Personal Data Processing Privacy Notice
This notice describes how UPMC Concussion Network collects and processes your personal data, including sensitive health data. It provides further explanation of the Personal Data Processing Consent Form.
WHAT IS UPMC CONCUSSION NETWORK AND WHY WILL MY DATA BE TRANSFERRED ABROAD?
UPMC Concussion Network (“Network”), a multi-member collaboration, is providing concussion-related services including the ImPACT assessment and cognitive test. This test is licensed to UPMC Ireland by ImPACT Applications Inc. of San Diego, California, USA. ImPACT Applications, Inc. maintains a secure data center in Canada, which is the central location from which the test is delivered over secure Internet, and where the test data and results are stored.
WHAT DATA WILL BE COLLECTED AND HOW?
The ImPACT test will be administered by a qualified provider of the UPMC Concussion Network who will ask you to provide personal information (name, address, etc.) and basic health status to ascertain as to whether an injury has occurred and whether the baseline or post-injury test should be administered. During completion of the test, information concerning your various cognitive skills will be requested and evaluated.
WHY IS MY DATA PROCESSED?
1. In order for you to receive assessment services and for administrative purposes (INFORMED CONSENT
Your personal data is collected and processed so that you can receive the necessary services, and also to fulfil the related analysis and administrative requirements which includes transfer of data to ImPACT Applications in Canada. To this extent your health data is maintained, and may be shared (including via telemedicine) with the following:
- family doctors, specialty physicians;
- accounting and management staff
In order for the Network to provide these services it is necessary that you give your consent. If you do not wish to sign the informed Consent #1 of the Consent Form, the Network will not be able to provide the assessment.
2. To conduct scientific studies and research (CONSENT #2)
If you sign Consent #2 of the Consent Form, your assessment data (collected within assessment and deidentified by removal of your name) may be used for research conducted by the Network. Please note that you can withdraw your consent to this data processing at any time, and that this will not affect your assessment.
3. To verify the quality of the assessment received, and for planning care (CONSENT #3)
If you sign Consent #3 of the Consent Form, the Network may use your data to monitor the effectiveness of the assessment as delivered, and its appropriateness and quality. These verifications will be carried out using data with no direct identification elements (name, surname, tax code, etc.), therefore not allowing a tracing of the identity of the patient. This data will be processed and compared using computer tools with information managed by other facilities.
4. To receive information and marketing material (CONSENT #4)
If you sign Consent #4 of the Consent Form, you may receive information on the Network’s projects and services, and information campaigns.
5. To receive scheduling and instructional information (CONSENT #5)
If you sign Consent #5 of the Consent Form, you may be contacted about the dates of upcoming appointments, and to receive information and instructions on how to prepare for your assessment.
HOW WILL MY DATA BE PROCESSED?
Data processing is performed using both paper and electronic tools, adopting appropriate safety measures to guarantee data confidentiality and security.
WHO WILL ACCESS MY PERSONAL DATA?
Your personal data will be processed by the clinical and administrative staff of the Network, and by duly appointed Data Processors, bound by professional secrecy and confidentiality. Your data may also be shared with third parties, who as independent data controllers or appointed data processors, provide ancillary services to activities of the Network, such as:
- external consultants, and
- other entities providing services instrumental to the Network’s activities.
The updated list of members of the UPMC Concussion Network to which data could be transferred, and third parties to which data could be communicated, can be requested by Data Controller at the following address: UPMC Concussion Network, c/o UPMC Whitfield, Cork Road, Butlerstown North, Co. Waterford, Ireland.
WHO WILL BE INFORMED OF MY HEALTH STATUS?
Information regarding your health status will only be provided to your physicians as you indicate, without prejudice to the provisions of law.
WHAT ARE MY RIGHTS ACCORDING TO THE LAW?
Your rights are identified by the Data Protection Commissioner (www.dataprotection.ie). You have the right to:
- have your data used in line with the data protection regulations
- receive confirmation that the Network holds your personal data and why
- access your personal details
- know if personal details are being held
- change or remove your details
- prevent use of your personal details
- remove your details from a direct marketing list
- object to use of your details (under certain circumstances)
- freedom from automated decision making
- refuse direct marketing calls or mail
HOW CAN I EXERCISE MY RIGHTS?
The rights defined in this document can be exercised by contacting the Data Controller (UPMC Ireland Limited) at the following address: UPMC Concussion Network, c/o UPMC Whitfield, Cork Road, Butlerstown North, Co. Waterford, Ireland.