Cookies on this website
We use cookies to ensure that we give you the best experience on our website. If you click 'Continue' we'll assume that you are happy to receive all cookies and you won't see this message again. Click 'Find out more' for information on how to change your cookie settings.

how is information collected about me in ORIon-4?

Participants in ORION-4 are asked to attend regular study clinic visits. During these visits health and other information about you is recorded on a secure computer system. As well as the information you provide during these study visits, information may be requested from your usual doctors or other sources.     

For UK participants, the coordinating centre in Oxford will ask for information about your health from Health Registries or NHS bodies such as NHS Digital, the electronic Data Research and Innovation Service (eDRIS), which is a part of Public Health Scotland, and the SAIL Databank at the University of Swansea. The ORION-4 team would send your name, date of birth, NHS number (or CHI number in Scotland) and postcode to NHS Digital, or other similar body, who can link this information to individual participants in the study.  For participants living in England and Wales, NHS Digital provides information about any cancer on behalf of Public Health England. NHS Digital also provides information about any admissions to hospital (called Hospital Episode Statistics). In addition, NHS Digital provides information about people who may have passed away in order that the study does not make contact and cause any distress to relatives. This information includes date and cause of death. Similar information will be requested from the relevant bodies for participants living in Wales and Scotland. At any time you can contact the study team to withdraw permission for the study to get this information. 

Will my information be kept secure?

Information about you is entered onto a computer, processed and stored securely. The study is co-sponsored by the University of Oxford and Novartis Pharmaceutical Corporation. The University of Oxford is the "data controller" for the information collected about participants. This means that the University of Oxford is responsible for looking after your information and using it properly. No information identifying you will be passed to Novartis Pharmaceutical Corporation.

Blood samples are sent to a laboratory at the University of Oxford for analysis. They are identified by a unique number linked in the computer to other study information. In the laboratory they are not linked to your name or anything else which could identify you. 

Who has access to my personal data? 

Personal data that directly identifies you (such as your name, address, and date of birth) can be accessed by study staff at the local ORION-4 site. 

Nurse monitoring staff from the coordinating centre may occasionally ask permission to be present during a clinic visit to make sure the study procedures are being followed. Relevant sections of your medical notes, and information collected about you during the study, may be looked at, in confidence, by authorised individuals from a local study site, the University of Oxford, Novartis Pharmaceutical Corporation, and regulatory authorities to check that the study is being carried out correctly.

If you are a UK participant, personal data which directly identifies you (such as name, address and date of birth) can also be accessed by the ORION-4 coordinating team at the University of Oxford. The only people in the ORION-4 coordinating team who will have access to your personal data will be people who need to contact you (for example to rearrange a study clinic appointment or discuss any questions you have about the study). The people who analyse the information will not be able to identify you.  

The ORION-4 team at NorthWest eHealth will be able to access details of people taking part in ORION-4 at local General Practices in Manchester so they can help with enquiries about appointments and questions about the trial.  

NHS bodies such as NHS Digital, SAIL and eDRIS will also receive information about you as part of the ORION-4 team’s request to link study participants to national electronic health records.

How long is my personal data held by the ORION-4 team? 

The University of Oxford is required to keep the information collected about you for at least 25 years after "end of the study" and perhaps longer if required by the law or other research needs. The "end of the study" is when the last health information is collected about study participants which may be many years after the end of the scheduled treatment period when everyone stops the study injections and the main results are analysed. 

What are my data rights? 

The UK general data protection regulation (UK GDPR) applies in this study in addition to US or other UK regulations where appropriate. These laws require us to tell you about the rights you have over the personal data collected about you in the study. 

The University of Oxford is using your personal data for research purposes, it will only process personal data as necessary to undertake research that is being carried out in the public interest. This is known under data protection law as our “legal basis” for processing your personal data.

Your rights to access, change or move your data are limited as the University of Oxford needs to manage your information in specific ways in order for the research to be reliable and accurate. You have the right to access any personal data that is held about you by the ORION-4 team and the right to ask us to correct any inaccurate personal data we hold about you. You have the right to restrict or object to processing of your personal data.  However, if you decide that you do not want any more information collected about you by the ORION-4 team, the University of Oxford may be obliged by law to keep information already collected to ensure consistency and reproducibility of the study results. Rights to receive an electronic copy of the personal data held about you are also limited. 

If you would like to discuss this further please contact the ORION-4 team or alternatively you can contact the Data Protection Officer,

If you are not happy with the way your data has been handled by the ORION-4 team you have the right to lodge a complaint with the Information Commissioner’s Office (0303 123 1113 or