Description of the processing of personal data in a scientific study
(Data protection notice EU [679/2016], articles 13, 14 and 30)
Study title
Higher education students at direct physiotherapy appointments, and the treatment paths and service use of customers with musculoskeletal symptoms within the Finnish Student Health Service
Personal data processed in the study
The purpose of the study is to examine the treatment paths and service use of customers with musculoskeletal symptoms and to clarify factors relating to the functioning of the treatment relationship and to the mental stress of the person with musculoskeletal symptoms at direct physiotherapy appointments in student health care.
The following personal data will be collected about you in the study
Before your physiotherapy visit, you will have received a questionnaire concerning symptoms (PTA), a questionnaire assessing risk factors for pain prolongation (Örebro) and a questionnaire measuring mental stress (MHI-5). These questionnaires are part of standard care and will only be included in the study if you give your consent to participate. If you consent to participate in the study, you will be sent a questionnaire after your physiotherapy visit to evaluate your view of the treatment relationship during the appointment. For the purposes of the study we will also collect your customer number, age and gender, educational background (student at university of applied sciences / university student) and field of study.
Legal basis for the processing of personal data in research / archiving
☒ The processing is necessary for scientific or historical research purposes or statistical purposes and it is proportionate to the aim of public interest pursued (Finnish Data Protection Act, section 4, paragraph 3).
In the study, the following special categories of personal data will be processed/requested about customers:
☒ Health > Only the answers to the questionnaires, no other health data
The derogation from the prohibition to process special categories of personal data is made on the following basis:
☒ Scientific or historical research purposes or statistical purposes in the public interest (Data Protection Act, section 6)
Transfer of personal data outside the EU/EEA
In this study, your data will not be transferred outside the EU/EEA.
Protection of personal data
The processing of personal data in this study is based on an appropriate research plan, and a person responsible for the study has been designated. Your personal data will be used and disclosed only for historical / scientific research purposes or for other compatible purposes (statistical purposes), and the procedure followed is also otherwise such that data concerning you will not be revealed to outsiders.
Removal of identifiability
As a protective measure, directly identifiable data will be removed during the material’s creation stage (the material will be pseudonymised, allowing for the return to identifiability using a code or similar and for the addition of new data to the material).
The personal data processed in the study will be protected
The FSHS and the University of Jyväskylä will pay particular attention to information security, which will be ensured using a number of technical solutions, including firewalls, strong authentication, limitation of access, encrypted connections and auditing, and constant data security updates.
The study has been ethically evaluated prior to its start
☒ Yes
A separate data protection impact assessment has been made for the study / The data protection officer has been consulted regarding the impact assessment
☐ Yes ☒ No because responsible study director has ascertained that an impact assessment is not obligatory.
The researchers have been trained in data protection and information security
☒ Yes
Processing of personal data following completion of the study
The study register will be anonymised, removing all identifiable information completely and rendering it impossible to return to identifiable personal data and to add new data to the material.
Data controllers and parties conducting the study
The data controllers for this study are
a) The Finnish Student Health Service (FSHS), Töölönkatu 37A, 00260 Helsinki. Business ID: 0202637-8. Person responsible for data protection at the FSHS: Marjo Tipuri, marjo.tipuri(at)yths.fi, tel. 040 5775526.
b) The University of Jyväskylä, Seminaarinkatu 15, PO Box 35, 40014 University of Jyväskylä. Tel. (switchboard) (014) 260 1211, business ID 0245894-7. Data Protection Officer at the University of Jyväskylä: tietosuoja(at)jyu.fi, tel. 040 805 3297.
Responsible study director, contact person and person conducting the study
Heidi Riska, tel. 044 5093910, heidi.e.riska(at)student.jyu.fi, FSHS, Töölönkatu 37A, 00260 Helsinki.
Study supervisor
Associate Professor Arto Hautala, University of Jyväskylä, Seminaarinkatu 15, PO Box 35, 40014 University of Jyväskylä.
Rights of data subjects
Withdrawal of consent (Data Protection Regulation, article 7)
You have the right to withdraw your consent in so far as the processing of personal data is based on consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right of access (Data Protection Regulation, article 15)
You have the right to know whether your personal data are being processed and what personal data are being processed about you. If you wish, you may also request a copy of the personal data being processed.
Right to rectification (Data Protection Regulation, article 16)
If your personal data being processed are inaccurate, you have the right to request rectification or completion of the data.
Right to erasure (Data Protection Regulation, article 17)
You have the right to request erasure of your personal data in certain cases. However, the right to erasure shall not apply in so far as the erasure renders impossible or seriously impairs the achievement of the objectives of the processing in scientific research.
Right to restriction of processing (Data Protection Regulation, article 18)
You have the right to have the processing of your personal data restricted in certain cases, including when you contest the accuracy of your personal data.
Right to object (Data Protection Regulation, article 21)
You have the right to object to the processing of your personal data when the processing is based on public or legitimate interest. After such an objection, the University cannot process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your rights.
Derogating from these rights
The rights described here may be derogated from in certain individual cases on the grounds laid down in the Data Protection Regulation and the Finnish Data Protection Act in so far as the rights render impossible or seriously impair scientific or historical research purposes or statistical purposes. The need to derogate from these rights is always assessed on a case-by-case basis.
Profiling and automated decision-making
In this study, your personal data will not be used for automated decision-making. The purpose of processing personal data in the study is not to assess your personal characteristics (profiling); your personal data and characteristics will be assessed from the perspective of a broader scientific study.
Implementation of the rights of data subjects
If you have any questions regarding the rights of data subjects, you can contact the University’s Data Protection Officer. All requests regarding implementation of the rights should be sent to the Registry Office of the University of Jyväskylä. Registry Office and Archives, PO Box 35 (C), 40014 University of Jyväskylä, tel. 040 805 3472, e-mail: kirjaamo(at)jyu.fi. Visiting address: Seminaarinkatu 15, building C (University main building, 1st floor), room C 140.
Notification to the University of Jyväskylä of a data breach or a suspected data breach
https://www.jyu.fi/fi/yliopisto/tietosuojailmoitus/ilmoita-tietoturvaloukkauksesta
You have the right to lodge a complaint with a supervisory authority, in particular with the supervisory authority of your habitual residence or place of work, if you consider that the processing of personal data infringes the EU’s General Data Protection Regulation (EU 2016/679). In Finland, this supervisory authority is the Data Protection Ombudsman.
Up-to-date contact details for the Data Protection Ombudsman’s Office: https://tietosuoja.fi/etusivu
(This text has been prepared 12 September 2022)