Data Minimisation, Secure Transfer and Defined Accountability
Research Data Handling
Neuromap™ separates public research enquiries from contracted study-data processing. Participant data are accepted only through an approved route after roles, purpose, security and permitted processing have been defined.
Public website enquiries
The public enquiry form is intended for professional contact information, study-level details, acquisition specifications and non-identifiable documents. Do not submit participant names, dates of birth, addresses, NHS numbers, medical-record numbers or identifiable EEG files through the public form or ordinary email.
Before study data are transferred
- The intended purpose and requested processing are defined.
- The contracting parties identify controller, joint-controller or processor roles as applicable.
- The permitted dataset, identifiers, metadata and linkage keys are agreed.
- The secure transfer route, hosting, access, retention and deletion requirements are confirmed.
- Applicable data-processing, confidentiality, international-transfer and sub-processing terms are executed.
- A representative de-identified file may be reviewed through the approved route for technical feasibility.
Pseudonymisation and minimisation
Study files should use sponsor-controlled subject and visit identifiers rather than direct identifiers. Only metadata required for the approved analysis should be transferred. The re-identification key should remain with the authorised sponsor, site or designated data custodian unless a separate lawful and documented arrangement requires otherwise.
Secure transfer and access
- Encrypted transport through the approved project route.
- Role-based access limited to authorised personnel.
- Multi-factor authentication where applicable.
- Project separation and least-privilege access.
- Malware scanning and controlled file intake.
- Logging of material access, processing and release events according to the project specification.
- No use of participant data for unrelated marketing or public demonstration.
Processing and output control
Source files, derived data, analysis configurations, quality status and deliverables are linked through the approved project identifiers. Outputs are reviewed and released only to authorised recipients. Any use of data to improve, retrain or validate an algorithm beyond the contracted study purpose requires a separate lawful basis, governance approval and contractual permission.
Retention, return and deletion
Retention periods are defined by the applicable contract, protocol, sponsor requirements, law and research-governance framework. At the end of the agreed period, data are returned, archived or securely deleted according to documented instructions. Neuromap™ does not publish a single universal study-data retention period because requirements differ by project and jurisdiction.
International and multi-site projects
For international studies, the parties assess data location, applicable law, transfer mechanism, importer and exporter roles, sub-processors, security and sponsor requirements before transfer. A study being multi-site does not by itself authorise unrestricted pooling or cross-border transfer.
Incident and issue management
Suspected data-security incidents, misdirected files, unexpected identifiers, access issues or integrity concerns are escalated through the agreed incident pathway. The responsible controller determines regulatory and participant notifications, with Neuromap™ providing required information within the contracted role.
Research participant transparency
The sponsor or responsible research organisation provides appropriate participant information describing how data are used, who receives them, retention, rights and safeguards. Neuromap™ supports accurate processor or recipient wording where its role forms part of the approved study data flow.
Contact about research data
For study-specific security, privacy or data-transfer questions, contact research@neuromap.co.uk. Do not attach participant data to the initial email.
Frequently asked questions
Common questions about research EEG data handling.
Can we upload an EEG file through the public enquiry form?
The public form should not receive participant EEG files. Request an approved secure transfer route after initial feasibility review.
Does removing the name make an EEG anonymous?
Not necessarily. Pseudonymisation and anonymisation are different. The risk depends on the full dataset, metadata, linkage and reasonable means of re-identification.
Will Neuromap™ use study data to train AI models?
Not unless that use is separately authorised, lawful, governed and contractually permitted.
Where are data hosted?
Hosting and data-residency details are confirmed for the specific service and contract before transfer.