MELODY Study (Mass evaluation of lateral flow immunoassays for the detection of SARS-CoV-2 antibody responses in immunosuppressed people) - Transplant Patients

This agreement is to support the Mass evaluation of lateral flow immunoassays for the detection of SARS-CoV-2 antibody responses in immunosuppressed people (MELODY) Study, being conducted by Imperial College London (sponsor) and joint data controllers with NHS Blood & Transplant and being funded by the Medical Research Council.

MELODY aims to determine:

1. The proportion of immunosuppressed people who have detectable SARS-CoV-2 antibodies following a primary vaccine course (at least 3 doses), and the demographic, disease, and treatment characteristics that influence antibody status.

2. If the detection of antibodies inversely correlates with subsequent risk of SARS-CoV-2 infection and/or severity of disease in immunosuppressed people.

The MELODY study includes two parallel arms: one where a cohort of people who are immunosuppressed due to autoimmune diseases and cancers are identified by the National Disease Registration Service (NDRS) (completed under DARS application DARS-NIC-609903-V6Q7S-v0.2) and another parallel and methodologically similar arm where a cohort of people who are immunosuppressed due to solid organ transplants are included through NHS Blood and Transplant (NHSBT). This application relates only to the arm involving NHSBT and the transplant recipient patients.

Imperial College is leading this research, but other organisations are also involved. Imperial College have engaged Ipsos MORI, an independent research organisation, as data processor, to send out invitations to people who are eligible for the MELODY study, to conduct the survey, and post out the home antibody testing kits to participants.

NHS Blood and Transplant (NHSBT) are supplying the cohort of patients to invite to the transplant recipients arm of the study, and NHSBT will receive the study data once the survey and antibody tests are complete to perform the study analysis, and for those participants who consent to data linkage will process it further as part of the NHSBT record.

The National Disease Registration Service (NDRS) are supplying the cohort of patients to invite to the immunosuppressed people arm of the study and will receive the study data relating to this cohort once the survey and antibody tests are complete to perform the study analysis (completed under DARS application DARS-NIC-609903-V6Q7S-v0.2).

There will be two separate parallel analyses, and only NDRS and NHSBT separately have access to the longer-term outcome data, including positive COVID tests and hospital admission. The NDRS and NHSBT data will not be linked and will be analysed separately.

Other organisations (University of Nottingham, University of Cambridge, University of Southampton) employ people who are clinical experts and form part of the study team but are not involved in data flows or in determining the purpose and means of the processing.

The study team are undertaking a rapid study set up in order to capture this participant cohort in line with the current roll out of 3rd doses of COVID 19 vaccinations for people who are immunosuppressed, which was announced on 1 September 2021. The researchers need to collect antibody test results within 90 days of people's 3rd or 4th dose of COVID 19 vaccination.

The MELODY study will invite up to 40,000 people solid organ transplant recipients aiming to recruit 10,000. (An additional 24,000 people immunosuppressed from disease or treatment for blood cancer will also take part in the MELODY study, but the process of inviting them has been covered in another DARS application DARS-NIC-609903-V6Q7S-v0.2. The two cohorts from each separate agreement will not be linked). The patient demographic service data (PDS) requested from NHS Digital is restricted to this cohort, for the sole purpose of sending them letters of invitation asking them if they wish to consent to take part in the study and confirming their identity if they register on the study web portal or contact the Ipsos MORI helpline. Those eligible will be people who have received a solid organ transplant and are ≥18 years of age who have received at least 3 doses of a COVID-19 vaccine.

The near patient antibody testing kits (also called Lateral Flow Immunoassay, or LFIA kits - an at home finger prick blood test) used in the MELODY study are licensed by the Medicines and Healthcare products Regulatory Agency (MHRA) only for use in people aged 18 or over. The Real time assessment of community transmission (REACT-2) study team did apply to the MHRA for their approval to use the kits in under 18s outside the licence, but the MHRA did not grant approval for this. We are therefore limiting the MELODY study to participants aged 18 and over at the present time in order to start the MELODY study without delay. The MELODY study team are planning to apply to the MHRA to use the LFIA kits in people aged 12-18, and if this is granted apply for a study amendment to include participants aged 12+ (the age group who have been offered vaccination at the time of writing); but the MELODY study team do not wish to delay the start of the study while awaiting the outcome of this application process.

There will also be two online or telephone questionnaires to complete. There are no invasive procedures, although the fingerprick may cause some short-lived discomfort.

The processing of data for this study is a task of public interest. Imperial College London is data controller and processes data under the legal basis of Article 6(1)(e) ‘processing is necessary for the performance of a task in the public interest or in the exercise of official authority’, and Imperial College London is a Public Authority as it has a Royal Charter. The research will provide a measure of the national seroprevalence, i.e an estimate the proportion of the population that has COVID-19 antibodies, for these vulnerable populations, and also describe the real-world effectiveness of at least 3 COVID-19 vaccinations against COVID-19 infection, hospitalisation and death. Furthermore, it may identify a cohort of people who have not developed measurable antibodies following at least 3 doses of COVID-19 vaccination and who may be targeted for further studies or interventions, for example of prophylactic (preventative) monoclonal antibody treatments to prevent COVID-19 infection.

Imperial College London, the Data Controller, processes special category data under Article 9(2)(j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes…’ as the data are required for research purposes in the public interest and judged subject to the appropriate safeguards. This means that Imperial College London (the Data Controller) can use personal data for research with appropriate safeguards in place.

Health and care research should serve the public interest, and the Data Controller has demonstrated in this Purpose section that their research serves the interests of society as a whole. They also do this by following the UK Policy Framework for Health and Social Care Research.

The legal basis for the patient identifiable data from NDRS to flow from NHS Digital to Ipsos MORI for the purpose of Ipsos MORI inviting them is Section 251 approval (NHS Act 2006).

The survey will involve processing special category data in relation to the health and ethnicity of individuals taking part. The results will be used to help provide stratified advice to specific patient groups, rather than classify all immunosuppressed patients at risk. This information could also help estimate and/or identify the number of patients who may benefit from additional or alternative methods of prophylaxis, i.e. treatment given or action taken to prevent disease, such as monoclonal antibody therapy. Monoclonal antibodies (MABs) are a type of targeted drug therapy, in this case against the SARS-CoV-2 virus, and have the potential for both therapeutic (treatment) and prophylactic (preventative) applications.

The research also has ethical approval from the London Central Research Ethics Committee (REC) and Health Regulatory Authority (HRA) dated 30 November 2021.

The cohort will be selected from the NHS Blood and Transplant Registry. The data required is demographic information from the NHS Digital Personal Demographic Service (PDS), to allow individuals aged 18+ from the cohort selected above to be contacted for the purpose of undertaking a survey of seroprevalence, i.e an estimate of the proportion of the study population that has COVID-19 antibodies, using self-administered lateral flow assays. The data requested (name, address, postcode, mobile telephone number, and date of birth) are the minimum required to send letters of invitation to a random sample of suitable participants, and confirm their identity on registration or when they contact the helpline.

Ipsos MORI will use the names and addresses to post letters of invitation to potential participants, and mobile telephone numbers to send text message reminders. They will use the name and date of birth to check the identity of each person who registers (to ensure they are the invited person). Each potential participant will also be assigned a unique invitation ID so that issues with specific records can be communicated between Ipsos MORI and NHSBT, such as if an invitee wishes to opt out. Personal identifiable information such as names, addresses and mobile telephone numbers will be kept separately from the study data and not used for analysis. However, for those participants who give consent to be contacted about future research studies, contact details will be passed to NHSBT at the end of data collection to enable this future contact if appropriate. Ipsos MORI will destroy the personal data they receive after all invitations have been issued, which is estimated to be at the end of March 2022.

The data extracts requested from NHS Digital will be used in order to contact a nationally representative sample of adults to take part in the testing. Data will not be made available to any third parties, other than those specified in this agreement, except in the form of aggregated outputs with small numbers suppressed in line with the suppression rules stated in the HES analysis guide.

Patient and Public Involvement

The study has the support of several different health charities (Kidney Research UK, Blood Cancer UK, Vasculitis UK, Lupus UK, the Cystic Fibrosis Trust, Kidney Care UK). The study protocol and acceptability was designed/adapted with patient representatives from these groups, together with patient representatives from the NHSBT patient advisory groups.

When the survey and antibody results have been collected they will be collated by Ipsos MORI, and securely transferred to NHSBT for analysis. Participants will be identified by their unique invitation ID . MELODY is an approved NHSBT analytical project.

Data controllers:

• Imperial College London (sponsor)

• NHS Blood and Transplant

Data processor:

• NHS Blood and Transplant

Ipsos MORI who are working with the following suppliers to deliver the project:

• Formara Limited - Print and dispatch

• Txtlocal Ltd - Text message reminders

• Tivian GmbH - Online front-end data collection platform accessed by Ipsos Germany

NHSBT will be sending NHSD the NHS number of approx. 40,000 eligible transplant recipients identified through the UK Transplant Registry. NHS Digital are requested to provide the contact details (from PDS), (approx. 40,000), in one drop to Ipsos MORI. If records do not match they will be excluded from the data disseminated to Ipsos MORI.

Imperial and NHSBT have a Data Processing Agreement with Ipsos Mori, that has the provisions for sharing data outside of the UK for example standard contractual clauses within their Data Processing Agreement.

The contact details will be used to contact up to 40,000 people to ask them to register and consent to complete the test - stopping when 10,000 have consented to do this. In order to do this each person will be sent a letter by an approved print supplier (Formara Ltd). If they agree they will register online which will then trigger a test being sent to their address by Formara Limited. The test is then self-administered and the participant is asked to take part in a short online or telephone survey including information on demographic variables, household composition and their medical condition.

Ipsos MORI will use the following PDS data to programme the online registration/survey and data collection platform at Tivian GmbH:

~ sample source

~ first name

~ surname

~ serial ID

Tivian GmbH will then hold the consented cohort data on their servers. All suppliers are GDPR and UK GDPR compliant.

Name and address information is held securely and separately from the survey data, for example, there is controlled and restricted access to the computer system where this information is stored at Ipsos MORI. The personal data is only used by Ipsos MORI for the purpose of inviting people to take part in the research, and confirming the identities of people who register for the study or contact the helpline. No identifiable data is shared outside the research team (unless participants consent to data linkage or to be contacted about future research). All published outputs will be aggregated with small numbers suppressed.

If participants do not consent to further data linkage they will be withdrawn from the second part of the study (aim 2: If the detection of antibodies inversely correlates with subsequent risk of SARS-CoV-2 infection and/or severity of disease in immunosuppressed people) as outcome measures for the second part require linkage to other datasets within NHSBT.

The identifiable patient level data is used to invite patients to register to take part in the research.

All employees involved in the processing are substantive employees of the data processing organisations and are appropriately trained in data protection and confidentiality. Ipsos MORI is certified to ISO 27001 the international standard for Information Security and ISO 20252 the international standard for market research. All employees sign contracts that include appropriate confidentiality clauses, requiring them to comply with relevant data protection policies and procedures. Information Security and acceptable use policies and procedures include clauses that clearly define unauthorised use and/or deliberate misuse, disclosure, loss or destruction as misconduct, with appropriate links to disciplinary procedures. Policies and procedures also include clear warnings that such actions may also lead to legal action against those involved.

All suppliers (for printing and online survey delivery) are approved suppliers (also certified to ISO 9001 and ISO 27001) and UK GDPR Article 28 compliant agreements are in place.

All personal data held in delivering this survey will be subject to appropriate security measures to ensure it is kept secure from accidental or deliberate loss, destruction or disclosure. All organisations handling personal data are accredited to the international standard for information security (ISO 27001), which requires an information security policy documenting their approach.

In terms of technical measures, all users have their own login and password, and access controls are based on user accounts with rights automatically controlled by ‘Active Directory’ group security policy objects.

Access to patient identifiable data will be restricted to the minimum number of personnel; all of whom have undergone training in data protection law, their duty of confidentiality under contract and in the care and handling of personal data.

Any locations containing patient identifiable information would have restricted access to a limited number of project team members, with access rights regularly reviewed.

Where data needs to be transferred, this will be done via SEFT (with NHS Digital). Controls extend to data destruction policies, with electronic data destroyed using approved shredding software, to agreed timescales, and evidenced by destruction certificates stored in the project folder.

The NHS Digital data will not be used for any other purposes or combined with any other datasets other than those detailed in this Agreement.

The outputs will be a report for the Department of Health and Social Care (DHSC) to inform health policy, and papers in the peer-reviewed medical literature to make the results available for the benefit of all. Target date for report of antibody prevalence - Feb 2022; target date for full study results publication in the medical literature - up to and including Oct 2022.

It is anticipated that the data may help the study to:

1) Quantify the proportion of immunosuppressed patients who have detectable SARS-CoV-2 antibodies following a primary vaccine course (at least 3 doses). This will inform patients, clinicians and those who devise health policy of the numbers of immunosuppressed people in the UK who have not responded to the SARS-CoV-2 by developing antibodies. This will pave the way to protect them in other ways, for example by additional targeted protection with prophylactic monoclonal antibody treatments (a monoclonal antibody given as a preventative treatment. An antibody is a protein that is naturally produced by the immune system in response to an infection. A monoclonal antibody is a molecule developed in a laboratory that is designed to mimic or enhance the body’s natural immune system response against an invader, such as the SARS-CoV-2 virus).

target date - February 2022.

2) Description of and the demographic, disease, and treatment characteristics that influence antibody status. This will allow stratification of the whole group of people who are immunosuppressed into groups at different risks of having no detectable antibodies to SARS-CoV-2 following their 3rd or 4th primary vaccination. This will inform which groups may benefit from targeted strategies such as prophylactic monoclonal antibodies. Target date March 2022.

3) Understanding if the detection of antibodies inversely correlates with subsequent risk of SARS-CoV2 infection and/or severity of disease in immunosuppressed individuals. This will further inform the potential need for additional measures targeted towards these individuals. Target date - July 2022.

Yielded Benefits is not a requirement for new applications.