Privacy Notice

v2.0 July 2026

Who are we?

We are the COVID Symptom Study Biobank (CSS Biobank) based in the Department of Twin Research, Ageing and Genomic Epidemiology (DTR-AGE) at King’s College London. The DTR-AGE is a research department within the School of Life Course & Population Health Sciences. The DTR-AGE collects, stores, and uses personal information (any information that relates to or may identify an individual) about certain groups of people with whom we interact to perform medical research under the banner of the CSS Biobank. King’s College London (KCL) is one of the top 25 universities in the world and the fourth oldest university in England. The DTR-AGE has been conducting cutting-edge health-related research for over 30 years.

KCL is the ‘data controller’ as defined in the Data Protection Act (the organisation that determines why and how personal data are processed). The DTR-AGE complies with the requirements of the European General Data Protection Regulation (GDPR) and the Data Protection Act (2018) regarding the collection, processing, storage and disclosure of personal information and special categories of data.

The KCL Core Privacy Notice information can be found here: https://www.kcl.ac.uk/terms/privacy

This privacy notice is in addition to the KCL one and explains how we use data that you share with us.

Who is this document for?

  • Participants of the CSS Biobank
  • Visitors to our website
  • People using or posting information on our social media channels
  • Researchers

Why are we processing your personal information?

This privacy notice tells you what to expect when the CSS Biobank collects personal information. We are a research tissue bank that collects human tissue and other biological material, which is stored for potential future research use with ethical approval. We also perform longitudinal cohort studies, collecting similar types of data over time. Data are collected through regular questionnaires and by analysing donated biological samples from CSS Biobank participants.   We may, from time to time, receive additional complementary data from sources such as health or environmental records. We work very hard to ensure that these data are as accurate as possible and to eliminate the risk that any individual may be personally identified from them. We share these “de-identified” data with bona fide researchers anywhere in the world to conduct health-related research that works towards the KCL vision of making the world a better place.

What information does the Privacy Notice apply to?

  • Information provided when visiting our website
  • Information posted on social media
  • Participants who:
    • Register to join the CSS Biobank with names and contact information
    • Phone, email or text us
    • Provide questionnaire responses
    • Book & attend clinic visit appointments
    • Update their contact details
    • Provide consent forms or other written information
    • Allow us to collect test information at visit in clinic or home
    • Provide bio-samples
    • Allow us to collect data from routine official records (e.g. NHS and other health records; school, college and university education records; economic records; environmental, census and other similar data)
  • Researchers completing an online proposal form
  • Researchers completing a data transfer agreement or material transfer agreement

It also applies to the way we handle, process, and store your information and to how we communicate with you.

Where applicable, further information on your privacy, confidentiality and anonymity is provided when we ask you to take part in clinical visits or to complete questionnaires.

Responsibilities

All DTR-AGE personnel who work with the data have some responsibility for ensuring data is collected, stored and handled appropriately. Each DTR-AGE staff member handling personal data must ensure that it is handled and processed in line with the KCL and DTR-AGE Data Protection Policy and Data Protection principles.

  • The only people able to access data covered by this policy should be those who need it for their work
  • Data should not be shared informally.
  • KCL provides training to all employees to help them understand their responsibilities when handling data
  • Employees should keep data secure by taking sensible precautions and following guidelines
  • Strong passwords must be used, and they should never be shared
  • Personally identifiable data should not be disclosed to unauthorised people, either within the Department, the University or externally
  • Data should be regularly reviewed and updated if it is found to be out of date or if it is no longer required. it should be deleted and disposed of securely.
  • Employees should request help from their manager if they are unsure about any aspect of data protection.

What is the legal basis for collecting and processing the information?

Our legal basis

The aim of the CSS Biobank is to understand the impact of COVID-19 and how it may be linked to health conditions and other genetic and environmental factors.

Our legal basis for using your information, under GDPR and the Data Protection Act 2018, is:

  • performance of a task carried out in the public interest (Article 6(1)(e) in the GDPR); and, where  special categories of data are involved:
  • scientific or historical research purposes or statistical purposes (Article 9(2)(j) in accordance with Article 89(1)).

In order to conduct our research effectively, we will collect and store “personal information” and “special categories of data”. The GDPR defines the latter as information about an individual’s race; ethnic origin; politics; religion; trade union membership; genetics; biometrics (where used for identification purposes); health; sex life; or sexual orientation.

This legal basis within GDPR and the Data Protection Act 2018 is separate to, and in addition to, our seeking consent to take part in the research process, which we use to help ensure our research is ethical and complies with other applicable laws.

We will never disclose your “personal information” to third parties unless we are under a duty to disclose or share these data to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements.

For more information and definitions, see: https://ico.org.uk/for-organisations/guide-to-data- protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special- category-data/

Privacy Notice for participants of the CSS Biobank

Our commitment to you

Taking part in the CSS Biobank is voluntary and you are free to withdraw at any time without providing a reason. You may be offered the choice to take part in research projects. We will never  share your personal information with researchers and data that we share for research purposes is identified only by an ID number. This process is referred to as “pseudonymisation”.

We do not perform research with the primary aim of commercial gain – our research aims to benefit society. Requests for data and proposals for collaboration go through our The CSS Research Platform and Biobank Management Group (comprising senior management staff with relevant knowledge across a broad range of areas) and are    checked to have a valid scientific aim and to meet ethical standards.

Communicating with us

When you phone, email or text us we will verify your identity and ensure that you are a study participant before proceeding. We record all communications (description, date/time and method) in our database. Being a twin cohort, we regularly communicate with multiple members of the same family at the same time. With that in mind, we are extra vigilant not to divulge an individual’s personal details, information and communications with other family members.

Completing online or postal questionnaires

Paper questionnaires are identified by an ID Number only and will not contain easily identifiable information. Online questionnaires are administered using a secure encrypted interface and will either be anonymous or use an encrypted web link. We currently use the following secure web-based applications for building, distributing and managing online surveys and databases:

  • REDCap (Research Electronic Data Capture)
  • Qualtrics XM
  • Microsoft 365

When you login to an online questionnaire, our website will collect standard internet login information and details of visitor behaviour patterns to help us understand how people are accessing different parts of the questionnaire. We will also use this information to decide if you have completed your questionnaire and may then contact you to remind you to complete your questionnaire if you have not already done so.

On the rare occasion when it is required by a particular research project, we may collect personally identifiable information. In these cases, we will make it clear why we are collecting this and explain what we intend to do with it and how it will be safeguarded.

How we will use your personal details

Your personal details such as contact information etc. are treated as highly confidential and only a very few key personnel may have access to them. Your personal details will not be shared with researchers.  They may be shared with certain select third parties providing service work for us. At the time of this document update the DTR-AGE has non-disclosure agreements with the following companies (this list is not exhaustive and can change at any time):

  • Abacus Data & Mailing (for printing and collating large mailings)
  • Data 8 (for conducting searches of public databases for updated data)

We only share your personal details with these third parties under strict conditions set out in a legally binding data processing agreement. This offers assurances about the use, access and security of any personal data disclosed and does not allow any onward disclosure or sale of personal data by the third party. We use Royal Mail for posting questionnaires, invitations to take part and other correspondence.

Some research projects need information based on locations – such as where you live/work. We never share specific postcodes with any researchers. Rather we use the first 4 alphanumeric characters of the postcode to allow aggregation of information near where you live/work – such as levels of air pollution near your home, or crime rates in your neighbourhood.

We also share limited personal data (such as your first name and email address) with the email services provider MailChimp in order to send out our email communications, newsletters and manage our mailing lists. You can read their privacy policy here:  https://mailchimp.com/legal/privacy/.

How we will use your research data

We only collect your data with permission, for example by asking you to take part in a study, attend a clinic visit or complete a questionnaire. Once we have collected it, it will be stored securely and confidentially. We de-identify research data so that individuals cannot be identified from it. We will then provide this information to researchers on request that have been approved by the CSS Research Platform and Biobank Management Group. This process is outlined here: https://cssbiobank.com/information-for-researchers

A list of approved research projects is available on request.

Who do we share data with?

Researchers working at universities, government departments, charities and other research organisations across the world may apply to access research data. Each application is assessed by the CSS Research Platform and Biobank Management Group who decide whether the researcher is legitimate, if the data requested is needed to conduct the research, and if the research project can be conducted in line with the commitments we have made to you.

We only share data in a way that guarantees the confidentiality of your identity.

Collecting data from routine official records

Where we have permission, the DTR-AGE may identify and take a copy of parts of official records such as those held by the NHS, the education system and other government information centres. We call this way of collecting information, ‘data linkage’. Before we start linking to records, we will write to you explaining how this works and give you the opportunity to opt out. We accept your right to decide that you don’t want the DTR-AGE to access your records, and if you feel this way it is important that you tell us.

Data linkage is a one-way flow of information only. We do not provide the organisations who keep your records with any information that you have provided to the DTR-AGE via questionnaires and/or clinic visits. Therefore, collection of information by the DTR-AGE will not affect the services you receive from government departments in any way. To make sure we identify your records accurately we will use your personal details (e.g. name, address, date of birth, NHS ID) to make an accurate link to the equivalent information in the official records but again, these personal identifiers are not made available to researchers.

You can request from us and review the relevant documents that give more details on why we need these data, how we collect them and highlight the benefits of data linkage to the scientific community.

The UK Longitudinal Linkage Collaboration (UK LLC)

A new way of working with longitudinal data is by combining data from many Longitudinal Population Studies to allow researchers to look at more people across diverse population groups, occupations and other factors to improve health and wellbeing and service provision. To do this, many studies need to put relevant data into a highly secure computing environment, known as either a Trusted Research Environment (TRE) or a Safe Data Haven (SDH) or a Secure Data Environment (SDE).

The CSS Biobank is a partner with UK Longitudinal Linkage Collaboration, a Trusted Research Environment set up to bring data together for research in the public good.

Who is UK Longitudinal Linkage Collaboration (UK LLC)?

UK LLC is the national Trusted Research Environment for data linkage in longitudinal research. It is run by the Universities of Bristol and Edinburgh, in collaboration with University College London (UCL), Swansea University, University of Leicester and City St George’s, University of London. Their purpose is to bring together data about Longitudinal Population Study (LPS) participants that has been collected by their LPS or as part of their wider care and support and link it to participants’ health and other data.

The University of Bristol is the Data Controller for UK LLC and SeRP UK at Swansea University is the contracted Data Processor to University of Bristol for UK LLC. SeRP UK is a leader in providing this type of secure research server in the UK and internationally.

How does this work?

The CSS Biobank provides UK LLC with de-identified copies of selected data. This includes (list study data in UK LLC TRE). We remain the owner and Data Controller and retain control of how the data is used in the UK LLC Trusted Research Environment. This makes sure the principles of The CSS Biobank are upheld.

The CSS Biobank provides a list of personal data (e.g. name, date of birth, address) to NHS Digital Health and Care Wales (DHCW). They are a NHS Trusted Third Party, which means they have the official approvals in place to handle data in this way. They do not see your study data. They then facilitate linkages by sending your personal identifiers to linked data owners and UK LLC’s place-based (e.g. air pollution, noise pollution) modellers for processing. These organisations extract and send de-identified datasets to SeRP UK who bring them together with your survey datasets. They then deposit your de-identified data into the UK LLC TRE. Through this split process, NHS Digital Health and Care Wales can only see your personal identifiers and SeRP UK and UK LLC can only see de-identified data about you.

Linked data owners:

  • NHS England
  • Office for National Statistics in England and Wales
  • SAIL databank

Where and how is The CSS Biobank data stored at UK LLC?

The CSS Biobank data is stored on secure servers at SeRP UK, which are controlled by the University of Bristol and physically located at Swansea University. The servers are managed to information security best practice standards (including ISO 27001) and are regularly audited by external experts in information security.

Can I find out if the CSS Biobank data held in the UK LLC Trusted Research environment has been approved for a research project?

UK LLC has a Data Use Register – https://ukllc.ac.uk/data-use-register – where you can view all approved and declined applications, with project summaries that provide a list of the UK LLC partner Longitudinal Population Studies that have been approved as part of each project and the aims of the research question.

The UK Data Protection Act 2018 provides individuals with rights over how their data are used. The UK LLC supports these rights. If you would like to find out more, read the full UK LLC privacy notice at https://ukllc.ac.uk/privacy-policy

Privacy Notice for visitors to our website

We will collect standard internet log information and details of visitor behaviour patterns. These are collected to help us monitor the usage in order to see what is popular and what is not, to help improve the website. We do not make any attempt to find out the identities of those visiting our website. If we decide to collect or associate personal information at any point on the website, we will be open and transparent and inform visitors about it. Please see the separate document on our cookies policy.

Privacy Notice for people using or posting information on our social media channels

The DTR-AGE has a social media presence to keep the members of our cohort informed and to publicise the work we do. At the latest review of this document, we maintain presence on Twitter, Instagram, Facebook and YouTube. Any information posted voluntarily on these channels is covered by the terms and conditions of the respective site and is in the public domain. Please be aware that you have a responsibility to ensure that information you post on our social media sites is within the bounds of the law.

The DTR-AGE will not use data gleaned from social media for research purposes without asking your permission. We will not attempt to use social media to collect your personal details. Social media is to only be used as a communication tool between us and you.

Privacy Notice for Researchers

We hold your name, institution name and contact details plus any application forms for any data and bio-samples that you have ever sent to us on an internally accessible secure database. We use this data for historical cross-checking purposes and to inform our funders of our data-sharing activity. We will use this information, so we can communicate with you about your proposal. We may also collect your personal details on several supporting documents related to your proposal. These may include data access agreements, data transfer agreements, material transfer agreements, confidentiality agreements or data user responsibilities agreements. We may also collect your personal details when you submit a manuscript for review.

We will also use the contact information to perform annual audits and to inform you of your obligations regarding our data and to receive data back from you where appropriate. Your name and institution name may be used in reports to our funders regarding activity based around the data we share with you.

The accuracy of your information is important to us. Please let us know if any of your details change or you move institutions.

We will not use your information for any other purpose, and we will never sell your personal information to other organisations.

What are your rights?

By law, you have certain rights over your personal information:

  • To receive a copy of your information
  • To ask us to correct any errors
  • To delete it once we no longer need it
  • To ask us to stop using your information in a certain way
  • To ask for certain information in a portable, electronic format
  • To object to certain uses of your information (for example, marketing and automatic profiling or decision making)

For more information about this please contact us at enquiries@cssbiobank.com

To make a request to us for any personal information we may hold on you, please see the document “Request for personal information”. If we do hold information about you, we will give you a description of it; tell you why we are holding it; tell you who it could be disclosed to; and let you have a copy of the information.

How long do we keep your information for?

King’s College London’s Records and Data Retention Schedule stipulates how long relevant records are kept. The CSS Biobank within the DTR-AGE is a longitudinal study and as such the data and records belonging to the DTR-AGE, King’s College London will be kept for the lifetime of the study.

How to complain?

The CSS Biobank is part of the DTR-AGE at King’s College London, who is the Data Controller for the information directly collected by the DTR-AGE.

The DTR-AGE aims to meet the highest standards when collecting and using personal information. We encourage people to tell us if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving the way we handle your personal details. Please get in touch with us via email: enquiries@cssbiobank.com

If you would like to complain about our handling of your data, contact the University’s Data Protection Officer by:

  • email – info-compliance@kcl.ac.uk
  • post – Information Compliance team, King’s College London, Room 5.20 JCMB, 57 Waterloo Road, London SE1 8WA

About this privacy notice

This is version 2.0 of the privacy notice reviewed in July 2026.