Privacy Policy
We conduct research to the highest standards of research integrity. As part of our commitment to research integrity, we follow the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 (DPA), (hereafter referred to as UK data protection legislation).
We assure to respect the confidentiality and sensitivity of the personal information that you provide to us, that we obtain from other organisations, and that we share with other collaborating organisations (such as Sponsor Companies (and their agents) and Regulatory Bodies such as the MHRA or FDA ). We will tell you how we will use your information, how we will keep it safe and who it will be shared with. We commit to keeping your personal information secure and will not use it to contact you for any other purpose unless you have agreed to this.
Research has a special status under UK data protection law. Research conducted by our staff is defined as making an original contribution to research which is published at the end of a clinical trial. We are a Data Controller for research trials. This means that we will decide how your personal information is collected, used, shared, archived and deleted. When we do this we will ensure that we collect only what is necessary for the clinical trial and that you have agreed to this. If more than one organisation work together on a clinical trial, there may be two or more Data Controllers for a specific clinical trial. If this happens, the organisations will have agreements in place which outline their responsibilities and details of this will be made clear in the study-specific Participant Information Sheet, provided to you.
Information about you
‘Personal data’ means any information which can identify you. It can include information such as your name, gender, date of birth, address/postcode or other information such as your opinions or thoughts.
We will only ever collect personal information that is appropriate and necessary for the specific clinical trial being conducted.
We may process some information about you that is considered to be ‘sensitive’, and this is called ‘special category’ personal data. This includes, but is not limited to, information such as your ethnicity, sexual orientation, gender identity, and details about your health. These types of personal information require additional protections, particularly in relation to sharing, which we ensure are in place.
Under UK data protection legislation, we must have safeguards in place to help protect your rights and freedoms when using your personal information, and these are:
– Policies and procedures that tell our staff how to collect and use your information safely.
– Training which ensures our staff understand the importance of data protection and how to protect your data.
– Security standards and technical measures that ensure your information is stored safely and securely.
– All clinical trials involving personal data are reviewed and approved by a research ethics committee.
– We carry out data protection impact assessments to ensure that your privacy, rights as an individual or freedoms are not affected.
– If we use collaborators outside of the UK, we will ensure that they have adequate data protection laws or contractual mechanisms for international transfers have been put in place.
In addition to the above safeguards, the UK GDPR and the DPA also require us to meet the following standards when we conduct research with your personal information:
– the research will not cause damage or distress to someone (e.g., physical harm, financial loss or psychological pain).
– the research is not carried out to do or decide something in relation to an individual person or their care, unless the processing is for medical research approved by a research ethics committee.
– the Data Controller has technical and organisational safeguards in place to protect your data(e.g. appropriate staff training and security measures).
– if processing a special category of data, this must be subject to a further public interest test to make sure this particularly sensitive information is required to meet the research objectives.
The Legal Part
Data protection law requires us to have a valid legal reason to process and use personal data about you. This is often called a ‘legal basis’. UK GDPR requires us to be explicit with you about the legal basis upon which we rely in order to process information about you.
For research, the legal reason is “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Article 6 of the UK GDPR):
For sensitive information, the legal reason is: “the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes… which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”. (Article 9 of the U K GDPR).
Where we need to rely on a different legal reason, such as consent, this will be listed in the Study Specific Participant Information Sheet provided to you. In clinical trials, we may use the following reason:
“Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards”.
Sharing your information
Your personal information will be kept confidential at all times and our teams within our dedicated research sites are asked to de-identify it (anonymise) and pseudonymise (remove any information which can identify you, such as your name and replace this with a unique code).
Your personal information, as well as any de-identified information, will only be shared with members of the research team in order to carry out the clinical trial. If they need to share your information with anyone else, including anyone outside of the UK, you will be told who they are and why this is the case in the study-specific Participant Information Sheet.
We will only keep your personal information for as long as necessary to complete the aims of the clinical trial. The Study specific Participant Information Sheet will state how long your personal information will be kept and for what purpose.
Obtaining information about you from other organisations
On occasion, other organisations share personal information about you with our research teams, your information is treated in the same way as the information we collect directly from you in accordance with appropriate laws and standards. The suppliers of this data are usually official NHS establishments, such as NHS Digital, NHS England, or your GP, when your data is provided to us by those organisations, with your written and informed consent.
Your rights
By law, you have rights in relation to the personal information we hold about you. These include the right to:
– See the information/receive a copy of the information;
– Correct any inaccurate information;
– Have any information deleted;
– Limit or raise concerns about our processing of the information;
– Move your information (“portability”).
– Request human intervention when automatic decision-making or profiling is carried out.
These rights only apply to your information before it is anonymised, as once this happens, we can no longer identify your specific information. Sometimes your rights may be limited if it would prevent or delay the research. If this happens, you will be informed by the research team, but you still have the right to complain to our Data Protection Officer and if you are still not satisfied, you also have the right to complain about this to the Information Commissioner.
If you have any questions about how your personal information is used, or wish to exercise any of your rights, please contact DPO@futuremeds.com
If you are not happy with the way your information is being handled, or with the response received from us, you have the right to make a complaint with the Information Commissioner’s Office (https://ico.org.uk/).