Privacy Policy

Updated: 10 January 2022

What is SkIN DP?

SkIN DP is tool to allow clinicians to send photos of skin lesions to researchers based at The Univeristy of Manchester and Manchester and Salford NHS Foundation Trusts. A clinician will use the app to acquire the photos and enter some observations about them. The photos will then be sent to a secure University server along with a patient link code and information on the clinic location.

Who owns SkIN DP?

The app was commissioned by a research team led by Dr Chiedu Ufodiama and written and distributed by the Mobile Development Service in Research IT at The University of Manchester, UK. You may contact the developers at mobile@manchester.ac.uk. The source code copyright and compiled application is owned by The University of Manchester. The services the app provides are provided at no cost and are intended for use as is. These services are made available subject to funding availability and may be discontinued at any time. The University of Manchester will not be responsible for any liabilities resulting from the use of the app.

How is SkIN DP maintained and for how long will it be available?

While the app will be available for use over an indeterminate period of time, it will only be updated and maintained for a limited period subject to the availability of funding. App content may be updated without prior notice to improve the user experience or performance. Any changes in the terms of use will be communicated directly to the user and alterations to the terms must be accepted before new content may be consumed.

Who has reviewed SkIN DP?

The app has been developed as part of a research project for which ethics approval was obtained from The Health Research Athority (HRA) (IRAS 299446). The processing and handling of any data collected by the app is handled in accordance with the Privacy Notice for Research Participants and the associated Data Management Plan (DMP) for the research project (DMP 87528), reviewed by the Information Governance Office at The University of Manchester. The app has undergone an internal test programme prior to public release and has been approved for release by the research team and the Research IT Strategy and Change Management Board (RIT SCMB) at The University of Manchester.

How does SkIN DP handle data?

Research IT at The University of Manchester handles data in compliance with The Data Protection Act 2018 (GDPR). By using the app, users agree that researchers at The University of Manchester and collaborating institutions, associated with the development of the app can use any data collected for research purposes only. All research data handling is compliant with our Privacy Notice for Research Participants.

What data is stored on the device?

In order to function, the app is required to store some information locally on your device. The following information is stored in a database which resides in a private application directory on your device. This data may be used strictly behind-the-scenes or may be displayed directly on screen in appropriate locations to assist with the function of the app.

• Data Connection Credentials -- the authentication token to allow the app to send data securely to the server

This database is erased when the app is uninstalled.

It is the responsibility of the device owner to protect their access to their device and hence the data store on it. We strongly recommend that you use some form of screen lock and storage encryption to protect unauthorised access to any of the data we store or display in the app.

What data is transmitted to researchers?

The app sends data to University researchers through the following mechanisms:

• StorageConnect - data collection system owned by Research IT at the University of Manchester

Note that if an internet connection is not available at the time of transmission, StorageConnect data is buffered in a separate local database on the device. Once an internet connection is available again, these records are transmitted and deleted from this local database.

The following data is buffered temporarily on the device and transmitted to researchers by the app:

• Device Details -- the make, model and operating system version of the device.
• Patient Link Code -- a link code which can be used later to connect photos with patient demographics obtained via the separate Qualtrics survey tool.
• Diagnosis and Description Text -- comments entered about each photo by clinicians.
• Photos -- the photos taken by the clinician through the app and metadata about their zoom level.
• Feedback Details -- information on whether there were any issues taking photos of the lesions.

How will you protect my data?

All transmissions over the internet are encrypted using a standard TSL/SSL encryption protocol and is thus protected in transit. The data you send us is stored on systems that are access-controlled and data is only accessible by project researchers and nominated collaborators. The StorageConnect system is also accessible by select members of Research IT. Access to StorageConnect is controlled by Research IT on a person-by-person basis and will not be granted to individuals not affiliated with the research project to which the data is attached. StorageConnect is backed-up and replicated daily. Records stored in StorageConnect are given an anonymous user ID and are not identified against any username or password you may have been asked to enter into the app.

What will you use the data for?

The photos will be used by researchers to identify connections between patient demographics and the nature and severity of skin complaints.

Who will you share the data with?

The data may be shared for research purposes with researchers at The Univeristy of Manchester and within the Manchester and Salford Royal NHS Foundation Trusts. The data is considered confidential research data and will only be shared with other institutions through an appropraite Data Sharing Agreement.

Does SkIN DP collect usage statistics or analytics?

The app connects automatically to Microsoft App Center servers for the purposes of crash reporting and usage monitoring. In the event of a crash, or when you install, uninstall or open the app, the app will collect the following information:

• Device information (e.g. make, model, operating system and version)
• Unique device identifiers (not directly person-identifying but allows us to know two reports came from the same device)
• Location data (only what country your device is in and what time zone)
• Usage data (limited to when you installed / uninstalled / opened the app)

This information is transmitted to servers not owned by The University of Manchester, and is hence shared with the third-parties who operate the crash monitoring services. We make use of this service to monitor how many people are using the app and to acquire details on crashes users may have experienced. This allows us to improve future versions of the app. This data is only accessible to Research IT staff and is not shared with other services.

Does SkIN DP access third-party content?

The app contains links to websites. If you click on a link, you will be directed to that site. Note that these external sites are not operated by the app provider. Therefore, we would advise you to review the Privacy Policy of these websites. We have no control over, and assume no responsibility for, the accuracy of content, the privacy policies, or practices of any third-party sites or services.

What permissions does SkIN DP need?

The app requires permission to access certain features of your device for its functionality. The permissions required along with the reason are described below:

• Camera -- the app requires access to your camera to allow the taking of photos of lesions.
• Write Access to Local Storage -- the app stores some local information on your device to help it function and so requires access to the storage on your device to store this information.

Who do I contact about the study?

Lead Researcher: Dr Chiedu Ufodiama
Email: chiedu.ufodiama1@nhs.net

What if I have a complaint about the research team?

We encourage you to contact the research team in the first instance. However, if you are dissatisfied with their response and wish to make a formal complaint about the conduct of the research team, please write to:

Head of the Research Office
Christie Building
The University of Manchester
Oxford Road
Manchester
M13 9PL

What if I have a complaint about Data Protection and Information Governance?

We encourage you to contact the research team in the first instance. However, if you are dissatisfied with their response and wish to make a formal complaint about data protection, please contact:

Information Governance Office
G7 Christie Building
The University of Manchester
Oxford Road
Manchester
M13 9PL
Tel: +44 (0)161 275 7789
Email: information.governance@manchester.ac.uk