4.4.02 Please provide the NHSCR reference number for your project. This should also be provided on the pre-submission checklist. I f you do not have a reference number and require NHSCR data, you will need to contact the NHSCR before submission of your HSC-PBPP form. Please indicate the nature of the access to the NHS Central Registry:

- • proposal requires access to the NHS Central Registry as a sampling frame for cohorts • proposal requires access to the NHS Central Registry as a sampling frame for cohorts identified in the proposal.
- • proposal involves the flagging of individuals on the NHSCR for the purpose of long-term • proposal involves the flagging of individuals on the NHSCR for the purpose of long-term follow up.

4.4.03 If you require flagging, please select the specific purpose for which flagging of individuals against the NHSCR will be undertaken, selecting each relevant specific purpose listed. If Scottish Cancer Registrations is part of the selection these will be anonymised. 4.4.04 Please indicate if the proposal requires any further involvement of NRS, its data, infrastructure or staff, providing details where this is the case.

#### 4.5 Making Contact with Individuals

This section outlines in detail any proposed contact with individuals, who are the data subjects and / or their families, those who will be approached to provide data from their patients (e.g. clinical staff, GPs) and how this will be controlled. It is considered best practice for contact with patients, patient's relatives and families to be undertaken by clinical staff or other professionals already known to them. Proposed contact with individuals by those not already known to them should be supported by detailed evidence as to the reasons that contact in this way is appropriate.

If you wish to contact people (e.g. participants for research) via text or email, you need to ensure that your approach complies with the Privacy and Electronic Communications Regulations (PECR). The PECR sit alongside the Data Protection Act and the UK GDPR. They give people specific privacy rights in relation to electronic communications. These primarily apply to marketing emails, but recruitment for research could be classed as a form of marketing. For further information please see the link on the ICO's website: https://ico.org.uk/for-organisations/guide-to-pecr/ and / or contact your local Information Governance advisor / Data Protection Officer.

4.5.01 Please indicate if any direct contact with any group of individuals is proposed.

###### If you answer 'No' to this question, please proceed to section 4. 6.

4.5.01a If you answer 'Yes' to this question, please use the section below to indicate which group will be contacted, what method of contact will be used, and who will make contact. Please include these details in respect of each group to be contacted. 4.5.02 Please provide an explanation of why contact is necessary within the context of the proposal methodology. You should attach as supporting evidence any relevant documentation detailing the methodology proposed for making contact, and in particular contact forms, information leaflets, letters or other communications being used when making contact with individuals.

#### 4.6 Community Health Index (CHI) Database

This section details any proposed use of the information held within the Community Health Index (CHI) database. This includes the use of details such as current and previous address, current GP Practice, where accessed via the CHI database. This does not include the use of CHI numbers for data linkage, data matching or obtaining matched controls.

4.6.01 Please indicate whether you require access to the CHI database.