Privacy Notice

Privacy information for PERFORMS Participants

For information about the University’s obligations with respect to your data, who you can get in touch with and your rights as a data subject, please visit: www.nottingham.ac.uk/utilities/privacy/privacy.aspx.

Why we collect your personal data

Personal Performance in Mammographic Screening (PERFORMS) is a web-based educational self-assessment and training scheme for breast screening professionals. All participants examine a set of challenging malignant, benign and normal anonymous FFDM cases containing a range of decisions using the PERFORMS reporting software. Having completed the test set, they receive immediate expert radiological opinion on various aspects of each case.  Each test set provides participants with information about their strengths and weaknesses in reading performance. They also receive further detailed feedback from their personal web portal which can anonymously compare them to their colleagues. PERFORMS also identifies under-performing outliers and provides further tailored training to improve their performance.

Participation in PERFORMS requires data collection for the following purposes;

1. Participants’ identity: we need to be able to verify participants’ identity which is confirmed by their administrator at their Breast Screening Centre. Their personal information and contact details enable us to verify their employment at the hospital.
2. Participation to the scheme: we need contact information to arrange for participants to take part in the PERFORMS scheme, as well as to contact them in case we need to discuss any aspect of their participation in the scheme. 
3. Diagnostic opinion: when participants take part in PERFORMS, giving their diagnostic opinion and reporting the feature type and location of abnormality for each mammographic case, we then hold this information in our database and analyse it to provide them with their results. 
4. Saved information: we hold information about participant’s keystrokes for each case so if there is a loss of internet connection all information is saved in our online system.
5. Questionnaire: we collect information related to participants’ work via their account and our online questionnaire (which is not compulsory to complete) to enable us to do statistically meaningful analysis. This information also enables us to enhance performance data and improve our service to participants.
6. Results: each time participants read our cases, their individual results are uploaded to their account.  only participants and the PERFORMS team have access to these accounts.

Publications: we anonymously share information using statistical data for journal and conference papers as well as presentations at meetings. We also anonymously provide statistical information to funding bodies as part of our contract with them.

Outliers: participants who are statistical outliers in our scheme receive a letter to offer assistance to improve performance.

Legal basis for processing your personal data under GDPR
The legal basis for processing your personal data for this programme is:
Article 6(1e) processing is necessary for the performance of a task carried out in the public interest.  

How we process your data 
We hold information about staff who carry out breast screening, breast radiology, administration and technical PACS support in this area.  This information is: name , address, phone, email, job title, job type, evidence of training, results of PERFORMS scheme, number of cases that they have read, answers to questionnaires, comparison of their performance to an expert panel and to their peers, results if statistical outliers, correspondence between us and them, notes related to their participation, contact details for symptomatic participants, contact details for finance departments.
Participants data are held securely on the PERFORMS database server at University of Nottingham.  This information has a back-up system and the University follows a code of practice to keep their information secure.
After analysing participants’ data, we produce brief reports (participants can see their own data as they have access to their personal online account) as well as organisation reports (only available to the Main Contact of the Unit) to describe the performance of screening personnel. If required, we calculate statistical outliers – those individuals who are performing statistically significantly lower than their colleagues. By identifying which mammographic features or cases which they have had difficulty with we can then indicate how such individuals could improve.

How long we keep your data
The University may store the data for up to 25 years and for a period of no less than 7 years after the research project finishes. The researchers who gathered or processed the data may also store the data indefinitely and reuse it in future research. Measures to safeguard your stored data include:
Personnel records – These are held on a secure database which is backed up within University of Nottingham while personnel records on paper are kept in locked filing cabinets.  Both the records and keys are only accessible by PERFORMS staff, which is based in a confidential and secure area of the university.

Who we share your data with
Anonymous use of data in research:
Extracts of the data may be disclosed in published works that are posted online for use by the scientific community. Data may also be stored indefinitely on external data repositories (e.g., the UK Data Archive) and be further processed for archiving purposes in the public interest, or for historical, scientific or statistical purposes. It may also move with the researcher who collected the data to another institution in the future.
We anonymously share information using statistical data for journal and conference papers and presentations at meetings. 
Sharing of data with funders:
The costs of making the PERFORMS self-assessment available to participants are funded partly by the University and partly by public health organisations in the territories in which PERFORMS is available. Depending on the terms of our contracts with these funders, we may share the data so that a funder knows which participants within its territory have registered and completed the self-assessment.
We may also share anonymised, aggregated information with the relevant public health organisation showing score average and range across all participants in that territory, and how that compares with other territories.
We will not share details of any individual participant’s performance in the self-assessment except in the case of outliers (i.e. where performance falls below acceptable levels), in which case we will notify the participant and, where required by the terms of our contract, we will also notify the relevant national or regional public health organisation so that the funder can ensure that the participant has access to the training they need to improve their performance.
Participants in England:
For participants based in England, participation in PERFORMS is funded by Public Health England (PHE) under a contract for services between PHE and the University of Nottingham. When the University is processing participants’ data in the performance of its obligations under that contract, it does so on behalf of PHE as PHE’s processor, and PHE is the controller of that data. We share data with PHE in the way described above.
At PHE, the PERFORMS data shared with PHE will be held and accessed only by appropriate people in the PERFORMS team at PHE and otherwise held securely and confidentially. PHE will keep all data confidential and will delete participants’ personal data after 25 years.
For information about PHE’s obligations with respect to your data, who you can get in touch with and your rights as a data subject, please refer to PHE’s personal information charter at https://www.gov.uk/government/organisations/public-health-england/about/... or contact PHE’s Data Protection Officer: Alex Sienkiewicz: Public Accountability Unit, Public Health England, 7th Floor North, Wellington House, 133-155 Waterloo Road, London SE1 8UG. Email:dataprotectionofficer@phe.gov.uk

Later in 2021, our contract is likely to transfer to one of the public health agencies that succeeds PHE as a result of the UK Government’s decision to abolish PHE. Accordingly we will then process and share participant data with that agency for the same purposes. We will try and update this privacy notice at the time.

Transfers of your data outside Europe
All data held within the PERFORMS system is held on secure data centres owned and operated by the University of Nottingham. The University does not transfer data outside of the EEA, however, users can access their accounts from non EEA countries. Users accessing their personal data from the PERFORMS systems from outside of the EEA do so at their own risk.