FRF Privacy Notice

Content last updated: 14 May 2024. Changes made to address change of legal body from CRNCC to RDNCC under new contract from 1 April 2024.  Change of presentation on site to show all content on one page but also leave distinct site links to separate pages.

The Department of Health and Social Care  ("DHSC”) is the Data Controller for the Find, Recruit and Follow-up "[FRF]" under the Data Protection Act 2018, the UK GDPR, and the General Data Protection Regulation (EU) 2016/679 ("Data Protection Laws"). 

The University of Leeds (“The Host Organisation”) is the Data Processor for the "[FRF]". The University of Leeds provides the National Institute for Health and Care Research (“NIHR”) Research Delivery Network Coordinating Centre (“RDNCC”) on behalf of the Department of Health and Social Care and the RDNCC is responsible for the processing of your personal data. 

The purpose of this Privacy Notice is to inform you, as a user of the Find, Recruit and Follow-up website, about what information we collect when you visit the website, how we use your information, whether or not your information is shared, and the ways in which we protect your privacy.

By continuing to use or engage with the website, you are agreeing to the processing of your personal information in accordance with this Privacy Notice.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time so please check back periodically. If we were to make significant changes to the Notice that would impact you we will email you so that you can be updated on what has changed. 

Links to external websites

The Find, Recruit and Follow-up website may contain links to other websites of interest outside the Find, Recruit and Follow-up website. This privacy notice only applies to the Find, Recruit and Follow-up website and when moving away from this site the relevant privacy notices on those external websites, systems and services apply.

About the NIHR Research Delivery Network Coordinating Centre

The Department of Health and Social Care (DHSC) is the Data Controller for the Find, Recruit and Follow-up site under the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 (Data Protection Laws).

The University of Leeds is the Data Processor for Find, Recruit and Follow-up. The University of Leeds provides the National Institute for Health and Care Research (NIHR) Research Delivery Network Coordinating Centre (RDNCC) on behalf of the DHSC and the RDNCC is responsible for the processing of your personal data.The RDNCC manages the NIHR Research Delivery Network (RDN) on behalf of the Department of Health and Social Care. The RDN makes it possible for patients, the public and health and social care organisations across England to participate in and deliver health and care research studies.

The RDN provides the infrastructure that allows high-quality research funded by charities, research funders and the life-sciences industry to be undertaken throughout the NHS and in other health and care settings. The RDN works with patients and the public to make sure their needs are placed at the heart of all research and provides opportunities for patients to gain earlier access to new and better treatments through research participation. The RDN provides practical help in identifying and recruiting patients for clinical research studies, so that researchers can be confident of completing the study on time and as planned. The RDN supports around 5,000 clinical research studies each year.

About Find Recruit and Follow-up

The Find Recruit and Follow-up website is run by the NIHR RDNCC working with NHS Research Scotland and Health and Care Research Wales. The aim of the Find, Recruit and Follow-up website is to help researchers and life sciences companies understand, navigate and use services available across the UK to support data-enabled Find, Recruit and Follow-up activities.

The information we collect and how we use that data

The type of personal information we collect will vary according to the interactions you have with the Find, Recruit and Follow-up website. Different interactions and information collected at those relevant points are outlined below:

 Cookies

One way we collect information from you when you visit the Find, Recruit and Follow-up website is by using cookies.

 Cookies are small files of information that save and retrieve information about your visit to our site.

 You can choose whether to accept or reject additional (optional) cookies:

• If you choose to reject additional (optional) cookies, an essential cookie will be set to remember this cookie preference.

• If you choose to accept additional (optional) cookies,  we will set performance cookies to give us insights into how people use our website and help us improve it.  We may also host content (e.g. videos) on the site from Third Parties (e.g. YouTube). If you choose to accept additional (optional) cookies, these Third Parties may also set cookies.

More information is available on the specific use of cookies in the FRF Cookie Policy.

Forms

The Find Recruit and Follow-up website has a number of forms to enable users to contact various organisations involved in Find Recruit and Follow-up. These forms collect users’ contact details to enable the recipients to respond to the enquiry or feedback. The section below outlines the different forms, the information collected and why, how we store and who we share that information with:

1. Contact research support form

• The information we collect

The UK offers multiple services and teams of professionals who can support researchers and life sciences companies with identifying appropriate data services or wider support with planning and delivering their study in the UK.

If you are a researcher or life sciences company and would like to access this support you can complete the Contact research support form and a professional from the relevant research support infrastructure will get in touch to respond to your request.

The personal information requested within the form are:

• Full name

• Email address

• Telephone (optional)

• Job role

• How and why we use your personal information

When you submit this form, information is sent to a relevant UK research support organisation via email who will use this to get in touch with you to respond to your request for support.

The organisations receiving your enquiry will be responsible for managing your personal information in line with their usual processes for managing personal information received via email and you should refer to that organisation’s privacy policy for further information.

A copy of your submitted enquiry will also be sent to you for your records.

• Who do we share your personal information with 

There are a number of different organisations that support research within the UK but one country or region will take the lead on supporting the research. This can be the region within which the Chief Investigator or Clinical Trials Unit (CTU) is based or, for Commercial Studies, the lead region selected by the Sponsor. 

Depending on which lead region you select, your personal information will be sent to the following organisations to allow them to respond to your enquiry:

Enquiry & personal information should be emailed to concerned lead regions.

• One of the NIHR RDN regional networks  - FRF central team within NIHR RDNCC and/or host organisation for that regional network.

• Northern Ireland - FRF central team within NIHR RDNCC and/or Northern Ireland Clinical Research Network.

• Scotland - NHS Research Scotland.

• Wales - Health and Care Research Wales.

• Unknown lead region (for commercial studies) - Relevant team within NIHR RDNCC (not shared).

2. Contact Data Service Provider form

• The information we collect

If you have identified a data service provider that you would like to get in touch with to find out more about their services, you can complete the Contact data service provider form.

The personal information requested within the form are:

• Full name

• Email address

• Telephone (optional)

• Job role

• How and why we use your personal information

When you submit this form we send the information provided to the relevant data service provider via email who can then use that information in the form to get in touch with you to respond to your enquiry.

The organisations receiving your enquiry will be responsible for managing your personal information in line with their usual processes for managing personal information received via email and you should refer to that organisation’s privacy policy for further information.

• Who do we share your personal information with 

There are a number of organisations that offer Find, Recruit and Follow-up data services to researchers and life sciences companies (known as data service providers). If you complete the form to get in touch with a data service provider, your personal information will be sent to the organisation operating or managing enquiries for the service to allow them to respond to your enquiry.

3. Contact Find, Recruit and Follow-up central team form

• The information we collect

The Find, Recruit and Follow-up central team manage the content of this website and can be contacted in relation to general enquiries about Find, Recruit and Follow-up advisory support.

If you are an organisation offering Find, Recruit and Follow-up data services to researchers and life sciences companies or a colleague within the various research support organisations across the UK and would like to get in touch with the Find Recruit and Follow-up central team you can complete the Contact Find, Recruit and Follow-up central team form and a member of the team will respond to your enquiry.

The personal information requested within the form are:

• Full name

• Email address

• Telephone (optional)

• Job role

• How and why we use your personal information

The personal information provided in the form is used  to get in touch with you to respond to your enquiry.

The personal information held within the email is then managed in line with our standard processes for managing personal information.

• Who do we share your personal information with

When you submit this form we send the information provided to the Central FRF team within the NIHR RDNCC via email. 

Personal information provided in the Contact FRF central team form is not generally shared outside of the NIHR RDNCC FRF Team unless further sharing is necessary in order to fully answer your question. For example further sharing may be between the NIHR RDNCC FRF Team and a DSP, or one of the other organisations supporting research in the UK. Please be assured, however, that this sharing would only be for the purpose of answering your query.  

4. Provide feedback form

• The information we collect

We actively seek feedback from users of the FRF website to help us to understand how helpful the website is and to seek suggestions for improvement of the website. Feedback can either be anonymous or you can provide your contact details. 

The personal information that may be provided within the Feedback form are:

• Full name (optional)

• Email address (optional)

• How and why we use your personal information

For follow up contact; if you have provided identifiable feedback, we may then contact you to  explore your feedback or issues raised further and/or invite you to provide more in depth feedback.

• Who do we share your personal information with

When you submit this form with personal information, this is sent to the Central FRF team within the NIHR RDNCC via email. The personal information held within the email is then managed in line with our standard processes for managing personal information.

Personal information provided alongside feedback is not shared outside of the NIHR RDNCC without your permission.

How we protect your data

We are committed to ensuring that your information is secure.  We use leading technologies and encryption software to safeguard your data, and maintain strict security standards to prevent any unauthorised access to it. However, given that transmitting information over the internet cannot be completely secure, we can’t guarantee the security of your data in transit. 

The security of the Find Recruit and Follow-up website is managed by the NIHR Information Systems Function, on behalf of the Department of Health and Social Care. This Function has the appropriate technical expertise to protect against unlawful processing and/or accidental loss of information.

Any personal data provided via the  Find Recruit and Follow-up website will be stored in a secure database hosted on the Amazon Web Services platform. This is a cloud-based software platform that provides for disaster recovery processes across its servers, which are all located within the European Economic Area (EEA). None of the personal data collected within the Find Recruit and Follow-up website  will go outside of the UK or the EEA. This service falls within the scope of NIHR RDNCC's ISO27001:2022 certification and its Cyber Essentials certification. 

We will not sell your personal data.  Except for operational support of the system (where an IT hosting provider may access your details as part of maintenance and support) or as outlined within this privacy policy, we will not disclose your personal data to third parties outside of the RDNCC, unless we have your explicit permission, or are required by law to do so. 

We will hold any personal data you provide to us for 12 months to enable us to act upon your request or feedback.  After 12 months your personal identifiers will be securely deleted.

The lawful basis for processing

Data protection laws mean that each use we make of your personal information must have a “lawful basis” for the processing of that information. The relevant lawful bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK Data Protection Act 2018. Whilst you provide implied consent by accepting additional (optional) cookies or providing your contact details in one of our forms, consent will not be used as the lawful basis for processing your data under the data protection legislation. Rather, the legal basis for processing your personal data under the data protection legislation will be as follows:

• Article 6.1 (e) performance of a task in the public interest or in the exercise of official authority vested in controller; 

The NIHR funds, enables and delivers world leading health and social care research that improves people's health and wellbeing and promotes economic growth. The NIHR RDNCC acts as an agent of the DHSC in this endeavour. The Secretary of State for Health and Social Care has a duty to promote health and care research and a public sector equality duty; thus this service falls right within the public interest task of the DHSC.   

For further information please refer to the ICO’s website page on lawful basis for processing.

Your rights over your personal data

• The Data Protection Officer for the RDNCC is:

• Name of Data Protection Officer: Lee Cramp

• Address: Department of Health and Social Care, First Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU

• Email: data_protection@dhsc.gov.uk

As a data subject, you may have the following rights under the Data Protection Laws:

• the right to be informed about the collection and use of your personal data

• the right of access to personal data relating to you

• the right to correct any mistakes in your information

• the right to restrict or prevent your personal data being processed

• rights in relation to automated decision making

• the right to object.

These individual rights are explained on the Information Commissioner's Office website.

If you wish to exercise any of your data subject rights, please contact the NIHR Service Desk in the first instance - either: 

• Write to The NIHR Service Desk, Back Lane, Melbourn, Royston, SG8 6DP

• or Email: gdpr_request@nihr.ac.uk

We will respond on time to any rights that you wish to exercise, and for Subject Access Requests (SARs) this has to be within a month of receiving your request unless the request is particularly complex.

Contacting the Regulator

It is important that you ensure you have read this privacy notice - and if you do not think that we have processed your data in accordance with this privacy notice - you should let us know as soon as possible. 

Similarly, you may complain to the Information Commissioner's Office.