Privacy notice for participants in research project:
Stratifying Genomic Causes of Intellectual Disability by Mental
Health Outcomes in Childhood and Adolescence (IMAGINE-2)

1. General Information
   University College London (UCL) Great Ormond Street Institute of Child Health (GOS
   ICH) respects your privacy and is committed to protecting your personal data.
   Please read this Privacy Notice carefully – it describes why and how we collect and
   use personal data and provides information about your rights. It applies to personal
   data provided to us, both by individuals themselves or by third parties and the notice
   supplements other, wider, UCL privacy notice(s).
   UCL aims to conduct research to the highest standards of research integrity. Our
   research is underpinned by policies and procedures that ensure we comply with
   regulations and legislation that govern the conduct of research; these policies include
   data protection legislation such as the General Data Protection Regulation (GDPR)
   and the Data Protection Act 2018 (DPA).
   UCL uses personal data to conduct research to improve health, care and services. As
   a publicly funded organisation incorporated under a Royal Charter, we ensure that it
   is in the public interest when we use personal data from people who have agreed to
   take part in research. This means that when you agree to take part in a research study,
   we will use your personal data only in ways that are needed to conduct and analyse
   the research study.
   Health and care research should serve the public interest, which means that we have
   to demonstrate that our research serves the interests of society as a whole. Most of
   our health and care research follows the UK Policy Framework for Health and Social
   Care Research.
2. About our research
   UCL Great Ormond Street Institute of Child Health is one of the institutes of University
   College London which is a company incorporated by Royal Charter (number RC
   000631) and the entity that determines how and why your personal data is processed.
   This means that UCL is the ‘controller’ of your personal data for the purposes of data
   protection law.
   The IMAGINE-2 research project has a special status under data protection legislation.
   It is important therefore to specify what we mean by research. It is generally
   understood by universities that research makes an original contribution to knowledge.
   Research conducted by our staff and postgraduate research students is always
   intended to make an original contribution to knowledge. Such research is published in
   order to share that knowledge.
3. What is personal data?
   Personal data, or personal information, means any information which relates to or
   identifies an individual. This includes information we have collected that may not
   explicitly identify you (e.g. because your name has been removed) but which does
   make it possible to identify you if it is combined with other information that is readily
   available elsewhere. For example, this might be because the information available
   contains a postcode, gender and date of birth; in these circumstances it might be
   possible to identify you by using other information available elsewhere. Therefore, in
   these circumstances, we will treat the details we hold on you as personal information
   and that information will be protected as carefully as if it explicitly identified you.
   We promise to respect the confidentiality of the personal information that you, as a
   participant in our research, provide to us. We will also treat with the same respect any
   information about your child that we get from and/or share with other organisations,
   such as NHS Digital, the National Pupil Database or other university collaborators of
   this project.
   We will be clear with you when we collect your information how we intend to use it. We
   will not do anything with your personal information that you wouldn’t reasonably
   expect. We will use your information only for the purpose of the research you are
   participating in and we will not usually use your information or contact you for any
   purpose other than research unless you have agreed to this. We commit to keeping
   your personal information secure.
4. Who is responsible for my personal information?
   The IMAGINE-2 research team at UCL manages this research project and UCL will be
   the controller, which means that we will decide how your personal information is
   created, collected, used, shared, stored and deleted (processed). We will do so in line
   with the objectives of the research, ensuring we collect only what is appropriate and
   necessary, always making sure that we have informed you of what we are collecting.
   There is also an IMAGINE-2 research team at Cardiff University, and we are working
   together on this project. Cardiff University has agreements and/or contractual
   arrangements in place which document how they will share their responsibilities for
   data protection with us. The information has been detailed in the Participant
   Information Sheet we give to the participants.
5. What personal information do we use within research projects and where do
   we get it from?
   The type of personal information we collect and use for research purposes is
   determined by the objectives of the IMAGINE-2 project in which you are participating.
   We may collect personal information directly from you or from third parties. Whatever
   personal information we collect and no matter where we collect it from, it will always
   be proportionate to achieving the objectives of our research study. No automated
   decision making, including profiling, is involved.
   Personal information that we collect from you
   Where we collect personal information from you directly, a Participant Information
   Sheet and/or Privacy Notice will inform you about what information we are using and
   how we are going to use it. We will ask you for your informed consent when we contact
   you directly.
   Personal information that we collect from other sources
   Where it is not possible or practical to collect data from you directly, the IMAGINE-2
   team at University College London will collect information about our study participants
   from other sources including:

• NHS Digital: the national information and technology partner for the health
  and care system in the UK, from which we will seek information about your
  child’s medical history.
• The National Pupil Database, which is held by the Department for Education
  from which we will seek information about your child’s educational records.
  Your information will be shared within the research team at University College London.
  We will state in the Participant Information Sheet if there are collaborators that are not
  employed by the University who will also access your information. The Participant
  Information Sheet is a separate document that we will send to you, which explains
  more about the way in which we are conducting the IMAGINE-2 investigation.
  All our researchers are asked to de-identify (anonymise), pseudonymise (remove
  identifiers such as your name and replace this with a unique code or key) or delete
  personal information collected as part of their research at the earliest opportunity. All
  personal information is kept in line with our policies or any regulatory requirements.
  Information relating to healthcare professionals and others, such as
  researchers, involved in setting up and conducting research studies
  You should be aware that for each research study in which UCL is the study sponsor
  (such as the IMAGINE-2 study), UCL will collect personal data (e.g. names, contact
  details, CVs, training records) about the researchers involved in that study. These
  researchers could include:
• Doctors, nurses and other staff involved in the recruitment, diagnosis, and
  treatment of participants taking part in the research study.
• Laboratory staff, company employees, and staff from other organisations that
  are supporting and/or funding the research study.
• Members of the public who contribute to the design and conduct of the research
  study, including individuals that sit on relevant local working groups or
  committees.
• Healthcare professionals who contribute to the trial management groups and
  oversight committees that oversee the research study.
  UCL will collect personal data about these research staff for the core purpose of
  carrying out the research study either directly from the researcher (for example, via
  the staff signature and delegation of responsibilities log) or indirectly from public
  sources or the study’s source data.

1. What safeguards do we have in place to protect your personal information?
   In order to protect your rights and freedoms when using your personal information for
   research and to process special category information the University must have special
   safeguards in place to help protect your information. We have the following
   safeguards:

• Policies and procedures that tell our staff and students how to collect and use
  your information safely.
• Training which ensures our staff and students understand the importance of
  data protection and how to protect your data.
• Security standards and technical measures that ensure your information is
  stored safely and securely.
• All research projects involving personal data are scrutinised and approved by a
  research ethics committee.
• Contracts with companies or individuals not associated with the University have
  confidentiality clauses to set out each party’s responsibilities for protecting your
  information.
• We carry out data protection impact assessments on high risk projects to ensure
  that your privacy, rights as an individual or freedoms are not affected.
• If we use collaborators outside of Europe, we will ensure that they have
  adequate data protection laws or are part of privacy and security schemes such
  as the privacy shield in the US.
  In addition to the above University safeguards the data protection legislation also
  requires us to meet the following standards when we conduct research with your
  personal information:
  a) the research will not cause damage or distress to someone (e.g., physical harm,
  financial loss or psychological pain).
  b) the research is not carried out in order to do or decide something in relation to an
  individual person, unless the processing is for medical research approved by a
  research ethics committee.
  c) the Data Controller has technical and organisational safeguards in place (e.g.
  appropriate staff training and security measures).
  d) if processing a special category personal data, this must be subject to a further
  public interest test to make sure this particularly sensitive information is required
  to meet the research objectives.

1. The lawfulness of using your personal data
   Data protection legislation requires us to have a valid legal reason to process and use
   personal data about you. This is often called a ‘legal basis’. GDPR requires us to be
   explicit with you about the legal basis upon which we rely in order to process
   information about you.
   As part of this research project, UCL uses Article 6(1)e of the GDPR as the lawful basis
   for processing personal information, where:
   “Processing is necessary for the performance of a task carried out in the
   public interest or in the exercise of official authority vested in the controller”
   This is generally known as the “public task” basis. UCL has reviewed current ICO
   guidance available here: https://ico.org.uk/for-organisations/guide-to-the-generaldata-protection-regulation-gdpr/lawful-basis-for-processing/public-task/, and has
   determined that this research forms part of its performance of a task in the public
   interest, as one of its core purposes provided for in its Charter and Statutes.
   We also collect and use sensitive personal information (special category personal
   data) under the legal basis of Article 9(2)j of the GDPR, where:
   “the processing is necessary for archiving purposes in the public interest,
   scientific or historical research purposes or statistical purposes… which
   shall be proportionate to the aim pursued, respect the essence of the right
   to data protection and provide for suitable and specific measures to
   safeguard the fundamental rights and the interests of the data subject”.
   The full statement in the ICO guidance is available here: https://ico.org.uk/fororganisations/guide-to-data-protection/guide-to-the-general-data-protectionregulation-gdpr/special-category-data/what-are-the-conditions-for-processing/.
2. Who will my personal information be shared with?
   Your personal data will be collected and processed primarily within our project team in
   a way that we can identify you as a participant. Most personal information used in
   research will be pseudonymised before sharing more widely or publishing the research
   outcomes. It may sometimes be necessary to share your personal information with
   other researchers for the purpose of achieving the research outcomes. If data sharing
   is relevant to the research you are involved with, you will be provided with information
   about this in your Participant Information Sheet. If you have any further questions
   about research collaborations, please contact the research team you are involved with.
   If we are collaborating with other organisations, your personal information could be
   shared with them. We will inform you about data sharing in the Participant Information
   Sheet. Information shared will be on a need-to-know basis. It will not be excessive and
   all appropriate safeguards will be put in place to ensure the security of your
   information.
   We also sometimes use products or services provided by third parties who carry out a
   task on our behalf or used for sharing research data for collaboration, such as NHS
   Digital and the National Pupil Database from the Department for Education. These
   third parties are known as data processors and, when we use them, we have
   contractual terms, policies and procedures to ensure confidentiality is respected. This
   does not always mean that they access your information. The University remains
   responsible for your personal information as the controller and should researchers use
   another third-party service to process personal your information they will provide you
   with details about the relationship they have with the service provider, supplier or
   collaborator on the Participant Information Sheet.
   Your personal information will only be used for the purpose of health and care research
   and cannot be used to contact you or to affect your care. It will not be used to make
   decisions about future services available to you.
3. Your rights
   Under data protection legislation you have individual rights in relation to the personal
   information we hold about you. For the purposes of research where such individual
   rights would seriously impair research outcomes, such rights are limited. However,
   under certain circumstances, these include the right to:
   ▪ access your personal information
   ▪ correct any inaccurate information
   ▪ erase any personal information
   ▪ restrict or object to our processing of your information
   ▪ request the transfer of your personal information
   ▪ withdraw consent
   It is important to understand that the extent to which these rights apply to research will
   vary and that in some circumstances rights may be restricted. If it is considered
   necessary to refuse to comply with any of your individual rights, you will be informed
   of the decision within one month and you also have the right to complain about our
   decision to the Information Commissioner. It should also be noted that we can only
   implement your rights during the period upon which we hold personal identifiable
   information about you. Once the information has been irreversibly anonymised and
   becomes part of the research data set it will not be possible to access your personal
   information.
   If you wish to exercise any of these rights, please contact the Data Protection Officer.
4. For how long is my information kept?
   We ask our researchers to de-identify information wherever possible (anonymisation
   or pseudonymisation). Information where you can be identified will, as such, be kept
   for a minimum amount of time and in accordance with the research objectives. We
   may, however, keep consent forms which contain personal information for a number
   of years after the research has been completed, as this is sometimes a requirement
   the research’s funder. The personal information obtained for research purposes will be
   kept for 20 years. You will be informed in your Participant Information Sheet with
   regards to how long your personal information will be kept for.
   For the data from the external organisations, the data retention will be in line with their
   regulations, such as in NHS digital and the Department for Education for the National
   Pupil Database.
5. Who can I contact?
   Please note that UCL has appointed a Data Protection Officer. If you have any
   questions about how your personal information is used, or wish to exercise any of your
   rights, please consult the University’s data protection webpages. If you need further
   assistance, please contact the University’s Data Protection Officer (dataprotection@ucl.ac.uk)
   You can contact UCL by telephoning +44 (0)20 7679 2000 or by writing to: University
   College London, Gower Street, London WC1E 6BT.
   If you have any questions about this Privacy Notice, including any requests to exercise
   your legal rights, please contact our Data Protection & Freedom of Information Officer:
   data-protection@ucl.ac.uk
6. How can I complain?
   If you are not happy with the way your information is being handled, or with the
   response received from us, and you wish to complain about our use of personal data,
   please send an email with the details of your complaint to data-protection@ucl.ac.uk
   so that we can look into the issue and respond to you.
   You also have the right to lodge a complaint with the Information Commissioner’s
   Office (ICO) (the UK data protection regulator), at Wycliffe House, Water Lane,
   Wilmslow, SK9 5AF. For further information on your rights and how to complain to the
   ICO, please refer to the ICO website at https://ico.org.uk.
7. When was the privacy notice last updated?
   This privacy notice was last updated on 4 November 2020 and may be amended from
   time to time.
   Additional Privacy notice information for the IMAGINE -2 study website:
   The Website
   This website and its owners take a proactive approach to user privacy and ensure the
   necessary steps are taken to protect the privacy of its users throughout their visiting
   experience. This website complies with all UK national laws and requirements for user
   privacy.
   Use of Cookies
   This website uses cookies to improve the user experience while visiting the website.
   Where applicable this website uses a cookie control system allowing the user on their
   first visit to the website to allow or disallow the use of cookies on their computer or
   other browsing device. This complies with recent legislation requirements for websites
   to obtain explicit consent from users before leaving behind or reading files such as
   cookies on a user’s computer / device.
   Cookies are small files saved to the user’s computer’s hard drive that track, save and
   store information about the user’s interactions and usage of the website. This allows
   the website, through its server to provide the users with a tailored experience within
   this website.
   Users are advised that if they wish to deny the use and saving of cookies from this
   website on to their computer’s hard drive, they should take necessary steps within their
   web browser’s security settings to block all cookies from this website and its external
   serving vendors.
   This website uses tracking software to monitor its visitors to better understand how
   they use it. This software is provided by Google Analytics which uses cookies to track
   visitor usage. The software will save a cookie to your computer’s hard drive in order to
   track and monitor your engagement and usage of the website, but will not store, save
   or collect personal information. You can read Google’s privacy policy here for further
   information [ http://www.google.com/privacy.html ].
   Other cookies may be stored to your computer’s hard drive by external vendors when
   this website uses referral programs, sponsored links or adverts. Such cookies are used
   for conversion and referral tracking and typically expire after 30 days, though some
   may take longer. No personal information is stored, saved or collected.
   Contact & Communication
   Users contacting this website and/or its owners do so at their own discretion and
   provide any such personal details requested at their own risk. Your personal
   information is kept private and stored securely until a time it is no longer required or
   has no use, as detailed in the Data Protection Act 1998. Every effort has been made
   to ensure a safe and secure form to email submission process but advise users using
   such form to email processes that they do so at their own risk.
   This website and its owners use any information submitted to provide you with further
   information about the products / services they offer or to assist you in answering any
   questions or queries you may have submitted. This includes using your details to
   subscribe you to any email newsletter program the website operates but only if this
   was made clear to you and your express permission was granted when submitting any
   form to email process. Or whereby you the consumer have previously purchased from
   or enquired about purchasing from the company a product or service that the email
   newsletter relates to. This is by no means an entire list of your user rights in regard to
   receiving email marketing material. Your details are not passed on to any third parties.
   Social Media Platforms
   Communication, engagement and actions taken through external social media
   platforms that this website and its owners participate on are custom to the terms and
   conditions as well as the privacy policies held with each social media platform
   respectively.
   Users are advised to use social media platforms wisely and communicate / engage
   upon them with due care and caution in regard to their own privacy and personal
   details. This website nor its owners will ever ask for personal or sensitive information
   through social media platforms and encourage users wishing to discuss sensitive
   details to contact them through primary communication channels such as by telephone
   or email.
   This website may use social sharing buttons which help share web content directly
   from web pages to the social media platform in question. Users are advised before
   using such social sharing buttons that they do so at their own discretion and note that
   the social media platform may track and save your request to share a web page
   respectively through your social media platform account.
   Shortened Links in Social Media
   This website and its owners through their social media platform accounts may share
   web links to relevant web pages. By default, some social media platforms shorten
   lengthy URLs [web addresses] (this is an example: http://bit.ly/zyVUBo).
   Users are advised to take caution and good judgement before clicking any shortened
   URLs published on social media platforms by this website and its owners. Despite the
   best efforts to ensure only genuine URLs are published many social media platforms
   are prone to spam and hacking and therefore this website and its owners cannot be
   held liable for any damages or implications caused by visiting any shortened links