Corporate
Our mission is to achieve the highest ethical, medical and scientific standards in the study of potential new medicines in humans, with the ultimate aim of improving the prevention and treatment of disease. To help us achieve our mission, we’re committed to training and developing our employees, and encouraging them to improve their performance.
The UK Medicines Act (1968) excluded clinical trials of investigational medicinal products (IMPs) in healthy subjects, because they were deemed to receive no therapeutic benefit. However, from 1 May 2004 until 31 Dec 2020, the testing of IMPs in all people in the UK, healthy subjects and patients, was regulated by the European Union (EU) Clinical Trials Directive (2001/20/EC) and the detailed guidance documents. The Directive aimed to raise standards for testing IMPs in humans by legally enforcing the principles of Good Clinical Practice (GCP) and Good Manufacturing Practice (GMP). The UK left the EU on 31 January 2020 and was in a transition period until 31 December 2020; during that period EU laws still applied. Since 1 January 2021, the testing of IMPs in people in the UK has been regulated by the UK Clinical Trials Regulations.
However, our biggest incentive to maintain and improve the quality of our work stems from the duty of our physicians, nurses and support staff to follow high standards of ethics, safety and science in the care of the subjects that take part in our clinical trials.
Our company is owned and managed by physicians, whose professional regulatory body, the General Medical Council, demands that we maintain high standards of conduct. Similarly high standards are demanded by the Research Ethics Committee (REC) and Medicines and Healthcare products Regulatory Agency (MHRA), who represent the interests of the trial subjects. Like any other business, we must make every effort to satisfy consistently and effectively the requirements of our sponsors with respect to both the quality and timing of our services. Unlike most businesses, however, ethics, safety and science must take precedence over the need to satisfy trial sponsors and financial matters. In practice, the potential conflict with sponsors rarely causes any difficulty, because sponsors generally share our desire to maintain high ethical and scientific standards. Trials that are poorly done are likely to be rejected by regulatory authorities when an application is made to market a new medicine; thus, it is strongly in the interests of our business, and of our sponsors, that our output be uniformly of the highest quality and that we continue to improve our facilities and services.
We encourage all our employees to achieve and maintain high standards in their work, and to report any issue or incident that might threaten the welfare of the company, another employee, or – most important of all – a subject on one of our clinical trials. Those aims are incorporated within the company’s quality system, which must be understood, implemented and maintained throughout the organisation. We expect all employees to identify opportunities to enhance the quality system and thereby improve our service, not only to trial sponsors, but also to trial subjects and the community
Our 2023 Gender Pay Gap Report
As an employer, we’re required by law to carry out Gender Pay Reporting under the Equality Act 2010 (Gender Pay Gap Information) Regulations 2017. We must publish the results on our own website and a government website.
We’ve done 6 calculations that show the difference between the average earnings of men and women in our organisation. We don’t publish individual employees’ data. We use the results to assess:
- the levels of gender equality in our workplace
- the balance of male and female employees at different levels
- how effectively talent is maximised and rewarded
The challenge in our organisation and across Great Britain is to eliminate any gender pay gap.
Mean Gender Pay Gap: On average, men are paid 46.4% more than women
Median Gender Pay Gap: The median hourly rate for men is 3.9% higher than for women
Personal data
All personal data processing in the UK must conform to the UK General Data Protection Regulation (GDPR) and to the UK Data Protection Act 2018. The EU GDPR also applies to the UK as a third country.
The UK GDPR defines personal data as:
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
HMR (Hammersmith Medicines Research Ltd) may use personal information about you that is provided by you, any employment agency used by you, or your referees. We’ll hold information about you, such as your name, address, contact details and CV.
How we use your information
This privacy notice tells you how we will collect and use your personal data. We’ll ensure your information is kept confidential in line with the GDPR. We’ll use it to assess your suitability for current job vacancies and to demonstrate and assess our compliance with legal requirements for recruitment of staff. We’ll ensure that the information we collect and use is appropriate for those purposes, and does not constitute an invasion of your privacy.
What is the lawful basis for processing my personal information?
If you contact us, whether in person, by phone, in writing or through our website, the legal basis for processing your information will be HMR’s legitimate interest, because HMR is a company that does clinical trials and needs to be able to identify potential new employees.
If your application is not successful, or we have no suitable vacancies, we might, with your permission, keep your application on file, in case any suitable vacancy arises. The lawful basis would be your consent.
You can contact our Data Protection Officer as described below.
Will HMR share my personal data with anyone else?
We may keep the information about you on paper and on computers. HMR will keep that information confidential, and restrict access to it. Unless required by law, we won’t share your information with anyone except any employment agency that you have used or your referees. Those parties must keep your information confidential and use it only in relation to your application.
We’ll never allow third parties access to your personal information for their own marketing purposes. We’ll never sell personally identifiable information to third parties.
How will HMR use the personal data it collects about me?
HMR will process (collect, store and use) your information in line with the GDPR. We’ll use your information only for the following purposes:
- to assess your suitability for current job vacancies
- to demonstrate and assess our compliance with legal requirements for recruitment of staff
If we offer you a job, we’ll ask you for some medical information, to help us assess your suitability for the role, and we’ll record your sex and ethnic origin, so we can monitor equal opportunities. For some roles, we must also do checks of criminal convictions, for legal reasons and because we have a duty of care to our trial participants. However, we will ask your consent before doing so.
We’ll do our best to keep your information accurate and up to date during the application process.
If your application is unsuccessful, and you agree that we can keep your information on file, we may contact you if a suitable vacancy arises. We’ll stop contacting you if you inform us at any time that you no longer wish to be contacted. We aim not to be intrusive.
We will not keep your personal information for longer than is necessary. If your application is successful, we’ll keep your information in line with our company policies and procedures, which will be available for you to review. If your application is unsuccessful, we’ll keep your information for up to 6 months, in case we need to respond to a claim of discrimination. If you agree that we can keep your information on file, we’ll keep it for up to 12 months.
Automated decision making
We don’t use automated decision making when we process your personal information.
Cookies
Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]
Google Analytics
We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google. Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.
Can I find out the personal data that HMR holds about me?
HMR, at your request, can confirm what information we hold about you and how it is processed. Under the GDPR, you can request the following information.
- The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
- Contact details of the Data Protection Officer.
- The purpose of the processing, and the legal basis for processing.
- If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
- The categories of personal data collected, stored and processed.
- Details of who will see your data.
- If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
- How long the data will be stored.
- Details of your rights to correct or erase your data or to restrict or object to the processing.
- Information about your right to withdraw consent at any time.
- How to make a complaint to the supervisory authority.
- Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
- The source of personal data if it wasn’t collected directly from you.
- Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
What forms of ID will I need to provide to access my personal information held by HMR?
We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):
- Passport
- driving licence
- birth certificate
- credit or debit card
- utility bill (from last 3 months)
- bank statement (from last 3 months)
What should I do if I have any concerns or complaints?
Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com. If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).
Contact details of the Data Protection Officer / GDPR Owner:
Data Protection Officer
Hammersmith Medicines Research
Cumberland Avenue
Park Royal
London NW10 7EW
Personal data
All personal data processing in the UK must conform to the UK General Data Protection Regulation (GDPR) and to the UK Data Protection Act 2018. The EU GDPR also applies to the UK as a third country.
The UK GDPR defines personal data as:
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
HMR (Hammersmith Medicines Research Ltd) may use personal information about you that is provided by you, your organisation or another organisation with which your organisation is working, or is available publicly or from third parties, such as GlobalData. We’ll hold information about you, such as your name, address, contact details, company name and position, and CV.
How we use your information
This privacy notice tells you how we will collect and use your personal data. We’ll ensure your information is kept confidential in line with the GDPR. If you make an enquiry about clinical trials, we might use your information to inform you about our capabilities, expertise, facilities and services, and manage any work you place with us. If you’re a service provider, contractor or supplier, we’ll use it to make enquiries and manage orders. We’ll ensure that the information we collect and use is appropriate for those purposes, and does not constitute an invasion of your privacy.
What is the lawful basis for processing my personal information?
If you contact us, whether in person, by phone, in writing or through our website, the legal basis for processing your information will be HMR’s legitimate interest, because HMR is a company that does clinical trials and needs to be able to:
- promote its services to potentially interested parties
- respond to customers and execute contracts
- identify suppliers
If you go on to engage HMR’s services, or HMR engages yours, the lawful basis for processing your personal information will be contractual.
You can contact our Data Protection Officer as described below.
Will HMR share my personal data with anyone else?
We may keep the information about you on paper and in a computer database. HMR will keep that information confidential, and restrict access to it. We may share that information with third parties working on behalf of HMR to deliver services relating to your enquiry. Those parties must keep your information confidential and use it only in relation to your enquiry. We’ll never allow third parties access to your personal information for their own marketing purposes. We’ll never sell personally identifiable information to third parties.
How will HMR use the personal data it collects about me?
HMR will process (collect, store and use) the information you provide in line with the GDPR. We’ll use your information only:
- to process enquiries and execute work placed with or by HMR
- where otherwise necessary for our legitimate interests (such as analysis of any feedback you have about HMR)
- to comply with the law
We’ll do our best to keep your information accurate and up to date.
We will not keep your personal information for longer than is necessary. By law, HMR must keep certain types of information (such as information for clinical trials, income tax and audit) for fixed periods of time. In particular, we must keep information collected as part of a clinical trial for at least 15 years.
We may, from time to time, contact you to ask about your current and future clinical trials requirements, or to let you about any developments at HMR. If HMR has enquired about your services, we may contact you to let you know about any developments at HMR or potential opportunities. We’ll stop contacting you if you inform us at any time that you no longer wish to be contacted. We aim not to be intrusive.
Automated decision making
We don’t use automated decision making when we process your personal information.
Cookies
Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]
Google Analytics
We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google. Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.
Can I find out the personal data that HMR holds about me?
HMR, at your request, can confirm what information we hold about you and how it is processed. Under the GDPR, you can request the following information.
- The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
- Contact details of the Data Protection Officer.
- The purpose of the processing, and the legal basis for processing.
- If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
- The categories of personal data collected, stored and processed.
- Details of who will see your data.
- If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
- How long the data will be stored.
- Details of your rights to correct or erase your data or to restrict or object to the processing.
- Information about your right to withdraw consent at any time.
- How to make a complaint to the supervisory authority.
- Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
- The source of personal data if it wasn’t collected directly from you.
- Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
What forms of ID will I need to provide to access my personal information held by HMR?
We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):
- Passport
- driving licence
- birth certificate
- credit or debit card
- utility bill (from last 3 months)
- bank statement (from last 3 months)
What should I do if I have any concerns or complaints?
Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com. If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).
Contact details of the Data Protection Officer / GDPR Owner:
Data Protection Officer
Hammersmith Medicines Research
Cumberland Avenue
Park Royal
London NW10 7EW
This statement explains how HMR protects the personal information of volunteers who take part in our clinical trials of potential new medicines and in other research studies approved by an independent research ethics committee, such as projects sponsored by HMR to collect blood or urine samples to help develop tests in our laboratory.
Personal data
All personal data processing in the UK must conform to the UK General Data Protection Regulation (GDPR) and to the UK Data Protection Act 2018. The EU GDPR also applies to the UK as a third country.
The UK GDPR defines personal data as:
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Personal information held by HMR might include your name, address, date of birth and photograph.
How we use your information
This privacy notice tells you how we, HMR (Hammersmith Medicines Research Ltd), will collect and use your personal data. We’ll ensure that information is kept confidential in line with the GDPR. We’ll use your information to contact you in the future about clinical studies. If you take part in a clinical study, we’ll keep your records for as long as required by law and international guidelines for clinical studies.
Why does HMR need to collect and store personal data?
The information that you submit to HMR will be held by us for the purpose of checking your suitability for future clinical studies, and contacting you to tell you about those clinical studies. We’ll ensure that the information we collect and use is appropriate for this purpose, and doesn’t constitute an invasion of your privacy. We won’t contact you for any other marketing purposes, without first obtaining your consent.
You’re under no obligation to give your personal information to HMR. But, if you want to take part in clinical studies at HMR, we’ll need your personal details, including medical information about you.
If you take part in a clinical study, HMR will use your personal information to meet the aims of the clinical study.
What information will you collect from me?
To register you to take part in clinical studies, we’ll collect basic identifiers (your name, sex and date of birth), your contact details, your nationality and ethnic origin, and limited information about your health and lifestyle (such as whether you smoke, your alcohol consumption, your height and weight, and whether you have certain medical conditions such as asthma or obesity). We’ll also ask you to confirm that you’re eligible to work in the UK.
If you go on to take part in a study, we’ll collect detailed information about your health and lifestyle, including your medical history and information about your sex life, sexual orientation and use of recreational drugs. We’ll also take copies of your official identity documents (such as your passport or driving licence and, if applicable, evidence of your National Insurance number). During a clinical study, we’ll record the results of many medical tests (such as blood pressure and medical examinations) and record the results in the study records. We’ll also collect information that doesn’t form part of the clinical trial records – please see the section below: What is the lawful basis for processing my personal information?.
What is the lawful basis for processing my personal information?
If you complete an enquiry form and/or any of our assessments, but don’t take part in a clinical study, the legal basis for processing your information will be the legitimate interest of HMR, because HMR is a company that does clinical studies and needs to be able to identify suitable study participants from a group of people who are interested in taking part in clinical studies. HMR is the data controller, and you can contact our Data Protection Officer as described below.
The legal basis for processing the data from projects sponsored by HMR to collect blood or urine samples to help develop tests in our laboratory is HMR’s legitimate interest, because HMR needs to set up and check new tests to use in clinical trials. HMR is the data controller, and you can contact our Data Protection Officer as described below.
If you take part in a clinical study, the sponsor (the company or organisation paying for the clinical study) will be the data controller for the clinical study data. The sponsor may use one of the following legal bases for processing your information:
- the legitimate interest of the sponsor— because the sponsor needs the information to develop new medicines or do other health-related scientific research
- your consent — please note that, if you withdraw your consent during the clinical study, the sponsor will use legitimate interest as the legal basis for keeping and processing the data we’ve already collected about you
For most of our studies, HMR is a data processor. But some sponsors might appoint HMR to be a co-controller of the clinical study data. In those cases, HMR’s legal basis for processing your information is HMR’s legitimate interest because HMR is a contract research organisation that does clinical trials of potential new medicines. Whether HMR is a data processor or a co-controller doesn’t change anything for volunteers – being a co-controller gives HMR extra responsibilities, such as reporting data breaches and handling requests from volunteers to access their data.
To contact the data controller, please refer to the information and consent form for the study or the data privacy statement on the sponsor’s website, or talk to your study doctor.
Data that aren’t part of the clinical trial records
If you volunteer to take part in a clinical study, HMR will collect and process some information that doesn’t form part of the clinical study records. For example:
- we’ll collect details of your next of kin – in case of emergency or in case we need to contact you in the future because we have important new information about the study medicine
- we’ll record your bank details – so we can pay you for taking part in the study
- we’ll take your photograph and a copy of an official identification document (such as your passport, national insurance number and NHS number) – so we can check that no-one else uses your name, and make sure you don’t take part in clinical studies too often
- we’ll ask for confirmation that you can work in the UK – because that’s a legal requirement
- if you decide to withdraw from a study, we’ll encourage you to have a follow-up –we do that because it’s in your best interest and, if you don’t want us to share your results with the study sponsor, HMR will keep them confidential
- we’ll write to your GP if we find any results that show something might be wrong
- we may test you for recreational drugs or COVID-19 – we do those tests to make sure it’s safe for you to take part in the study
- we’ll ask you to fill in optional questionnaires about your experience in the study – we use the feedback in the questionnaires to monitor our performance and find ways to improve our service to volunteers
- we’ll make records of when you visited HMR, including CCTV images from cameras around the entrances and perimeter of HMR – we keep CCTV images for up to 10 days, and we have access to CCTV images from the business park for up to 24 days; the images are then deleted unless they’re needed (for example, if there’s a break-in)
We’ll enter your details in our volunteer database and, if you attend a screening visit, we’ll create a medical record containing your health information – we’ll refer to those records each time you volunteer to do a clinical study, and keep them up to date.
We may use your information for supporting functions at HMR, such as staff training, investigating problems, and quality checks (audits) of our processes.
The legal basis for processing all that information is the legitimate interest of HMR. HMR is the data controller, and you can contact our Data Protection Officer as described below.
COVID-19 precautions
To limit the spread of COVID-19, and protect our staff and volunteers, all volunteers who want to take part in a trial must agree to have tests for COVID-19. Our laboratory must, by law, report all the results of COVID-19 tests to Public Health England (PHE), along with some personal details of the people who have been tested, including: name, date of birth, sex, ethnic group and contact details. If you have a COVID-19 test, we’ll collect those details and send them with your test result to PHE. HMR is the data controller and the legal basis for the processing is our legitimate interest; the legal basis for collecting and sharing the information required by PHE is legal obligation.
Some clinical trial protocols require us to do COVID-19 tests and record the results as part of the clinical trial data. Where that is the case, the sponsor is the data controller and the legal basis is the same as for the rest of the clinical trial data. We must still share the results with PHE.
If I take part in a clinical study, how will HMR collect information about me?
In addition to information that you give to us, HMR will process the results of the medical tests and procedures (such as blood tests, blood pressure and x-rays) described in the information and consent form for the study. When you’re screened to see if you’re suitable to take part in a clinical study, we’ll ask your GP, or another doctor responsible for your care, to give us medical information about you, in case there’s any medical reason why you shouldn’t take part. For some research studies sponsored by HMR, that don’t involve a study medicine, we won’t ask your GP for information – we’ll simply tell your GP that you’re taking part.
In some studies, medical professionals outside HMR may need to do specialist tests, such as an x-ray by a hospital department or a scan by a specialist company. HMR will receive the results of those tests. Full details will be in the study consent form.
Will HMR share my personal data with anyone else?
HMR will store your information, including personal and medical details. We may keep the information about you on paper, in files on computers and in a computer database. HMR will keep that information confidential, but we’ll inform your GP if our tests show that something might be wrong. Also, as noted above, if you have a COVID-19 test at HMR, we’ll share your personal details and test result with Public Health England. We won’t send any other information outside HMR unless that’s required by law, but some of the information might be seen by the authorities that control medicines, so that they can check our processes.
However, if you consent to take part in a clinical study, your information will form part of the clinical study records and will be processed in line with the laws and international guidance that control clinical studies. We’ll give you full details before you agree to take part in a study.
If you take part in a clinical study, your personal identifiable information might be seen at HMR by:
- HMR staff
- medical professionals who work on the study or help with your care
- the authorities that control medicines, such as the UK Medicines and Healthcare products Regulatory Agency (MHRA) or the US Food and Drug Administration (FDA)
- representatives of the sponsor (the company paying for the study), who check that the study procedures are being done correctly
As part of a clinical study, we might share your personal identifiable information with other parties (such as a specialist doctor or scanning unit who work on the study). Those parties must keep your information confidential and use it only for the clinical study. However, unless required by law, we won’t send your name, address or any other information that identifies you, to anyone else outside HMR except for medical professionals responsible for your care (such as your GP). When HMR sends your information to anyone else, we’ll replace your name with a code, so they won’t know that it came from you. HMR will keep the key that links your results to you; we won’t share that key with anyone else.
HMR will send your coded study results to the sponsor at the end of the study. The UK considers that the EU has data protection laws that meet the UK’s minimum standard of data protection, so HMR may send your coded study results to sponsors in EU countries. HMR may also send your coded study results to other countries approved by the EU because the EU has checked that those countries also have data protection laws that meet those standards. If the sponsor is not in the EU or a country approved by the EU, we’ll make sure that safeguards are in place, for example by using standard contract terms. We’ll never allow third parties access to your personal information for their own marketing purposes, and we’ll never sell personally identifiable information to third parties.
How will HMR use the personal data it collects about me?
HMR will process (collect, store and use) the information you provide in line with the GDPR. We’ll do our best to keep your information accurate and up to date, and not keep it for longer than is necessary.
How long will HMR keep my personal data?
If you never do a clinical study, we’ll keep your personal information for at least 5 years after you’ve last been in contact with us.
By law, HMR must keep certain types of information (such as information for clinical trials, income tax and audit) for fixed periods of time. If you’ve ever taken part in a clinical study, we can’t delete you from our records because we need to keep clinical study information for at least 15 years, in line with the law and international guidance, and because we might need to contact you if there is any new information about the study medicine.
We’ll use your bank details only to pay you. We must keep your bank details for up to 7 years, but we won’t share them with anyone outside HMR, except our bank, unless we’re required to do so by law.
Under what circumstances will HMR contact me?
We’ll ask your consent to contact you in future by email or telephone to tell you about forthcoming studies. We’ll stop contacting you about clinical studies if you inform us at any time that you no longer wish to be contacted. We aim not to be intrusive, and not to ask irrelevant or unnecessary questions.
Automated decision making
We don’t use automated decision making when we process your personal information.
Cookies
Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]
Google Analytics
We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google. Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.
Can I find out the personal data that HMR holds about me?
HMR, at your request, can confirm what information we hold about you and how it is processed. If you give HMR your personal information but you never take part in a clinical study, you can request the following information under the GDPR.
- The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
- Contact details of the Data Protection Officer.
- The purpose of the processing, and the legal basis for processing.
- If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
- The categories of personal data collected, stored and processed.
- Details of who will see your data.
- Information about how we ensure that data transfers are done securely, if personal data are sent to an international organistaion or an organsiation in a country that is not in the EU or is not approved by the EU or UK for data transfers, ,. The EU and other approved countries meet the UK’s minimum standard of data protection – in other cases, we will ensure that there are specific measures in place to secure your information.
- How long the data will be stored.
- Details of your rights to correct or erase your data or to restrict or object to the processing.
- Information about your right to withdraw consent at any time.
- How to make a complaint to the supervisory authority.
- Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
- The source of personal data if it wasn’t collected directly from you.
- Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
What rights do I have over my personal data if I take part in a clinical study?
If you take part in a clinical study, information we hold about you will form part of the clinical study records, and will be processed as described in the information and consent form for the study. Because the information is used for a clinical study that has been approved by a research ethics committee, your rights to access, change, delete or move your information are limited, as follows:
- you can’t make us delete study information and results we’ve already collected, or object to or limit our processing them
- we might not have to make corrections to your study results and information if you ask us to
- you can ask to see your study results and information at any time, but you don’t have an automatic right to have a copy – the data controller (usually the sponsor of the clinical study) will decide if we can give you a copy of your study results; however, the study doctor will share any important medical information with you and other doctors responsible for your care.
The rules are different for information we hold that is not part of clinical study records (such as your entry in our volunteer database). You can ask us for a copy of that information and request corrections. You can object to our processing those records, or ask us to restrict our processing or erase the records. We may not be able to erase all your data – for example, we must, by law, keep records of volunteer payments for 7 years). In addition, for medical reasons, we advise people who have taken part in trials to remain on our database in case any important safety information comes to light in future. If you want us to restrict or stop our processing, or erase your records, it’s likely that you won’t be eligible for future clinical studies.
If your COVID-19 tests are not done as part of a clinical study, you have the same rights over your COVID-19 test data as you have over other information that is not part of clinical study records (see the paragraph above).
What should I do if I want access to my information or I have any concerns or complaints?
Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com. If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).
What forms of ID will I need to provide to access my personal information held by HMR?
We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):
- Passport
- driving licence
- birth certificate
- credit or debit card
- utility bill (from last 3 months)
- bank statement (from last 3 months)
Contact details of the Data Protection Officer / GDPR Owner:
Data Protection Officer
Hammersmith Medicines Research
Cumberland Avenue
Park Royal
London NW10 7EW
Staff volunteers
HMR staff who volunteer for clinical studies should also refer to SOP SV217.
Personal data
All personal data processing in the UK must conform to the UK General Data Protection Regulation (GDPR) and to the UK Data Protection Act 2018. The EU GDPR also applies to the UK as a third country.
The UK GDPR defines personal data as:
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
If you’ve been nominated as next of kin or emergency contact by a staff member, HMR will hold your name and contact details.
If you’ve been nominated as an emergency contact by a volunteer in a clinical trial, HMR will hold your name, contact details and relationship to the volunteer, during the clinical trial.
How we use your information
This privacy notice tells you how we, HMR (Hammersmith Medicines Research Ltd), will collect and use your personal data. We’ll ensure that information is kept confidential in line with the GDPR.
Why does HMR need to collect and store personal data?
We’ll use your information only for the following purposes:
- to contact you in an emergency affecting the staff member or volunteer who nominated you
- if we have important new information about the study medicine taken by the volunteer who nominated you, and we can’t get in touch with the volunteer
We’ll ensure that the information we collect and use is appropriate for this purpose, and doesn’t constitute an invasion of your privacy. We won’t contact you for any other purposes.
What personal information will HMR collect about me?
We’ll store your name, contact details and your relationship with the staff member or volunteer who nominated you, alongside their details.
What is the lawful basis for processing my personal information?
The legal basis for processing your information will be the legitimate interest of HMR, because HMR has a duty of care for its staff and volunteers. HMR is the data controller, and you can contact our Data Protection Officer as described below.
Will HMR share my personal data with anyone else?
HMR will not share your personal data with anyone else, unless that’s required by law.
How will HMR use the personal data it collects about me?
HMR will process (collect, store and use) the information you provide, in line with the GDPR.
How long will HMR keep my personal data?
If you’ve been nominated by a staff member, we’ll keep your information for 7 years after that staff member leaves HMR.
If you’ve been nominated by a volunteer who took part in a clinical trial at HMR, we’ll keep your information until the volunteer has finished the clinical trial.
Automated decision making
We don’t use automated decision making when we process your personal information.
Cookies
Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]
Google Analytics
We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google. Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.
What rights do I have over my personal data?
Under the GDPR, you have the right to access, correct, or delete your information.
Can I find out the personal data that HMR holds about me?
HMR, at your request, can confirm what information we hold about you and how it is processed. Under the GDPR, you can request the following information.
- The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
- Contact details of the Data Protection Officer.
- The purpose of the processing, and the legal basis for processing.
- If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
- The categories of personal data collected, stored and processed.
- Details of who will see your data.
- If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
- How long the data will be stored.
- Details of your rights to correct or erase your data or to restrict or object to the processing.
- Information about your right to withdraw consent at any time.
- How to make a complaint to the supervisory authority.
- Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
- The source of personal data if it wasn’t collected directly from you.
- Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
What should I do if I want to access, correct, or delete my information, or if I have any concerns or complaints?
Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com. If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).
What forms of ID will I need to provide to access my personal information held by HMR?
We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):
- passport
- driving licence
- birth certificate
- credit or debit card
- utility bill (from last 3 months)
- bank statement (from last 3 months)
Contact details of the Data Protection Officer / GDPR Owner:
Data Protection Officer
Hammersmith Medicines Research
Cumberland Avenue
Park Royal
London NW10 7EW