EU GDPR form and permission

The personal data you are going to collect is considered as sensitive data and are ruled by Article 9 GDPR because they refer to individuals’ health. You need to ask the consent of the interviewed person for collecting and showing results to the moderator. 

Pseudonymization can be a good solution to protect the identity avoiding to show their name and calling them as “case 1” and “case 2”. Moderators can have access to full documentation upon request. You must specify that in the privacy notice you are going to submit to your individuals before interviewing them. You can also establish a data retention period and inform the interviewed individuals about how long the project will last and you are going to keep their data.

Here you can find some articles about privacy policy and consent:

• Everything you need to know about the GDPR Privacy Notice: https://advisera.com/articles/gdpr-privacy-notice-6-key-elements-to-include/
• Is consent needed? Six legal bases to process data according to GDPR: https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/

EU GDPR document template Privacy Notice: https://advisera.com/eugdpracademy/documentation/privacy-notice/

You may also consider enrolling in this online EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//