The EPIC Privacy Statement

Who we are

The Enabling the early and equitable diagnosis of epilepsy in infants in the community (EPIC) is led by the University of Edinburgh and funded by the UK Research and Innovation Engineering and Physical Sciences Research Council [Grant number UKRI1659]. The Unit consists of the University of Edinburgh with seven partners: United Kingdom Infantile Spasms Trust (UKIST); Epilepsy Research Institute UK (ERI-UK); Epilepsy Scotland; SYNGAP1 UK; BrainsView; Newcastle University and UCB Pharma. 

For data collected under this Privacy Statement, the University of Edinburgh is the Data Controller (as that term is defined in the EU General Data Protection Regulation (EU) 2016/679), registered with the Information Commissioner’s Office, Registration Number Z6426984.

You can contact the University of Edinburgh Data Protection Officer at dpo@ed.ac.uk.
The University of Edinburgh’s data protection policy and privacy policy are available online at https://www.ed.ac.uk/data-protection/data-protection-policy and https://www.ed.ac.uk/about/website/privacy

What Information is collected by EPIC and how do we use it? 

• Personal details (including: name, email address, phone number, dietary and mobility/access requirements) for those who sign up to our family or clinician mailing list and register. Through this mailing list we will send project updates, Patient Public Involvement and Engagement (PPIE) opportunities and details on how you can get involved with EPIC. Opting-in to receive information does not mean you have to get involved, we will simply be sharing information with you and you will have time to ask questions and consider if you would like to get involved.
• Personal details (including: name, email address, phone number, address, passport details, dietary and mobility/access requirements) for those who attend any of our meetings in person. If you are an attendee, speaker or facilitator, we will use your information to provide you with the details you need to attend the event, make travel arrangements, and allow strategic planning of future events.
• Video recordings and photography from our events, which may be online or in person. Video recordings of content presented at events may be published on the EPIC website and shared on social media. Photographs from events may be used in promotional material or presentations about EPIC and shared on social media. We will always notify participants if an event is being recorded and/or if photographs will be taken. If it is an online event, we will clarify the use of the recording and allow people to leave the event or turn off their camera if they do not wish to be filmed or photographed. If the event is in person, we will ask you to inform one of the organisers at the event if you do not wish to be filmed or photographed.
• Posting images and/or video on the EPIC website or University of Edinburgh social media channels constitutes international transfer of data. This will only be done with explicit consent of the individual(s) concerned.
• Any information you post, email or otherwise send to us. We will use this information to reply to you and to keep records of what we say.

Legal basis for using your information 

Whenever we use personal data we must have a legal basis for doing so. The legal basis for using your information will normally be legitimate interest, for the day-to-day running of EPIC.

How we store and share your personal information

University staff working for EPIC, in administration roles or the direct research team, and patient representative/s involved in co-production will have access to your personal information. Information about you will be stored securely with controlled access.

• Other departments and services within the University of Edinburgh;
• The University of Edinburgh’s approved travel provider (currently Key Travel) for the purposes of making travel and accommodation arrangements;
• The University of Edinburgh’s international banking payments provider (currently Flywire) for non-staff international payments;
• Co-hosts and organisations involved in delivering events and conferences;
• Videography and photography companies;
• Research funding bodies (e.g. for reporting or audit of financial records);
• Eventbrite, Microsoft Forms and Microsoft Teams for event registrations.

Personal data will not be shared with external service providers other than those acting on the instructions of the University of Edinburgh. Where your personal information is shared, a written agreement will be put in place with the provider to set out the purposes for which the information can be used and the security measures that must be in place. This agreement will ensure that the service provider agrees never to use your data for any additional purposes not set out in the agreement.

Otherwise, unless required to do so by law, we will not share, sell or distribute any of the information you provide to us without your consent.

How long will your information be held?

Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected and so we can comply with our legitimate and contractual obligations. At the end of that retention period, your data will  be deleted completely.

In the case of subscribed services such as the EPIC PPIE mailing list/register, we will review all list members at least once a year. You can opt out of our mailing lists at any time.

Your data protection rights

Under data protection law, you have rights including:
Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at epic.team@ed.ac.uk if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you may in the first instance contact the University of Edinburgh Data Protection Officer at dpo@ed.ac.uk.

If you remain dissatisfied then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

Changes to the privacy policy

We keep this privacy policy under regular review and may amend this policy from time to time. If we make any substantial changes we will notify you by posting a prominent notice on the website.