NOAR PRIVACY NOTICE FOR RESEARCH PARTICIPANTS
INTRODUCTION
The Norfolk Arthritis Register Research Study (NOAR) is a large community-based, long-term study investigating the cause and outcome of inflammatory arthritis. Established in 1989, the study collects serial data and samples directly from participants and from medical records in order to undertake this study.
NOAR is sponsored by the University of East Anglia (UEA) in collaboration with the University of Manchester (UoM), working closely with the Norfolk & Norwich University Hospitals NHS Foundation Trust (NNUH). Both universities are registered data controllers and will collect and process information in accordance with UK data protection legislation. The research is funded by Norfolk and Norwich Hospitals Charity. This study has been reviewed and approved by the East of England Cambridgeshire and Hertfordshire Research Ethics Committee (15/EE/0076; IRAS 166048).
This privacy notice applies to all NOAR participants and explains how your personal data is collected, used, stored and shared throughout the study. NOAR is committed to protecting the privacy and security of your personal information. By personal information, we mean information which, by itself or with other data available to the study, can be used to identify you. Please read this privacy notice carefully. If you have any questions about the study, please email the NOAR Research Team at noar@uea.ac.uk .
WHERE DOES OUR INFORMATION COME FROM?
Your Rheumatology Consultant or GP involved in your care has passed your name and hospital number to us as part of the NOAR study approved referral process. Your contact details are accessed by designated staff only to invite you to take part in the study.
NOAR will collect personal information about you when you provide your informed consent to take part in the study. You will be asked to complete and sign a consent form by post or online, whichever you prefer.
If you choose not to take part, UEA will retain your hospital number and date of birth only for a period of 2 years so that we do not recontact you should your details be passed to us again. This is in line with our recruitment inclusion criteria. After this period, we will destroy this information.
Most of the information we use is collected directly from you, either verbally, in writing or when you fill in a questionnaire. Other information we may obtain from your medical records and from NHS England and other data linkages, where you have given your permission to do so. Whenever you provide personal information, we are legally obliged to use it in accordance with the laws concerning the protection of personal information.
LEGAL BASIS FOR USING YOUR DATA
We are collecting and storing personal data in accordance with data protection law, which protects your rights. These state that we must have a legal basis (specific reason) for collecting and using your data. For this study, the specific lawful bases are:
Consent (Article 6(1)(a)) – your participation is voluntary. Consent also covers the initial contact stage, where we may collect basic information (e.g. name, email) to invite you. You can withdraw consent at any time.
Public interest (Article 6(1)(e)) your data supports research to improve health and care;
Scientific research (Article 9(2)(j)) We may process special category data (such as health information) for scientific research purposes, with appropriate safeguards in place.
In addition to, and where compatible with, these purposes, the Universities also combine data collected within its in-house databases to allow statistical reporting and modelling of research data.
Staff who analyse the information will not be able to identify you and will not be able to find out your name or contact details.
Contact noar@uea.ac.uk for further advice, or to withdraw consent.
Section 251 Approval - using patient data without consent
The Confidentiality Advisory Group (CAG) is an independent body which provides expert advice on the use of confidential patient information without patient consent. It provides advice to the Health Research Authority (HRA) for research uses, and to the Secretary of State for Health and Social Care.
Its main purpose is to protect and promote the interests of patients and the public, while also making sure that confidential patient information can be used when it is appropriate, for purposes beyond individual care.
Support under Regulation 5 of the Control of Patient Information (COPI) Regulations (section 251 support) is in place for the NOAR research team to process confidential patient information without consent for the following purposes:
- access confidential patient information to check the eligibility of newly diagnosed patients and make contact to seek consent to be involved in the Register.
- obtain information about hospital admissions (morbidity data) and information about deaths (mortality data) from NHS England for all NOAR participants who have died or whom (for whatever reason)contact with the study has not been maintained. This may be due to participants moving out of the area or not responding to survey requests.
- obtain morbidity and mortality information from NHS England for all NOAR participants whose consent did not give permission for NOAR to collect the NHS England data.
NHS England is the national information and technology partner for the health and care system. Their systems and information help doctors, nurses and other health care professionals improve efficiency and make care safer. NHS England provide morbidity and mortality data for the NOAR research which enables us to identify which patients have died and/or developed certain important comorbidities (e.g. cardiovascular disease, lung disorders, and certain types of cancer).
If you have not explicitly consented for NOAR to collect morbidity data, then you may request that your Hospital Episode Statistics (HES) data is not made available to the research by contacting noar@uea.ac.uk .
WHAT INFORMATION WE HOLD ABOUT YOU
The following table describes what information we collect about you, and when we need to use it.
| TYPE OF INFORMATION | ESTABLISH ENTRY CRITERIA AND INVITE YOU TO TAKE PART IN NOAR | RECRUIT YOU TO THE STUDY (BASELINE DATA COLLECTION) | COLLECT FOLLOW UP DATA | NOTIFY YOU ABOUT FUTURE STUDIES | DISSEMINATE FINDINGS TO YOU/PROVIDE STUDY UPDATES | STORE/TEST BLOOD AND DNA SAMPLES | ACCESS NHS ENGLAND DATA | DATA LINKAGE | DATA ANALYSIS | SHARING RESEARCH DATA OUTSIDE THE NOAR TEAM | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| PERSONAL IDENTIFIERS | |||||||||||
| Full name and title | X | X | X | X | X | ||||||
| Sex | X | X | X | X | X | X | |||||
| Date of birth | X | X | X | X | X | X | |||||
| Hospital number | X | X | X | X | |||||||
| NHS number | X | X | X | X | |||||||
| NOAR unique ID number | X | X | X | X | X | X | X | X | X | ||
| CONTACT DETAILS | |||||||||||
| Full postal address (inc. full postcode) | X | X | X | X | X | ||||||
| District level postcode (e.g. NR1, NR15) | X | X | |||||||||
| Telephone number(s) | X | X | X | X | X | ||||||
| Email address | X | X | X | X | X | ||||||
| 'SPECIAL CATEGORY' OR SENSITIVE INFORMATION | |||||||||||
| QUESTIONNAIRE DATA PROVIDED BY YOU | |||||||||||
| Ethnicity | X | X | X | ||||||||
| Occupation and working status | X | X | X | X | |||||||
| Date of symptom onset | X | X | |||||||||
| Self-examination of joints (which are tender and/or swollen) | X | X | X | X | |||||||
| Self-reported diagnosis | X | X | X | X | X | ||||||
| Current medications and treatments | X | X | X | X | |||||||
| Co-morbidities | X | X | X | X | |||||||
| Hospital admissions/operations and procedures | X | X | X | X | |||||||
| Pregnancy and hormonal history | X | X | X | X | |||||||
| Smoking and alcohol intake | X | X | X | X | |||||||
| Height, weight, hip and waist measurements | X | X | X | X | |||||||
| Clinical Health assessment questionnaire | X | X | X | X | |||||||
| Current health state (EQ5D) | X | X | X | X | |||||||
| Bristol Rheumatoid Arthritis Fatigue Numerical Rating Scale and Falls | X | X | X | X | |||||||
| DATA OBTAINED FROM MEDICAL RECORDS | |||||||||||
| Clinical diagnoses and dates | X | X | X | X | X | X | X | ||||
| Registered GP practice | X | X | |||||||||
| Recent blood test results | X | X | X | X | X | X | |||||
| Medications and treatments | X | X | X | X | X | X | |||||
| DATA OBTAINED FROM NHS ENGLAND | |||||||||||
| Hospital admission data | X | X | X | ||||||||
| Mortality data | X | X | X | ||||||||
| RESULTS FROM BLOOD TEST INCLUDING GENETIC DATA | X | X | X | ||||||||
| DERIVED DATA - for example we use your date of birth to work out your age, age at diagnosis etc. | X | X | X |
SHARING AND DISCLOSING YOUR INFORMATION
Staff access to your personal data held by the Universities will be restricted to those individuals whose roles require use of such data for the purposes listed above.
Where appropriate, we may share certain data with the following organisations for clearly defined research or administrative purposes. In all cases, only the minimum necessary information will be shared, and strict safeguards will be in place to protect your privacy.
| ORGANISATION | DATA SHARED | PURPOSE |
|---|---|---|
| University of Manchester | Pseudonymised research data (including results from analysis of your blood sample, DNA and genetic data) | 1.To carry out data analysis. 2. To link your questionnaire and clinical data with data you have provided to one or both of the following Manchester sponsored studies if you have taken part and given permission for the linkage: a) Rheumatoid Arthritis and Methotrexate Study (RAMS) b) Manchester Arthritis Registry (BSBRBR-RA). |
| NHS England | NHS number; date of birth, sex, district level postcode (e.g NR1, NR10), unique NOAR ID | To obtain information about you if you i) were admitted to hospital ii) should die. If you agree to the NOAR team obtaining health information about you from NHS England, we will provide NHS England with these identifiers to enable NHS England to correctly identify data that pertains to you. The information received may be linked with other NOAR data (e.g. questionnaires, clinical records, sample data) for ongoing research analysis. |
| European Prospective Investigation into Cancer (EPIC) | NHS number; date of birth, sex, district level postcode (e.g. NR1, NR15)unique NOAR ID. | If you have taken part in the EPIC study and agree to the NOAR team obtaining information about you from EPIC, these identifiers will be used to accurately identify and obtain data about you from EPIC for approved linkage with NOAR data. |
| Local Authority responsible for adult social care | First and last name, year of birth, district level postcode (e.g NR1, NR15), unique NOAR ID | If you agree to the NOAR team obtaining social care information about you from the local authority, we will provide these identifiers to enable the local authority to correctly identify data that pertains to you. The data obtained will be used to validate the information you give us and to help health and social care planning for the future. |
| Be Part of Research Volunteering Service (BPORVS) | First and last name, email address | For participants referred via Be Part of Research; UEA will confirm with BPORVS who has joined the study to ensure you are not recontacted about this or other related studies you may no longer be eligible for. |
DATA PROCESSORS
We may consider sharing certain data with other researchers outside of the NOAR team if it is deemed to support valuable scientific research. Before any data is shared:
- We will review the proposed research to ensure it meets appropriate ethical and regulatory standards, including approval from a Research Ethics Committee (REC) if required.
- Any researcher granted access to data must enter into a formal written agreement with the UEA. This agreement will require them to handle the data responsibly, protect its confidentiality, and comply with all relevant data protection laws and best practice.
All decisions regarding data access are made by the NOAR Management/Steering committee. These decisions, along with the rationale and any conditions will be formally recorded and securely maintained.
We will only share data necessary and proportionate to the specific research purpose, and we will never share any information that directly identifies you.
HOW LONG WILL WE KEEP YOUR INFORMATION
The University of East Anglia would like to keep your data for 10 years after the completion of the study. The UK GDPR rule on personal data is that it can only be kept for as long as it is justifiably needed. As NOAR is collecting personal data for a database that is long-term, ongoing, and live, there is good reason that the purpose for which we are collecting data and the permissions we have from you (the participant) to continue holding your data.
After this time, we will assess whether we can anonymise and retain the research data to continue to support research well into the future. We would like to keep your data until such time as bona fide researchers no longer need to utilise the database.
Further guidance about research data management can be found here.
YOUR RIGHTS, CONCERNS & COMPLAINTS, AND OTHER INFORMATION
The privacy and data security of our NOAR participants is important to us. UK data protection law gives you a range of rights in relation to your personal data. Information about your rights can be found on the Information Commissioner’s website.
To maintain the integrity of NOAR as a valuable research data source we need to manage your records in specific ways for the research to be reliable. This means that we won’t be able to let you see or change the data we hold about you.
If you withdraw from the study, we will keep the information about you that we already have.
If you choose to stop taking part in the study, we would like to continue to: -
- Collect information about your health from NHS England
- Collect information from your medical records
- Hold your contact details to notify you of future research studies that may be relevant, and you may be interested in.
If you do not want any of one of these to happen, tell us and we will stop.
CONTACT
Communication preferences: Communications may be sent to you by post, telephone, or electronic means (principally by email) depending on the contact details we hold and the preferences you expressed when giving your informed consent. To let us know how you would prefer to be contacted by NOAR, to withdraw from the study, or if you have any questions about the study, please contact the NOAR Research Team:-
Email: noar@uea.ac.uk.
Telephone: 01603 597205
Post: Bob Champion Research and Education Building, Room 2.20, University of East Anglia, Norwich Research Park, Norwich NR4 7UQ
Website: Contact Us page
If you have any concerns about the study, you can contact the Dean of the Norwich Medical School at med.hospa@uea.ac.uk or the UEA’s sponsor representative at researchsponsor@uea.ac.uk
For any queries about our use of your personal data, contact dataprotection@uea.ac.uk. Further data protection information can be found here.
Further details about the NOAR research can be found on our website: https://noar.uea.ac.uk/about
CHANGES TO THIS PRIVACY NOTICE
This privacy notice is under regular review, and we will provide you with a new privacy notice when any substantial amendments are made. We may change this privacy notice at any time to ensure it always accurately reflects the way we collect, use, and safeguard your Personal Data. The most current version will be displayed here.
Please check this notice from time to time to ensure you are aware of any updates we may have made to our data handling practices. The date of changes will be listed in the ‘Last Updated’ section below.
We will notify you of any updates to this notice via email, include any changes in our annual NOAR newsletter and post the relevant announcement on our website.
This privacy notice was last updated in January 2026.