INFORM Study Data Privacy Notice

ASTRAZENECA PRIVACY NOTICE FOR THE INFORM STUDY

Background

AstraZeneca UK Limited (“AstraZeneca” “we” “us” “our”) is conducting a research study called INFORM (INvestigation oF cOvid-19 Risk among iMmunocompromised populations).

The INFORM study is registered on the public registry of clinical trials at https://www.isrctn.com/ and has the identification ISRCTN53375662.

Why AstraZeneca UK are Conducting this Study?

The overall purpose of the INFORM study is to generate the evidence necessary to understand unmet need in the prevention and treatment of COVID-19 following the deployment of vaccination campaigns. This may help inform the assessment and usage guidance of COVID-19 vaccines and therapies to protect the most vulnerable patients in England who are not adequately protected by vaccines.

The objectives of the study are to:

• Estimate the size of populations in England that potentially are ineligible for vaccines or are at risk of inadequate response to COVID-19 vaccines.
• Estimate incidence of COVID-19 by age group, disease severity, and selected comorbidities.
• Estimate incidence of long-COVID-19 by age, disease severity, and selected comorbidities
• Describe patterns of healthcare resource utilisation (HCRU) and costs associated with an episode of COVID-19, stratified by age, selected comorbidities, disease severity, and the occurrence (vs. absence) of long-COVID-19.

Additionally, AstraZeneca is exploring if the data could be used to assess the indirect burden of COVID-19 on underlying and/or related diseases (such as influenza).

Who is this notice intended for?

This privacy notice is intended for patients treated and managed by the National Health Service in England whose data is included in the INFORM study.

As a leading pharmaceutical company, we understand and respect that privacy matters to you. This respect is core to all our values and we are committed to protect and treat your data fairly, lawfully and with care. We would like to take the opportunity to explain to you what information we collect about you, the way in which we use your data, how we keep it safe, what your rights are and how you may exercise them.

This privacy notice has been developed with the aim to meet the requirements of privacy laws and data protection legislations throughout the UK  and being in line with AstraZeneca’s Data Privacy Standard it aims to explain our general approach and practices. 

Personal data means any information or piece of information which could identify you either directly (e.g. your name) or indirectly (e.g. a unique ID number). 

Who is the data controller?

NHS England is the custodian of the national datasets (generated by health and social care services) that will be used as part of the INFORM study. As this is an AstraZeneca initiated study, although we will not have access to any of your personal data, we will also constitute a data controller for the purposes of the INFORM study.

We have appointed Evidera Limited, (address: The Ark, 201 Talgarth Road, Hammersmith, London, W6 8BJ), as the data processors. As data processor, Evidera will be given access to the NHS-England secure environment to process your data. The data that will be accessed will however be pseudonymised data which means you will not be identifiable as an individual.

Do we collect any personal data?

As set out above, the INFORM study will access and process data already held in NHS England datasets which consist of patients’ electronic health records, which may include, but is not limited to: 

• Age (or year and month date of birth), ethnicity
• Your health status, diagnoses, and treatments

We do not collect or use any additional data beyond what already exists in your electronic health record (as listed above)

How We will process your data.

Data will be processed both by manual and automatic means via the National Health Service England (NHSE) Secure Data Environment (SDE), where the datasets approved for use are uploaded to a virtual desktop for analysis. Once each set of analyses is conducted by AstraZeneca's appointed data processor, the output is checked for compliance with NHSE’s Safe Output Service Disclosure Control Rules and approved for export. This secure data environment ensures that none of the patients’ individual-level data can leave the NHS England servers.

What is the Lawful basis for processing your data?

Data protection legislation (UK GDPR) requires us to have a valid legal reason to process and use pseudonymised data about you. This is called a ‘legal basis’.

In the context of the INFORM study, the lawful basis upon which we will process your information is in accordance with Article 6(1)(f) and Article 9(2)(j) of the UK GDPR, we process your data where it is within our legitimate interest to do so, and where it is necessary for reasons of public interest in the area of public health and/or is necessary for research purposes.  

We will use the datasets for the purpose of carrying out the INFORM study. We may use the results from the study for the following purposes or for purposes reasonably compatible with the ones listed in this notice such as to: 

• To understand the size and characteristics of these vulnerable populations.
• To assess the burden of COVID-19 among vulnerable populations
• Data from the INFORM study will provide additional information to regulatory and health assessment agencies (e.g., Medicines and Healthcare Products Regulatory Agency [MHRA], National Institute for Health and Care Excellence [NICE]) with additional real- world evidence to supplement and augment trial data in immunocompromised patients.  
• Although considerable research efforts have been devoted to understanding specific vulnerable groups for poor COVID-19 outcomes, data from the INFORM study will help to understand trends in vulnerability to COVID-19 as new SARS-CoV-2 variants emerge. 

To be clear, at no point throughout the study will AstraZeneca itself have access to any patient-level data. All data shared with AstraZeneca will be fully aggregated in nature with small numbers suppressed. Any results of the study will also be fully aggregated and will not include any of your personal-level  information. 

With whom We may share results of the INFORM data.

Only your aggregated data may be shared with: 

Auditors and consultants to verify Our compliance with internal and external requirements; 

Statutory bodies, law enforcement agencies, legal advisors and litigants when required for a legal reporting requirement or defending or instigation a legal claim; and  

Other third parties providing contracted services on Our behalf e.g. medical writers.

How long We keep your data.

Your aggregated data may be processed by manual and automatic means and stored  for the number of years as may be legally required and in accordance with local laws and Our document retention policies. The data may be stored for as long as it is necessary to satisfy Our legitimate business interests, legal or contractual obligations, or in order to establish, exercise, or defend legal claims. If the aggregated data is no longer needed for these purposes, it will be permanently deleted. For more information on AstraZeneca's internal document retention policy, see www.astrazenecapersonaldataretention.com.

Your rights in relation to your data and how to exercise them.

NHS-England patients are able  to opt out from the use of their data for research or planning purposes by changing their national data opt-out choice at any time by using the online service at  www.nhs.uk/your-nhs-data-matters or by clicking on "Your Health" in the NHS App, and selecting "Choose if data from your health records is shared for research and planning". If you choose to opt-out on this basis your data will automatically be removed from the datasets used in the INFORM study.

You have the right to lodge a formal complaint with the UK Information Commissioner's Office. Full details may be accessed on the complaints section of the ICO's website.   

Contact information for Data Privacy.

AstraZeneca has assigned a Data Protection Officer that is responsible for overseeing Our compliance with data protection laws around the world. You may contact the DPO with questions or concerns regarding the processing of your pseudonymised data at Privacy@astrazeneca.com or by mail at: Global Data Protection Officer, AstraZeneca Middlewood Court, Silk Road, Macclesfield, Cheshire, United Kingdom SK10 2NA.  See the section titled, Who is the Controller of your pseudonymised Data, to access the link to each AstraZeneca site and contact information.

Reminder, to exercise your rights related to any of the rights in the section titled, Your rights in relation to your data and how to exercise them, visit: http://www.astrazenecapersonaldataretention.com.

How We make changes to this notice.

We will review this notice on an annual basis and, if necessary, update this notice at that time or more frequently if there are important changes that require an update. Such changes become effective when We post the revised privacy notice on Our website and the date of last update is identified. We will provide additional notice to make you aware of those changes if We make material changes.

GB-60044 | DOP: October 2024