Privacy policy

The Department of Health and Social Care (DHSC) is the Data Controller for the Be Part of Research site under the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 (Data Protection Laws).

The Consortium, made up of the University of Leeds and Guy’s and St Thomas’ NHS Foundation Trust (The Consortium) is the Data Processor for Be Part of Research. The Consortium provides the National Institute for Health and Care Research (NIHR) Clinical Research Network Coordinating Centre (CRNCC) on behalf of the Department of Health and Social Care and the CRNCC is responsible for the processing of your personal data.

The NIHR Clinical Research Network Coordinating Centre (CRNCC) is a service provided by the Consortium, supported by a wider partnership which includes King’s College London, Imperial College London, University of Liverpool and PA Consulting Services Limited.

The CRNCC manages the NIHR Clinical Research Network (CRN) on behalf of the Department of Health and Social Care. The CRN makes it possible for patients, the public and health and social care organisations across England to participate in and deliver health and care research studies.

The CRN provides the infrastructure that allows high-quality research funded by charities, research funders and the life-sciences industry to be undertaken throughout the NHS and in other health and care settings. The CRN works with patients and the public to make sure their needs are placed at the heart of all research, and provides opportunities for patients to gain earlier access to new and better treatments through research participation.

The CRN provides practical help in identifying and recruiting patients for clinical research studies, so that researchers can be confident of completing the study on time and as planned. The CRN supports around 5,000 clinical research studies each year.

The Be Part of Research website is run by the NIHR CRNCC in collaboration with Health and Social Care Public Health Agency, Research & Development (Northern Ireland), NHS Research Scotland and Health and Care Research Wales to provide information on taking part in research and enable the public to find research opportunities across the UK.

The CRNCC collects your personal data on behalf of and as directed by the Department of Health and Social Care. The personal data we collect will vary depending on the nature of your interaction with us. However, we always protect your personal data within the terms of this Privacy Notice.

This data may be collected directly or indirectly:

Direct Collection

All BPOR Site Users:

We collect information directly from you in a number of ways. One way is by using cookies. Cookies are small files of information that save and retrieve information about your visit to our site, such as how you entered our site, how you navigated through the site and what information was of interest to you.

The cookies we use identify you only as a number. If you are uncomfortable about the use of cookies, you can disable them by changing the settings in the preferences or options menu in your internet browser. However, disabling cookies may affect our ability to provide services to you: if certain cookies are disabled you may not be able to access the service.

See our separate Cookies statement for more information on the cookies we use.

The only data stored in relation to navigation of the site includes:

• cookie ID;
• IP address or device identifier information collected when you access the website;
• navigation data regarding how you move around the site, hyperlinks you click on;
• if applicable, the website you originated from

The Be Part of Research “contact us” form collects your name, email address and telephone number so that we can respond to your enquiry.

Indirect Collection

All BPOR Site Users:

Hotjar

When you use Be Part of Research, we use technology to collect information indirectly - such as your internet address. This is commonplace across all internet services to enable the investigation of issues such as malicious use. This information is then kept in our internet access logs.

NIHR CRNCC uses Hotjar, a technology service that allows us to better understand users’ needs and to optimise this service and experience (e.g. how much time users spend on which pages, which links they choose to click, what users do and don’t like) and this enables us to improve our service.

Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices (in particular device's IP address (captured and stored only in anonymised form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website).

Hotjar stores this information in an anonymous user profile. Neither Hotjar nor CRNCC will ever use this information to identify individual users or to match it with further data on an individual user. Please read Hotjar’s privacy policy for more information. You can opt-out of the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link.

ServiceNow

When you ‘contact us’ to gain help or send comments about the Be Part of Research website, we will respond to your queries through the ServiceNow contact management platform. This may be through completing the form on ‘About us - Help with this site’ page or through sending an email to bepartofresearch@nihr.ac.uk.

ServiceNow securely stores the queries that are sent to the service and the Be Part of Research team are effectively able to manage, categorise and respond to all queries sent as soon as possible Monday to Friday. All data is stored in the UK for further information, please refer to the ServiceNow privacy policy.

BPOR Volunteer Service Account Holders Only (this service is currently in testing and open to a limited number of volunteers): 

If you decide to create a volunteer account, then you will provide some detailed personal information about yourself directly to the service. To create a volunteer account on Be Part of Research you must be over the age of 18. 

Personal information is collected by the service at the following different stages:

Registration and Verification

First and last name, and email address. An email verification link is sent to the email address you provided at registration. 

Profile Creation

Name, date of birth, postal address, telephone number (optional), sex at birth and gender identity, ethnic group and background, whether you consider yourself to have a disability and how much that impacts your day to day life.

You will also be asked to state the areas of research you are interested in to enable the Be Part of Research team to contact you and signpost you to the studies that may be relevant to you.

Please note that if you then go on to contact a research study team, you may have to provide additional information as required by that team; information governance relating to this additional information is not covered by this privacy notice.

NHS Login

If you use NHS login to create an account or sign into your account, we will be provided with some of your information from your NHS account. We will link to your unique NHS login ID in order to verify your information. 

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to them to get an NHS login account and to verify your identity, and they use that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS England’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

General across Be Part of Research

Most of the personal information we process is provided to us directly by you and we use this information in a number of different ways:

• To help us to track visitors to the site to provide statistics to enable us to understand how many people and who is visiting the site so we can improve the service to users; 
• Cookies are used to ensure you get the best experience on the website; this information helps us to develop the website and associated services (see ‘the information we collect’ section above re cookies);
• The login session cookie controls and recognises your secure session whilst on the site. However, if you wish to, you can change your browser settings to block or remove cookies at any time. Go to www.aboutcookies.org.uk for information on how to do this.

Be Part of Research Volunteer Account Creation

If you register for a volunteer account with Be Part of Research we shall use your personal information primarily to:

• Identify studies and contact you about studies that may be of interest to you;
• Inform you about changes that impact our services or policies;
• Identify inactive accounts and contact you to see if you still require the service;
• Analyse navigation data to anonymously track visitors to the site. This provides statistical information to enable us to better understand how many people and who is visiting our site so we can improve the service to users. This is done via Google analytics, please refer to our cookie statement for further information.

General across Be Part of Research

Due to the nature and function of Be Part of Research, it has to link to other websites to obtain the data presented on the site. These sites are third-party sites and Be Part of Research does not control the way these sites use your information. If you choose to access these sites using the links provided, the operators of these sites may collect information from you that may be used by them in accordance with their privacy policies; please be aware, these policies may differ from ours. You should read their privacy policies carefully to find out what happens to any information that is collected by these services when you use them.

Be Part of Research is hosted on the Amazon Web Services (AWS) platform, a cloud-based software platform which provides for disaster recovery processes across its servers, which are all located within the European Economic Area (EEA) or the UK. None of the data contained within Be Part of Research will go outside the UK or EEA. The Be Part of Research platform is accredited to ISO 27001 security standards. Amazon Cognito is the service within AWS used to create an account login for Be Part of Research, you can find out more information on AWS platform privacy policy.

We will not sell your personal data. We will not disclose your personal data to third parties outside of the CRNCC, unless we have your explicit permission, or are required by law to do so.

All third party contractors are required to sign up to an Agreement, which prevents them from sharing your data with other non-authorised third parties and provides for the secure disposal of this data.

You will be given the opportunity to subscribe to our email newsletter. Our email newsletters are processed and stored electronically via Mailchimp in the USA. Please see the Mailchimp Privacy Policy for further information on how your data is processed and protected. Data processed and stored in Mailchimp is never sold to third parties. You have the opportunity to unsubscribe to the newsletter at any time.

Be Part of Research Volunteer Account Registration

Once you register for a volunteer account with Be Part of Research, your data is viewable by the Be Part of Research staff who administer the service. Your personal data will still be stored within our secure system. If a study is identified that may be of interest to you we will contact you with details of the study. This will include information about the study and how to contact the research study team. It is your choice as to whether you choose to share further information with the research study team.

If you agree to join a study, the research study team will contact you in regards to entering your data onto their research system. This is not part of the Be Part of Research system, and you will need to provide further consent for them to continue. 

Having a volunteer account means that you may or may not be contacted to be involved in health research depending on the requirements of individual studies. Please note that registering to be contacted by Be Part of Research, withdrawing your consent to be contacted by Be Part of Research or taking part or not in a health research study will not impact your medical care.

The NIHR is keen to ensure that participants in the Vaccine Research Registry, who registered an interest in finding out about opportunities to participate in other types of health research, are not frustrated by continued communications to request sign up to Be Part of Research when they may have already done so. To prevent this happening, NIHR Be Part of Research Team will share with NHS Digital, on a time-limited basis, the email addresses of those who have already registered with Be Part of Research, so that their email addresses can be removed from any further communications in that regard. This will continue until such time as the Vaccine Research Registry is discontinued.

Some of our emails to volunteers are processed and stored electronically via Mailchimp and SendGrid in the USA. We may use these services to contact you with regards to account maintenance, changes to the service, updates/amendments to the privacy policy, and/or to advise you of research opportunities that you may be interested in. 

Please see the Mailchimp Privacy Policy for further information on how your data is processed and protected. Data processed and stored in Mailchimp is never sold to third parties.

Please see the SendGrid Security Policy and SendGrid Privacy Policy for information on how your data is used and protected. Data processed and stored in SendGrid is never sold to third parties. 

You have the right to withdraw your consent from Be Part of Research and close your volunteer account at any time; see section below “Withdrawing Consent for Be Part of Research volunteer account”.  

Maintaining Data Accuracy and Currency

We have a duty under data protection legislation to ensure that information we hold is accurate and up to date. Whilst we ask that you play your part in this by keeping your data updated, we also contact NHS Digital approximately twice a year, Public Health Scotland yearly and the Northern Ireland General Registry Office every two to three years, to identify volunteers who may have since died across England and Wales, Scotland and Northern Ireland respectively. We share basic personal information about volunteers in a secure way with these organisations in order to carry out such a search. Once the search is carried out, the information shared, the accounts and all personal information of deceased volunteers are deleted.

Data protection laws mean that each use we make of your personal information must have a “lawful basis” for the processing of that information. The relevant lawful bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK Data Protection Act 2018.

Whilst we are asking you to give your consent to the creation of a volunteer account on Be Part of Research, consent will not be used as the lawful basis for processing your data under the data protection legislation. Rather, the legal basis for processing your personal data under the data protection legislation will be as follows:

• Article 6.1 (e) performance of a task in the public interest or in the exercise of official authority vested in controller; 
• Article 9.2 (j) - research purposes. The NIHR funds, enables and delivers world leading health and social care research that improves people's health and wellbeing and promotes economic growth. The NIHR CRNCC acts as an agent of the DHSC in this endeavour. The Secretary of State for Health and Social Care has a duty to promote health and care research and a public sector equality duty; thus this service falls right within the public interest task of the DHSC.   

For further information please refer to the ICO’s website page on lawful basis for processing.

If you register a volunteer account on Be Part of Research and you then decide you wish to withdraw from the service, you can do this at any time - please see the section below on “Withdrawing consent for Be Part of Research volunteer account.”

We are committed to ensuring that your information is secure.  The security of Be Part of Research is managed by the NIHR Information Systems Function, on behalf of the Department of Health and Social Care. This Function has the appropriate technical expertise to protect against unlawful processing and/or accidental loss of information.

We use leading technologies and encryption software to safeguard your data and will ensure only authorised users can see your data, and maintain strict security standards to prevent any unauthorised access to it. The NIHR CRNCC operates to ISO27001, an international standard on information security management and is audited annually.

How long do we keep your personal information for?

We will hold your personal information for as long as we are providing you with services via Be Part of Research, and for as long as you agree to this. We will retain your data for varying amounts of time depending on the nature of your interactions with Be Part of Research. The following principles will apply across the Service:

• We only store data that is necessary for the specific purpose(s);
• Data will be held digitally rather than in paper record form wherever possible;
• We will not store your data for longer than is necessary for the intended purpose or as required by law;
• Your data will be securely deleted when no longer needed for the purpose(s);
• When a disc drive fails or is no longer required for use, this is securely destroyed in accordance with the NHS Code of Practice;
• When an electronic file containing personal identifiable information (e.g. a complaints file) is no longer required it is securely deleted by overwriting the space several times with selected patterns, thus rendering any information unreadable;
• If you choose to close your volunteer account, Be Part of Research will only keep anonymous data to help improve the service.

We have specific, defined data retention periods for different data types, which are determined by legal and operational considerations.

You have the right to withdraw your consent for us to contact you, store and process your data, and share your data with site teams. If you wish to withdraw your consent you can do 

this by closing your volunteer account. You have the right to close your volunteer account at any time and without providing any explanation for doing so. 

If you choose to close your volunteer account, Be Part of Research will only keep anonymous data to help us improve the service, including date of registration and account closure, date of birth, postcode, sex and health conditions. We will remove all of your personal data including your name, email address, home address and phone numbers. 

If you have any difficulties withdrawing from the service and closing your volunteer account please contact a member of the Be Part of Research service support team at bepartofresearch@nihr.ac.uk

The Data Protection Officer for the CRNCC is:

• Name of Data Protection Officer: Lee Cramp
• Address: Department of Health and Social Care, First Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU
• Email: data_protection@dhsc.gov.uk

As a data subject, you may have the following rights under the Data Protection Laws:

• the right of access to personal data relating to you
• the right to correct any mistakes in your information
• the right to ask us to stop contacting you with direct marketing
• rights in relation to automated decision making
• the right to restrict or prevent your personal data being processed
• the right to withdraw consent

These individual rights are explained on the Information Commissioner's Office website:

If you wish to exercise any of your data subject rights, please contact the NIHR Service Desk in the first instance - either: 

• Write to The NIHR Service Desk, Back Lane, Melbourn, Royston, SG8 6DP
• or Email: gdpr_requests@nihr.ac.uk

We will respond in a timely manner to any rights that you wish to exercise, and for Subject Access Requests (SARs) this has to be within a month of receiving your request unless the request is particularly complex.

It is important that you ensure you have read this privacy notice - and if you do not think that we have processed your data in accordance with this privacy notice - you should let us know as soon as possible. 

Similarly, you may complain to the Information Commissioner's Office.