What happens to participant information?

There are an increasing number of data protection regulations that we are required to follow. These laws require us to disclose participant rights and how we will use participant data.

The two parties involved in this study (the University of Oxford, whose full legal name is “The Chancellor, Masters and Scholars of the University of Oxford”, and Boehringer Ingelheim International GmbH) will be responsible for deciding how any personal data collected during this study are processed and will ensure data protection laws are followed (i.e. they will be the “data controllers”). Both parties are bound by a duty of confidentiality. In an exception to this, only for data that Oxford receives from NHS England, the University of Oxford will be sole Data Controller.

Where the University of Oxford is using information for research purposes, it will only process personal data as necessary for the performance of such research being carried out in the public interest. This is known under data protection law as our “legal basis” for processing personal data.

In this study personal data that directly identifies participants such as name, address, or date of birth (so-called personal identifiers) can be accessed by the EMPA-KIDNEY doctors and nurses who are running the study at local hospitals. Health regulators (such as the UK Medicine and Healthcare Regulatory Agency and U.S. Food and Drug Administration) and auditors from Boehringer Ingelheim could also access these data if they were to ever perform an audit by visit to your local hospital or "virtually" (e.g. due to Covid-19 travel restrictions) to check that the study is being carried out properly. These people are also all bound by a duty of confidentiality.

During the study, a member of the University of Oxford or other EMPA-KIDNEY staff may ask permission to be present during a participant clinic appointment. This helps us ensure study procedures are being followed.

In the UK, name, date of birth, sex, NHS number (or CHI number in Scotland) and postcode will also be stored securely by the University of Oxford to link participants with data held by NHS England (or other central NHS bodies or the UK renal registry). Oxford University will not send these personal identifiers to anyone else (including Boehringer Ingelheim).

To help keep information confidential, information recorded about participants in this study as well as any samples collected are “de-identified”. De-identified means that health information and blood/urine samples are labelled with unique numbers linked inside a computer and not by name.

As already explained above, it would be very difficult for anyone to re-identify participants after de-identification as we use special measures to protect data, but it remains theoretically possible.

The “de-identified” data in this study are to be used for the following purposes: analysis of the study results, to help learn more about how empagliflozin and other “gliflozins” work in the body, to do future research, to write scientific articles on kidney diseases and associated health problems, and to help design and conduct future studies.

Oxford will provide Boehringer Ingelheim with a copy of the study database containing de-identified data only. It may be necessary for copies of the de-identified database to be shared with health regulators and ethics committees, and it may be shared with other bone fide researchers.

Oxford and Boehringer Ingelheim¹ may process and combine data from this study with data from other sources (always using appropriate safeguards) and may carry out these activities alone or in collaboration with public or commercial private partnerships (i.e. third parties) in the areas of research described above.

Some of the above mentioned parties who receive data will be located outside the UK. If any foreign country to which de-identified data is transferred does not have equivalent data protection standards to those required in the UK, appropriate safeguards will be adopted to protect and maintain the confidentiality of data and blood/urine samples (including using standard data protection clauses adopted by the European Commission, where relevant). Should participants require any information about these safeguards, they may contact us at: data.protection@admin.ox.ac.uk

The University of Oxford will safely keep the study data and Boehringer Ingelheim will safely keep the copy of the de-identified database for at least 25 years after the end of the study, and perhaps longer if required by the law or other research needs.