GDPR Compliance

​Confidentiality:

Ethical concerns relating to personal data are addressed by ensuring security of personal data acquired for the study

and by following good clinical practice and the requirements of the European Union data protection law (General Data

Protection Regulation [GDPR]) and data protection regulations of the countries to which study data may be transferred

to for analysis. Data will be provided by CIS-Oncology to contract research organisation (Evidera, a part of PPD) in a

pseudonymised format containing no patient identifiable information. For the purposes of protecting a patient's identity,

a unique code will be assigned to identify each patient. CIS-Oncology will keep the key to match the unique study

codes with the NHS patient identifiers and Evidera and Bristol-Myers Squibb will not have access to this.

Informed consent:

All data collected will be retrospective and will be pseudonymised to ensure that no patient identifiable data will be

extracted and transferred from ChemoCare. It is therefore not anticipated that informed consent is required for this

study. In line with GDPR, centres that take part in the study have information pages on their hospital websites,

describing how patient data may be used for research.

Repeated access to data (waved data collection approach):

Data from each wave will be used in the final analysis. The rationale for this approach is because at the time of the

first data extract (wave 1), some treatments for the indications of interest may have only been on the market for a short

period of time and therefore repeated data extraction would facilitate the evaluation of longer term outcomes (e.g.,

treatment patterns and overall survival). While new patients will be included with each follow-up wave (waves 2-7),

patient identification and data collection will remain fully retrospective at each follow-up extraction. At each follow-up

wave, the data extracted will span from the time of the first wave (i.e., the study eligibility period start date) up until the

current wave extraction date. Data collected from each subsequent follow-up wave will replace data extracts from

previous waves, to ensure that the most up-to-date information is available at each timepoint. The same confidentiality measures will apply to the first wave and any follow-up waves. With this approach, no linking between data extraction

waves is needed.

The ChemoCare prescription platform owner (CIS-Oncology) will be provided with a list of the variables and timepoints

of interest and they will de-identify all data before sending this to Evidera. Therefore, Evidera will not have access to

any patient identifiable data at any stage in this study.