Privacy and data protection
Participant Information Notice Template
A template that organizations and researchers using EnaResearch can adapt when preparing the information notice they give to study participants.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This is a template, not legal advice. ENA Innovation provides this text as a starting point for organizations and researchers using EnaResearch. Before it is given to participants, it must be reviewed by the organization's data protection officer or legal counsel and its ethics committee, and adapted to the study and the applicable law (for example the KVKK, the GDPR, the UK GDPR or the Swiss FADP). The organization running the study fills in the fields in square brackets
[...]; sections that do not fit the study should be removed. The organization running the study is the data controller; ENA Innovation is not responsible for the content of this notice or for the organization's duty to inform.
[Study title] — Participant Information Notice
- Data controller: [Full legal name of the organization, or name of the independent researcher], [address] (the "Organization")
- Study: [Study title and protocol number]
- Principal investigator: [Name, department, contact]
- Ethics approval: [Name of the ethics committee], [date and reference number of the decision]
- Version and date: [Notice version, date]
1. Why are you receiving this notice?
This notice explains how your personal data will be processed if you take part in the [study title] study. Taking part is voluntary. Not taking part, or ending your participation, does not affect [the care you receive or your relationship with the Organization].
2. The software used
The Organization uses the EnaResearch platform of ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation") to collect and manage study data. ENA Innovation processes the data only on the Organization's instructions and on its behalf, as a data processor. Your data is kept in the Organization's own environment: a separate environment with its own application stack and its own database and database user. This environment is hosted in [hosting region / country].
EnaResearch is not a medical device. The data collected is not monitored in real time and is not used to raise alerts about your health. [The Organization describes the study's monitoring arrangements here.] If you have an urgent health problem, call [emergency number] or go to the nearest healthcare facility.
3. What data is processed?
| Data group | Examples |
|---|---|
| Identity | Given name, family name, sex, date of birth |
| Person identifier (if used) | [Turkish national ID number / NHS number / BSN / AHV number / KVNR / hospital record number]. The identifier is not stored in clear text; only a keyed hash and its last 4 characters are kept. [State it if the Organization has switched on storing an encrypted copy.] |
| Study records | Your participant code, dates of participation, devices assigned to you |
| Device and health-platform data | [Measurement types the study allows: for example heart rate, heart rate variability, steps, distance, calories, workouts, SpO₂, respiratory rate, skin temperature, sleep, blood pressure, blood glucose, weight, walking steadiness, heart health events, mood and GAD-7/PHQ-9 total scores, nutrition, symptoms, hearing and environment] |
| Sources | [Wearable such as an armband (where available, through a hub or your phone) / Apple Health (HealthKit) / Health Connect] |
| Clinical records (if used) | [Records entered or imported by the research team, for example from the hospital system as CSV or FHIR R4: admissions and discharges, procedures such as surgery, clinical events, free-text notes] |
| Manually entered values (if used) | [For example pain and fatigue scores, Borg scale, hemoglobin, CRP, leukocytes, creatinine, albumin] |
| Eligibility and research results | [Your eligibility assessment for the study; research variables derived from your data and statistical results] |
| Technical data | Mobile app session and device details; participant web area session (participant code and PIN), where you see your transfer status and a daily summary; data transfer and synchronization status |
| [Other] | [Add any other study-specific data, such as questionnaires or clinical data] |
Device and health-platform data, clinical records and manually entered values are a special category of personal data (health data).
[Include only if the study collects them: Reproductive health and sex life data. The study also collects [menstrual cycle / fertility / pregnancy / contraception / menopause / sexual activity] data. This data is particularly sensitive; it is collected only with your explicit consent, which you can refuse [without affecting the rest of your participation]. Our ethics approval [number, date] covers it explicitly.]
The mobile app reads Apple Health or Health Connect data only with the permission you give on your phone's permission screen, and only for the measurement types above. Data collection period: [start – end].
4. For what purposes is it processed?
- [Scientific purpose of the study]
- Collecting, validating and organizing data according to the study protocol
- Monitoring data transfers and fixing problems
- [Other purposes]
Your data is not used for advertising, marketing or profiling, and is not sold.
5. Legal basis
[The Organization determines the legal basis with its legal counsel and states it here. For example, under the KVKK, explicit consent or another condition provided in Article 6; under the GDPR, Article 6 together with Article 9 (for example Article 9(2)(a) explicit consent or, to the extent permitted by the applicable law, Article 9(2)(j) scientific research). If consent is relied on, explain how it is given and how it can be withdrawn.]
6. Who can access the data and who receives it?
- Authorized members of the study team. A researcher can access only the data of studies whose team they belong to.
- ENA Innovation as data processor and its sub-processors (current list: www.enaresearch.com/en/legal/sub-processors).
- Datasets exported for analysis do not include your name; a pseudonym (for example P001) is used. The person identifier is not exported.
- [If there are other recipients, such as a sponsor, a partner institution or competent authorities, give their names and purposes.]
- [If data is transferred abroad, state the country and the safeguard relied on.]
- [Include only if the Organization enables the AI assistant: the research team may use an optional AI assistant (provider: Anthropic, USA). It receives only aggregate study information, such as counts with small numbers suppressed and statistical results, and text the researcher types; your individual records and identity are never sent.]
Apple and Google do not receive data for this study: Apple Health and Health Connect data stays on your phone until the app sends it to the Organization's environment.
7. Retention period
Your data is kept for [retention period and reason]; at the end of the period it is deleted, destroyed or anonymized. [State it if raw data and exported datasets have different periods.] [State whether the data of your participation will be deleted if you leave the study; EnaResearch lets the Organization delete it.]
8. How can you end your participation?
- You can withdraw the Apple Health or Health Connect permissions at any time in your phone's settings; no new data is read after that.
- To leave the study, tell the research team through [contact channel]. The team revokes your participant code; this also ends the app session on your phone.
- [Explain what happens to data collected before you leave: for example it is deleted (EnaResearch lets the Organization delete the data of your participation) / anonymized / continues to be used in the analysis to the extent the law allows.]
- Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
9. Your rights
Depending on the applicable law, you have rights such as to access your data, to ask for it to be corrected, erased or its processing restricted, to object, to data portability, and to claim compensation for damage caused by unlawful processing. [The Organization sets out here the rights and any limitations under the applicable law, for example scientific research exemptions.]
Send your requests to the Organization: [address, email, form]. Requests that reach ENA Innovation are forwarded to the Organization.
You can also lodge a complaint with [name and contact details of the supervisory authority, for example the Turkish Personal Data Protection Authority, the relevant EU/EEA supervisory authority, the UK ICO or the Swiss FDPIC].
10. Contact
- Research team: [name, phone, email]
- Data protection officer / personal data contact: [name, email]
- Ethics committee: [name, contact]
[Consent section: if the Organization relies on explicit consent, use a consent form separate from this notice, with a signature or confirmation field.]