SCAMP > Privacy notice

Privacy notice

Research Study Title: Study of Cognition, Adolescents and Mobile Phones (SCAMP) Wave 2 

IRAS 150360 

This Privacy Notice describes how your personal information will be processed in this study. Please contact us at scamp@imperial.ac.uk if you have any questions. 

Data controller: Imperial College London, located at South Kensington Campus, London, SW7 2AZ, is the sponsor and data controller for the SCAMP study. We will be using information from you and your medical records in order to undertake this study and will act as the data controller for this study. A Data Controller is the legal entity which determines how and why personal data is collected and used. This means that they are responsible for looking after your information and using it properly. 

What personal data we collect and how we use them 

Personal data means any information about you. We collect and process two kinds of information about you. Depending on when you are involved in our study and how, we may collect some or all of these. 

1. Personal identifiable information. It includes: 

  • Your name. 
  • Email address. 
  • Date of birth. 
  • Mobile phone number. 
  • Your correspondence address. 

2. We also collect other personal information. It includes: 

  • Password 
  • Your school name. 
  • Your mobile phone usage which includes frequency and duration of calls and messaging, time spent on different apps; amount of data usage; and when the phone is turned on and off (collected in the background by the app, if you’ve given permission)  
  • Your physical activity frequency and intensity (collected in the background by the app, if you’ve given permission) 
  • Your sleep duration and quality (collected in the background by the app, if you’ve given permission) 
  • Your cognitive abilities. 
  • Sociodemographic information (e.g. ethnicity) 
  • Information about your lifestyle. 
  • Information about your physical and mental health  
  • Information about your educational records  
  • Information from biological samples you donate 
  • Genetic information (collected when biosamples you have donated are analysed in a lab). 

We collect and process this information for the purpose of: 

  • Allowing the SCAMP Study app to function, e.g. allowing you to create an account in the app, managing rewards points you have earned. 
  • Keeping in touch with you about the SCAMP study. 
  • Sending you invitations and packages to participate in different parts of the SCAMP study. 
  • Sending you information about the rewards and how to redeem your rewards.  
  • Conducting scientific research into young people’s physical and mental health. 

The information listed above is collected directly from you, when you fill in survey questions or complete cognitive tasks (which are a bit like computer games), unless stated otherwise. 

Some of the information listed above is collected directly from your mobile phone device (i.e. in the background), if you have given permission for this, as stated above.  

Some information about physical activity and sleep will be collected in the background by the app, from Apple HealthKit or Google Fit on your phone (depending on your mobile phone operating system). If you agree to wear an activity tracker, more detailed information about physical activity and sleep will be collected from an activity tracker (e.g. Fitbit), via connection to Fitabase, a web platform that was designed for research purpose to manage and collect data from multiple fitness trackers at the same time. Your data will be gathered and stored by both Fitbit Inc (Fitbit) and Small Steps Labs LLC (Fitabase) and Fitbit will be the controller for the data they collect. Please read their privacy policies (https://www.fitbit.com/global/uk/legal/privacy-policy) to understand how they will use your data. 

Some information is collected when biological samples you have donated are analysed in a lab – this will include genetic information, and may in the future include other measurements such as, measures of inflammation and metabolism. 

In addition to information you provide via surveys, if you give permission we also collect information about you for this study from NHS Digital who will provide data such as: hospital in-patient admissions, outpatient attendance and birth records. We will send your name, gender, date of birth, and address to NHS Digital who will then link the information on our behalf to your NHS number, update your contact details and return the updated details and health data to us. 

We also collect information about you for this study from the Department for Education (National Pupil Database) – this information includes your name, postcode, sociodemographic information, and educational records. 

We will link information you have provided in the past and future, with routine health and educational data collected as described above, and any additional information you provide.  

We will not sell your personal information to third parties, such as advertising companies. We will only use your personal information when the law allows us to.  

How is information about you kept confidential? 

Your confidentiality, and the appropriate use and protection of your data are top priority. Imperial College ensures this research complies fully with General Data Protection Regulation (GDPR) and the Data Protection Act 2018. All individually identifiable data are dealt with in the strictest confidence. Your personal data are stored long-term on a secure computer network at ICL. Your identifiable information is stored separately from other information about you, e.g. your health, educational records, genetic information, and behaviours, to preserve confidentiality. Study findings will be published in scientific journals but no data individually identifying you, your family or your school will ever be published. 

Who can access and use your information? 

Where appropriate, your data will always be analysed by the research team in a de-identified form. Access to your identifiable information is strictly limited to key members of the research team, who are required to sign strict non-disclosure agreements. This is an agreement where we must stick to by law where we agree that we will not tell anyone else your information. Your other personal information may be shared with other researchers to support research in the future, but only in a form that does not identify you. 

How long will we keep your personal data? 

We follow the rules set by the organisation who pays us to do our research. This is 25 years after the end of the study. 

Your rights 

Under the GDPR you have a number of important rights. In summary, you have a right to:  

  • Access your personal data. 
  • Require us to correct any mistakes in your information which we hold. 
  • Ask for the data we hold about you to be removed from our records in certain situations. 
  • Restrict our processing of your personal information in certain situations. 
  •  Receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations. 
  • Object to our continued processing of your personal data in certain situations. 
  • Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you 

More information on your rights can be found on the Information Commissioner’s Office (ICO) website at this link. 

Legal basis 

As a university we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. 

Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research. 

We process your data for the purpose of scientific research in the public interest under General Data Protection Regulation (GDPR) Articles 6(1)(e) and also 9(2)(j), as the data relate to the processing of special category (health, genetic, ethnicity) data. 

International transfers 

There may be a requirement to transfer information to countries outside the European Economic Area (for example, to a research partner). Where this information contains your personal data, ICL will ensure that it is transferred in accordance with data protection legislation. If the data is transferred to a country which is not subject to a European Commission (EC) adequacy decision in respect of its data protection standards, ICL will enter into a data sharing agreement with the recipient organisation that incorporates EC approved standard contractual clauses that safeguard how your personal data is processed. 

Sharing your information with others 

For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we will share your personal data with certain third parties. Other College employees, agents, contractors and service providers (for example, suppliers of printing and mailing services, text message and email communication services or web services, rewards providers, or suppliers who help us carry out any of the activities described above). Our third party service providers are required to enter into data processing agreements with us. We only permit them to process your personal data for specified purposes and in accordance with our policies. 

Complaints 

If you wish to raise a complaint on how we have handled your personal data or if you want to find out more about how we use your information, please contact Imperial College London’s Data Protection Officer via email at dpo@imperial.ac.uk, via telephone on 020 7594 3502 and/or via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ. 

If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO). The ICO does recommend that you seek to resolve matters with the data controller (us) first before involving the regulator. 

Changes to this Privacy Notice  

This Privacy Notice will be kept under regular review and any updates will be placed on this website (https://www.scampstudy.org/privacy-notice/). 

Updated August 2022, Version 3