The Wales Cancer Biobank and Cardiff University take data privacy very seriously and the information below is especially relevant for patients who have kindly agreed to donate samples and data to the biobank.

Cardiff University is the data controller for the Wales Cancer Biobank project and is committed to respecting and protecting your personal data in accordance with your expectations and Data Protection legislation. Under data protection law we have to specify the legal basis that we are relying on to process your personal data. In providing your personal data for this research we will process it on the basis that doing so is necessary for our public task for scientific and historical research purposes in accordance with the necessary safeguards, and is in the public interest. The University is a public research institution established by royal charter to advance knowledge and education through its teaching and research activities. Our charter can be found on the Cardiff University website. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interest of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research. As a university we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

You can find out more about how we use your information, or if you wish to raise a complaint about how we have handled your personal data, by contacting Cardiff University’s Data Protection Officer at [email protected]. Further information about Data Protection, including your rights and details about how to contact the Information Commissioner’s Office can be found at: https://www.cardiff.ac.uk/public-information/policies-and-procedures/data-protection.

You can also contact the Information Commissioner’s Office should you not be satisfied with our response to a complaint or believe we are processing your personal data in a way that is not lawful.

When you agree to donate samples and data to the Wales Cancer Biobank, Cardiff University, specifically Wales Cancer Biobank staff, will collect information about you for the biobank records from your NHS medical records. This information will include your name/NHS number/contact details/date of birth and health information which is regarded as a special category of information. We will use your personal information (name, address, NHS number, date of birth) to make sure we are matching the correct medical record to the correct donated samples. Researchers receiving samples and data from the Wales Cancer Biobank will NOT receive your personal information.

The information about your health and care may be provided to researchers running other research studies in this organisation and other organisations. These organisations may be universities, NHS organisations or companies involved in health and care research in this country or abroad. Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research. Your information could be used for research in any aspect of health or care, and could be combined with information about you from other sources held by researchers, the NHS or government.

Where this information could identify you, the information will be held securely with strict arrangements about who can access the information. The information will only be used for the purpose of health and care research, or to contact you about future opportunities to participate in research. It will not be used to make decisions about future services available to you, such as insurance.

Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee.