What happens to your health data when you take part in research

Handing over information about your body to a stranger is a real thing to do, and it deserves a real explanation rather than a consent tick box.

Key points

• Health information receives extra protection under UK GDPR.
• Ask whether data is identifiable, pseudonymised or anonymous.
• A clear consent form should explain access, storage and deletion.

Health information has its own legal category

Under UK GDPR, information about health and a person's sex life is special category data and receives additional protection. [1]

An organisation needs both an Article 6 lawful basis and an Article 9 condition. Explicit consent and qualifying scientific research are possible Article 9 routes, but neither applies automatically to every organisation or project. [2]

You are entitled to be told which one applies to you, before you answer anything.

Who sees what

A well-designed study splits the two halves apart.

The researcher sees your answers attached to an anonymous ID. They know that participant 0472 is forty three, perimenopausal and has tried two treatments. They do not need your name to learn anything from that.

The platform sees the account information needed to verify you and pay you. It does not need to see your survey answers, and on FeFe it does not: studies run on the researcher's own survey tool, so your responses go to them, not to us.

The health profile you fill in when you join is a third thing. It stays with FeFe, it is what matching runs on, and it is never sold. Researchers see counts, not people. They can see that eighty women match their criteria. They cannot browse them.

Anonymised, pseudonymised, identifiable

These three words get used loosely and they mean different things.

Identifiable means your name or something equivalent is attached.

Pseudonymised data can still be linked back using additional information and remains personal data. [3]

Anonymised means the link is gone and cannot be rebuilt. Once genuinely anonymised, data protection law largely stops applying, which is exactly why the point of anonymisation is usually the deadline for withdrawing.

Free text is the weak point. If you write a detailed account of a rare condition in a small town, that paragraph can identify you even with your name removed. Worth knowing before you write it.

Your rights

Data protection law provides rights including access and correction, while deletion and objection rights can be limited in some research circumstances. You can complain to the ICO about how an organisation has used your data. [4] [5]

Questions worth asking before you consent

• Who is the data controller, and is there a privacy notice I can read?
• Will my answers be linked to my name at any stage?
• How long will the data be kept, and where?
• Will it be shared with anyone outside the research team, or moved outside the UK?
• Until when can I withdraw?

A study that answers those clearly is one you can trust. A study that gets vague is telling you something.

Start from the beginning with the participant guide, or check a specific study against the legitimacy checklist.

References

1. Information Commissioner’s Office. What is special category data?
2. Information Commissioner’s Office. What are the conditions for processing special category data?
3. Information Commissioner’s Office. Pseudonymisation.
4. Information Commissioner’s Office. Your right to get copies of your data.
5. Information Commissioner’s Office. Make a data protection complaint.