FEED Study Data Privacy Notice
1. What is the purpose of this document?
The University of Oxford is committed to protecting the privacy and security of your personal information (‘personal data’).
This privacy policy describes how we collect and use your personal data during your participation in the FEED Study. The legal basis for the processing and storage of your personal data for the FEED Study is that it is ‘a task in the public interest’ (Article 6(1)(e) UK General Data Protection Regulation (UK GDPR). In addition, a required condition under the UK GDPR to process your special category (sensitive) personal data is met as it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)(j) UK GDPR).
This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study.
It is important that you read this policy, together with any other privacy policy we may provide on specific occasions when we are collecting or processing information about you, so that you are aware of how and why we are using your information. We may update this policy at any time.
2. Glossary
Where we refer in this policy to your ‘personal data’, we mean any recorded information that is about you and from which you can be identified.
Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure or retention.
3. Who is using your personal data?
The University of Oxford* is the “data controller" for the information that we obtain from you or others as part of the FEED Study. This means that we decide how to use it and are responsible for looking after it in accordance with UK GDPR legislation.
* The University’s legal title is the Chancellor, Masters and Scholars of the University of Oxford
Access to your data will be provided to designated members of our staff who need to view it as part of their work in carrying out the purposes set out in section 5. We also share it with the third parties described in section 6.
4. The types of data we hold about you and how we obtained it
We collect all of the information directly from you, when you complete our survey. This information includes an email address, ethnicity, and other personal data including height, weight, smoking, alcohol, dietary habits, intakes and motivations, physical activity, living situation, working patterns, and general wellbeing.
5. How the University uses your data
Using the information you have given us on our survey we can assess dietary intakes and related motivations and personal characteristics. For example, we can investigate if participants who follow a particular diet eat more or less of a particular nutrient. We can also investigate if following a particular diet varies by personal motivations and characteristics. We collect and process your data (including your special category sensitive data) in this way for the purpose of performing scientific research being carried out in the public interest. This is known under data protection law as our “legal basis” for processing personal data.
We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent to use it for that new purpose. We do not use your personal data for any form automated decision making or public profiling and we will not use your data for any unrelated purposes.
Please note that we may process your data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
General information about how long different types of information are retained by the University can be found in the University’s Policy on the Management of Research Data and Records.
6. Who has access to your data?
Access to your data within the University will be provided to those who need to view it as part of their work in carrying out the purposes described above.
We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption, and destruction.
In addition, in order to perform our research and other legal responsibilities or purposes, we may, from time to time, need to share your information with external regulatory bodies.
Where information is shared with third parties, we will seek to share the minimum amount necessary, including pseudonymising your data where possible. This means we remove your identity and replace it with a code number before sharing the information. Only the research team have access to the ‘key’ linking the code to your identity.
7. Retention
Period All research data and records will be stored securely on the Nuffield Department of Population Health, University of Oxford servers for up to 10 years and then deleted. We may also retain personal data for further research for which a legal basis exists, but this will always be done in accordance with data protection laws.
8. Security
We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption, and destruction.
We use technical measures such as encryption and password protection to protect your data and the systems in which they are held, and the information that we receive is stored securely in a study database. Access to the study database is by unique combinations of usernames and passwords and only authorised study personnel can access information about participants. The University building is also secure with authorised swipe card access only.
We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held. And whenever possible, your personal identifiers will be removed and replaced by a unique ID number. Your data is treated in the strictest confidence and is used solely for academic research purposes. Importantly, no individuals will be identified in any publications arising from this work.
We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice.
9. Your rights
Data protection regulation provides you with control over your personal data and how it is used. When your information is being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available on the University's website.
10. Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and will seek to inform you of substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.
11. Contact
If you wish to raise any queries or concerns about this privacy notice please email using the contact details below:
Dr Keren Papier
Cancer Epidemiology Unit
Richard Doll Building
Oxford OX3 7LF
Email: Feedstudy@ndph.ox.ac.uk
Please also refer to the participant information sheet on the FEED study webpage for more information.