Read our Privacy Notice
Be Part of Research (referred to hereinafter as “BPOR”), is committed to protecting and respecting your privacy. The purpose of this Privacy Notice is to inform you, as a user of BPOR, about what information we collect when you visit the service, how we use your information, whether or not your information is shared, and the ways in which we protect your privacy. At all times, we want you to feel secure when using this website and associated services.
Please note that this Privacy Notice aims to be clear between the sections that will apply to all users and those that will only apply if a user opts into different service options, with key differences that will apply in those instances.
By continuing to use this application or engaging with us you are agreeing to the processing of your personal information in accordance with this Privacy Notice.
Changes to this Privacy Notice
We may change this Privacy Notice from time to time so please check back periodically. If we were to make significant changes to the Notice, we will highlight this clearly when you login to your account or by email so that you can be updated on what has changed.
This Notice was last updated on 21st September 2022.
The Department of Health and Social Care (DHSC) is the Data Controller for the BPOR site under the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 (Data Protection Laws).
The Consortium of the University of Leeds and Guy’s and St Thomas’ NHS Foundation Trust (The Consortium) is the Data Processor for BPOR. The Consortium provides the National Institute for Health and Care Research (NIHR) Clinical Research Network Coordinating Centre (CRNCC) on behalf of the Department of Health and Social Care and the CRNCC is responsible for the processing of your personal data.
The NIHR Clinical Research Network Coordinating Centre (CRNCC) is a service provided by the Consortium, supported by a wider partnership which includes King’s College London, Imperial College London, University of Liverpool and PA Consulting Services Limited.
The CRNCC manages the NIHR Clinical Research Network (CRN) on behalf of the Department of Health and Social Care. The CRN makes it possible for patients, the public and health and social care organisations across England to participate in and deliver health and care research studies.
The CRN provides the infrastructure that allows high-quality research funded by charities, research funders and the life-sciences industry to be undertaken throughout the NHS and in other health and care settings. The CRN works with patients and the public to make sure their needs are placed at the heart of all research, and provides opportunities for patients to gain earlier access to new and better treatments through research participation.
The CRN provides practical help in identifying and recruiting patients for clinical research studies, so that researchers can be confident of completing the study on time and as planned. The CRN supports around 5,000 clinical research studies each year.
The Be Part of Research website is run by the NIHR CRNCC in collaboration with HSC Public Health Agency, Research & Development (Northern Ireland), NHS Research Scotland and Health and Care Research Wales to provide information on taking part in research and enable the public to find research opportunities across the UK.
The CRNCC collects your personal data on behalf of and as directed by the Department of Health and Social Care. The personal data we collect will vary depending on the nature of your interaction with us. However, we always protect your personal data within the terms of this Privacy Notice.
This data may be collected directly or indirectly:
All BPOR Site Users:
We collect information directly from you in a number of ways. One way is by using cookies. Cookies are small files of information that save and retrieve information about your visit to our site, such as how you entered our site, how you navigated through the site and what information was of interest to you.
See our separate Cookies statement for more information on the cookies we use.
The only data stored in relation to navigation of the site includes:
- cookie ID;
- IP address or device identifier information collected when you access the website;
- Navigation data regarding how you move around the site, hyperlinks you click on;
- If applicable, the website you originated from.
The Be Part of Research “contact us” form collects your name, email address and telephone number so that we can respond to your enquiry.
All BPOR Site Users:
When you use BPOR, we use technology to collect information indirectly - such as your internet address. This is commonplace across all internet services to enable the investigation of issues such as malicious use. This information is then kept in our internet access logs.
NIHR CRNCC uses Hotjar, a technology service that allows us to better understand users’ needs and to optimise this service and experience (e.g. how much time users spend on which pages, which links they choose to click, what users do and don’t like) and this enables us to improve our service in addition to through user feedback.
When you ‘contact us’ to gain help or send comments about the BPOR website, we will respond to your queries through the ServiceNow contact management platform. This may be through completing the form on ‘About us - Help with this site’ page or through sending an email to email@example.com.
BPOR Volunteer Service Account Holders Only (this service is currently in testing and open to a limited number of volunteers):
If you decide to create a volunteer account, then you will provide some detailed personal information about yourself directly to the service. To create an account on the BPOR Volunteer Service you must be over the age of 18. If you then go on to contact a research study team, you may have to provide additional information as required by that team; this information would not be governed by this privacy notice.
Personal information is collected by the service at the following different stages:
Registration and Verification
First and last name, and email address. An email verification link is sent to the email address you provided at registration.
Name, date of birth, postal address, telephone number (optional), sex at birth and gender identity, ethnic group and background, whether you consider yourself to have a disability and how much that impacts your day to day life.
You will also be asked to state the areas of research you are interested in to enable the BPOR team to contact you and signpost you to the studies that may be relevant to you.
General across Be Part of Research
Most of the personal information we process is provided to us directly by you and we use this information in a number of different ways:
- To help us to track visitors to the site to provide statistics to enable us to understand how many people and who is visiting the site so we can improve the service to users;
- Cookies are used to ensure you get the best experience on the website; this information helps us to develop the website and associated services (see ‘the information we collect’ section above re cookies);
- The login session cookie controls and recognises your secure session whilst on the site. However, if you wish to, you can change your browser settings to block or remove cookies at any time.
Be Part of Research Volunteer Account Creation
If you register with the BPOR Volunteer Service we shall use your personal information primarily to:
- Identify studies and contact you about studies that may be of interest to you;
- Inform you about changes that impact our services or policies;
- To identify inactive accounts and contact you to see if you still require the service.
Analyse navigation data to anonymously track visitors to the site. This provides statistical information to enable us to better understand how many people and who is visiting our site so we can improve service to users. This is done via Google analytics, please refer to our cookie statement for further information.
Data protection laws mean that each use we make of your personal information must have a “lawful basis” for the processing of that information. The relevant lawful bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK Data Protection Act 2018.
Whilst we are asking you to give your consent to the creation of an account on BPOR, consent will not be used as the lawful basis for processing your data under the data protection legislation. Rather, the legal basis for processing your personal data under the data protection legislation will be as follows:
- Article 6.1 (e) performance of a task in the public interest or in the exercise of official authority vested in controller;
- Article 9.2 (j) - research purposes. The NIHR funds, enables and delivers world leading health and social care research that improves people's health and wellbeing and promotes economic growth. The NIHR CRNCC acts as an agent of the DHSC in this endeavour. The Secretary of State for Health and Social Care has a duty to promote health and care research and a public sector equality duty; thus this service falls right within the public interest task of the DHSC.
For further information please refer to the ICO’s website page on lawful basis for processing.
If you register an account on BPOR Volunteer Service and you then decide you wish to withdraw from the service, you can do this at any time - please see the section below on “Withdrawing consent for Be Part of Research Volunteer Service.”
We are committed to ensuring that your information is secure. The security of BPOR is managed by the NIHR Information Systems Function, on behalf of the Department of Health and Social Care. This Function has the appropriate technical expertise to protect against unlawful processing and/or accidental loss of information.
We use leading technologies and encryption software to safeguard your data and will ensure only authorised users can see your data, and maintain strict security standards to prevent any unauthorised access to it. The NIHR CRNCC operates to ISO27001, an international standard on information security management and is audited annually.
How long do we keep your personal information for?
We will hold your personal information for as long as we are providing you with services via BPOR, and for as long as you agree to this. We will retain your data for varying amounts of time depending on the nature of your interactions with BPOR. The following principles will apply across the Service:
- We only store data that is necessary for the specific purpose(s);
- Data will be held digitally rather than in paper record form wherever possible;
- We will not store your data for longer than is necessary for the intended purpose or as required by law;
- Your data will be securely deleted when no longer needed for the purpose(s);
- When a disc drive fails or is no longer required for use, this is securely destroyed in accordance with the NHS Code of Practice;
- When an electronic file containing personal identifiable information (e.g. a complaints file) is no longer required it is securely deleted by overwriting the space several times with selected patterns, thus rendering any information unreadable;
- If you choose to close your account BPOR will only keep anonymous data to help improve the service.
We have specific, defined data retention periods for different data types, which are determined by legal and operational considerations.
You have the right to withdraw your consent for us to contact you, store and process your data, and share your data with site teams. If you wish to withdraw your consent you can do this by closing your account. You have the right to close your account at anytime and without providing any explanation for doing so.
If you choose to close your account BPOR will only keep anonymous data to help us improve the service, including date of registration and account closure, date of birth, postcode, sex and health conditions. We will remove all of your personal data including your name, email address, home address and phone numbers.
If you have any difficulties withdrawing from the service and closing your account please contact a member of the BPOR service support team at firstname.lastname@example.org
The Data Protection Officer for the CRNCC is:
- Name of Data Protection Officer: Lee Cramp
- Address: Department of Health and Social Care, First Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU
- Email: email@example.com
As a data subject, you may have the following rights under the Data Protection Laws:
- the right of access to personal data relating to you
- the right to correct any mistakes in your information
- the right to ask us to stop contacting you with direct marketing
- rights in relation to automated decision making
- the right to restrict or prevent your personal data being processed
- the right to withdraw consent
These individual rights are explained on the Information Commissioner's Office website
If you wish to exercise any of your data subject rights, please contact the NIHR Service Desk in the first instance - either:
- Write to The NIHR Service Desk, Back Lane, Melbourn, Royston, SG8 6DP
- or Email: firstname.lastname@example.org
We will respond in a timely manner to any rights that you wish to exercise, and for Subject Access Requests (SARs) this has to be within a month of receiving your request unless the request is particularly complex.
It is important that you ensure you have read this privacy notice - and if you do not think that we have processed your data in accordance with this privacy notice - you should let us know as soon as possible. Similarly, you may complain to the Information Commissioner's Office.