Version 1.0 - August 2023
The OnTrack Rehab system (consisting of the OnTrack App and OnTrack Tools) is intended to be used by research participants and clinicians as part of the UPBEAT Trial (IRAS 323576 - include REC body when available). The study is sponsored by Imperial College London and is managed by Cardiff University, all study participants are required to provide informed consent according to the study’s research protocol.
Whilst being involved in the UPBEAT Trial and using the OnTrack Rehab system, we may collect, store, and process the following information about you:
Personal information - The OnTrack App collects information such as your name, address, year of birth, gender, email address, home address, mobile/telephone number is collected for the purposes of the study, this information is inputted by you or with support from your NHS therapist. OnTrack Tools collects information such as your name, email, mobile/telephone number, employer, profession, and band/level for the purposes of the study, this information is inputted by you; some information (name, profession, email) may be shared with the patients of your choice for the purposes of the study.
Health data - Information such as the date of your last stroke, the type of stroke you had (and sub-type), your most affected arm, your dominant arm, and how well you can use your arm is collected for research purposes. Activity data is collected via the Apple Watch sensors as you use the application. Rehabilitation goal data is collected via the app and inputted by you and your NHS therapist. Your data is shared with your treating NHS healthcare service (e.g. you therapy team) for the purposes of the study.
Cookies - Our technology uses cookies to distinguish you from other OnTrack users for the purpose of the clinical trial. For more information on the cookies we use and the purposes for which we use them see the ‘Cookies and Tracking Technologies’ section below. Cookie data collected is based on your consent to participate in the UPBEAT Trial.
Technical information - Technical information collected by the OnTrack App includes device information (device ID, device type, system language, operating system and version), information about your app usage (time and frequency you perform certain actions or ‘events’), and other information (server processing times). Technical information collected by OnTrack Tools includes device information (device ID, device type), internet and browser information (IP address, language, browser and version, platform type), information about your app usage (time and frequency you perform certain actions or ‘events’), and other information (server processing times, country location).
Location information - We may collect location information for any device provided by the UPBEAT Trial in case they are reported as lost or stolen exclusively.
All study participants enrolled in the UPBEAT Trial provide informed consent, this is the basis for processing the data.
Imperial College London uses personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Our legal basis for using your information under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, is as follows:
Imperial College London - “performance of a task carried out in the public interest”; Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.
Where special category personal information is involved (most commonly health data, biometric data and genetic data, racial and ethnic data etc.), Imperial College London relies on “scientific or historical research purposes or statistical purposes.
As part of the UPBEAT Trial, we ask for your agreement to process certain data for specific purposes. You have the right to withdraw your consent at any time and without your rights being affected. For more information on the withdrawal process please contact the UPBEAT Trial manager using the contact details provided in the relevant section below.
Data collected for the purposes of the UPBEAT Trial will be retained by Imperial College London and Cardiff University for a minimum of 15 years after the conclusion of the study, this may include anonymised and non-anonymised data.
Data collected via the OnTrack Rehab platform is stored in secure access-controlled computer databases that can only be accessed by specific members of the research team.
We use Amazon Web Services (AWS, Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg) to host data on the OnTrack Rehab platform. Your data is processed on servers in the EU. For further information, please refer to AWS’s privacy policy here: https://aws.amazon.com/privacy/. The processing of your data in AWS servers is based on your consent to participate in the UPBEAT Trial.
At the end of the study, data collected through the devices will be kept anonymous so that it cannot be linked back to you. Study data may be shared with other researchers for the purpose of future research studies.
The Chief Investigator of the UPBEAT Trial is responsible for preserving the confidentiality of participants taking part in the study. Information regarding the participants will be kept confidential and managed in accordance with the General Data Protection Regulation, NHS Caldicott Guardian, The Research Governance Framework for Health and Social Care, and Research Ethics Approval.
Under data protection legislation (GDPR), you have the following rights with regards to your personal information:
We use a third party service (Amplitude, Inc. 201 Third Street, Suite 200, San Francisco, CA 94103) that uses cookies to distinguish you from other users of our services for the purpose of the clinical trial. Amplitude is not able to collect any of your personal information. More information on Amplitude’s privacy policy can be found here: https://amplitude.com/privacy
Additionally, we use Sentry (Functional Software, Inc, 45 Fremont Street, 8th Floor, San Francisco, CA 94105) to identify, monitor, and alert our developers to errors, bugs, and other performance issues that may be occurring in the OnTrack Rehab platform. Sentry is not able to collect any of your personal information. More information on Sentry’s privacy policy can be found here: https://sentry.io/privacy/
We may update this policy from time to time in response to changing legal, regulatory, or technical developments. When we update this policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material changes to this policy if, and where, required by applicable data protection laws.
You can see when this policy was last updated by checking the date displayed at the top of this policy.
For questions regarding the software applications please contact the OnTrack Rehab Team via email at support@ontrackrehab.com
If you need more information about how we handle your data or wish to make a complaint, please contact the research team first at:
Email: upbeat@cardiff.ac.uk
Phone: 02922 514553
Following our response, if you are not satisfied please contact Imperial College London’s Data Protection Officer via email at dpo@imperial.ac.uk, via telephone on 020 7594 3502 and/or via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ.
If you remain unsatisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO) via www.ico.org.uk. Please note the ICO does recommend that you seek to resolve matters with the data controller (Imperial College London) first before involving them.
