General Data Protection Regulation (GDPR) for the Rapid Eczema Trials Scratch Less Study
How will information about me be used?
We will need to use information from you for this research project.
This information will include:
Your name
Your contact details
Information about you and your eczema
People will use this information to do the research or to check your records to make sure that the research is being done properly.
People who do not need to know who you are will not be able to see your name or contact details. Your data will have a code number instead.
Nottingham University Hospitals NHS Trust and University of Nottingham are joint data controllers for this study and are responsible for looking after your information.
We will keep all information about you safe and secure by:
Following and adhering to the laws relating to General Data Protection Regulation (GDPR)
Storing your data securely at the University of Nottingham and at Nottingham University Hospitals NHS Trust
Using a secure, encrypted transfer protocol when transferring your data
Having strict access controls on our electronic systems
Deleting your personal data (as outlined in this information sheet) when it is no longer required
Keeping the details we have to contact you separate from the trial data
We will share your name, email address, study ID, study group and age group (8-12 years) with We Create Digital who are a data processor for the study and are hosting the website for the Scratch Less programme. We Create Digital and their sub-processors will use this information to create a user account so you can access the online programme, and send you reminders to complete the programme. We Create Digital will keep the information shared with them for up to 12 months after the end of the study.
Data on how the programme has been used e.g. dates accessed, will be processed by We Create Digital and shared with the study team.
Further information on what personal information is collected for the Scratch Less programme, how it is used, and how cookies are used to make the website work properly can be found in the We Create Digital privacy policy.
If you choose to provide your phone number, we will share your name and telephone number with Esendex, our text messaging provider and their sub processors. They will use this information to send you study-related text messages and reminders about the study questionnaires whilst you are taking part in the study. Esendex will keep the information shared with them for two years or until the end of the RAPID Eczema Trials Project (whichever occurs first) before it is destroyed. You can choose to share your phone number for study-related communication, but it’s okay if you don’t. You can still take part either way.
We may also use Mailchimp and Mailgun platforms within the study to send study newsletters/updates and reminder emails. Your information will be shared with them for processing. Learn more about Mailchimp’s privacy practices here [https://mailchimp.com/legal/terms/].
Learn more about Mailgun’s privacy practices here [https://www.mailgun.com/legal/privacy-policy/].
In accordance with Sponsor, Government and funder policies we may share data about you within and outside the UK for research related purposes to:
Enable researchers to re-use data for new questions.
Check our findings to ensure accuracy and reliability.
This means that they don’t waste time and resources repeating the same work.
If this happens, we will only share the data that is needed. We will also make sure you can’t be identified from the data that is shared where possible. This may not be possible under certain circumstances – for instance, if you have a rare illness, it may still be possible to identify you. If your data is shared outside the UK, it will be with the following sorts of organisations:
Academic institutions and other research organisations
We will make sure your data is protected. Anyone who accesses your data outside the UK must do what we tell them so that your data has a similar level of protection as it does under UK law. We will make sure your data is safe outside the UK by doing the following:
Some of the countries your data will be shared with have an adequacy decision in place. This means that we know their laws offer a similar level of protection to data protection laws in the UK
We use specific contracts approved for use in the UK which give personal data the same level of protection it has in the UK. For further details visit the Information Commissioner’s Office (ICO) website: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
We do not allow those who access your data outside the UK to use it for anything other than what our written contract with them says
We need other organisations to have appropriate security measures to protect your data which are consistent with the data security and confidentiality obligations we have. This includes having appropriate measures to protect your data against accidental loss and unauthorised access, use, changes or sharing
We have procedures in place to deal with any suspected personal data breach. We will tell you and applicable regulators when there has been a breach of your personal data when we legally have to. For further details about UK breach reporting rules visit the Information Commissioner’s Office (ICO) website: https://ico.org.uk/for-organisations/report-a-breach
How will we use information about you after the study ends?
Once we have finished the study, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the study.
We will keep your study data for a minimum of 5 years after the end of the study as per sponsor policy.
The study data will then be fully anonymized and securely archived or destroyed.
What are your choices about how your information is used?
You can stop being part of the study at any time, without giving a reason, but we will keep information about you that we already have.
You have the right to ask us to remove, change or delete data we hold about you for the purposes of the study. We might not always be able to do this if it means we cannot use your data to do the research. If so, we will tell you why we cannot do this.
Where can you find out more about how your information is used?
Nottingham University Hospitals NHS Trust and University of Nottingham are joint data controllers for this study. This means they are jointly responsible for how your data is being processed. You can find out more about how we use your information:
For Nottingham University Hospitals NHS Trust at https://www.nuh.nhs.uk/data-patients-public
For University of Nottingham at https://www.nottingham.ac.uk/utilities/privacy/privacy.aspx
NHS Health Research Authority hra.nhs.uk/patientdataandresearch
by sending an email to: RapidEczemaTrials@nottingham.ac.uk
by calling the Nottingham Clinical Trials Unit on 0115 823 1600
v1.1 23 Jul 2026.