Privacy Notice

This Privacy Notice is directed to participants in the NHS-Galleri trial. This trial is organised by GRAIL Bio UK Ltd. (the UK subsidiary of a company in the United States (US) called GRAIL, Inc.) in partnership with the National Health Service (NHS) England and The Cancer Research UK Cancer Prevention Trials Unit at Queen Mary University of London. The Participant Information Sheet (PIS) that you received when you joined the trial describes the procedures you undergo during the trial, the information collected from you during the trial, and how the trial organisers use the information collected about you during the trial. As explained in the PIS, GRAIL, Inc., 1525 O’Brien Drive, Menlo Park, California, 94025, USA, is a company that has developed a blood test for early cancer detection and is providing money and equipment to support the NHS-Galleri trial. This notice describes how the information is used that is received about you from the trial.

The NHS-Galleri trial was initially run by a team of cancer researchers and trial managers at The Cancer Research UK & King’s College London Cancer Prevention Trials Unit. In late 2023, The Cancer Prevention Trials Unit moved from King’s College London to Queen Mary University of London. As a result, some responsibilities previously given to King’s College London related to your information have now passed to Queen Mary University of London. King’s College London is no longer a joint data controller. Staff involved with the trial still based at King’s College London continue to process your information on behalf of Queen Mary University of London. This Privacy Notice has been updated to reflect this change. There have been no other changes to the groups that may use, access or store your information.


Who are the data controllers of my information?

GRAIL Bio UK Ltd. and Queen Mary University of London are joint data controllers for the NHS-Galleri trial and are responsible for coordinating the collection and use of your information under the trial. GRAIL Bio UK Ltd. is the data controller in relation to the processing of the information that GRAIL receives for purposes of the trial.

What information does GRAIL Bio UK Ltd. receive about me?

GRAIL Bio UK Ltd. receives personal information about you, including your name, date of birth, NHS number, address (including postcode), telephone number, and email.

The trial team also receives any information you entered into the electronic questionnaires during trial appointments and information from your medical records and other health databases that is collected for the trial, as well reports of side effects occurring during the trial. This information includes details about your health, your sex, your age, and if you are in the test group of the trial, the test result. GRAIL Bio UK Ltd. has access to your health information held by Queen Mary University of London and information held about you by the National Disease Registration Service (NDRS) and NHS England.

What information does GRAIL, Inc. in the United States receive about me?

GRAIL, Inc. in the US receives certain information about you as part of the NHS-Galleri trial. Importantly, the information and samples that GRAIL Inc. in the US receives do not contain your name or other information from which you can readily be identified. Instead, the information that GRAIL, Inc. receives contains coded numbers in place of your name and other readily identifying information; this is sometimes called ​“pseudonymised” or ​“coded” information. Only certain authorised members of the trial team are able to link your name to this code. GRAIL, Inc. does not have access to the link between the code and your name.

Can anyone else access my information?

Your information is accessed by King’s College London staff involved in the trial, and other approved third parties, only where necessary for carrying out their parts of the trial. 

What does GRAIL, Inc. do with my information and samples?

GRAIL performs tests on your blood samples, including analyses of the pattern of markers on your DNA. GRAIL, Inc. will use these test results and the other information described above for research purposes related to evaluating the test for early cancer detection. GRAIL, Inc. may also use this information to authorise and commercialise this test. As part of this process, GRAIL, Inc. may share your information with regulators, collaborators and other researchers. Your personal information is stored separately (but linked via unique identifiers to your blood samples and other health information about you). This is so that only the members of the trial team who need to see your personal information have access to it. 

GRAIL, Inc., its collaborators, and other researchers may use your information to conduct additional studies with the information collected in this trial to advance scientific research and public health. These projects may involve bringing together coded information from the NHS-Galleri trial with information from other studies or sources outside typical research settings, such as electronic health records or biobanks. If your coded information is used for additional studies, specific safeguards will be used to protect the information, which may include:

  • Limiting access to specific individuals who are obligated to keep the information confidential.
  • Using security measures to avoid information loss and unauthorised access.
  • Anonymising the information by destroying the link between the coded information and your personal identifiers when possible.
  • When required by applicable law, ensuring that the scientific research has the approval of research ethics committees (RECs), or other similar review groups.

GRAIL, Inc., its collaborators, and other researchers may publish the results of the research, and they may be required by law or scientific journal policy to make information generated in the research publicly available or available to future researchers. If GRAIL, Inc., its collaborators, or other researchers make public any trial results, the results will not contain your name or other details that can easily be used to identify you.

What is the basis for processing my information?

As joint data controllers, GRAIL Bio UK Ltd. and Queen Mary University of London need a valid legal reason to process and use your information. This is called a ​“legal basis.” GRAIL Bio UK Ltd.’s legal basis for processing your information is its legitimate interest in conducting scientific research and to improve the test in the future. Queen Mary University of London’s legal basis for processing your information is its public task in the public interest as a research institution.

How long will my information be kept?

GRAIL Bio UK Ltd. will keep your information for as long as needed to fulfil the purposes outlined in this notice and the PIS, unless a different retention period is required by law. Queen Mary University of London and GRAIL Bio UK Ltd. will keep your information for up to 20 years after the trial finishes. Information that is both aggregated and anonymised will be retained indefinitely.

Will my information be transferred outside of the UK?

Your samples are transferred to the US, where GRAIL, Inc. laboratories are located. Your samples are marked with trial identifiers, but no personal identifiers are used or transferred outside of the UK. Some countries, including the US, have been found by the European Commission not to offer the same level of data protection as that found in the European Economic Area. GRAIL, Inc. and the trial organisers have entered into a data transfer agreement in a form approved by the European Commission to make sure that your information remains protected after it is sent to GRAIL. Please contact the trial team if you wish to obtain a copy of the standard data transfer agreement.

What are my rights?

Under data protection legislation you have certain rights in relation to your personal information, including the right to access, correct, erase or restrict or object to the use of your personal information. These rights are limited in the research setting, however, because GRAIL Bio UK Ltd. needs to manage your information in specific ways in order for the research to be reliable and accurate. Because the trial team at GRAIL Bio UK Ltd. does not know your identity, if you wish to exercise any of these rights, you should contact your doctor or the trial team, and they can direct your question to the appropriate person at GRAIL.

You also have the right to make a complaint with the Information Commissioner’s Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.

Whom can I contact with questions?

Because the trial team at GRAIL Bio UK Ltd. does not know your identity, you should address your questions to the trial team for the NHS-Galleri trial in the first instance at participant_help@nhs-galleri.org. GRAIL’s Data Protection Officer is reachable at privacy@grail.com. For further information on how Queen Mary University of London uses the information that is received about you from the trial, please refer to the Queen Mary University of London Privacy Notice at www.qmul.ac.uk/privacy.

Use of cookies and other technologies

For information about how this site uses cookies, see our cookie policy.

This Privacy Notice was updated on 16 Sep 2024, to reflect that the Cancer Prevention Trials Unit moved from King’s College London to Queen Mary University of London and some responsibilities previously given to King’s College London passed to Queen Mary University of London.

IRAS Project ID: 293034
Wales REC1 Ref: 21/WA/014
Version 5.0 — 16 SEP 2024