NIHR Expert Connect (NIHR EC App) Privacy Notice

Content created 6 October 2025

The Department of Health and Social Care  ("DHSC”) is the Data Controller for NIHR Expert Connect under the Data Protection Act 2018, the UK GDPR, and the General Data Protection Regulation (EU) 2016/679 ("Data Protection Laws"). 

The University of Leeds (“The Host Organisation”) is the Data Processor for NIHR Expert Connect. The University of Leeds provides the National Institute for Health and Care Research (“NIHR”) Research Delivery Network Coordinating Centre (“RDNCC”) on behalf of the Department of Health and Social Care and the RDNCC is responsible for the processing of your personal data.

About the NIHR Research Delivery Network Coordinating Centre

The NIHR Research Delivery Network Coordinating Centre (RDNCC) is a service provided by the University of Leeds, with contracted maintenance by PA Consulting Services Limited.

The RDNCC manages the NIHR Research Delivery Network ("RDN") on behalf of the Department of Health and Social Care.  The RDN makes it possible for patients and health professionals across England to participate in clinical research studies within the NHS.  The RDN provides the infrastructure that allows high-quality clinical research funded by charities, research funders and life-sciences industry to be undertaken throughout the NHS.  The RDN works with patients and the public to make sure their needs are placed at the heart of all research, and provides opportunities for patients to gain earlier access to new and better treatments through research participation. The RDN provides practical help in identifying and recruiting patients for clinical research studies, so that researchers can be confident of completing the study on time and as planned.

The RDN supports around 5,000 clinical research studies each year. 

The information we collect

The RDNCC collects your personal data on behalf of and as directed by the Department of Health and Social Care.

The data that we collect about you may vary depending on the nature of your interactions with NIHR. Specifically, we will collect the following from you directly.

-Title

-First Name

-Last Name

-Email address

-Employing institution

-Affiliated organisations and institutions

-Professional background

-Areas of expertise

We will always protect your personal data within the terms of this Privacy Notice.

How and why we use your data

Data will be collected from the registration form that you have been invited to complete, where you will also be asked to indicate that you have read, understood and agree to the NIHR Expert Connect Terms and Conditions including the Confidentiality Clauses. 

Once the registration form is submitted, it will be reviewed by one of the NIHR team administering the NIHR Expert Connect App who may query any relevant missing information with you. Once the record is complete it will be approved and your data will be searchable on the NIHR Expert Connect App in order to facilitate matching requests for support requiring your expertise. In some cases, a registration may not be accepted; in these instances, the team will be in contact to provide you with a reason and any relevant next steps. 

If a suitable request matches your expertise, a member of the NIHR team facilitating the service in receipt of the request will email you details of the request and ask you to confirm if you are willing to support it. If you are able to support the activity, the team may supply you with further information and timescales for your input. If you decline the request, we will ask you to provide a reason in order to inform our systems, processes and management of the invitations going forward. 

We may from time to time send you newsletters or updates to provide you information on the NIHR Expert Connect App and its services.

The lawful basis for processing

Data protection laws mean that each use we make of your personal information must have a “lawful basis” for the processing of that information. The relevant lawful bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK Data Protection Act 2018.

The lawful basis for processing your personal data under the data protection legislation for NIHR Expert Connect App is as follows:

Article 6.1 (e) performance of a task in the public interest or in the exercise of official authority vested in the controller.

How we protect your data

We are committed to ensuring that your information is secure.  We use leading technologies and encryption software to safeguard your data, and maintain strict security standards to prevent any unauthorised access to it.  However, given that transmitting information over the internet cannot be completely secure, we can’t guarantee the security of your data in transit. 

The NIHR Expert Connect App services may provide you with links to other websites of interest outside the RDNCC. This Privacy Policy only applies to our websites, systems and services, and doesn’t cover other websites and services that we may link to. You should exercise caution and look at the privacy notice applicable to the website/service in question. 

The security of the NIHR EC App is managed by the NIHR Information Systems Function, on behalf of the Department of Health and Social Care. This Function has the appropriate technical expertise to protect against unlawful processing and/or accidental loss of information.

The NIHR EC App is provided through the google cloud environment provided by DHSC for the NIHR.  Google maintains a robust security posture across its infrastructure, meeting and exceeding widely accepted industry standards. Google, as a service provider, has no proprietary rights to the NIHR data and will only use any material held as is deemed essential in providing and maintaining the service. All processing of information via the NIHR Hub is in accordance with the Data Protection Act 2018, UK GDPR and other prevailing data protection legislation in force at the time. 

We will not sell your personal data.  With the exception of an IT hosting provider who may access your details as part of operational support and maintenance of the system, we will not disclose your personal data to third parties outside of the NIHR, unless we have your explicit permission to do so, or are required by law to do so. 

We will hold the data for as long as we are providing you services and for as long as you agree to this. We will retain your data for varying amounts of time depending on the nature of your interactions with the NIHR EC  App:

• We only store data that is necessary for a specific purposes e.g. your contact information to match you with requests for supports, details of the requests assigned to you

• We will not store your data for longer than is necessary

• Your data will be securely deleted when no longer needed for the purpose(s) 

Destruction of Data

• This services falls within the scope of NIHR RDNCC's  ISO27001:2022 and Cyber Essentials certifications

• If you do not hold a contract that requires your support for requests from NIHR, you may ask to have your details removed from the NIHR EC  App. We will review and process these requests within two weeks of receipt. We reserve the right to retain records of which requests that you have already  supported. The information retained will include your name, affiliation and email address, but you will no longer appear as an available reviewer in the system. 

Who do we share your personal data with

For all NIHR EC App Experts:

If you agree, your details may be passed to the requester in some instances, such as a request to participate in a meeting or provide further support. We will only pass on your information when you have provided permission for us to do so. 

We welcome any feedback on the frequency and type of requests you receive so that we can better tailor your experience as an NIHR expert. 

After you complete a request for support, we will invite you to provide feedback on your experiences. This feedback will help to improve our services and systems. We will also use this information to inform evaluations of the NIHR EC  App’s value to the organisation. 

We may from time to time seek feedback from those individuals and organisations submitting requests for support. This feedback will help to improve our services, and will feed into evaluations of our services and systems. However, we will only further share this information once it has been anonymised. 

You may request to be marked as unavailable for a period of time on the NIHR EC App. We will not record reasons for this, but will monitor unavailable experts periodically and may contact you to see if you still wish to remain as an expert on the NIHR EC App.

For experts coming to the NIHR EC App through the RDNCC:

Teams internal to wider NIHR infrastructure (Including, but not limited to teams based within NIHR, such as the RDN, Experimental Cancer Medicine Centres (ECMC) and Advanced Therapy Treatment Centres (ATTC) network) will be able to access your details in order to match incoming requests with your expertise.

For experts from outside of the RDNCC:

For experts that have come to the NIHR EC App through the extended NIHR networks, such as (but not limited to) ECMC and ATTC, we will make your user record available to all services who use the NIHR EC  App to match you to requests for support. 

We will also share information with your host network about the frequency and type of requests you receive and accept through the NIHR EC App system and services. This will help the networks to understand, monitor and manage workload coming through the services and make adjustments where necessary.

Current NIHR Services using the NIHR EC App:

Key areas and NIHR services using the NIHR EC App include (but are not limited to):

• Public Engagement in Clinical Development (PECD): This service facilitates public involvement activities for the Life Sciences Industry. The NIHR EC App would help them identify relevant experts within the NIHR for the purpose of sharing public engagement opportunities with the experts’ wider networks.

• Early Feedback Service: This service facilitates the review of commercial research protocols by UK clinical and care experts to optimize them for UK delivery. Experts provide feedback on various aspects like patient care pathways, recruitment strategies, and study complexity.

• NIHR Industry Team (including Key Accounts, Business Development and Marketing): use the NIHR EC App to identify expertise for discussions with commercial sponsor companies. For example, for early advice and input into protocol development and optimisation for delivery in the UK health and care system. Current  services for industry are  on our website. 

• National Settings and Specialities Team (NSST), NIHR RDN Strategic Development Directorate: The NIHR EC App acts as a central repository for all NIHR-connected experts and their expertise. The NSST team is responsible for inviting RDN experts to join the NIHR EC App in order to support the Services outlined above. The team also uses the NIHR EC App to identify experts to support urgent Department of Health and Social Care (DHSC) requests.

• Experimental Cancer Medicine Centres (ECMC) receive requests for early stage collaborative discussions about running early phase oncology studies or associated translational research in the UK.  For these opportunities, the ECMC Programme Office will use the NIHR EC App to identify experts matching the expertise request from the commercial or non-commercial organisation. If the experts agree to the opportunity, their professional contact details and expertise will be shared with the organisation for the purposes of establishing the collaborative discussion. The ECMC Programme Office may arrange and/or facilitate a meeting between the experts and company/non-commercial organisation, if requested by the organisation, or if multiple experts are involved. 

The NIHR EC App will also be used to track which ECMC-affiliated experts have been assigned to and responded to which opportunities, and collect feedback from experts about the opportunities they have been matched to using the NIHR EC App. 

The Privacy Notice for ECMC can be found here: https://www.ecmcnetwork.org.uk/privacy

• The Advanced Therapy Treatment Centre network receives requests for early-stage collaborative discussions about the delivery of advanced therapy clinical trials in the UK. For these opportunities, the ATTC network, in collaboration with their coordinating organisation Cell and Gene Therapy Catapult (CGTC), will use the NIHR EC App to identify experts matching the expertise request from the commercial or non-commercial organisation. If the experts agree to the opportunity, their professional contact details and expertise will be shared with the organisation for the purposes of establishing the collaborative discussion. The ATTC network/CGTC may arrange and/or facilitate a meeting between the experts and commercial/non-commercial organisation, if requested by the organisation, or if multiple experts are involved.

The NIHR EC App will also be used to track which ATTC-affiliated experts have been assigned to, and responded to, which opportunities, and collect feedback from experts about the opportunities they have been matched to using the NIHR EC App.

Your rights over your personal data

The Data Protection Officer for the RDNCC is:

• Name of Data Protection Officer: Lee Cramp

• Address: Department of Health and Social Care, 1st Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU

• Email - data_protection@dhsc.gov.uk 

As a data subject, you have the following rights under the Data Protection Laws: 

• the right of access to personal data relating to you 

• the right to correct any mistakes in your information

• the right to ask us to stop contacting you with direct marketing

• rights in relation to automated decision making  

• the right to restrict or prevent your personal data being processed

• the right to have your personal data ported to another data controller (e.g. if you decide to contract with a different supplier).

• the right to erasure (this is not an absolute right)

• the right to withdraw consent

These rights are explained in more detail on the Individual Rights section of the Guide to the General Data Protection Regulations on the Information Commissioner's Office website.

If you wish to exercise any of your data subject rights, please contact the NIHR Service Desk in the first instance - either:  

• Write to The NIHR Service Desk, Back Lane, Melbourn, Royston, SG8 6DP

• or Email: gdpr_requests@nihr.ac.uk 

We will respond in a timely manner to any rights that you wish to exercise, and for Subject Access Requests (SARs) this has to be within a month of receiving your request unless the request is particularly complex.

Contacting the Regulator

It is important that you ensure you have read this privacy notice - and if you do not think that we have processed your data in accordance with this privacy notice - you should let us know as soon as possible.  

Similarly, you may complain to the Information Commissioner's Office. Information about how to do this is available at  www.ico.org.uk