Privacy Policy
REDCap Privacy Policy
Effective as of September 16th. 2024
Introduction
This “Privacy Policy” describes the privacy practices of the University of Alberta (the University) where they relate to the Research Electronic Data Capture (REDCap) systems installed and operated by the University. This Privacy Policy describes how we collect, use, disclose and otherwise process personal information with REDCap.
End Users
End-users are researchers and members of study teams, participating research institutions and study sites, that have a user ID and password login to REDCap. The University of Alberta is the Data Controller for information relating to system end-users.
We collect minimal amounts of end user information in order to provide secure access to the REDCap system, to communicate with our users, and to comply with legal and regulatory requirements. Apart from the information you provide to us this information may also include IP addresses, usage information (such as audit trails and logging data) and other technical data that is used to manage your REDCap session.
Study Participants
Study participants are research subjects involved in studies hosted on the University of Alberta’s REDCap systems. Usually the University of Alberta manages all aspects of the data collected by the system. (The University is the Data Controller). However, under certain circumstances, we may be involved in a research collaboration collecting data on behalf of another institution. (The University is the Data Processor).
Participant information may be provided to members of the study team and entered into REDCap. Alternatively, data may be entered into REDCap directly by the participants themselves using REDCap’s survey interface.
Participant information is collected and processed to fulfil the academic research objectives of individual studies. Research involving people is reviewed and approved by Research Ethics Boards (REBs) according to strict ethical principles. In Canada these are defined by the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans – TCPS 2. Studies are conducted in compliance with the ethics and privacy legislation applicable in each jurisdiction where the data is collected. Unless a waiver is granted, study participants are informed of the purpose of the research, how their data will be stored, processed and used, and their rights to withdraw from the study. We only collect personal data from you if you have provided informed consent. Informed consent can be withdrawn at any time.
Your Rights and Choices
If you choose not to share your information you may not be able to participate in the research study. In the case of end-users we may not be able to provide you with access to the REDCap system.
Depending on your jurisdiction, you may have legal rights associated with the University collecting your data, including rights to access, correct, delete, transfer, or object to the storage and processing of your data.
These rights vary by jurisdiction and may be overridden by superior legislation. For example, participants may not have the right for their data to be deleted if there is a legal obligation for the data to be retained, or if the data is necessary for the integrity and reliability of the scientific research for which it is collected.
In some studies participant data is anonymized and cannot be traced back to the participant. These rights do not apply to fully anonymized data.
How to Contact Us
In the first instance, inquiries relating to data collection, storage, processing and privacy should be made directly to the study team responsible for the study that you are involved in. If you are a study participant you should have been provided with contact information when you agreed to participate in the study. If you cannot contact the study team you may email the University’s REDCap helpdesk at redcap@ualberta.ca. We will forward your inquiry to the researcher responsible for the study.
As a last resort, see this web page for information about the University’s Information and Privacy office.
Security
The security of the data we collect is important to us. We take a number of organizational, technical, and physical measures designed to protect this information, both during transmission and once we receive it. However, no security safeguards are 100% secure and we cannot guarantee the security of this information. If you believe the security of your data has been compromised please contact the team responsible for the study.
Data Transfer
The University of Alberta is located in the province of Alberta, Canada. Individual researchers may be working with collaborators in other Canadian provinces or internationally. Data collected outside Alberta is transferred to Alberta for processing and storage. Data may be transferred to other locations or governmental jurisdiction where privacy laws may not be as protective as those in your jurisdiction. If you are a study participant and your data will be shared outside of the University of Alberta this should be documented in your study consent documents.
Other Sites and Services
Individual study pages may contain links to other websites and services. These links are not an endorsement, authorization, or representation that the University is affiliated with that third party. The University does not exercise control over third party websites or services and is not responsible for their actions. Other websites and services may follow different rules regarding the use or disclosure of the information submitted to them. We encourage you to read the privacy policies of the other websites you visit and the services you use.
Changes to this Privacy Policy
We reserve the right to modify this Privacy Policy at any time. We encourage you to periodically review this page for the latest information.
GDPR Privacy Statement
This “Privacy Policy” describes the privacy practices of the University of Alberta (the University) where they relate to the Research Electronic Data Capture (REDCap) systems installed and operated by the University. This Privacy Policy describes how we collect, use, disclose and otherwise process personal information with REDCap.
The General Data Protection Regulation (“GDPR”) is a data protection law that applies across the 28 member nations of the European Union as well as Iceland, Lichtenstein, and Norway (the EU and these 3 nations collectively make up the European Economic Area or “EEA”). The United Kingdom also has its own GDPR.
Research studies that collect data from study participants in the EEA and United Kingdom should comply with applicable GDPR legislation.
1. Contact Details
For any questions or to exercise your rights you should contact the Principal Investigator for the research study that you are participating in. Alternatively you may contact the University’s Information & Privacy Office, who will function as a Data Protection Officer under the GDPR for the purposes of this Privacy Statement.
Mary Golab
Director, Information & Privacy
Information and Privacy Office (IPO)
7-20 University Terrace, 8303 – 112 Street NW
Edmonton, AB T6G 1K4
+1 780 492-9419
2. Purpose of Data Processing
We process personal data to manage and conduct academic research studies, improve patient care, ensure regulatory compliance, and enhance our REDCap services.
3. Legal Basis for Processing
Our legal basis for processing personal data includes:
Consent from study participants.
Performance of a task carried out in the public interest or in the exercise of official authority.
Compliance with legal obligations.
Legitimate interests pursued by the University as part of its academic and research mandate, and ensuring the safety and efficacy of clinical research.
4. Data Subject Rights
You have the right to request:
Access to your data.
Correction of inaccurate data.
Erasure of your data.
Restriction on the processing of your data.
Data portability.
Withdrawal of your consent.
You also have the right to lodge a complaint with your applicable supervisory authority, or with the University’s Information & Privacy Office (see “Contact Details” at Section 1 of this GDPR Privacy Statement above).
5. Categories of Personal Data
We collect and process the following types of personal data, as necessary for the purposes of the applicable Study:
Personal Identification Information: Name, contact details, date of birth.
Health Information: Medical records, health conditions, treatments, laboratory results.
Research Data: Data collected through clinical trials and other research activities.
6. Recipients of the Data
We may share your data with:
Research teams and collaborators within the University of Alberta.
External researchers and institutions collaborating on research studies.
Regulatory bodies and ethics committees.
Service providers assisting in data management and analysis.
7. International Data Transfers
Your data may be transferred to countries outside the EU/EEA. We ensure these transfers are safeguarded by appropriate measures.
8. Data Retention Period
We retain personal data for the duration of the research study and as required to comply with legal and regulatory obligations. Specific retention periods are determined based on the nature of the data and the requirements of the study.
9. Data Security
We implement administrative, technical, and physical security measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction.
10. Automated Decision-Making
We do not engage in automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals.
11. Source of Data
If not collected directly from you, the data originates from healthcare providers involved in your treatment and care, or from other researchers collaborating on the study.
12. Updates to This Notice
We may update this privacy notice periodically. Any changes will be posted on this page and, where appropriate, notified to you via email.
13. No Obligation to Provide Data
There is no statutory or contractual requirement which would obligate you to provide your personal data for the specific Study purposes. For clarity, you are not obligated to provide any such personal data. The consequences of you not providing the requested personal data may include non-eligibility to participate in the Study.