Cardiff and Vale University Health Board

NIHR152686

ISRCTN Registry - 14434966

Trial - Randomised Controlled Trial

Krishna Narahari (0000-0003-0257-7033)

Rakesh Heer (0000-0003-1952-7462)

Mark Forrest ORCID ID 0000-0002-2395-8823

CHaRT data sharing policy https://www.abdn.ac.uk/hsru/what-we-do/trials-unit/data-sharing-1115.php

UK Hospitals, patient reported outcomes collected from participants at home

Patient reported baseline and outcome data will be collected via postal or online questionnaires from participating men. Clinical data will be collected from existing medical, surgical and pathology/laboratory records. Study data will be captured into a bespoke study website. Source data is documented in the trial protocol

Study data will be captured into a bespoke study website. We aim to recruit 1080 participants into the study and will capture data at baseline, at the time of surgery, at 3, 6 12, 18, 24 and 36 months. The data will be structured and stored within SQL Server 2019.

Standardised data capture tools are used; mostly with closed response options. Trial staff involved in recording data onto hard copy or eCRF will be trained. Where data is transcribed from hard copy to eCRF, a sample will be checked for accuracy of data entry. Similarly a sample of postal questionnaires will also be selected to be checked for accuracy of data entry entry. The trial team will undertake quality assurance on the data collected - looking for outliers, missing data etc. The independent DMC will review accumulating data.

Files are backed up nightly, weekly and monthly, and backups retained for up to 6 months. • Our standard backup policy for unstructured data is based on daily snapshots, plus 2 monthly backups to tape, extended to 6 months for research projects. • Data is encrypted at rest. • Backups of active University data are stored on tape in locations separate to the IT data centres. • The backup infrastructure and backup tapes are held in 2 separate buildings on our Foresterhill campus. • Each tape drive location is within a physically locked room and keys to access the rooms are only available to a limited number of IT staff. • Access to the room is only available when arranged in advance with the data centre team.

• Study website uses SSL/HTTPS and is a minimum of 3DES SHA-1 • Website is partitioned so that access is restricted to only those who need to have access (eg personal identifiable data for site participants is only accessible to site staff with delegated responsibilities in site and trial office staff with delegated responsibilities in CHaRT) • Personal identifiable data is encrypted to AES_256 as a minimum. • Username and password required to access the study website. • The programming team are looking to incorporate multifactorial authentication (MFA) into the study websites, and during the course of ELIPSE this may be implemented. • The inactivity timeout is set to 20 minutes to allow sufficient time for users (research Nurses) to be able to complete the case report forms without being timed out. • Regular vulnerability assessments and penetration testing carried out by external partners as directed by University of Aberdeen Information Security Policy. • All user access and activity are logged in an audit trail using Apex audit system and Log4Net. • The Trial Office removes user access to the study website on confirmation that a member of staff with access has left. • In addition the programming team run a report every 6 months identifying people who have not logged onto the system within the last 3 months. The trial office team review this and remove study website access for anyone who no longer requires it. • Personal identifiable data is kept in a separate encrypted table within the study website Intrusion defence: • Email Spam Filtering, • Malware , • ProtectionAntivirus Software is installed on all servers • Vulnerability Scanning: The University undertakes internal vulnerability scanning on at least a monthly basis.. A Service Desk call is logged for all vulnerabilities rated ‘High’ or ‘Critical’ so that these can be investigated and remediated. Where remediation is not possible, these are assessed, accepted or mitigated as appropriate, and reviewed on a regular basis.

The study is due to complete in January 2030. Once the study is complete and reported, data can be shared on reasonable request to the Chief Investigator. CHaRT (the CTU running ELIPSE) is committed to sharing clinical trial de-identified data for additional, ethical research with justified scientific objectives. CHaRT has a data sharing policy https://www.abdn.ac.uk/hsru/what-we-do/trials-unit/data-sharing-1115.php

All trial data will be preserved within the University of Aberdeen, along with associated documentation in the trial master file.

Data requests should be made to the Chief Investigator via DataSharing@abdn.ac.uk and such requests will be handled directly. It is likely that data can be shared in multiple formats (for example STATA, MS Excel). We are exploring depositing data into a repository but have not yet developed a policy.

Krishna Narahari (Chief Investigator), Cardiff and Vale University Health Board Mark Forrest (Senior IT Manager), CHaRT, University of Aberdeen

Resources are included in the funding to cover data collection and storage for the lifetime of the project and curation/preservation beyond the project's lifetime. Unless requirements change, we do not anticipate requiring additional resources at this stage. We have not included costs associated with depositing into a data repository (as noted above, we do not yet have a policy to cover this).