be found here: https://le.ac.uk/ .

The University’s Data Protection Officer is: Elisabeth Taoudi, Data Protection Officer and Commercial Lawyer, University Of Leicester, University Road, Leicester, LE1 7RH. Tel: 0116 229 7640. Email: et177@leicester.ac.uk. 

This privacy notice explains what information we are collecting, how we will use this information in the DIRECT study and what rights participants have in relation to their information.

What information are we collecting or using?

In the DIRECT study, we are collecting information from you because you are:

• Are aged 16 and over; and
• Live and work in the UK; and
• Are a healthcare worker or work in a healthcare setting in Leicester or the surrounding area (even if you do not look after patients directly)

We will only collect and use your information if you have voluntarily agreed to participate in this study and have completed a participant consent form in accordance with ethical requirements and to meet legal obligations relating to confidentiality.

The information we will collect directly from you when you register and in the form of a baseline and other questionnaires for the DIRECT study includes:

• Your name, and contact information including telephone/mobile numbers and email address and date of birth;
• Special category information concerning your ethnicity, your possible exposure to COVID-19 and whether you have been vaccinated against it, together with information concerning other aspects your physical health;
• Other background information including your occupation, working life, home environment, and living circumstances.

We will also collect, receive and use the following special category information provided by you, the University Hospitals of Leicester NHS Trust (UHL), the NHS and other partners:

• your routine NHS and GP records
• COVID-19 records from your occupational health records
• blood samples collected from you by our trained research staff and the results from tests carried out by laboratories (including DNA analysis) .
• any COVID-19 related records including positive tests, treatment and vaccines.

We will also:

• Ask you to complete further short (2-3 minute) questionnaires on a monthly basis over the next 6 months when we will ask about COVID-19 symptoms, testing and vaccination.
• 6 months after your first blood tests, we will ask you to provide further blood samples for testing which will tell us how your immune responses have changed over time.

If you agree we will also:

• Contact you in the future to invite you to take part in additional studies.

This DIRECT study is a ‘Long-COVID’ Public Health study taking place over 25 years. Therefore, even if you later decide to withdraw, , we will continue to follow your health by extracting information from your NHS routine health care records, and any COVID-19 related records. This will ensure we make the best use of the time, information and samples provided by all those participating in this study.

Why are we collecting your information for this Research Study?

COVID-19 is a new disease, and the main purpose of the UK-REACH research study is to identify and to understand if, how, and why, ethnicity affects clinical outcomes from COVID-19 in healthcare workers.

Previous research has found that healthcare workers and those from ethnic minority groups are at high risk of COVID-19 infection and may be at higher risk of severe disease than their white colleagues. We know that immune responses are key to the outcome of COVID-19 infection and vaccination.

The DIRECT study aims to determine whether there are differences in immune responses to COVID-19 infection and vaccination between ethnic groups in order to understand whether these differences may contribute to the observed differences in infection risk and COVID-19 outcomes in different ethnic groups.

We will specifically study healthcare workers and people who work in healthcare settings (including those who do not work directly with patients) so that we can understand:

• If, how, and why, ethnicity affects the immune response to COVID-19 infection and vaccination in those working in healthcare settings and to study any changes over a period of 2 years.

• Our additional purpose is also to carry out this research about healthcare workers over a long period so that this can be used to answer further research questions quickly to help improve outcomes for healthcare workers in the long term. This is the reason why we need to continue to collect data about your health by extracting information from your past and future NHS routine health care records for the 25-year life of this study.

How we will use your information?

We will use your information to enable us to answer the research questions we have set out above, to allow secure linkage of the questionnaire data to your healthcare records and COVID-19 related outcomes in your occupational health record for blood testing and for future contact by the team.

We will use your information in a way that protects your identity as follows:

• Data managers from the University will separate out the personal identifiable information you supply (e.g., your name and contact information) from the questionnaire/s you complete and store these securely in separate places. Your questionnaire information will be identified only by a unique code called your ‘Study ID Number’.
• A very small number of the research team will have access to your name and contact details, so that we can re-contact you to arrange a follow up appointment, for further questionnaires or for other aspects of the study.
• Your personal identifiable information will be sent securely by the UHL to NHS data providers such as NHS Digital where it will be used to allow secure linkage with your NHS routine healthcare and COVID-19 related outcomes in your medical and occupational health records.
• Once your records have been located by the NHS all identifiable information is removed (name, date of birth, address, NHS number) and these de-identified healthcare records are attached to unique codes and are then transferred securely back to the UHL.
• Linkage to COVID-19 related outcomes (absences, swab test results, antibody results) in your occupational health record will be performed by a member of the occupational health department at UHL (not by researchers), and is strictly limited to information about COVID-19.
• Blood samples sent to the external laboratories for testing will be identified only by your Study ID Number.
• The linked DIRECT study dataset will be held at UHL within the NHS N3 safe network – this will not include any personal identifiable information just your DIRECT study ID.
• Access to the study research data held at UHL by other bona fide researchers will be subject to approval from the UK REACH Core Management and Steering Committees .These researchers will only have access to anonymised information.
• Only anonymised research analysis and outcome reports for the DIRECT study that have been checked will be allowed to leave the UHL secure NHS N3 Network.
• We will not share any information about your health, or any other information you have given us, with your employer or professional body.
• In the future the linked DIRECT study information held by UHL may be transferred to and linked with other UK-REACH data where it will be securely stored in the Data Safe Haven managed by Swansea University(SAIL)

The University and the UHL both have technical and organisational measures in place to ensure that your data is securely stored, or transferred as appropriate and will only be used for the purposes of this research.

We will not be using the data to record, learn or decide something about you.

Due to the nature of the study, there will be “profiling” of information including demographics, those who have medical conditions including COVID-19 outcomes and all participants who are in specific ‘at-risk’ groups.  This will allow us to be more precise in the way we study the impact of ethnicity on how the immune system responds to COVID-19 and vaccinations in healthcare workers.

The DIRECT study does not involve automated decision-making.

What is the legal basis for processing your information?

The legal basis for processing your information in this DIRECT study is Public Task as set out in the Data Protection Act 2018 and the UK GDPR Article 6.1(e). Research is a public task that the University of Leicester performs in the public interest, and is part of its core functions as a University.

Our additional legal bases for processing your special category information are that:

1. processing is ‘necessary for reasons of public interest in the area of public health’, specifically relating to COVID-19, as set out in the Data Protection Act 2018 and UK GDPR Article 9.2(i); or
2. processing is necessary for ‘scientific research or statistical purposes’ in accordance with Article 89(1) as set out in the Data Protection Act 2018 and UK GDPR Article 9.2(j)

If we are sharing your information with others, who are we sharing it with?

The DIRECT sub-study involves delivery partners such as the UHL and other information processors such as laboratories. The following is a list of the organisations we are sharing your information with, but is not an exhaustive list of all those who we may need to involve over the 25-year lifetime of the study:

• Staff employed by the University of Leicester who are not part of the research team on a ‘need to know’ basis
• University Hospitals of Leicester NHS Trust who are acting as Data Processor to provide the main data centre facilities for the duration of the study
• NHS data providers (including NHS digital) for linkage to your health records
• Bona Fide researchers outside the DIRECT team who successfully apply to the UK REACH Core Management and Steering Committee. This could include researchers in other countries and commercial research companies.
• We may be required to disclose participant information to regulatory authorities, auditors and public health agencies.
• Only anonymised and summarised data will be included in our research reports for this study so no one will be able to tell that you participated in the DIRECT study.
• We may be required to transfer the DIRECT study linked information to a secure long-term data storage centre based at Swansea University (SAIL) where it can be combined with the main UK-REACH information.

We are also required to provide progress reports and summarised research information to our grant funders and the Department of Health and Social Care but this will not include any information about individual participants.

We will only share with all these parties the minimum information that is necessary for them to undertake the task they are performing. We will not share information that identifies participants such as their name and contact information with people who do not need to know this.

Anonymised information means that a person is no longer identifiable from the information and it is not personal information for the purposes of Data Protection Legislation.

How long we will process your information for?

The DIRECT study is part of the UK-REACH study, and we will store the anonymous research data and any research documents with personal information, such as consent forms, securely at the University for 6 years after the 25-year study ends.

For other information held by the University as out below, unless otherwise stated, all the data held for this study will be deleted after 25 years.

• The information you supplied in the questionnaires held by the University will be transferred to our Research File store at the end of the initial 6-month
• If you have given us permission, we will retain your contact information, otherwise we will delete it if you withdraw from the research or after 25 years whichever is the sooner.

Storage and future use of samples

• If you have given your permission we will keep any remaining samples (in their pseudonymised form) beyond the 25 years for use in future ethically approved research.
• If you give us permission to retain your samples for future research, it is necessary to retain your consent form until the samples have been depleted or destroyed, or if you withdraw your permission. This may be longer than the 25 year life of the study +6 years.
• The Human Tissue Authority is the regulatory authority responsible for the oversight and inspections of human tissue storage in the UK after a study has concluded. We require your consent form to comply with the Human Tissue Authority to ensure we have obtained your permission to retain the samples beyond the life of this project. Your consent form would be stored independently from your pseudonymised samples to ensure your samples remain anonymous to researchers that may use them in the future.
• If your samples are used up within this period your consent form and personal information will be destroyed 6 years after the study ends.

What are your rights and how to enforce them?

Under Data Protection legislation, individuals normally have rights in relation to the personal information we hold about them. For the purposes of research, where such individual rights would seriously impair research outcomes, such rights are limited.

In respect of the DIRECT study, we need to limit your rights and are relying on the exemptions in Schedule 2 Part 6 paragraph 27 of the Data Protection Act 2018 because we are processing this information for scientific research in accordance with UK GDPR Art. 89(1) and Approved Medical Research covered by s19 Data Protection Act 2018.

Prior to applying these exemptions, we have carried out a Data Protection Impact Assessment and taken into account:

• That this public health and scientific research is long term (25 years) and is of national significance because it relates to COVID-19, a new disease classed as a pandemic because it has affected people in many countries;
• That the results of our research will only be published in an anonymised or summarised basis;
• We have taken appropriate measures to safeguard participant information we collect or receive and to protect the rights and freedoms of the patients whose information we will be using in our research by use of third parties who will remove the identifiable personal information from the linked data sets;
• We and our partners are under an obligation to maintain confidentiality in our handling of identifiable and pseudonymised participants’ information;
• We are making information about our research and use of their information available to participants and the public through this privacy notice which is available on the UK-REACH DIRECT Study website and the University’s main website.

We have concluded that the exercise of subject rights by participants would seriously impair the achievement of the DIRECT Study objectives and the exemptions are necessary to enable us to fulfil our scientific research purposes in the public interest.

How will this affect the rights of participants?

Whilst participants involved in this research may withdraw from the study at any time they will not be able to exercise their rights to access their personal information, to request correction of inaccurate information or erasure of their information, to restrict processing of information or to object to our processing of their information even if they leave the study. UK GDPR Articles 15,16,17,18 and 21 will not apply.

If you withdraw from the DIRECT sub-study at any stage, we will keep the information we have already obtained but, to safeguard your rights, we will use the minimum personally identifiable information possible.

What right do you have to complain to the Information Commissioner’s Office?

If you wish to ask questions about our use of this data or your rights, you may contact Information Assurance Services by email at ias@leicester.ac.uk or the University’s Data Protection Officer by email at et177@leicester.ac.uk.

Anyone can raise concerns about how their information has been processed with the Information Commissioner’s Office (ICO).

The ICO may be contacted:

By post addressed to: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

By telephone: 0303 123 1113.

By email: www.ico.org.uk

IAS/v1/01/03/21