Which organisation holds which information?
Map the steps separately: browsing a study listing, sending an enquiry, being assessed at a centre and participating in research. Ask which organisation is responsible at each step and where its notice is available. A hospital, sponsor or technology provider may have different roles; do not infer those roles from a logo alone. This guide does not replace any HopeStage notice or describe the practices of every listed study. Before sharing information through a form, check its own purpose, recipients and contact details rather than assuming it goes directly into a research record.
What is the difference between coded and anonymous data?
An anonymous dataset does not identify you in practice. With coded or pseudonymised information, names may be replaced by a study code while additional information can still connect that code to a person. The CNIL explains why pseudonymised data remain personal data within the relevant European framework. Ask who holds the connection between your name and the research code and who can use it. A statement that names will not appear in a publication does not answer every question about access to identifiable source records or other sharing.
Who might access or receive the information?
Ask for the recipients or categories of recipients in the study notice, their purposes and the information they can see. Distinguish the team providing care, researchers analysing data, people checking study quality and any other named recipients. These are questions to clarify, not a universal access list. Ask whether a recipient sees your name, a code or a summary. If someone outside the centre is involved, ask under what arrangements. A relative or supporter should not be assumed to have access simply because they accompany you to an appointment.
What about recordings, apps, samples or other countries?
Ask separately about audio, video, wearable devices, phone data and biological samples if the protocol includes them. What is necessary, what is optional and what happens if you decline an optional use? For an app, ask which organisation supplies it and how technical support handles information. For future research or sharing abroad, ask which purposes, destinations and safeguards are described. Do not assume every study uses these data types or that being asked to use an app means every permission on your phone is required.
How long are records kept and what rights apply?
Look for retention information and the route for exercising applicable rights. Participation consent and the legal grounds for processing data are distinct. The available rights and their limits depend on the relevant jurisdiction, purpose and records. Ask about correcting an error, obtaining access or stopping future contact without assuming that all existing research information can be erased. France’s CNIL MR-001 is a conditional framework for particular health research, updated in 2026; it is not a certificate that applies to every study worldwide. Request an explanation specific to the notice you received.
Who can help you resolve an unclear answer?
Start with the study’s named privacy contact or data-protection officer, if one is listed. Describe the particular question and the document or version you are reading. Ask for an answer in writing if that would help you compare the arrangements with your concerns. In France, CNIL provides information on data-protection rights and complaints; elsewhere, identify the appropriate local authority. Keep records of requests without posting health details publicly. If a form lacks enough information to understand its purpose or recipients, clarify that before uploading sensitive documents.