Personal Data Protection Notice

<div class="m-sm-4">
    <h1>Personal Data Protection Notice</h1>

    <h1 class="h3 pt-3">Background to National Neurology Registry (NNeuR)</h1>
    <ul>
      <li>The NNeuR is an ethically approved clinical quality registry containing patient data collected for the express purpose of contributing to improved patient treatments and outcomes</li>
      <li>The NNeuR is funded by an independent non profitable organization Malaysia Stroke Council. The aim is to improve patient care.</li>
      <li>The collection, use, disclosure and access to data are all conducted in accordance with legal, ethical and national best practice guidelines</li>
    </ul>

    <h1 class="h3">NNeuR compliance to Personal Data Protection Act</h1>
    1. General, Notice & Choice, Disclosure Principle
    <ul>
      <li>Data submission to NNeuR is a voluntary basis</li>
      <li>The National Neurology Registry has been approved by Ethics Committee</li>
      <li>All the relevant NNeuR forms and policies are available on the NNeuR website by authorized users</li>
      <li>Open and transparent management of personal information</li>
      <li>NNeuR collects data for statistical and non-commercial purpose. The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured</li>
    </ul>

    2. Open and transparent management of personal information
    <ul>
      <li>The NNeuR website provides the NNeuR Office contact details in the event of questions, concerns and complaints about the NNeuR.</li>
      <li>States that the NNeuR is not permitted to identify patients by law and that, to maintain absolute security and confidentiality, anyone wanting to use any of the data from the Registry will be required to obtain the approval in accordance to data request guidelines as stated in
        the website.</li>
      <li>Each participating site has the ultimate responsibility for appropriately collecting and maintaining the NNeuR data, including ensuring privacy and confidentiality of their own patient's data.</li>
      <li>All personal information is kept strictly confidential: all data will be anonymised and aggregated in any presentations or publications and no patients or hospitals will be identified by name in reports.</li>
      <li>User will need to read through and accept the Information Security Policy and Security Practice Guideline during their first time login in order to ensure their responsibility to safeguard patient data.</li>
    </ul>

    3. Anonymity and pseudonymity
    <ul>
      <li>Anonymity is preserved in the way that the data are used e.g. reports, presentations.</li>
      <li>Patients can withdraw from the registry at any time, with just an ID code remaining in the system.</li>
    </ul>

    4. Collection of solicited personal information
    <ul>
      <li>The NNeuR collects personal health information which is directly related to its functions and activities. The NNeuR has all the appropriate ethics/governance approvals in place including approval of an opt-out/withdrawal 
      process.</li>
      <li>Data collection does not occur without prior ethics approval with local research governance.</li>
    </ul>

    5. Dealing with unsolicited personal information
    <ul>
      <li>Hospital staff can enter only required information on the eNNeuR web application.</li>
      <li>Hospital staff only enter follow-up data provided by the patient or their proxy.</li>
    </ul>

    6. Use or disclosure of personal information
    <ul>
      <li>The NNeuR data are summarised to provide information that can inform clinical practice and policy in neurology (stroke) related care. All data reported are de-identified and aggregated.</li>
      <li>The NNeuR team is guided by the NNeuR Information Security Policy which outlines how data may be used and supplied.</li>
      <li>Any persons wishing to undertake research using NNeuR data need to submit a proposal for review by the NNeuR Core Team Committee, as well as having appropriate ethical clearances. Data are only supplied to researchers, in approved studies, in a non-identifiable format.</li>
      <li>An Authorisation List which is signed by Site Principal Investigator / Head Of Department / Doctor in charge is submitted to the Registry Manager to setup login for the authorized personnel only.</li>
      <li>The Site Principal Investigator / Head Of Department / Doctor in charge need to inform the Registry Manager to deactivate a user's access once any user leaves the department.</li>
      <li>All NNeuR users are required to read through, accept and e-sign the Information Security Policy and Security Policy Guideline during their first time login prior to given access to the system.</li>

    </ul>

    7. Cross-border disclosure of personal information
    <ul>
      <li>The NNeuR server and backups are maintained in a secured, state of the art data centre in Cyberjaya, Malaysia.</li>
    </ul>
    8. Quality of personal information
    <ul>
      <li>The NNeuR Quality Assurance and Data Management Processes outlines the data verification processes employed by the NNeuR.</li>
      <li>NNeuR conducts regular reviews of data completeness and discrepancies for determining case ascertainment. Data quality checks are also built into the NNeuR Web application to ensure the quality of the data submitted.</li>
      <li>Training centre staff in data entry and use of the NNeuR Data Definition Dictionary takes place before any live data are entered. Site visits and data quality audits of randomly selected medical records may be done to verify the accuracy of data collected by the NNeuR. Centre users have been informed to ensure to enter only true and correct information, provide timely and accurate data and provide timely response to data query.</li>
      <li>Information is provided in the NNeuR annual reports on the quality of the aggregated, de-identified data in the registry e.g. proportion of missing data per field.</li>
    </ul>

    9. Security of personal information
    <ul>
      <li>The NNeuR Information Security Policy, Personal Data Protection Notice and Privacy Policy provides guidelines for all security-related aspects for the registry.</li>
      <li>NNeuR data are collected via a web application that requires password access with varying levels of authority. The web application itself is protected by Secure Sockets Layer and the certificate shows the encryption details used.</li>
      <li>The servers are maintained in a secured data centre with state-of-the-art facilities in Cyberjaya, Malaysia. Data centre security: Biometrics authentication for access to server storage area, CCTV, Pyrogen Fire Suppression System, Uninterrupted Power Supply. Besides that, the servers are also secured by server hardware and softwares such as firewall, Intrusion Detection System, Antivirus.</li>
      <li>Personal information are encrypted and deidentified in the database.</li>
      <li>All NNeuR staff, IT vendor, statisticians and Management Committee members sign a Non-Disclosure Agreement whereby they undertake to maintain the confidentiality of any data that they access in the NNeuR.</li>
      <li>Centre Users can only access data for their own site. Each authorized user in the centre have their own user account and is accountable for their own logins. All activities in the web application are audited.</li>
      <li>It is important to update NNeuR Registry Manager whenever there is a change in your personal information like mobile number and e-mail address and centre's information like centre address.</li>
      <li>If any staff who has access to NNeuR web application has left your centre or should no longer access to your patient record, please inform Registry Manager to inactivate their access right accordingly or update NNeuR whose access should be terminated.</li>
      <li>Data are backed up on a daily, weekly and monthly basis. Business continuity plan is in place in the event the web application is down.</li>
    </ul>

    10. Access to personal information
    <ul>
      <li>The Registry Forms provides details on the demographic and neurology (stroke) related information entered into the NNeuR (which stipulates that the data are available from their hospital record).</li>
      <li>Patients may contact the centre which they received treatment from (which act as data custodian) about their data.</li>
    </ul>

    11. Correction of personal information
    <ul>
      <li>To ensure that any missing or discrepant data are corrected, the NNeuR conducts regular data cleaning activities in consultation with the hospital staff.</li>
      <li>A systematic data quality audit process is also in place.</li>
      <li>All inaccurate information is amended by the site users when it is notified or becomes aware that particular information is incorrect.</li>
      <li>An audit trail of web tool edits is maintained within the database.</li>
      <li>Site Users can amend their personal details by updating their own User Profile page.</li>
    </ul>

    12. Data Retention
    <ul>
      <li>Softcopy data since beginning will be retained until the end of the registry conduct.</li>
    </ul>

</div>