Please note: DataLoch hosts and processes personal data from both patients (routinely collected health and social care data used for research, hosted within NHS Lothian) and applicants (researcher application data, survey responses, public enquiries and newsletter subscribers, hosted within the University of Edinburgh).
The University of Edinburgh is responsible for researcher applicant data, survey responses, public enquiries, and DataLoch newsletter subscriptions. NHS Lothian is responsible for patient data processed as part of the DataLoch service. (For details about personal data processed within NHS Lothian, visit the NHS Lothian DataLoch Privacy Notice.)
The rest of this privacy notice is focused on researcher applicant data, survey responses, public enquiries, and DataLoch newsletter subscriptions for which the University of Edinburgh is responsible.
The type of information we collect and how we get it
If you are an interested member of the public, the information you provide will be used to respond to queries or subscribe you to our newsletter, based on your request. This information will include your name and email address.
If you are a researcher interested in accessing data or services, the information you provide will be used to centralise completion, submission, review and approval processes and documentation for applications. We may also receive personal information indirectly as part of a researcher request for access to data by virtue of you being a collaborator on that application. This information will include your name, business address and email address. You may also provide this information within survey responses.
How we use the personal information
For enquiries and newsletter subscriptions: We are using information about you because it is necessary for responding to your query, or because you have given us your consent by subscribing to our newsletter. This information will not be shared further; it will only be used to subscribe you to our newsletter. You can withdraw your consent for the newsletter at any time by clicking on the ‘unsubscribe’ link in the newsletter or by contacting the DataLoch team.
For research applications: We are using information about you because it will be necessary for the performance of a contract to access research data. Your personal information will only be used to process your project and give access to the relevant data. In order to complete this, your information may be shared with: a) NHS Lothian as Data Controller of the data; and b) Public Health Scotland for setting up secure access to the Scottish National Safe Haven.
For survey responses: We are using information about you because it is necessary to attribute responses to an individual/project within publicly available summaries on the HDR UK Gateway and our own website. Any business information you supply may be used by us to contact you about your responses.
How we store your personal information
All information is stored in secure UK GDPR-compliant servers within the EU.
We will hold the personal data you provide for a limited time, based on the reason the personal data has been shared. We will hold the personal data for three years from the submission of your query, will confirm with you within three years after subscribing to the newsletter whether you still want your information to be registered for continued updates, or for three years from completion of your project request unless otherwise requested.
Requests for removal of personal data can be made to dataloch@ed.ac.uk.
Disposal of your information will be in line with University of Edinburgh policies.
If you have any questions, please contact dataloch@ed.ac.uk.
For further information about data sharing, your rights and how to complain about data held within the University of Edinburgh for research applications, survey responses, public enquiries, and newsletter subscriptions, please see the continued privacy notice.
Cookies
As with most websites, the DataLoch website uses cookies: tiny files stored by your browser. The ones we use are necessary for the website to function, as summarised in the below tables.
Cookies for the main website
Necessary
| CookieConsent | Stores the user's cookie consent state for the current domain. |
| cookie-agreed-version | Stores the user's cookie consent state for the current domain. |
| __cf_bm | This cookie is used to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on the use of the website. |
| rc::a | This cookie is used to distinguish between humans and bots. |
| rc::c | This cookie is used to distinguish between humans and bots. |
Statistics
| _ga | Registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| _ga_# | Used by Google Analytics to collect data on the number of times a user has visited the website as well as dates for the first and most recent visit. |
| vuid | Collects data on the user's visits to the website, such as which pages have been read. |
Cookies for research applications
Necessary
| CookieConsent | Stores the user's cookie consent state for the current domain. |
| __cf_bm | This cookie is used to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on the use of the website. |
| XSRF-TOKEN | Ensures visitor browsing-security by preventing cross-site request forgery. This cookie is essential for the security of the website and visitor. |
| laravel_session | This cookie is used internally by the website’s owners, when uploading or renewing website content. |
For more information about cookies, you may wish to visit the Information Commissioner’s Office website.
As DataLoch develops further, this privacy notice will be updated accordingly. This privacy notice was last updated on 18 September 2024 to include reference to surveys that may be completed by researchers.