Your Personal Data
The University of Glasgow will be what’s known as the ‘Data Controller’ of your personal data processed in relation to research and public interest purpose. This privacy notice will explain how The University of Glasgow will process your personal data.
Why we need it
We are collecting your basic personal data such as name, email address/contact details, encrypted personal identifiers and characteristics (including user pseudonym, IP address, International Mobile Equipment Identity) and, time and geolocation data in order to achieve research and public interest purpose for BeepTrace research project. We will only collect data that we need in order to provide and oversee this service to you.
List of collected data:
Essential: Encrypted Personal identifiers and characteristics (for example, used user pseudonym (Blockchain wallet address), International Mobile Equipment Identity (IMEI)). BeepTrace will collect these data for COVID-19 contact tracing and research purpose. If you do not opt-in it, you cannot use the service properly.
Essential: Alert data, Alert is sent out while the match of tagged pseudonym is found, BeepTrace project needs users’ alert data to test the performance of application.
Optional but essential for follow up study: Contact information, BeepTrace needs users’ email address to collect users’ feedback, reach out volunteers for research purpose, e.g., performance evaluation and surveys.
Optional: Geolocation data, BeepTrace collect users’ location data to test the performance of application for research purpose.
Optional: Time of being at a known location, BeepTrace collect users’ location data to test the performance of application for research purpose.
Legal basis for processing your data
We must have a legal basis for processing all personal data. As this processing is for Academic Research, we will be relying upon Task in the Public Interest in order to process the basic personal data that you provide.
We will also be asking for your consent:
- When you download the app to your device
- If you decide to supply additional, optional information to assist with evaluation of the app
What we do with it and who we share it with
- All the personal data you submit is processed by staff at the University of Glasgow in the United Kingdom. We do not share your personal data with any third party.
- We store your encrypted anonymous and non-identifiable data (with private keys held by user locally) on Amazon Web Service (AWS), which we will adopt sufficient safeguards (e.g. asymmetric encryption, including ECC Asymmetric-Key Algorithm and RSA 4096bits cryptosystem) to keep users’ privacy and data protection right and ensure the data security. Without your private key or authorization, the content of your data cannot be read. Users’ private key and relevant encrypted data (e.g., encrypted diagnosed information) will be store in user’s local devices. Your identifiable personal data is securely collected and stored by the authorised staff of University of Glasgow on university local storage.We only keep your personal data for 14 days. We will then completely delete your information by authorised staff of University of Glasgow.
- Once your pseudonyms data is match with other users’ pseudonyms who had COVID-19 recently. The alter will display to remind you that you had close contact with COVID-19 patient.
How long do we keep it for
Your data will be retained by the University for 15 days. After this time, data will be securely deleted. However, in the case of delayed process of data, the data may be kept a bit longer, but no more than 45 days from collection. A reason of extended period of data storage will be provided and validated by UofG staff.
What are your rights?*
You can request access to the information we process about you at any time. If at any point you believe that the information we process relating to you is incorrect, you can request to see this information and may in some instances request to have it restricted, corrected or, erased. You may also have the right to object to the processing of data and the right to data portability.
Where we have relied upon your consent to process your data, you also have the right to withdraw your consent at any time.
If you wish to exercise any of these rights, please submit your request via the webform or contact dp@gla.ac.uk. You could also directly contact us (and we are ideally the first point of contact for general queries: lei.zhang@glasgow.ac.uk, +44 (0) 141 330 8616 or postal address: Room 420, James Watt Building (South), School of Engineering, University of Glasgow, Glasgow G12 8QQ
*Please note that the ability to exercise these rights will vary and depend on the legal basis on which the processing is being carried out.
Complaints
If you wish to raise a complaint on how we have handled your personal data, you can contact the University Data Protection Officer who will investigate the matter.
Our Data Protection Officer can be contacted at dataprotectionofficer@glasgow.ac.uk
If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner’s Office (ICO) https://ico.org.uk/
(Optional) I agree to my personal information being used for app evaluation and understand that this is voluntary. I wish to be contacted by the following methods for future follow ups and user surveys (tick as appropriate):
? Email ? Mobile ? Text
I have read and understand how my personal data will be used.
Signed: ………………………………………………………………………………………………………
Date: ………………………………………………………………………………………………………