Privacy policy

The Department of Health and Social Care (“DHSC”) is the Data Controller for the Be Part of Research site under the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 (“Data Protection Laws”).

The University of Leeds (“The Host Organisation”) is the Data Processor for the Be Part of Research Service. The University of Leeds provides the National Institute for Health and Care Research (“NIHR”) Research Delivery Network Coordinating Centre (“RDNCC”) on behalf of the Department of Health and Social Care and the RDNCC is responsible for the processing of your personal data.

The NIHR Research Delivery Network Coordinating Centre (RDNCC) is a service provided by the University of Leeds, with contracted maintenance by PA Consulting Services Limited.

The RDNCC manages the NIHR Research Delivery Network ("RDN") / NIHR Clinical Research Network "CRN") on behalf of the Department of Health and Social Care. 

The RDN/CRN makes it possible for patients and health professionals across England to participate in research studies within the NHS.  The RDN/CRN provides the infrastructure that allows high-quality research funded by charities, research funders and life-sciences industry to be undertaken throughout the NHS.  The RDN/CRN works with patients and the public to make sure their needs are placed at the heart of all research, and provides opportunities for patients to gain earlier access to new and better treatments through research participation. 

The RDN/CRN provides practical help in identifying and recruiting patients for research studies, so that researchers can be confident in completing the study on time and as planned.

The RDN/CRN supports approximately 5,000 research studies each year.

The Be Part of Research website is run by the NIHR RDNCC in collaboration with NHS England, Health and Social Care Public Health Agency, Research & Development (Northern Ireland), NHS Research Scotland and Health and Care Research Wales to provide information on taking part in research and enable the public to find research opportunities across the UK.

The RDNCC collects your personal data on behalf of and as directed by the Department of Health and Social Care. The personal data we collect will vary depending on the nature of your interaction with us. However, we always protect your personal data within the terms of this Privacy Notice.

This data may be collected directly or indirectly:

Direct Collection

All Be Part of Research Site Users:

We collect information directly from you in a number of ways. One way is by using cookies. Cookies are small files of information that save and retrieve information about your visit to our site, such as how you entered our site, how you navigated through the site and what information was of interest to you. 

The cookies we use identify you only as a number. If you are uncomfortable about the use of cookies, you can disable them by changing the settings in the preferences or options menu in your internet browser. However, disabling cookies may affect our ability to provide services to you: if certain cookies are disabled you may not be able to access the service.

See our separate cookie policy for more information on the cookies we use.

The only data stored in relation to navigation of the site includes:

• cookie ID;
• IP address or device identifier information collected when you access the website;
• navigation data regarding how you move around the site, hyperlinks you click on;
• if applicable, the website you originated from

The Be Part of Research ‘Get in Touch' form collects your name, email address and telephone number so that we can respond to your enquiry.

Indirect Collection

All Be Part of Research Site Users:

Hotjar

When you use Be Part of Research, we use technology to collect information indirectly - such as your internet address. This is commonplace across all internet services to enable the investigation of issues such as malicious use. This information is then kept in our internet access logs.

NIHR RDNCC uses Hotjar, a technology service that allows us to better understand users’ needs and to optimise this service and experience (e.g. how much time users spend on which pages, which links they choose to click, what users do and don’t like), enabling us to improve our service.

Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices (in particular device's IP address (captured and stored only in anonymised form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website).

Hotjar stores this information in an anonymous user profile. Neither Hotjar nor RDNCC will ever use this information to identify individual users or to match it with further data on an individual user. Please read Hotjar’s privacy policy for more information. You can opt-out of the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites. Information on how to do this is available in the data privacy section of Hotjar's website.

ServiceNow

When you complete the  ‘Get in Touch’ Form or you send an email to bepartofresearch@nihr.ac.uk  to seek help or send comments about the Be Part of Research website, we will respond to your queries through the ServiceNow contact management platform.

ServiceNow securely stores the queries that are sent to the service and the Be Part of Research team is effectively able to manage, categorise and respond to all queries sent as soon as possible Monday to Friday. All data is stored in the UK; for further information, please refer to the ServiceNow privacy policy.

Be Part of Research users with a registered account only

If you decide to create an account with Be Part of Research, you will provide some detailed personal information about yourself directly to the service. To create an account on Be Part of Research you must be over the age of 18. 

Personal information is collected by the service at the following different stages:

Registration, Verification and Multi-Factor Authentication

First and last name, and email address. An email verification link is sent to the email address you provided at registration. 

For added security, you will be asked to provide a mobile phone number to set up multi-factor authentication on your account. If you prefer, you can use an authenticator app to do this instead.

Profile Creation

Name, date of birth, postal address, telephone number (optional), sex at birth and gender identity, ethnic group and background, whether you consider yourself to have a disability and how much that impacts your day to day life.

You will also be asked to state the areas of research you are interested in to enable the Be Part of Research team to contact you and signpost you to the studies that may be relevant to you.

Please note that if you then go on to contact a research study team, you may have to provide additional information as required by that team. Information governance relating to this additional information is not covered by this privacy notice.

NHS login

If you use NHS login to create an account or sign into your account, we will be provided with some of your information from your NHS account. We will link to your unique NHS login ID in order to verify your information. Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the data controller for any personal information you provide to them to get an NHS login account and to verify your identity, and they use that personal information solely for that single purpose. For Be Part of Research use of this personal information, our role is as a “data processor” only and we must act under the instructions provided by NHS England (as the “data controller”) when verifying your identity. NHS England's Privacy Notice and Terms and Conditions are available on their website. This restriction does not apply to the personal information you provide to us separately.

General across Be Part of Research

Most of the personal information we process is provided to us directly by you and we use this information in a number of different ways:

• To help us track visitors to the site to provide statistics to enable us to understand how many people and who is visiting the site so we can improve the service to users; 
• Cookies are used to ensure you get the best experience on the website; this information helps us to develop the website and associated services (see ‘the information we collect’ section above re cookies);
• The login session cookie controls and recognises your secure session whilst on the site. However, if you wish to, you can change your browser settings to block or remove cookies at any time. Go to aboutcookies.org.uk for information on how to do this.

Be Part of Research account registration

If you register for an account with Be Part of Research we shall use your personal information primarily to:

• Identify studies and contact you about studies that may be of interest to you
• Contact you to seek feedback about how we may improve the service we provide
• Contact you to ask you to discuss sharing your story or experience of a study you have taken part in via our website
• Contact you with updates about a study you may be enrolled in
• Inform you about changes that impact our services or policies
• Ensure the security of your account
• Identify inactive accounts and contact you to see if you still require the service

Analyse navigation data to anonymously track visitors to the site. This provides statistical information to enable us to better understand how many people and who is visiting our site so we can improve the service to users. This is done via Google Analytics. Please refer to our cookie statement for further information.

General across Be Part of Research

Due to the nature and function of Be Part of Research, it has to link to other websites to obtain the data presented on the site. These sites are third-party sites and Be Part of Research does not control the way these sites use your information. If you choose to access these sites using the links provided, the operators of these sites may collect information from you that may be used by them in accordance with their privacy policies; please be aware, these policies may differ from ours. You should read their privacy policies carefully to find out what happens to any information that is collected by these services when you use them.

Be Part of Research is hosted on the Amazon Web Services (AWS) platform, a cloud-based software platform which provides for disaster recovery processes across its servers, which are all located within the European Economic Area (EEA) or the UK. None of the data contained within Be Part of Research will go outside the UK or EEA. The Be Part of Research platform is accredited to ISO 27001 security standards. Amazon Cognito is the service within AWS used to create an account login for Be Part of Research, you can find out more information on AWS platform privacy policy.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We will share your data if we are required to do so by law (for example, by court order, or to prevent fraud or other crime), or if you have given explicit permission to do so. 

Sometimes we ask third parties, including suppliers and partners, to carry out business functions for us, for example maintaining and backing up our IT systems’ software, or providing a data analytics platform. All such organisations are either contractually obliged or have signed an Agreement, which prevents them from sharing your data with other non-authorised third parties and provides for the secure disposal of this data.

You will be given the opportunity to subscribe to our email newsletter. Our email newsletters are processed and stored electronically via Mailchimp in the USA. Please see the Mailchimp Privacy Policy for further information on how your data is processed and protected. Data processed and stored in Mailchimp is never sold to third parties. You have the opportunity to unsubscribe to the newsletter at any time.

Be Part of Research account registration

Once you register for an account with Be Part of Research, your data is viewable by the Be Part of Research staff who administer the service. Your personal data will still be stored within our secure system. If a study is identified that may be of interest to you we will contact you with details of the study. This will include information about the study and how to contact the research study team. It is your choice as to whether you choose to share further information with the research study team.

If you agree to join a study, the research study team will contact you in regards to entering your data onto their research system. This is not part of the Be Part of Research system, and you will need to provide further consent for them to continue. 

Having an account means that you may or may not be contacted to be involved in health research depending on the requirements of individual studies. Please note that registering to be contacted by Be Part of Research, withdrawing your consent to be contacted by Be Part of Research or taking part or not in a health research study will not impact your medical care.

The NIHR is keen to ensure that participants in the COVID-19 Vaccine Research Registry, who registered an interest in finding out about opportunities to participate in other types of health research, are not frustrated by continued communications to request sign up to Be Part of Research when they may have already done so. To prevent this happening, NIHR Be Part of Research Team will share with NHS England, on a time-limited basis, the email addresses of those who have already registered with Be Part of Research, so that their email addresses can be removed from any further communications in that regard. This will continue until such time as the Vaccine Research Registry is discontinued.

Some of our emails to users with a registered account are processed and stored electronically via Mailchimp and SendGrid in the USA. Some of our emails to users with a registered account may also be sent using Gov.uk Notify. We may use these services to contact you with regards to account maintenance, changes to the service, updates/amendments to the privacy policy, and/or to advise you of research opportunities that you may be interested in. 

Data is only held within Gov.uk Notify systems for a period of 7 days for each email sent and is encrypted. Please see the Gov.uk Security Policy for further information on how your data is processed and protected.

Please see the Mailchimp Privacy Policy for further information on how your data is processed and protected. Data processed and stored in Mailchimp is never sold to third parties.

Please see the SendGrid Security Policy and SendGrid Privacy Policy for information on how your data is used and protected. Data processed and stored in SendGrid is never sold to third parties. 

You have the right to withdraw your consent from Be Part of Research and close your account at any time; see section below “Withdrawing Consent for Be Part of Research account”.   

Study teams will advise Be Part of Research of which users from our registry go on to enrol in their study. This is important for service improvement and to ensure that service users are not further contacted about studies they may no longer be eligible for.

Maintaining Data Accuracy and Currency

We have a duty under data protection legislation to ensure that information we hold is accurate and up to date. Whilst we ask that you play your part in this by keeping your data updated, we also contact NHS England approximately twice a year, Public Health Scotland yearly and the Northern Ireland General Registry Office every two to three years, to identify account holders who may have since died across England and Wales, Scotland and Northern Ireland respectively. We share basic personal information about user account holders  in a secure way with these organisations in order to carry out such a search. Once the search is carried out, the information shared, the accounts and all personal information of deceased account holders are deleted.

Data protection laws mean that each use we make of your personal information must have a “lawful basis” for the processing of that information. The relevant lawful bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK Data Protection Act 2018.

Whilst we are asking you to give your consent to the creation of an account on Be Part of Research, consent will not be used as the lawful basis for processing your data under the data protection legislation. Rather, the legal basis for processing your personal data under the data protection legislation will be as follows:

• Article 6.1 (e) performance of a task in the public interest or in the exercise of official authority vested in controller; 
• Article 9.2 (j) - research purposes. The NIHR funds, enables and delivers world leading health and social care research that improves people's health and wellbeing and promotes economic growth. The NIHR RDNCC acts as an agent of the DHSC in this endeavour. The Secretary of State for Health and Social Care has a duty to promote health and care research and a public sector equality duty; thus this service falls right within the public interest task of the DHSC.   

For further information please refer to the ICO’s website page on lawful basis for processing.

If you register for an account on Be Part of Research and you then decide you wish to withdraw from the service, you can do this at any time - please see the section below on “Withdrawing consent for Be Part of Research account.”

We are committed to ensuring that your information is secure.  The security of Be Part of Research is managed by the NIHR Information Systems Function, on behalf of the Department of Health and Social Care. This Function has the appropriate technical expertise to protect against unlawful processing and/or accidental loss of information.

We use leading technologies and encryption software to safeguard your data and will ensure only authorised users can see your data, and maintain strict security standards to prevent any unauthorised access to it. The NIHR RDNCC has both ISO 27001 and Cyber Essentials certifications; both schemes set high standards for information and cyber security, against which NIHR RDNCC is audited annually.

How long do we keep your personal information for?

We will hold your personal information for as long as we are providing you with services via Be Part of Research, and for as long as you agree to this. We will retain your data for varying amounts of time depending on the nature of your interactions with Be Part of Research. The following principles will apply across the Service:

• We only store data that is necessary for the specific purpose(s);
• Data will be held digitally rather than in paper record form wherever possible;
• We will not store your data for longer than is necessary for the intended purpose or as required by law;
• Your data will be securely deleted when no longer needed for the purpose(s);
• This services falls within the scope of NIHR RDNCC's  ISO27001:2022 and Cyber Essentials certifications;
• When an electronic file containing personal identifiable information (e.g. a complaints file) is no longer required it is securely deleted by overwriting the space several times with selected patterns, thus rendering any information unreadable;
• If you choose to close your account, Be Part of Research will only keep anonymous data to help improve the service.

We have specific, defined data retention periods for different data types, which are determined by legal and operational considerations.

You have the right to withdraw your consent for us to contact you, store and process your data, and share your data with site teams. If you wish to withdraw your consent you can do 

this by closing your account. You have the right to close your account at any time and without providing any explanation for doing so. 

If you choose to close your account, Be Part of Research will only keep anonymous data to help us improve the service, including date of registration and account closure, date of birth, postcode, sex and health conditions. We will remove all of your personal data including your name, email address, home address and phone numbers. 

If you have any difficulties withdrawing from the service and closing your account please contact a member of the Be Part of Research service support team at bepartofresearch@nihr.ac.uk

The Data Protection Officer for the RDNCC is:

• Name of Data Protection Officer: Lee Cramp
• Address: Department of Health and Social Care, First Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU
• Email: data_protection@dhsc.gov.uk

As a data subject, you may have the following rights under the Data Protection Laws:

• the right of access to personal data relating to you
• the right to correct any mistakes in your information
• the right to ask us to stop contacting you with direct marketing
• rights in relation to automated decision making
• the right to restrict or prevent your personal data being processed
• the right to withdraw consent

These individual rights are explained on the Information Commissioner's Office website:

If you wish to exercise any of your data subject rights, please contact the NIHR Service Desk in the first instance - either: 

• Write to The NIHR Service Desk, Back Lane, Melbourn, Royston, SG8 6DP
• or Email: gdpr_requests@nihr.ac.uk

We will respond in a timely manner to any rights that you wish to exercise, and for Subject Access Requests (SARs) this has to be within a month of receiving your request unless the request is particularly complex.

It is important that you ensure you have read this privacy notice - and if you do not think that we have processed your data in accordance with this privacy notice - you should let us know as soon as possible. 

Similarly, you may complain to the Information Commissioner's Office.