This privacy notice was last updated on 3 August 2022.
Personal data is data that relates to you, and which can be used to identify you, either by itself or by combining it with other data. This privacy notice explains how Akrivia Health processes personal data. Where we refer to “Akrivia”, “we”, “our”, or “us”, we are referring to Akrivia Health.
This privacy notice relates to data that we process in relation to the National Centre for Mental Health (NCMH). NCMH is a Welsh Government funded Research Centre, led by Cardiff, Swansea and Bangor Universities. It is being funded by Health and Care Research Wales, Welsh Government.
Who are the data controllers?
Akrivia Health and Cardiff University are joint data controllers. This is a legal term that means that both organisations have worked together to decide what data should be collected and how it should be used.
In the case of joint controllers, the law allows the organisations to decide a point of contract for individuals to make it easier for them to exercise their rights. In this case, this will be Cardiff University. For further information, please refer to the participant information sheet which has been provided to you. Alternatively, you can contact the research team using the following details:
National Centre for Mental Health
Cardiff University
Hadyn Ellis Building,
Maindy Road, Cathays,
Cardiff
CF24 4HQ
Phone 029 20688401 Fax 029 20687100
Email info@ncmh.info
You can also contact the ICO for further information or to make a complaint:
Data Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Email ICO
Report a concern on the ICO website
What data do you collect & use?
We collect and use data about you for the purposes of research. The primary source of information is a short questionnaire that is collected during the course of the study, and blood samples that are taken at the same time. This data includes:
- Demographic data that identifies you, basic details such us name, gender, date of birth.
- Data relating to your health, including medical history, symptoms, and diagnosis.
- Genomic information (which is derived from biological samples.)
How do you use the data you collect?
We use personal data for the purposes of research in mental health and dementias. This is part of a study which has been approved by a Research Ethics Committee (REC). The information will enable researchers to better understand mental health conditions and the relationship between mental and physical health. Akrivia process a pseudonymised version of data and anonymise. To protect the integrity of the anonymisation, this data will only be viewed in a secure environment and only statistical information can be exported.
How do you comply with the law?
Data protection law requires organisations to have a legal basis for processing personal data. We rely on a legitimate interest to process this data. Akrivia Health’s purpose is to increase the pace of change in mental health research by providing a richer understanding of individual’s health. Processing this data will help Akrivia further mental health research. This is of benefit to the public by enabling research into treatments for individual patients, as well as by decreasing the cost of public spending on mental health as a consequence of providing effective treatments. Akrivia have conducted an in-depth legitimate interest assessment (LIA) which is available on request.
Who else is involved?
Akrivia Health work in partnership with Cardiff University as data controllers this means we have worked together to decide what data should be collected and how it should be used.
Akrivia Health and Cardiff use several data processors, these are organisations who are contracted to process personal data on behalf of Akrivia and cannot use the data in any other way. We try to ensure that as little data is processed as necessary at every step. Where possible we use an ID called a pseudonym which means that other data is required to relate this to an individual.
|
Organisation. |
Purpose |
Categories of data processed |
|
Smart Survey (Data processor) |
Smart Survey is a secure online survey tool with offline capability. It is accredited with ISO27001, submits evidence for the NHS DSPT. Data is stored by Smart Survey in their UK data centre for a short time before being downloaded by Cardiff.
|
• Demographic data. • Health data. |
|
Amazon Web Services (AWS) (Data Processor) |
AWS is used by Akrivia Health for storing data, and for providing secure access to data.
|
De-identified and anonymised health data. |
|
UK Biocentre (Data Processor) |
UK Biocentre are the secure storage facility where biological samples are stored. |
Sample ID. |
|
Phlebotomy Service (Data Processor) |
Will obtain blood samples from individuals |
Demographic data. |
|
Genomic Sequencer (Data Processor) |
Will sequence DNA. |
Pseudonym. |
|
Research Organisation (Data Controller) |
Will analyse biomarker samples. |
Pseudonym. |
Authorised researchers will be able to access anonymised data within a secure environment. To protect the integrity of the anonymisation, this data will only be viewed in a secure environment from which only statistical information can be exported.
How long is data kept for?
Personal data is retained for 15 years. Anonymised data will be retained indefinitely.
Is any data transferred outside the UK?
Akrivia does not process data outside the UK.
Your rights
Access to personal data
You have a right to request a copy of the personal data that we hold about you. You should include adequate data to identify yourself and such other relevant data that will reasonably assist us in fulfilling your request. Your request will be dealt with as soon as possible.
Right to rectification (correction)
You can request us to rectify and correct any personal data that we are processing about you which is incorrect.
Right of erasure (right to be forgotten)
You can request us to erase your personal data under certain circumstances, it is not a guaranteed or absolute right.
Right to data portability
This right allows you to obtain your personal data in an electronic format, where you have provided data to us with your consent, or where the data was necessary for us to provide you with our services or employment. You can request that the data be given in a format which enables you to transfer that personal data to another organisation. You may have the right to have your personal data transferred by us directly to the other organisation, if this is technically feasible.
Right to restrict processing of personal data
You have the right in certain circumstances to request that we suspend our processing of any or all your personal data. Where we suspend our processing of your personal data we will still be permitted to store your personal data, but any other processing of this data will require your consent, subject to certain exemptions.
Right to object to processing of personal data
You have the right to object to our use of your personal data which is used where we feel that we have legitimate interest. However, we may continue to process your personal data, despite your objection, where there are compelling legitimate grounds to do so or we need to process your personal data in connection with any legal claims.