Privacy Policy

Updated: 8 February 2023

What is SALVE?

The SALVE app stands for the Scleroderma App for Lesion VErification. Digital (finger) ulcers are common in systemic sclerosis (SSc), occurring in approximately 50% of patients, and represent a huge unmet clinical need because they are painful, disabling, and disfiguring. Effective therapies are urgently required and we believe that incorporating photographic assessment of digital ulcers is the way forward, building on successful pilot studies undertaken at the University of Manchester.

Who has reviewed SALVE?

The app has been developed as part of a research project for which ethics approval was obtained via the Integrated Research Application System (IRAS) (324518). The processing and handling of any data collected by the app is handled in accordance with the Privacy Notice for Research Participants and the associated Data Management Plan (DMP) for the research project (Ref. 30042), reviewed by the Information Governance Office at The University of Manchester. The app has undergone an internal test programme prior to public release and has been approved for release by the research team and the Research IT Strategy and Change Management Board (RIT SCMB) at The University of Manchester.

How does SALVE handle data?

Research IT at The University of Manchester handles data in compliance with UK GDPR and the Data Protection Act 2018. By using the app, users agree that researchers at The University of Manchester and collaborating institutions, associated with the development of the app can use any data collected for research purposes only. All research data handling is compliant with our Privacy Notice for Research Participants.

What data is stored on the device?

In order to function, the app is required to store some information locally on your device. The following information is stored in a database which resides in a private application directory on your device. This data may be used strictly behind-the-scenes or may be displayed directly on screen in appropriate locations to assist with the function of the app.

• User ID is encrypted and stored locally.

This database is erased when the app is uninstalled.

It is the responsibility of the device owner to protect their access to their device and hence the data store on it. We strongly recommend that you use some form of screen lock and storage encryption to protect unauthorised access to any of the data we store or display in the app.

What data is transmitted to researchers?

The app sends data to University researchers through the following mechanisms:

• StorageConnect - data collection system owned by Research IT at the University of Manchester for staging highly restricted research data
• Dropbox for Business - secure University of Manchester Dropbox for Business account where videos will be stored

Note that if an internet connection is not available at the time of transmission, StorageConnect data is buffered in a separate local database on the device. Once an internet connection is available again, these records are transmitted and deleted from this local database.

The following data is transmitted to researchers:

• Images of digital ulcers - This data is required as part of the SALVE research study into digital ulcers in patients with systemic sclerosis.
• Videos of digital ulcers - This data is required as part of the SALVE research study into digital ulcers in patients with systemic sclerosis.
• Patient Reported Outcome Measures (PROMs) - User's will answers to set questionnaires on a daily, weekly, and monthly basis.
• Fixed feedback responses - This data is used to let user's provide feedback to researchers about the video feature.
• Unique user ID - This data is required to keep patient's identity anonymised to non-clinical researchers. This ID is used to link the anonymised images and data collected to the correct patient identification details at the Salford Royal Foundation Trust.

Is any data Person Identifying Information (PII) and linked to my identity?

You will be assigned a unique identifier when using the app. This ID is encrypted within the app, and can only be linked back to you by your clinicians at Salford Royal Foundation Trust.

How will you protect my data?

All transmissions over the internet are encrypted using a standard TSL/SSL encryption protocol and is thus protected in transit. The data you send us is stored on systems that are access-controlled and data is only accessible by project researchers and nominated collaborators. The StorageConnect system is also accessible by select members of Research IT. Access to StorageConnect is controlled by Research IT on a person-by-person basis and will not be granted to individuals not affiliated with the research project to which the data is attached. StorageConnect is backed-up and replicated daily. Records stored in StorageConnect are given an anonymous user ID and are not identified against any username or password you may have been asked to enter into the app.

What will you use the data for?

The data will be used to monitor digital lesions over time with the goal of accurately assessing digital lesion healing rates. If successful, this could be used in future clinical trials to provide accurate outcome measures and ultimately aid in the discovery of effective new treatments for digital lesions.

Who will you share the data with?

Data will only be shared with the researchers directly involved in the project.

Does SALVE collect usage statistics or analytics?

The app connects automatically to Microsoft App Center servers for the purposes of crash reporting and usage monitoring. In the event of a crash, or when you install, uninstall or open the app, the app will collect the following information:

• Device information (e.g. make, model, operating system and version)
• Unique device identifiers (not directly person-identifying but allows us to know two reports came from the same device)
• Usage data (limited to when you installed / uninstalled / opened the app)

This information is transmitted to servers not owned by The University of Manchester, and is hence shared with the third-parties who operate the crash monitoring services. We make use of this service to monitor how many people are using the app and to acquire details on crashes users may have experienced. This allows us to improve future versions of the app. This data is only accessible to Research IT staff and is not shared with other services.

Does SALVE access third-party content?

The app contains links to websites. If you click on a link, you will be directed to that site. Note that these external sites are not operated by the app provider. Therefore, we would advise you to review the Privacy Policy of these websites. We have no control over, and assume no responsibility for, the accuracy of content, the privacy policies, or practices of any third-party sites or services.

What permissions does SALVE need?

The app requires permission to access certain features of your device for its functionality. The permissions required along with the reason are described below:

• Camera: The app requires access to your camera to facilitate the use of recording images and videos of your digital lesions.
• Network features and Internet: To send Base64 encoded images, questionnaire responses, and user feedback to Storage Connect. It will also be required to send videos to the secure University Dropbox.
• Read/Write to storage: To allow for future saving of images/videos.
• Record audio: required for recording videos.
• Access to media location: Allows the application to access any geographic locations persisted in the user's shared collection. Current version uses this to pick videos.

Who do I contact about the study?

Clinical Scientist: Dr Graham Dinsdale
Phone: +44 (0)161 206 2935
Email: Graham.Dinsdale@srft.nhs.uk

What if I have a complaint about the research team?

We encourage you to contact the research team in the first instance. However, if you are dissatisfied with their response and wish to make a formal complaint about the conduct of the research team, please write to:

Head of the Research Office
Christie Building
The University of Manchester
Oxford Road
Manchester
M13 9PL

What if I have a complaint about Data Protection and Information Governance?

We encourage you to contact the research team in the first instance. However, if you are dissatisfied with their response and wish to make a formal complaint about data protection, please contact:

Information Governance Office
G7 Christie Building
The University of Manchester
Oxford Road
Manchester
M13 9PL
Tel: +44 (0)161 275 7789
Email: information.governance@manchester.ac.uk