Data protection regulation requires that we state the legal basis for processing patient information. In the case of research, this is 'a task in the public interest'. The University of Oxford is the data controller and is responsible for looking after your information and using it properly.

The study staff will use information from the patient, medical records, NHS Digital, and other central NHS registries in order to undertake this study and will use the minimum personally-identifiable information possible.The study staff will ensure that the participants' anonymity is maintained. The participants will be identified only by a participant ID number on all study documents and any electronic database - with the exception of the case report forms (CRFs), where participant initials may be added. All documents will be stored securely and only accessible by study staff and authorised personnel. The study will comply with the Data Protection Act, which requires data to be anonymised as soon as it is practical to do so. A study specific participant number and/or code in any database will be used to identify the participants. The name and any other identifying detail will not be included in any study data electronic file. Any patient related data transferred between the main study office and participating sites will be identifiable only with the patients' unique study number. If more identifiable information is required, secure measures such as registered post, courier, or nhs.net email accounts will be utilised.

All patient information will be stored on password protected computer databases or in locked filing cabinets in line with the University of Oxford and Trust Policy. When the results of the study are reported, individuals who have taken part will not be identified in any way.

Any identifiable information surrounding patients will be kept for 12 months after the study has finished. This excludes any research documents with personal information, such as consent forms, which will be held securely at the University of Oxford for 5 years after the end of the study.

The local study team will use the patients name and contact details to contact patients about the research study, including sending questionnaires for you to complete. They will keep identifiable information about patients from this study for 12 months after the study has finished.

Responsible members of the University of Oxford or your NHS Trust may be given access to data for monitoring and/or audit of the study to ensure we are complying with research regulations. Personal data will be stored for 12 months after the study has ended and research data generated by the study will be stored for 5 years in locked filing cabinets accessed only by members of the research team who have card access to the building. After this time, this data will be destroyed.

Data protection regulation provides the patient with control over their personal data and how it is used. When agreeing to personal information being used in research, however, some of those rights may be limited in order for research to be reliable and accurate.

Further information about a participant's rights with respect to personal data is available at https://compliance.web.ox.ac.uk/individual-rights. NEON is an OCTRU Trial sponsored by the University of Oxford, which has issued the following transparency statement.