Participant Privacy Information
Introduction
The purpose of this Privacy Notice is to explain to “you” - participants in the Airwave Health Monitoring Study Tissue Bank (“Study”) - how “we” - Imperial College London (“The College”) - collects, shares, and uses personal information about you. We are required to provide the information set out below in accordance with the UK / EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
Purpose of the Study
The purposes of the Study are to conduct long-term epidemiological research into diseases affecting current and former members of the Police Service in Great Britain. We are interested in cancers affecting Participants as well as other common diseases. We continue to maintain an interest in the possible association of health with the use of Airwave, the TETRA-based radio system used by the Police Service since the early-2000s.
Although the Study is not currently open to new members, we continue to follow-up the health of existing participants via the NHS, and by inviting direct participation from members in online surveys and health-screening. More detail on the purposes of the Study can be found in our protocol.
Changes To the Privacy Policy
We keep our privacy policy under regular review. This version was last updated on 17 January 2024.
The College is the sponsor for the Study, which is based in the United Kingdom. Its REC reference is 23/NW/0350 (replacing 19/NW/0054) and details can be found on the HRA website. The Study was most recently granted approval by the North West - Haydock Research Ethics Committee on 2nd January 2024.
The College will be using information from you and your medical records to undertake this Study and acts as its data controller. This means that we are responsible for looking after your information and using it properly.
Types of Data Processed
We collect personal information about you from four sources: directly from you; from your employer’s Human Resources (HR) department; through linkage to your health records; and, from the generation of secondary data. These are explained in more detail below.
At each stage of processing, we minimise the sensitivity of information processed by removing identifiers such as name; and replacing them with codes such as the 5-digit barcode you may have seen on feedback letters, or the 8-digit participant identifier used in invitations.
Data Obtained Directly from You
When you joined the Study, you provided information about yourself via an enrolment questionnaire and / or from clinical measurements taken at health-screening appointments. You may have completed a tablet-based survey (questionnaire), a food-diary, Airwave Usage diary, and various online questionnaires and cognitive tests.
To enrol in the Study, you needed to provide your name, address, date-of-birth, gender, and certain employment-specific identifiers such as collar or shoulder number. These data are retained by the Study to maintain contact with you and to identify you to other data providers, as described below.
Employer’s Human Resources Department
If you consented to sharing these data, we may have obtained information on sickness absence and changes of employment (leaving or transferring within the Police Service) from your police force’s HR department. These are necessary to understand the extent of your usage of the Airwave system, and the nature and length of any absence through sickness. From these we may ascertain whether there is any connection between the use of Airwave and any possible health effects on its users.
Linkage to your Health Records
When you joined the Study, you may have granted us consent to obtain copies of your health records held by the NHS. These provide us with regular, updated information about your health and are necessary for the Study to achieve its objectives.
If you granted consent for us to link to your NHS health records, we were advised by the NHS of your NHS number, which is used to ensure efficient and accurate linkage to your health-records. We do not share your NHS Number with any third parties.
Secondary Data
If you provided us with a sample of blood and / or urine, we would have conducted certain laboratory analyses as part of your appointment and written to you explaining the results we obtained. If you consented for us to store unused samples, these have been stored in freezers since collection and may have been subsequently used to obtain more detailed information, such as your genetic code, that may be useful to understanding susceptibility to disease.
We have conducted detailed analysis within some datasets to identify characteristics that may be used to identify susceptibility to disease; for example, whether specific heart rhythms are significant to health outcomes or not.
Retention of Data
Imperial College London will keep identifiable information about you for 30 years after the Study has completed in relation to data subject consent forms and primary research data.
Legal Basis
As a university we use personally identifiable information to conduct research to improve health, care, and services. As a publicly funded organisation, we must ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the data collected.
Our legal basis for using your information is the “performance of a task carried out in the public interest” (Article 6(1)(e) in the GDPR). Health and care research should serve the public interest, which means that we must demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.
The identifiable information we collect about you includes your name, contact details and health information, which are regarded as a special category of information. We use these to access your medical records where applicable, to maintain contact with you, and in a limited way to study the geographic distribution of certain illnesses. Because these data are a special category of personal information under GDPR, our legal basis for holding these data is that they are for scientific or historical research purposes or statistical purposes (Article 9(2)(j) in accordance with Article 89(1) in the GDPR).
Data Sharing
The College and other research institutions may conduct research using your data and samples that requires us to share your personal data with them under a data sharing agreement. Recipients of your data are under a legal obligation to keep your data secure in accordance with this privacy notice; and must not attempt to discover your identity.
There are no circumstances in which we will transfer identifiable data such as name or address outside of The College’s control without your explicit consent.
International Transfers
There may be a requirement to transfer information to countries outside the United Kingdom (for example, to a research partner, either within the European Economic Area (EEA) or to other countries outside the EEA. Where this information contains your personal data, Imperial College London will ensure that it is transferred in accordance with data protection legislation. If the data is transferred to a country which is not subject to a UK adequacy decision in respect of its data protection standards, Imperial College London will enter into a data sharing agreement with the recipient research partner that incorporates UK approved standard contractual clauses or utilise another transfer mechanism that safeguards how your personal data is processed.
Wherever possible, we will satisfy the research requirement using de-identified rather than personal data.
Access Committee
Research projects that wish to either: (i) use the Study’s data for a legitimate research project; (ii) contact you to invite you to join a new research study; or, (iii) obtain assays (laboratory measurements) from biological samples you have donated to the Study must prepare a detailed proposal which will be considered by the Study Access Committee.
The Access Committee will assess each proposal and either accept or reject it based on its assessment of:
- Whether it meets the aims and objectives of the Study as set out in its protocol.
- Whether anything proposed would be against the interests of participants.
- The proposal’s technical and operational feasibility.
All approved research is set out on our website at https://police-health.org.uk/approved-research and a summary of any results will be made available on other publicly accessible websites.
The Access Committee includes a lay member who will normally be a member of a Police Service representative body such as the Police Federation.
Identification through Data Sharing
You will never be personally identified to any researcher outside the Study team without your explicit consent. The results of any research that is published, whether by Imperial College or anyone else, will never identify you.
Neither the Home Office nor your employer will be able to access your samples or data. From time to time, we will inform you of other research studies that you might be interested in participating in. There is no obligation to take part in such studies.
Access to and Use of Data
We will hold your identifiable information securely, with strict arrangements about who can access it. The information will be used only for the purpose of health and care research, or to contact you about future opportunities to participate in research. We will not use the information to make decisions about future services available to you, such as insurance.
Research Platforms
The nature of modern research requires that data from many cohorts be used as part of a single harmonised analysis rather than as many fragmented parts. Many research questions simply cannot be answered using data from a single cohort, even one as large as the Airwave Study.
In practical terms, such multi-cohort studies require us to share certain data with a small number of very carefully chosen platforms that:
- exhibit exacting standards of governance.
- provide us with the controls that ensure our data supports only research studies that we have explicitly approved.
- maintains technical standard that provide assurance of data confidentiality that are at least as high as our own.
We currently share our data with Dementias Platform UK, whose data-processing is supported by the SAIL Databank, a world-class flagship for the robust secure storage and use of de-identified person-based data for research to improve health, well-being and services.
We also share a copy of certain genetic data with Edinburgh University to support researchers there with whom we are collaborating on a research project connected with policing in Scotland and Wales.
Operational Data Processing Services
We may transfer your data to trusted partners (companies and public-sector organisations) under a data-processing-agreement for the study to operate efficiently and reliably. The purposes for which we would transfer your data include:
- Operating health-screening services on our behalf.
- Deriving information about your health by the analysis of the data collected at the health-screen, such as interpretation of the electrocardiogram (heart-trace).
- Collection of data via online surveys, tests of cognition and questionnaires.
- Fulfil the posting of correspondence such as newsletters, health-screen feedback, and invitations to join research projects approved by the Study’s Access Committee.
- Ensuring the accuracy of analyses conducted on your biological samples – for example, we may use data such as age and gender to inform laboratories conducting metabolomic analyses on your samples.
- Linking to your NHS health records.
- Making your data available in pseudonymised form (that is, where your personal identifiers have been removed) to researchers and institutions that have been approved by the Study’s Access Committee.
Your Data Protection Rights
Pursuant to the GDPR individuals have the following rights:
Opt-out of Communications
You have the right to opt-out of communication materials that are dispatched on a periodic basis. This right can be exercised at any time by contacting us via https://police‑health.org.uk/update-your-details, by writing to us at [email protected] or by post to Airwave Health Study, Imperial College London, Norfolk Place, London, W2 1PG.
Rights of Access, Correction, Restriction and to Object
You can stop being part of the Study at any time, without giving a reason, but we will keep information about you that we already have because some research using your data may have already taken place and this cannot be undone.
If you choose to stop taking part in the Study, we would like to continue collecting information about your health from central NHS records. If you do not want this to happen, tell us and we will stop. This will not affect any healthcare or support you may be receiving separately.
We need to manage your records in specific ways for the research to be reliable. This means that we won’t be able to let you see or change the data we hold about you if this could affect the wider study or the accuracy of data collected.
If you agree to take part in this Study, you will have the option to take part in future research using your data saved from this Study.
Rights to be Forgotten, Erasure and Withdrawal
These are covered by your ability to withdraw from The Study at any time for any reason (see below).
Update Your Contact Details
Study participants can update their contact details at any time through the main participant portal here or by contacting us via the usual channels.
Withdrawal
Participants can withdraw from the Study at any time without providing a reason. Withdrawal will not affect your healthcare or legal rights.
Please note that it is NOT necessary to withdraw from the Study just because you have retired from the Police Service or have moved to a job where you don't use the Airwave system. Your continued participation is valuable to the ongoing research, and we hope you will stay with us.
Please do not hesitate to contact a member of the research team at [email protected] if you have any queries about the way we use your data or samples in the Study.
If you do decide to withdraw, there are two alternative routes, described below.
- No Further Contact: We will not contact you again. We may continue to use samples and information provided previously, and to obtain and use further information from your health records.
- No Further Access: We will not contact you again or obtain further information about you. We will de-identify the records we hold about you by erasing all personally identifying information linked to your data. Some personal identifiers stored in secure archives may remain for the lifetime of the archive but will not be used again.
You can inform the Study team of your withdrawal by downloading the form here and return the paper or scanned copy to the address shown on the form. To withdraw from further contact, click here and enter your details.
Right to Complain
If you wish to raise a complaint on how we have handled your personal data or if you want to find out more about how we use your information, please contact Imperial College London’s Data Protection Officer via email at [email protected], via telephone on 020 7594 3502, or by post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ. Before doing so, however, we ask that you raise issue with The Study directly via an email to [email protected].
If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO). ICO recommends that you seek to resolve matters with the controller (The College) before involving the regulator.
Data Security
The College stores and processes your data according to ISO 27001, the leading international standard focused on information security. Our registration is regularly examined by external auditors.
Access to your data is limited to a small group of staff specifically authorised to do so. Only a limited number of staff are allowed access to your personal identifiers. Both they and the researchers – who have access only to de-identified data – must pass regular skills checks to ensure they understand the requirements for strict confidentiality.