Privacy policy

Read our Privacy Notice

Be Part of Research (referred to hereinafter as “BPOR”), is committed to protecting and respecting your privacy. The purpose of this Privacy Notice is to inform you, as a user of BPOR, about what information we collect when you visit the service, how we use your information, whether or not your information is shared, and the ways in which we protect your privacy. At all times, we want you to feel secure when using this website and associated services.

Please note that this Privacy Notice aims to be clear between the sections that will apply to all users and those that will only apply if a user opts into different service options, with key differences that will apply in those instances.

By continuing to use this application or engaging with us you are agreeing to the processing of your personal information in accordance with this Privacy Notice.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time so please check back periodically. If we were to make significant changes to the Notice, we will highlight this clearly when you login to your account or by email so that you can be updated on what has changed. 

This Notice was last updated on 21st September 2022.

About the NIHR Clinical Research Network Coordinating Centre

The Department of Health and Social Care (DHSC) is the Data Controller for the BPOR site under the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 (Data Protection Laws).

The Consortium of the University of Leeds and Guy’s and St Thomas’ NHS Foundation Trust (The Consortium) is the Data Processor for BPOR. The Consortium provides the National Institute for Health and Care Research (NIHR) Clinical Research Network Coordinating Centre (CRNCC) on behalf of the Department of Health and Social Care and the CRNCC is responsible for the processing of your personal data.

The NIHR Clinical Research Network Coordinating Centre (CRNCC) is a service provided by the Consortium, supported by a wider partnership which includes King’s College London, Imperial College London, University of Liverpool and PA Consulting Services Limited.

The CRNCC manages the NIHR Clinical Research Network (CRN) on behalf of the Department of Health and Social Care. The CRN makes it possible for patients, the public and health and social care organisations across England to participate in and deliver health and care research studies. 

The CRN provides the infrastructure that allows high-quality research funded by charities, research funders and the life-sciences industry to be undertaken throughout the NHS and in other health and care settings. The CRN works with patients and the public to make sure their needs are placed at the heart of all research, and provides opportunities for patients to gain earlier access to new and better treatments through research participation.

The CRN provides practical help in identifying and recruiting patients for clinical research studies, so that researchers can be confident of completing the study on time and as planned. The CRN supports around 5,000 clinical research studies each year.

About Be Part of Research

The Be Part of Research website is run by the NIHR CRNCC in collaboration with HSC Public Health Agency, Research & Development (Northern Ireland), NHS Research Scotland and Health and Care Research Wales to provide information on taking part in research and enable the public to find research opportunities across the UK.

The information we collect

The CRNCC collects your personal data on behalf of and as directed by the Department of Health and Social Care. The personal data we collect will vary depending on the nature of your interaction with us. However, we always protect your personal data within the terms of this Privacy Notice.

This data may be collected directly or indirectly:

Direct Collection

All BPOR Site Users:

We collect information directly from you in a number of ways. One way is by using cookies. Cookies are small files of information that save and retrieve information about your visit to our site, such as how you entered our site, how you navigated through the site and what information was of interest to you. 

The cookies we use identify you only as a number. If you are uncomfortable about the use of cookies, you can disable them by changing the settings in the preferences or options menu in your internet browser. However, disabling cookies may affect our ability to provide services to you: if certain cookies are disabled you may not be able to access the service.

See our separate Cookies statement for more information on the cookies we use.

The only data stored in relation to navigation of the site includes:

  • cookie ID;
  • IP address or device identifier information collected when you access the website;
  • Navigation data regarding how you move around the site, hyperlinks you click on;
  • If applicable, the website you originated from.

The Be Part of Research “contact us” form collects your name, email address and telephone number so that we can respond to your enquiry.

Indirect Collection

All BPOR Site Users:

Hotjar

When you use BPOR, we use technology to collect information indirectly - such as your internet address. This is commonplace across all internet services to enable the investigation of issues such as malicious use. This information is then kept in our internet access logs.

NIHR CRNCC uses Hotjar, a technology service that allows us to better understand users’ needs and to optimise this service and experience (e.g. how much time users spend on which pages, which links they choose to click, what users do and don’t like) and this enables us to improve our service in addition to  through user feedback.

Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices (in particular device's IP address (captured and stored only in anonymised form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website).

Hotjar stores this information in an anonymous user profile. Neither Hotjar nor CRNCC will ever use this information to identify individual users or to match it with further data on an individual user. Please read Hotjar’s privacy policy for more information. You can opt-out of the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link.

ServiceNow

When you ‘contact us’ to gain help or send comments about the BPOR website, we will respond to your queries through the ServiceNow contact management platform. This may be through completing the form on ‘About us - Help with this site’ page or through sending an email to bepartofresearch@nihr.ac.uk.

ServiceNow securely stores the queries that are sent to the service and BPOR team are effectively able to manage, categorise and respond to all queries sent as soon as possible Monday to Friday. All data is stored in the UK for further information, please refer to the ServiceNow privacy policy.

BPOR Volunteer Service Account Holders Only (this service is currently in testing and open to a limited number of volunteers): 

If you decide to create a volunteer account, then you will provide some detailed personal information about yourself directly to the service. To create an account on the BPOR Volunteer Service you must be over the age of 18. If you then go on to contact a research study team, you may have to provide additional information as required by that team; this information would not be governed by this privacy notice.

Personal information is collected by the service at the following different stages:

Registration and Verification

First and last name, and email address. An email verification link is sent to the email address you provided at registration. 

Profile Creation

Name, date of birth, postal address, telephone number (optional), sex at birth and gender identity, ethnic group and background, whether you consider yourself to have a disability and how much that impacts your day to day life.

You will also be asked to state the areas of research you are interested in to enable the BPOR team to contact you and signpost you to the studies that may be relevant to you.

How and why we use your personal data

General across Be Part of Research

Most of the personal information we process is provided to us directly by you and we use this information in a number of different ways:

  • To help us to track visitors to the site to provide statistics to enable us to understand how many people and who is visiting the site so we can improve the service to users; 
  • Cookies are used to ensure you get the best experience on the website; this information helps us to develop the website and associated services (see ‘the information we collect’ section above re cookies);
  • The login session cookie controls and recognises your secure session whilst on the site. However, if you wish to, you can change your browser settings to block or remove cookies at any time.

Be Part of Research Volunteer Account Creation

If you register with the BPOR Volunteer Service we shall use your personal information primarily to:

  • Identify studies and contact you about studies that may be of interest to you;
  • Inform you about changes that impact our services or policies;
  • To identify inactive accounts and contact you to see if you still require the service.

Analyse navigation data to anonymously track visitors to the site. This provides statistical information to enable us to better understand how many people and who is visiting our site so we can improve service to users. This is done via Google analytics, please refer to our cookie statement for further information.

How we share your personal information from Be Part of Research

General across Be Part of Research

Due to the nature and function of BPOR, it has to link to other websites to obtain the data presented on the site. The sites that BPOR links to are third-party sites and the site does not control the way these sites use your information. If you choose to access these sites using the links provided, the operators of these sites may collect information from you that may be used by them in accordance with their privacy policies; please be aware, these policies may differ from ours. You should read their privacy policies carefully to find out what happens to any information that is collected by these services when you use them.

BPOR is hosted on the Amazon Web Services (AWS) platform, a cloud-based software platform which provides for disaster recovery processes across its servers, which are all located within the European Economic Area (EEA) or the UK. None of the data contained within BPOR will go outside the UK or EEA. The BPOR platform is accredited to ISO 27001 security standards. Amazon Cognito is the service within AWS used to create an account login for BPOR, you can find out more information on AWS platform privacy policy.

We will not sell your personal data. We will not disclose your personal data to third parties outside of the CRNCC, unless we have your explicit permission, or are required by law to do so.

All third party contractors are required to sign up to an Agreement, which prevents them from sharing your data with other non-authorised third parties and provides for the secure disposal of this data.

You will be given the opportunity to subscribe to our email newsletter. Our email newsletters are processed and stored electronically via Mailchimp in the USA. Please see the Mailchimp Privacy Policy for further information on how your data is processed and protected. We will store your data in Mailchimp for a maximum of six months. Data processed and stored in Mailchimp is never sold to third parties. You have the opportunity to unsubscribe to the newsletter at any time.

Be Part of Research Volunteer Account Registration

Once you register an account with the BPOR Volunteer Service, your data is viewable by BPOR staff who administer the service. 

Your personal data will still be stored within our secure system. If a study is identified that may be of interest to you we will contact you with details of the study. This will include information about the study and how to contact the research study team. It is your choice as to whether you choose to share further information with the research study team. 

If you agree to join a study, the research study team will contact you in regards to entering your data onto their research system. This is not part of the BPOR system, and you will need to provide further consent for them to continue. 

Once you create an account, you may or may not be contacted to be involved in health research depending on the requirements of individual studies. Please note that registering to be contacted by BPOR, withdrawing your consent to be contacted by BPOR or taking part or not in a health research study will not impact on your medical care.

Time limited sharing of email address with NHS Digital for smooth transition from Vaccine Research Registry (VRR): the NIHR is keen to ensure that participants in the VRR, who registered an interest in finding out about opportunities to participate in other types of health research, are not frustrated by continued communications to request sign up to the BPOR VS when they may have already done so. In order to prevent this happening, NIHR BPOR Team will share with NHS Digital the email addresses of those who have already registered with the BPOR VS, so that their email addresses can be removed from any further communications in that regard. This will continue until such time as the VRR is discontinued.

You have the right to withdraw your consent from the BPOR Volunteer Service and close your account at any time, see section “Withdrawing consent for Be Part of Research Volunteer Service”.

Maintaining Data Accuracy and Currency

We have a duty under data protection legislation to ensure that information we hold is accurate and up to date. Whilst we ask that you play your part in this by keeping your data updated, we also contact NHS Digital approximately twice a year, Public Health Scotland yearly and the Northern Ireland General Registry Office every two to three years, to identify volunteers who may have since died across England and Wales, Scotland and Northern Ireland respectively. We share basic personal information about volunteers in a secure way with these organisations in order to carry out such a search. Once the search is carried out, the information shared, the accounts and all personal information of deceased volunteers are deleted.

The lawful basis for processing

Data protection laws mean that each use we make of your personal information must have a “lawful basis” for the processing of that information. The relevant lawful bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK Data Protection Act 2018.

Whilst we are asking you to give your consent to the creation of an account on BPOR, consent will not be used as the lawful basis for processing your data under the data protection legislation. Rather, the legal basis for processing your personal data under the data protection legislation will be as follows:

  • Article 6.1 (e) performance of a task in the public interest or in the exercise of official authority vested in controller; 
  • Article 9.2 (j) - research purposes. The NIHR funds, enables and delivers world leading health and social care research that improves people's health and wellbeing and promotes economic growth. The NIHR CRNCC acts as an agent of the DHSC in this endeavour. The Secretary of State for Health and Social Care has a duty to promote health and care research and a public sector equality duty; thus this service falls right within the public interest task of the DHSC.   

For further information please refer to the ICO’s website page on lawful basis for processing.

If you register an account on BPOR Volunteer Service and you then decide you wish to withdraw from the service, you can do this at any time - please see the section below on “Withdrawing consent for Be Part of Research Volunteer Service.”

How we store and protect your personal information

We are committed to ensuring that your information is secure.  The security of BPOR is managed by the NIHR Information Systems Function, on behalf of the Department of Health and Social Care. This Function has the appropriate technical expertise to protect against unlawful processing and/or accidental loss of information.

We use leading technologies and encryption software to safeguard your data and will ensure only authorised users can see your data, and maintain strict security standards to prevent any unauthorised access to it. The NIHR CRNCC operates to ISO27001, an international standard on information security management and is audited annually.

How long do we keep your personal information for?

We will hold your personal information for as long as we are providing you with services via BPOR, and for as long as you agree to this. We will retain your data for varying amounts of time depending on the nature of your interactions with BPOR. The following principles will apply across the Service:

  • We only store data that is necessary for the specific purpose(s);
  • Data will be held digitally rather than in paper record form wherever possible;
  • We will not store your data for longer than is necessary for the intended purpose or as required by law;
  • Your data will be securely deleted when no longer needed for the purpose(s);
  • When a disc drive fails or is no longer required for use, this is securely destroyed in accordance with the NHS Code of Practice;
  • When an electronic file containing personal identifiable information (e.g. a complaints file) is no longer required it is securely deleted by overwriting the space several times with selected patterns, thus rendering any information unreadable;
  • If you choose to close your account BPOR will only keep anonymous data to help improve the service.

We have specific, defined data retention periods for different data types, which are determined by legal and operational considerations.

Your rights over your personal data

The Data Protection Officer for the CRNCC is:

  • Name of Data Protection Officer: Lee Cramp
  • Address: Department of Health and Social Care, First Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU
  • Email: data_protection@dhsc.gov.uk

As a data subject, you may have the following rights under the Data Protection Laws:

  • the right of access to personal data relating to you
  • the right to correct any mistakes in your information
  • the right to ask us to stop contacting you with direct marketing
  • rights in relation to automated decision making
  • the right to restrict or prevent your personal data being processed
  • the right to withdraw consent

These individual rights are explained on the Information Commissioner's Office website

If you wish to exercise any of your data subject rights, please contact the NIHR Service Desk in the first instance - either: 

We will respond in a timely manner to any rights that you wish to exercise, and for Subject Access Requests (SARs) this has to be within a month of receiving your request unless the request is particularly complex.

Contacting the regulator

It is important that you ensure you have read this privacy notice - and if you do not think that we have processed your data in accordance with this privacy notice - you should let us know as soon as possible. Similarly, you may complain to the Information Commissioner's Office