REACTIVE Privacy Policy

Introduction

REACTIVE is a National Institute for Health and Care Research (NIHR) Invention for Innovation (i4i) funded research project, led by University of Exeter. The research aims to establish the sensitivity and specificity of the REACTIVE application to detect and predict clinically meaningful cognitive decline in adults at risk of dementia. The University of Exeter (UoE), Northcote House, The Queen’s Drive, Exeter, Devon EX4 4QJ, United Kingdom are committed to protecting your personal data.

This Privacy Policy (together with our Terms and conditions and other documents referred to on this website) sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. Please read the following document carefully to understand our views and practices regarding your personal information and how we will process it.

The Data Controller of your personal information in the study is, in accordance with current data protection legislation, the University of Exeter.

What information do we collect?

For the purposes of the study, we collect certain types of personal data, including special categories of personal data from you. This information is as follows:

• All demographic details, including full name, date of birth, email address, home address (including postal address), telephone number, gender, ethnic origin, employment status, and highest level of education completed. Providing these demographic details is a requirement to participate in this study, as they are basic data used in statistical analysis along with the information you provide in questionnaires and collected in cognitive tests. This information gives context and meaning to your information in relation to the information other participants provide.

• Lifestyle information, including physical activity, smoking, diet, sleep, and cognitive activities.

Sensitive Personal Data

• Medical and family history, including serious illnesses, such as stroke, heart disease, Parkinson's disease, and diabetes.

• Important aspects regarding your brain health, such as memory and logical thinking that can influence how well you perform everyday activities that we collect using cognitive tests.

• Responses to questionnaire regarding mental health, including validated scales measuring depression, stress and anxiety.

• Responses to questionnaire regarding health and quality of life.

• Responses to questionnaire regarding your access to health and care services.

• Detailed information about your everyday behaviour and ability to perform everyday functional activities.

All personal information is processed confidentially.

Demographic and Behavioural Data

In order to ensure that we improve the site where necessary and to provide you with a good user experience, we collect information about your usage, such as type and browser version, operating system and platform, information about your visits including the full URL used, clickstream to, through and from our site (including date and time), tests you have viewed or looked for; how long it takes a page to load, any download errors, length of visits to certain pages, and information about the interaction on the page (such as scrolling, clicks, and mouse crosses).

How do we use your information?

• To conduct research to improve how we detect dementia in people who are not yet in touch with their GP.

• To run a check to detect if there has been a change in performance.

• To send you sampling kits as part of the research study.

• To share with your GP if we detect a change in performance.

• This data is used for publication of results in academic/scientific publications, in future projects or in research archives.

• We may use your email address to send reminders, updates, and to make it possible to provide information about, for example, security issues, or to safeguard the dignity and well-being of participants. Also, we may use your telephone number to contact you, analyse and measure the performance of the Dementia Researcher Services, including by conducting analytics, research, and diagnostics.

• Comply with any legal obligation REACTIVE may have.

No member of the REACTIVE team will use your personal information to contact you regarding anything that is not directly related to this study.

What is our legal basis for processing your information?

Under Data Protection Laws, we must have a lawful basis for the processing of the information you have provided us with and will only process your personal data in accordance with the current Data Protection legislation (which includes the Data Protection Act 2018 and General Data Protection Regulation).

Whilst we will ask that you give your consent as part of your registration process in the study, we will not be relying on this consent as the lawful basis for processing your data under data protection law.

As the University of Exeter is a public institution and the study serves a significant public interest in advancing Dementia research, we will be processing your personal data under the following legal basis under the General Data Protection Regulation;

• Consent - all users consent to use of their data for all activities delivered by the platform.

• Public task - the platform performs activities in the public interest, including supporting users to monitor their health and take part in health-related research.

• Legitimate interest - the platform processes data based on the interests of the users and owners, within the parameters of the consent.

How will we share your data?

Your data may be shared as part of the REACTIVE study with individuals involved in the REACTIVE study:

• Your GP to notify them that you are taking part in the study and if there is a significant change in your brain health scores.

• A research nurse to enable them to complete an additional brain health assessment.

• Individuals representing the research team at the University of Exeter or from regulatory authorities (Medicines & Healthcare Products Regulatory Agency / Health Research Authority) – this may include name, date of birth, contact details and information provided through questionnaires, tests or samples.

• Individuals at deCODE genetics and the University of Gothenburg – this will not include data that could identify you.

Any data sharing will be done with strict safeguards and agreements in place. No member of the REACTIVE team will use or share information with third parties on any basis other than what is stated in this statement.

How long do we store your data?

Your personal information will be kept secure for as long as you take part in the study. Once the study is completed, we will retain the data for as long as required for study purposes, but no longer than ten years. The information will then be securely deleted. Anonymised and aggregated data will be archived indefinitely and may be made available as secondary data outside of the REACTIVE programme for research purposes, for example, through Open Access.

If you choose to withdraw from the study, we will keep a record containing your ID number, record of consent, and partial postcode for 10 years after the study has ended to confirm that you have withdrawn. After this, it will be securely deleted. We will also retain any anonymised analysis results you have submitted as described above, as it will not be possible to recognise or remove your personal information after it has been anonymised. During the withdrawal process, we will provide you with the opportunity to remove any remaining personal information (i.e. data that directly identifies you). This includes your email address, home address, and telephone number. If you wish to remove this information, you will no longer be able to receive any information from us. If you want to participate in the study again at a later date, you will have to start from the beginning and will not be able to reactivate your account. You can choose whether you want to receive information about the study if you choose to agree to us keeping the information. If you choose to end the study, you will not be able to log in to the study's website.

How do we protect your information?

All personal information will be collected through the website: reactivestudy.org.uk using an SSL (Secure Sockets Layer) protocol. This encrypts information you submit. Personal and sensitive information will be stored securely at Microsoft Azure, in UK West and will be processed within the framework of Microsoft Azure's governance procedures. Personal and sensitive personal information will be stored in separate databases in encrypted format in an access-regulated area, called a Transaction Database, which only database developers with permission from University of Exeter have access to. Research administrators at University of Exeter can access limited information in the Transaction Database through a secure administrators’ section of the website to contact you about your participation in the study and support you with using the website.

Information retrieved from the Transaction Database to be used for statistical analysis is de-identified and stored in a separate database, called the Results Database. This data does not contain any link to information that can identify you, such as your name, phone number or email address.

De-identified data stored in the Results Database will be securely stored at Microsoft Azure in UK West and will be processed within the framework of Microsoft Azure's governance procedures.

For those places on our website where we have provided you, or you have chosen a password that allows you to access certain parts of the website, you are responsible for keeping the passwords confidential. We ask that you do not share passwords with others.

Your rights and preferences

You have several rights in relation to the personal information that is collected and stored about you. You have:

• Right to be informed

• Right of access

• Right to rectification of information

• Right to remove information

• Right to restrict processing

• Right to data portability

• Right to object

• Right to withdraw consent

• Right to lodge a complaint with the Data Supervisory Authority e.g UK Information Commissioners Office (ICO)

In the information above and in the participant information sheet, we have provided information about how these rights apply in REACTIVE and the importance of exercising these rights.

If you have any questions regarding this Agreement or any other aspect of your privacy with respect to REACTIVE or if you wish to assert your rights, please contact us at the following addresses:

The Administrator REACTIVE Study College House 1.23 St Luke’s Campus The University of Exeter Exeter, EX1 2LU United Kingdom

Alternatively, you can also contact the Data Protection Officer, who is responsible for monitoring compliance with relevant legislation regarding the collection and storage of personal data, at University Data Protection Officer | About our site | University of Exeter.

You have the right to lodge a complaint with the Information Commissioner’s Office at www.ico.org.uk/concerns.

REACTIVE Cookie Policy

This Cookie Policy describes the practices of the University of Exeter regarding information we collect through this website: reactivestudy.org.uk. The policies on this page apply only to this website. It does not describe the practices of other websites. We do not control, and are not responsible for, the privacy practices or data contained on third-party websites, and we would like you to consider the appropriateness of these practices and data yourself.

Our site uses cookies to give you a better experience. By continuing to use the site, you consent to the use of cookies as described in our Privacy Policy.

Cookies

A cookie is a small piece of data containing an identifier that is sent to your computer, tablet or mobile phone browser (referred to here as a device) via a website's computer and stored on your device's hard drive. All websites can send their own cookies to your browser if the settings on your browser allow this. To protect your privacy, your browser will only allow a website to access the cookies it has already sent to you, not the cookies sent to you from other websites.

You can block cookies by activating the settings on your browser that allow you to turn off the settings that allow some or all cookies. If you use your browser settings to turn off all cookies, you may not be able to access certain parts of our website.

How does REACTIVE use cookies?

The REACTIVE study website uses cookies to distinguish between you and other users of our website. This helps us to provide you with a good experience when you are on our website and ensures we store your information correctly. When you register for participation in REACTIVE, we ask you to allow cookies. No cookies on our website store sensitive information that can be used to identify you personally. We use only essential cookies and these are listed in the table below.

Third-party cookies

When visiting the website, you may notice some cookies that are not part of this study. When you visit a website that contains content from other websites, such as videos from YouTube, you may be presented with cookies from those websites. The University of Exeter do not control the dissemination of these cookies. We therefore ask you to check the third-party website for more information regarding these.

Further information

This Privacy Policy is constantly under review. Changes will be updated on our website, and these will be communicated to the participants concerned.