Exercise-SCAD
University of the West of Scotland University of Leicester Edinburgh Napier University

Privacy notice

How this website handles the activity data you connect, and what your choices are.

Draft, pending information-governance review. The study information sheet you were given remains the authoritative description of the research. This page covers only the part of the study that happens on this website — the connection to your activity data — and is written to agree with that sheet.

Who is responsible for your data

The University of Leicester is the sponsor of this research and the data controller. It is responsible for looking after your information and for using it properly.

The study is run through the SCAD clinic at University Hospitals of Leicester, in collaboration with Edinburgh Napier University and the University of the West of Scotland. All members of the research team hold appointments with the University of Leicester.

What this website collects

When a member of the study team enrols you, you sign in to your own Google account and give this website permission to read activity data recorded by your Fitbit. With that permission we collect:

  • steps
  • heart rate
  • daily heart-rate variability
  • sleep

We collect a single fixed period: the 90 days ending on the date of your final study assessment. Once that period has been retrieved, collection stops. We do not collect data going forward indefinitely.

What this website does not collect

This website holds no information that identifies you directly. It does not store your name, email address, postal address, telephone number or date of birth. Your records here are labelled only with the study code number allocated to you by the research team.

Permission is read-only. We cannot change or delete anything in your Google or Fitbit account, and we never see or receive your password.

We do receive an anonymous account identifier from Google. It contains no email address and no profile information, and we use it for one purpose: to detect if the same account is accidentally connected to two different participants.

Our lawful basis

Under the UK GDPR, the University of Leicester processes your information as a task carried out in the public interest (Article 6(1)(e)). Activity and heart data are health data, which receives extra protection; we rely on the condition for scientific research purposes (Article 9(2)(j)).

Your consent is what makes it ethical to invite you into the study, but it is not the legal basis for the processing. This is the standard arrangement for university-sponsored health research, and it is why withdrawing does not automatically erase data already collected — see Your choices below.

How your data is stored and protected

  • Data is held on University of Leicester research infrastructure in the UK. Nothing is stored outside the UK.
  • The connection to your Google account is kept encrypted. The short-lived key used to make each request is never written down at all.
  • Only named members of the research team can sign in to this website, each with their own account.
  • Collected data is append-only: it is written once and never silently altered afterwards, so the research record cannot be quietly changed.
  • Your name and contact details are held separately by the clinical team at University Hospitals of Leicester, not on this website.

Who your data is shared with

As set out in your information sheet:

  • People who do not need to know who you are cannot see your name or contact details — your data carries a code number instead.
  • Pseudonymised data (labelled with your code, not your name) may be shared with collaborating researchers or companies for specialist analysis.
  • If you agree to take part in more than one SCAD project, data collected in one may be shared with the others, so you are not asked for the same information twice.
  • After the results are published, anonymised data may be shared with other researchers — only following an official request, an assessment of suitability, and a data-sharing agreement with the University of Leicester.
  • Regulators and auditors may check records to confirm the research is being done properly.

Published reports will never identify you.

How long we keep it

Data will be stored securely by the University of Leicester for at least 6 years after the study finishes, so the results can be checked and verified.

Your choices

You can stop taking part at any time, without giving a reason. Tell a member of the study team and we will stop collecting from your Fitbit. You can also disconnect this website yourself at any time from your Google account’s security settings.

As explained in your information sheet, information already collected will be kept. Research has to be reliable and verifiable, so the record of what has already been gathered and analysed cannot be removed retrospectively. For the same reason we cannot let you view or amend the study data we hold about you.

If you have a specific concern about your data, contact the study team or the Data Protection Officer using the details below and it will be considered individually.

Finding out more, and complaints

You can find out more about how patient data is used in research at www.hra.nhs.uk/information-about-patients/, or by asking a member of the research team.

If you are unhappy with how your data has been handled, you may complain to the Information Commissioner’s Office at ico.org.uk.

Contact

Questions about the study
Dr Coral Hanson — coral.hanson@napier.ac.uk

Questions about your data
Data Protection Officer, University of Leicester, University Road, Leicester, LE1 7RH — DPO@le.ac.uk

This study has been reviewed and given a favourable opinion by an NHS Research Ethics Committee (reference 24/EE/0253).