Skip Navigation LinksPrivacy

SCOTS Privacy Notice

The SCOTS Study, run by NHS Greater Glasgow and Clyde, respects that the privacy of your personal information is important to you. We have developed this privacy notice to let you know about the types of personal information (as defined below) we may collect from you and how your personal information will be maintained and used.

What is personal information?

Personal information is any item of information which relates to a person who is either identified or can be identified from information held about them (such as name, address, telephone number, e-mail address, date of birth, or other similar information).

What is the lawful basis for using your information?

The laws around data protection are strict but sometimes difficult for non-lawyers to interpret. The public health importance of SCOTS is that we wish to assess the risks and complications for patients undergoing bariatric surgery to ensure that they receive the most effective care and that they are cared for in the most efficient way.

The lawful grounds for processing personal information for SCOTS are the General Data Protection Regulations (GDPR) 2016/679. As part of joining the SCOTS Study, you have consented to the use of your personal information for use within the SCOTS Study. This is compliant with article 6 (1)(e) of GDPR.

GDPR defines “special category data” as especially sensitive data which includes health records. You have given us consent to view this data. This is done in compliance with article 9 (2)(j) of GDPR.

We go into more detail below as to how we obtain, use and store this information.

How does the SCOTS Study collect personal information?

We collect personal information when you voluntarily submit it to us (i.e. providing information to our study team during study visits or completing patient questionnaires) or when you give permission to others to share your personal information with us.

All SCOTS data are stored in a secure database within the Robertson Centre for Biostatistics, University of Glasgow. The University of Glasgow is the Data Management Centre for the study. All personal details are kept in a separate, more restricted, database and only visible to appropriately approved study team members.

Information collected from public or third-party information sources.

We may collect personal information from GPs and hospitals to verify and supplement information that you have provided (e.g. confirming contact details or details of hospital admissions with your GP). We will also supplement our existing study participant database with information from centrally held NHS datasets. In order to obtain these data the Study will send electronic Data Research and Innovation Service (eDRIS) in Scotland, details of your SCOTS ID number, NHS or community health index (CHI) number, and Date of birth etc. so that they can tell us about any hospitalisations or other events you may have had. The actual data that will be provided by NHS Scotland will be hospital admission and discharge details including dates, diagnoses with diagnostic codes, dates and causes of death if appropriate and details of the hospital you were admitted to.

(Participants: please refer to the “Record Linkage Process” section at or further details about this process.)

How does the SCOTS Study use your personal information?

Your personal information will be used only to allow the conduct of the SCOTS Study and in accordance with your expressed consent. We will not use automated decision-making tools including profiling during the course of the study.

Does the SCOTS Study share personal information with third parties?

We will not share your personal information with any third parties without your consent to do so. If you contact us to report additional study information, we may contact you for follow-up information. Any information that we do transfer or share will be used and disclosed in a manner consistent with the terms of this privacy notice, the fair processing statement, and with the study participant information sheet (PIS) and consent form.

Who will have access to my personal information?

The study is legally sponsored by NHS Greater Glasgow and Clyde, and your personal information will only be accessible to appropriately authorised SCOTS Study team members including some data processors and statisticians at the Robertson Centre for Biostatistics, University of Glasgow. These individuals will usually see only de-identified data.

What steps does the SCOTS Study take to protect personal information?

The SCOTS Study database adheres to ISO 27001 and endeavours to use reasonable technical and administrative safeguards to protect your personal information from unauthorised access, use, loss or destruction. For example, our website connection is encrypted and our internal network is fully protected and monitored. We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff. Any backed-up data will be encrypted and not accessible by any personnel external to the SCOTS Study.

Can you choose not to have the SCOTS Study collect, use or disclose information about me?

Yes, it is your choice to provide or not to provide personal information to the SCOTS Study. You may choose not to disclose some personal information to your study nurse or other member of the study team. However, to take part in the SCOTS Study you must consent to providing certain personal information.

You may change your study participation preferences at any time by contacting us or by speaking to your nurse during a study visit.

You may withdraw from the study at any time by contacting your local SCOTS Study team or by contacting the SCOTS helpdesk Withdrawal from the study will not impact on your medical care.

How long will the SCOTS Study retain your personal information?

We will store personal information for the duration of the study (approximately until June 2021), and then for a further 5 years following completion of the final patient questionnaire.

What are the SCOTS Study’s Notification Procedures?

In the event of an incident or breach of your personal information being accessed, lost, or stolen by an unauthorised third party, we will exercise reasonable efforts to notify you and disclose the personal information that was accessed/disclosed using the contact information you have provided.

The Right to Complain?

In the event you have concerns about the study then you have the right to contact the Information Commissioner’s Office (ICO). Please call 0303 123 1113, follow the directions on the ICO’s website ( or write to them at:

The Information Commissioner's Office - Scotland

45 Melville Street



Or please contact the NHS Greater Glasgow and Clyde Data Protection Office, or write to the Data Protection and Freedom of Information Office at

1 Smithhill Street



Contacting the SCOTS Study

We welcome your questions and comments regarding this privacy notice and the use of your personal information.

You may also contact us to update or correct the personal information you have provided to us, or to withdraw from study participation, by calling, emailing, or writing to:

The SCOTS Study

BHF Glasgow Cardiovascular Research Centre University of Glasgow

126 University Place, Room 430

University of Glasgow


G12 8TA

Tel: +44(0)141 330 1670 or