Privacy & Security

Purpose 

SHARE – The Scottish Health Research Register and Biobank, is part of the infrastructure of NHS Research Scotland (NRS) and is funded by the Chief Scientist Office of the Scottish Government. This privacy policy covers all the information provided on the website and the registration pages for the SHARE register. It describes the information SHARE collects when you or your computer interacts with the website, and how SHARE uses that information. 

By visiting the website and/or by supplying any personal data, you are accepting and consenting to the practices described in this policy. If you do not agree with these terms, then do not use this website or its resources. 

What do we do with your information?

The SHARE database only holds the information you provide when completing your registration: 

• Name
• Date of birth
• Postcode
• Phone number / email

No information will be shared with 3rd parties for marketing purposes. This data is held within an accredited “Safe Haven” within NHS Scotland, and only used to contact you for research projects, as you have given us permission to do. A data Safe Haven is a secure environment supported by trained staff and agreed processes whereby health data can be processed and linked with other health data. This information can be made available in an anonymous form, for research purposes. There are four Safe Havens in NHS Scotland. The information collected for the SHARE Register is stored by the Safe Haven (hosted by Dundee University), the Health Informatics Centre (HIC).  

We use this information for the following purposes: 
- Contacting you about health research that may be of interest or relevance to you. 
- Keeping in touch with you about the latest SHARE updates e.g. newsletters.  
If you are contacted, there is no obligation to participate in any research invitation. 

You have also given SHARE ‘permission to interrogate your health records using coded data’. To explain how this works: 

Your electronic health records are held within the NHS secure databases. When you sign up to SHARE, your record is ‘flagged’ to say you are happy to be invited for research through SHARE. 

When SHARE receives a study application from a researcher, this study undergoes careful scrutiny by a committee of doctors and researchers to see if it is a good and useful research project. Once this study application is approved, we look for people who might be suitable to take part, from the SHARE register. For example, if the study is looking for people who have asthma. Data Managers within the Health Informatics Centre (HIC), will interrogate the NHS database to identify people who have a diagnosis of asthma by using codes, for example, ICD-10 codes. ICD-10 codes are the International Statistical Classification of Diseases and Related Health Problems (ICD) (10th revision). These codes are a medical classification list developed by the World Health Organization (WHO). It contains codes for diseases, signs and symptoms, abnormal findings, complaints, social circumstances, and external causes of injury or diseases. The ICD-10 code for asthma is J45, so, if you have asthma, your name will be sent to the SHARE Team, as a possible match.

The SHARE team will then contact you, to explain the study opportunity and ask if you are willing to talk to the research team who are conducting the study. Only if you say yes, will your name will be passed on. If you are not interested in finding out more about the study or taking part, you can just say no.

When you join SHARE, you can also agree to allow us to keep any blood left over following routine clinical testing, for research purposes. This is not automatic; you have to tick the box to give us this permission. The bloods are stored and researched in an anonymised manner. Your identity will not be known to any of the research team. Further information is in our ‘Questions?’ section of the website. 

Why do we collect this information? 

When researchers want to carry out a healthcare or medical research study, they need help to identify individuals who are suitable for their study. Researchers will look for specific characteristics such as: age, sex, geographical location, diagnosis of a specific health condition, prescribed medication or possibly individuals who are entirely healthy. 
The SHARE Register can be interrogated by the Health Informatics Centre (HIC) to identify how many individuals with specific characteristics are registered.  

How long do we keep your information for? 

This register does not have a defined end date. We will keep you on the SHARE Register indefinitely and if you have given permission for use of your blood, this may be kept indefinitely. However, you are free to end your involvement at any time.  

We ensure that any information held on the SHARE register, is managed and stored according to strict guidelines and compliance with General Data Protection Regulations and national NHS Storage and Retention policies. Our records are ‘refreshed’ / kept up-to-date with regard to your consent, by requesting your consent every time we contact you. When we contact you (for example with updates, newsletters), we also inform you of your right to withdraw from the register at any time. If you decide at any point, you would like to withdraw from the SHARE register, please see ‘What if I change my mind after registration? How do I withdraw if I want to?’ on our Questions page.  Alternatively, please get in touch with us by emailing [email protected]. You have control in whether you wish to remain on the SHARE register. 

What happens when new information is found from this research on your samples? 

Medical researchers are at an early stage of understanding the importance of most of your genetic code and what differences in the code between people may mean. Researchers using your blood samples will produce reports and publications of what they find out, and that information could point to a better understanding of how diseases develop or new ways to treat illnesses. However, because researchers don’t know whose blood they are using you won’t be identified in these reports and publications and they or SHARE will not provide information to you about your own individual results. 

Nevertheless, as knowledge improves, including from research supported by SHARE, this could guide future tests and treatments offered by the NHS. Publications resulting from SHARE involvement will also be published on the SHARE website (www.registerforshare.org/publications). It is also possible that information about you that comes from research on your samples could be important and helpful to doctors treating you in the future. If that is the case, it may be appropriate at some point in the future for this information to be added to your medical records. For example, we know that people respond differently to some drugs given to prevent heart disease depending on their genetic code. However, SHARE is not set up to do this currently and a change to this policy will require further ethical review and your consent. 

Health Data shared via the SHARE App 

SHARE is not able to provide any feedback to individuals on the data you send to SHARE database via the App as all this information is anonymised and held within the secure Safe Haven along with your health records. This information goes straight to your health records and is not seen by anyone in SHARE.   

Website Hosting and How your information is stored 

Our website and apps are hosted by MTC Media Ltd, a website hosting company. They do not store any data. Once you register this information goes to the NHS Safe Haven (the Health Informatics Centre [HIC]) to process and consolidate with NHS Scotland electronic records.  
The SHARE Database with your registration details is held in the secure NHS Safe Haven. 

Cookies  

What are cookies? A cookie is a small amount of data placed on your computer or mobile phone by a website. Our cookies don't collect or store any information that personally identifies you.  

We use Google Analytics to monitor use of our website, use of web pages and to tailor the website operation to your needs and preferences; in order for Google Analytics to provide SHARE with this service, we use cookies on our website. 

When you use the Internet, you are assigned a unique address, known as an IP address. Google Analytics will use IP addresses to analyse trends, to administer the websites, track users' movements through the websites, and gather statistical information. IP addresses are not linked to other personally identifiable information.

When you use this website, we'll collect information about your browsing habits using cookies, which is processed by Google Analytics. This helps us to understand how you interact with the website and what information you're interested in. By using our website and agreeing to this policy, you consent to for us to use cookies to collect this information in accordance with the terms of this policy. 

Third party services 

The third-party providers, Google Analytics, used by us, will only collect and use information to the extent necessary to allow them to perform the analytical services they legally and transparently provide to us. (A third-party service provider is any unaffiliated provider that performs services for an organisation. Third-party service providers are paid for their services, but do not have an interest in the organisation). For example, when a news article is uploaded onto the website, we may use Google Analytics to track the interaction with this article to evaluate how many people have read it. This data helps us to know which articles/ adverts are more effective in promoting SHARE.  

Links to other websites while using the SHARE App 

When you click on links in any chats or other windows, they may direct you away from our apps. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements. 

Security and Confidentiality 

To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed.  

We are committed to ensuring that your information is secure. We use leading technologies and encryption software to safeguard your data and maintain strict security standards to prevent any unauthorised access to it. We make every effort to reduce the risks associated with data in transit over the internet by using appropriate technology, including (but not limited to) SSL for any of our websites or applications which collect data from you. 

We want our users to feel comfortable with their experience on our website and we would appreciate any feedback you may have to offer. If there are any questions about this privacy statement, the practices of this site, or dealings with this website, please contact [email protected].  

Data protection and security 

As SHARE is an NHS Research Scotland initiative, we adhere to all data security standards, guidelines and regulations that apply to medical and health research, and the NHS in Scotland. The South East of Scotland Research Ethics Committee (REC) 2, has granted ethical approval for the SHARE Register and Biobank.

For the purposes of data protection legislation, SHARE is the Data Controller responsible for adhering to Data Protection regulations with regard to the Register and Biobank.

SHARE has an agreement with the Health Informatics Centre (HIC); this agreement specifies how your personal data must be stored securely and restricts any further use of the data which you have not permitted.
HIC facilitates data collection, secure storage and interrogation of coded health data which is stored in NHS Scotland’s electronic health records systems. HIC is the Data Processor and must also adhere to strict Data Protection regulations.

The Data Protection Act 2018, controls how your personal information is used by organisations, businesses or the government. The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR). SHARE is bound by the regulations of the Data Protection Act 2018, and must ensure the Principles of the Act are strictly followed. The Data Protection Principles state we must ensure the information we store is: 

• used fairly, lawfully and transparently
• used for specified, explicit purposes
• used in a way that is adequate, relevant and limited to only what is necessary
• accurate and, where necessary, kept up to date
• kept for no longer than is necessary
• handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

Under the Data Protection Act 2018, you have the right to find out what information the organisations store about you. These include the right to: 

• be informed about how your data is being used
• access personal data
• have incorrect data updated
• have data erased
• stop or restrict the processing of your data
• data portability (allowing you to get and reuse your data for different services)
• object to how your data is processed in certain circumstances

Withdrawal from the SHARE Register and Biobank 

You are free to withdraw from the SHARE Register and Biobank at any time without giving a reason. This will not affect your normal care. If you wish to withdraw you need to contact the SHARE Team using mail, email; [email protected] Telephone ; 01382 383471 or the online form on the SHARE Website. 

However, we need to know if you wish to:  

1. Withdraw from contact 
I no longer wish to receive newsletters and invitations to take part in research studies.  

2. Withdraw from spare blood collection 
I no longer wish to have any leftover blood samples collected following routine clinical testing; any samples stored within the SHARE Biobank will be flagged for disposal (where possible*). 

3. Have your details removed from the register which includes removal of any stored blood samples. 
I do not wish to be contacted by email for newsletters or specific health research studies that I may have been suitable for. My details will be removed from the SHARE register and I will receive no further contact. I do not wish to have any leftover blood samples collected following routine clinical testing; any samples stored within the SHARE Biobank will be flagged for disposal (where possible*).

 *However, it is possible that samples may already have been issued to researchers and we may not be able to take further action. 

Please can you email us ([email protected]) or call us (01382 383471) to give us further information and we will act as per your request. 
We will need your full name and postcode to identify your registration. 

Changes to this Privacy Policy 

We reserve the right to modify this privacy policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the website. If we make material changes to this policy, we will notify you here that it has been updated, so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it. If SHARE is merged with another government credited health research entity, your information may be transferred so that we may continue to use the registration information for research. 

Questions and Contact 

If you would like to access, correct, amend or delete any personal information we have about you, register a complaint, or simply want more information you can contact us at [email protected] or by mail at: 

Scottish Health Research Register 
School of Medicine, Mailbox 12, Level 5, 
Centre for Pharmacogenomics and Pharmacogenetics, 
Ninewells Hospital and Medical School, 
Dundee, DD1 9SY