BreathForFx is an mHealth system to help researchers to collect data regarding screening on a target population, regarding tuberculosis and other respiratory infections.
A touch-screen icon-based application for Android smartphone includes 2 modules, which enable the collection of socio-demographic, clinical data, and lab tests results. Data collected during screening is automatically transmitted and processed on the cloud-based Amazon Web Service (AWS) third party provided EC2 services hosted in Ireland.
Data collected in the database can then be exported to spreadsheet software for scientific and epidemiological purposes. Every network connection is encrypted in transit within the system. Daily backup on cloud, 30-day retention period. Daily backups are stored on the cloud with a 30-day retention period.

If no connection is available, the app switches to off-line mode, and the data are stored on the phone until coverage is available again and synchronisation can be triggered.

In order to undertake the research project, we will collect the following patient personal information/data

● ID number

● Barcodes

● Age

● Ethnicity (country of birth)

● Marital status

● Education

● Health habits

● Medical history

● Pregnancy

● Details about previous TB disease or TB contact or other respiratory infections

● Symptoms related to respiratory problems.

● Lab test results

The system collects and stores personal information in accordance with the General Data Protection Regulation (GDPR). The legal basis upon which we are using patient personal information is “public interest task” and “for research purposes” if sensitive information is collected. The researchers take responsibility for the protection of the personal information that the study is collecting.

Barcode is used as an identifier for the participants' biological samples and scanned into the application.

The mHealth system has a hierarchical system of accesses. These are established by the project manager according to the roles of the participants and the geographical areas. In addition to the research users, access to the data is also given to:

- the developer, to guarantee immediate intervention in the event of system crashes or in the case of requests for changes.

- The system administrator as an interface figure between the users and the developer and to guarantee the resolution of problems and instances that may occur during system operation.

Both these figures have signed a non-disclosure agreement on data collected

The deletion of collected data is provided for in the following ways:

1) At the written request of the partners using the data collection system

2) When the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed

3) In case of withdrawal of consent or objection to processing

4) Where personal data have been unlawfully processed or collected

The deletion procedure is accompanied by specific communication measures to other parties who have participated in the activity, with a request to proceed to the deletion of the data in their possession.

In the event of an incident that may result in a data security breach, the data manager will conduct an initial investigation of the data incident to establish its timeline, facts and scope with immediate action to prevent further disclosure or damage. Specific plans and actions shall be put in place to inform the persons concerned and identify disciplinary actions consistent with the level of severity of the breach.