This privacy notice provides information about how we use the personal data we collect during the facilitation of project development or for projects involving respondent data collection. Data is collected from users to provide login access to the ITM-REDCap database.
REDCap databases are held on University Hospitals Birmingham NHS Foundation Trust (UHB) servers. Therefore, REDCap follows the UHB data protection and confidentiality policy.
What personal data will be processed?
To set up a user on REDCap the team require:
- Full name
- Email address
- Role
- Name of the work organisation
This will primarily be processed by the REDCap administration team but may be processed by other teams within UHB.
What is the purpose of the processing?
We will process your data to facilitate research project requests; in addition, we may use your data for audit or our internal processes.
If you do not wish to be involved in the improvement of services, to provide feedback on our services and/or be informed of new services you may inform us at any time via email or by selecting the relevant information boxes during the request process.
What is the legal basis of the processing?
Processing personal data of REDCap project users is considered necessary for the performance of your project and therefore a task in the public interest.
Who will your personal data be shared with?
The data you provide us with in your request form will be managed by the REDCap team and will not be shared unless first discussed with you or as part of servicing your request.
For the administration of REDCap, administrators within the REDCap team and IT services will have full access to your personal data to create your login profile.
REDCap user names will be visible to other users allocated to the same projects.
How long is your data kept?
Login information will be removed from the database:
- when all the projects you are allocated to are
- where you are only on one project, the CI or delegated member of the research team may formally request deletion of your
- when you request that your information be deleted*
* Where this contravenes the agreements set out by the project’s processes the user account will be suspended and email will be removed to prevent contact. The user information will not be deleted until the last project involving the user as part of the research team is deleted. Information collected as part of research will be governed by the approvals of the relevant research project.
Your rights in relation to your data
As a data subject, you have the following rights in relation to your personal data which is processed by the REDcap team on behalf of UHB:
- to access the personal information, we hold about you. This is known as a subject access request
- to correct inaccuracies or, where appropriate and taking into account the purpose for which we process your data, the right to have incomplete data completed
- to have your personal data. This is a limited right which applies, among other circumstances, when the data is no longer required or the processing has no legal justification. There are also exceptions to this right, such as when the processing is required by law or in the public interest (e.g. when the hospital needs to retain a historical archive)
- to object to the processing of your personal data for marketing purposes. If you ask us to delete your personal data, we will continue to maintain a core set of personal data comprising very brief information to ensure that we do not inadvertently contact you in. We may also need to retain some financial records for statutory purposes
- to object to the processing of your personal data when that processing is based on specific criteria such as the public interest or other legitimate interests, unless we have compelling lawful grounds to continue
- to restrict the processing of your personal data. This is a limited right which will apply in specific circumstances and for a limited period
- to ask for the transfer of your data electronically to a third party
- where the legal basis for us processing your personal data is your consent, to withdraw that consent at any time
Data protection officer
In the event that something does go wrong due to the REDCap’s negligence then you have the right escalate this issue.
The UHB complaints mechanisms will still be available to you; in the first instance we suggest that you contact Data Protection Officer.
Data Protection Officer
Information Governance Team
3rd Floor, Nuffield House
Queen Elizabeth Hospital Birmingham
Mindelsohn Way
Birmingham, B15 2TH
You can also email Information Governance who will be able to provide independent advice and direct you appropriately.
Last reviewed: 05 December 2022
