m. What to do if you do not want your data to be included in this study, or if you want to see your data that we hold.

Data for an individual can be removed from the database and will not be included in future research analysis datasets, and no further data will be sent for the UK CHIC study. Please ask your HIV doctor if you do not want your data to be included in the UK CHIC study.

If an individual attending for care at one of the collaborating HIV clinics wants to see their study record data, please speak to your HIV doctor in the first instance.

l. What we will not do with the information collected.

The anonymised datasets are not currently made publicly available. Instead, data or subsets of the data are made available to collaborators working in academic or research organisations, and we would consider applications from pharmaceutical companies. First though, collaborators must meet requirements and submit a research proposal to the study. The application is reviewed and is accepted if satisfactory.

j. Is there any automated decision making or profiling? What is the significance and the consequences of this?

Part of the process to prepare annual datasets involves identifying database records thought to belong to the same individual. A computerised algorithm uses data items to compare and link records, so that data from multiple records can be merged if appropriate. This is so that an individual only has one record for research analyses. Profiling of the data assists in data cleaning and in ascertaining how suitable it is for research analyses.

g. How is the information kept secure and where is it stored?

Data are encrypted, then sent by secure transfer methods to the study team. The data sent and the database itself are stored on separate servers at the Medical Research Council Clinical Trials Unit at University College London (MRC CTU at UCL).

Data are processed and the study database can only be accessed by a few named individuals.

Datasets used for research analyses are anonymised.

By removing clinic identifiers and anonymising the dataset before it is used for analyses, researchers do not have information that could identify a patient.

f. How do we collect this information and what do we do with it?

Once a year, the participating NHS HIV clinics transfer the data required for the study to the study team; all these transfers are within the UK. Data are sent in an electronic format and by secure transfer methods.

The data from each HIV clinic are checked, cleaned and merged. Each year an anonymised dataset is produced for collaborators to use for research analyses.