Privacy notice

Information you need to know:

The University of Leicester's Department of Respiratory Sciences is leading the UK Research Study into Ethnicity and COVID-19 Outcomes in Healthcare Workers (UK-REACH). Our research team is carrying out a sub-study called the DIRECT study.

The University of Leicester is the Data Controller (the University) for your information collected for the purpose of the DIRECT study. Further information about the University can be found here: .

The University’s Data Protection Officer is: Elisabeth Taoudi, Data Protection Officer and Commercial Lawyer, University Of Leicester, University Road, Leicester, LE1 7RH. Tel: 0116 229 7640. Email:

This privacy notice explains what information we are collecting, how we will use this information in the DIRECT study and what rights participants have in relation to their information.

What information are we collecting or using?

In the DIRECT study, we are collecting information from you because you are:

We will only collect and use your information if you have voluntarily agreed to participate in this study and have completed a participant consent form in accordance with ethical requirements and to meet legal obligations relating to confidentiality.

The information we will collect directly from you when you register and in the form of a baseline and other questionnaires for the DIRECT study includes:

We will also collect, receive and use the following special category information provided by you, the University Hospitals of Leicester NHS Trust (UHL), the NHS and other partners:

We will also:

If you agree we will also:

This DIRECT study is a ‘Long-COVID’ Public Health study taking place over 25 years. Therefore, even if you later decide to withdraw, , we will continue to follow your health by extracting information from your NHS routine health care records, and any COVID-19 related records. This will ensure we make the best use of the time, information and samples provided by all those participating in this study.

Why are we collecting your information for this Research Study?

COVID-19 is a new disease, and the main purpose of the UK-REACH research study is to identify and to understand if, how, and why, ethnicity affects clinical outcomes from COVID-19 in healthcare workers.

Previous research has found that healthcare workers and those from ethnic minority groups are at high risk of COVID-19 infection and may be at higher risk of severe disease than their white colleagues. We know that immune responses are key to the outcome of COVID-19 infection and vaccination.

The DIRECT study aims to determine whether there are differences in immune responses to COVID-19 infection and vaccination between ethnic groups in order to understand whether these differences may contribute to the observed differences in infection risk and COVID-19 outcomes in different ethnic groups.

We will specifically study healthcare workers and people who work in healthcare settings (including those who do not work directly with patients) so that we can understand:

How we will use your information?

We will use your information to enable us to answer the research questions we have set out above, to allow secure linkage of the questionnaire data to your healthcare records and COVID-19 related outcomes in your occupational health record for blood testing and for future contact by the team.

We will use your information in a way that protects your identity as follows:

The University and the UHL both have technical and organisational measures in place to ensure that your data is securely stored, or transferred as appropriate and will only be used for the purposes of this research.

We will not be using the data to record, learn or decide something about you.

Due to the nature of the study, there will be “profiling” of information including demographics, those who have medical conditions including COVID-19 outcomes and all participants who are in specific ‘at-risk’ groups.  This will allow us to be more precise in the way we study the impact of ethnicity on how the immune system responds to COVID-19 and vaccinations in healthcare workers.

The DIRECT study does not involve automated decision-making.

What is the legal basis for processing your information?

The legal basis for processing your information in this DIRECT study is Public Task as set out in the Data Protection Act 2018 and the UK GDPR Article 6.1(e). Research is a public task that the University of Leicester performs in the public interest, and is part of its core functions as a University.

Our additional legal bases for processing your special category information are that:

  1. processing is ‘necessary for reasons of public interest in the area of public health’, specifically relating to COVID-19, as set out in the Data Protection Act 2018 and UK GDPR Article 9.2(i); or
  2. processing is necessary for ‘scientific research or statistical purposes’ in accordance with Article 89(1) as set out in the Data Protection Act 2018 and UK GDPR Article 9.2(j)

If we are sharing your information with others, who are we sharing it with?

The DIRECT sub-study involves delivery partners such as the UHL and other information processors such as laboratories. The following is a list of the organisations we are sharing your information with, but is not an exhaustive list of all those who we may need to involve over the 25-year lifetime of the study:

We are also required to provide progress reports and summarised research information to our grant funders and the Department of Health and Social Care but this will not include any information about individual participants.

We will only share with all these parties the minimum information that is necessary for them to undertake the task they are performing. We will not share information that identifies participants such as their name and contact information with people who do not need to know this.

Anonymised information means that a person is no longer identifiable from the information and it is not personal information for the purposes of Data Protection Legislation.

How long we will process your information for?

The DIRECT study is part of the UK-REACH study, and we will store the anonymous research data and any research documents with personal information, such as consent forms, securely at the University for 6 years after the 25-year study ends.

For other information held by the University as out below, unless otherwise stated, all the data held for this study will be deleted after 25 years.

Storage and future use of samples

What are your rights and how to enforce them?

Under Data Protection legislation, individuals normally have rights in relation to the personal information we hold about them. For the purposes of research, where such individual rights would seriously impair research outcomes, such rights are limited.

In respect of the DIRECT study, we need to limit your rights and are relying on the exemptions in Schedule 2 Part 6 paragraph 27 of the Data Protection Act 2018 because we are processing this information for scientific research in accordance with UK GDPR Art. 89(1) and Approved Medical Research covered by s19 Data Protection Act 2018.

Prior to applying these exemptions, we have carried out a Data Protection Impact Assessment and taken into account:

We have concluded that the exercise of subject rights by participants would seriously impair the achievement of the DIRECT Study objectives and the exemptions are necessary to enable us to fulfil our scientific research purposes in the public interest.

How will this affect the rights of participants?

Whilst participants involved in this research may withdraw from the study at any time they will not be able to exercise their rights to access their personal information, to request correction of inaccurate information or erasure of their information, to restrict processing of information or to object to our processing of their information even if they leave the study. UK GDPR Articles 15,16,17,18 and 21 will not apply.

If you withdraw from the DIRECT sub-study at any stage, we will keep the information we have already obtained but, to safeguard your rights, we will use the minimum personally identifiable information possible.

What right do you have to complain to the Information Commissioner’s Office?

If you wish to ask questions about our use of this data or your rights, you may contact Information Assurance Services by email at or the University’s Data Protection Officer by email at

Anyone can raise concerns about how their information has been processed with the Information Commissioner’s Office (ICO).

The ICO may be contacted:

By post addressed to: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

By telephone: 0303 123 1113.

By email: