Privacy

  • Privacy notice for sponsors and suppliers
    close

    Personal data

    All personal data processing in the UK must conform to the European Union (EU) General Data Protection Regulation (GDPR). The GDPR defines personal data as:

    “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

    HMR (Hammersmith Medicines Research Ltd) may use personal information about you that is provided by you, your organisation or another organisation with which your organisation is working, or is available publicly or from third parties, such as GlobalData.  We’ll hold information about you, such as your name, address, contact details, company name and position, and CV.

    How we use your information

    This privacy notice tells you how we will collect and use your personal data. We’ll ensure your information is kept confidential in line with the GDPR. If you make an enquiry about clinical trials, we might use your information to inform you about our capabilities, expertise, facilities and services, and manage any work you place with us. If you’re a service provider, contractor or supplier, we’ll use it to make enquiries and manage orders.  We’ll ensure that the information we collect and use is appropriate for those purposes, and does not constitute an invasion of your privacy.

    What is the lawful basis for processing my personal information?

    If you contact us, whether in person, by phone, in writing or through our website, the legal basis for processing your information will be HMR’s legitimate interest, because HMR is a company that does clinical trials and needs to be able to:

    • promote its services to potentially interested parties
    • respond to customers and execute contracts
    • identify suppliers

    If you go on to engage HMR’s services, or HMR engages yours, the lawful basis for processing your personal information will be contractual.

    You can contact our Data Protection Officer as described below.

    Will HMR share my personal data with anyone else?

    We may keep the information about you on paper and in a computer database.  HMR will keep that information confidential, and restrict access to it.  We may share that information with third parties working on behalf of HMR to deliver services relating to your enquiry. Those parties must keep your information confidential and use it only in relation to your enquiry.  We’ll never allow third parties access to your personal information for their own marketing purposes.  We’ll never sell personally identifiable information to third parties.

    How will HMR use the personal data it collects about me?

    HMR will process (collect, store and use) the information you provide in line with the GDPR.  We’ll use your information only:

    • to process enquiries and execute work placed with or by HMR
    • where otherwise necessary for our legitimate interests (such as analysis of any feedback you have about HMR)
    • to comply with the law

    We’ll do our best to keep your information accurate and up to date.

    We will not keep your personal information for longer than is necessary. By law, HMR must keep certain types of information (such as information for clinical trials, income tax and audit) for fixed periods of time.  In particular, we must keep information collected as part of a clinical trial for at least 15 years.

    We may, from time to time, contact you to ask about your current and future clinical trials requirements, or to let you about any developments at HMR.  If HMR has enquired about your services, we may contact you to let you know about any developments at HMR or potential opportunities.  We’ll stop contacting you if you inform us at any time that you no longer wish to be contacted.  We aim not to be intrusive.

    Automated decision making

    We don’t use automated decision making when we process your personal information.

    Cookies

    Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]

    Google Analytics

    We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google.  Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.

    Can I find out the personal data that HMR holds about me?

    HMR, at your request, can confirm what information we hold about you and how it is processed. Under the GDPR, you can request the following information.

    • The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
    • Contact details of the Data Protection Officer.
    • The purpose of the processing, and the legal basis for processing.
    • If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
    • The categories of personal data collected, stored and processed.
    • Details of who will see your data.
    • If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
    • How long the data will be stored.
    • Details of your rights to correct or erase your data or to restrict or object to the processing.
    • Information about your right to withdraw consent at any time.
    • How to make a complaint to the supervisory authority.
    • Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
    • The source of personal data if it wasn’t collected directly from you.
    • Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

    What forms of ID will I need to provide to access my personal information held by HMR?

    We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):

    • Passport
    • driving licence
    • birth certificate
    • credit or debit card
    • utility bill (from last 3 months)
    • bank statement (from last 3 months)

    What should I do if I have any concerns or complaints?

    Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com.  If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).

    Contact details of the Data Protection Officer / GDPR Owner:

    Data Protection Officer
    Hammersmith Medicines Research
    Cumberland Avenue
    Park Royal
    London NW10 7EW

    privacy@hmrlondon.com

    close
  • Privacy notice for job applicants
    close

    Personal data

    All personal data processing in the UK must conform to the European Union (EU) General Data Protection Regulation (GDPR). The GDPR defines personal data as:

    “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

    HMR (Hammersmith Medicines Research Ltd) may use personal information about you that is provided by you, any employment agency used by you, or your referees.  We’ll hold information about you, such as your name, address, contact details and CV.

    How we use your information

    This privacy notice tells you how we will collect and use your personal data. We’ll ensure your information is kept confidential in line with the GDPR. We’ll use it to assess your suitability for current job vacancies and to demonstrate and assess our compliance with legal requirements for recruitment of staff.  We’ll ensure that the information we collect and use is appropriate for those purposes, and does not constitute an invasion of your privacy.

    What is the lawful basis for processing my personal information?

    If you contact us, whether in person, by phone, in writing or through our website, the legal basis for processing your information will be HMR’s legitimate interest, because HMR is a company that does clinical trials and needs to be able to identify potential new employees.

    If your application is not successful, or we have no suitable vacancies, we might, with your permission, keep your application on file, in case any suitable vacancy arises.  The lawful basis would be your consent. 

    You can contact our Data Protection Officer as described below.

    Will HMR share my personal data with anyone else?

    We may keep the information about you on paper and on computers.  HMR will keep that information confidential, and restrict access to it.  Unless required by law, we won’t share your information with anyone except any employment agency that you have used or your referees.  Those parties must keep your information confidential and use it only in relation to your application.  

    We’ll never allow third parties access to your personal information for their own marketing purposes.  We’ll never sell personally identifiable information to third parties.

    How will HMR use the personal data it collects about me?

    HMR will process (collect, store and use) your information in line with the GDPR.  We’ll use your information only for the following purposes:

    • to assess your suitability for current job vacancies
    • to demonstrate and assess our compliance with legal requirements for recruitment of staff

    If we offer you a job, we’ll ask you for some medical information, to help us assess your suitability for the role, and we’ll record your sex and ethnic origin, so we can monitor equal opportunities.  For some roles, we must also do checks of criminal convictions, for legal reasons and because we have a duty of care to our trial participants.  However, we will ask your consent before doing so.

    We’ll do our best to keep your information accurate and up to date during the application process.

    If your application is unsuccessful, and you agree that we can keep your information on file, we may contact you if a suitable vacancy arises.  We’ll stop contacting you if you inform us at any time that you no longer wish to be contacted.  We aim not to be intrusive.

    We will not keep your personal information for longer than is necessary.  If your application is successful, we’ll keep your information in line with our company policies and procedures, which will be available for you to review.  If your application is unsuccessful, we’ll keep your information for up to 6 months, in case we need to respond to a claim of discrimination.  If you agree that we can keep your information on file, we’ll keep it for up to 12 months.

    Automated decision making

    We don’t use automated decision making when we process your personal information.

    Cookies

    Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]

    Google Analytics

    We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google.  Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.

    Can I find out the personal data that HMR holds about me?

    HMR, at your request, can confirm what information we hold about you and how it is processed.  Under the GDPR, you can request the following information.

    • The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
    • Contact details of the Data Protection Officer.
    • The purpose of the processing, and the legal basis for processing.
    • If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
    • The categories of personal data collected, stored and processed.
    • Details of who will see your data.
    • If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
    • How long the data will be stored.
    • Details of your rights to correct or erase your data or to restrict or object to the processing.
    • Information about your right to withdraw consent at any time.
    • How to make a complaint to the supervisory authority.
    • Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
    • The source of personal data if it wasn’t collected directly from you.
    • Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

    What forms of ID will I need to provide to access my personal information held by HMR?

    We must make sure that we don’t give your personal information to anyone else.  So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):

    • Passport
    • driving licence
    • birth certificate
    • credit or debit card
    • utility bill (from last 3 months)
    • bank statement (from last 3 months)

    What should I do if I have any concerns or complaints?

    Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com.  If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).

    Contact details of the Data Protection Officer / GDPR Owner:

    Data Protection Officer
    Hammersmith Medicines Research
    Cumberland Avenue
    Park Royal
    London NW10 7EW

    privacy@hmrlondon.com

    close
  • Privacy notice for next of kin/emergency contacts
    close

    Personal data

    All personal data processing in the UK must conform to the European Union (EU) General Data Protection Regulation (GDPR). The GDPR defines personal data as:

    “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

    If you’ve been nominated as next of kin or emergency contact by a staff member or a volunteer in a clinical trial, HMR will hold your name and contact details.

    How we use your information

    This privacy notice tells you how we, HMR (Hammersmith Medicines Research Ltd), will collect and use your personal data. We’ll ensure that information is kept confidential in line with the GDPR.

    Why does HMR need to collect and store personal data?

    We’ll use your information only for the following purposes:

    • to contact you in an emergency affecting the staff member or volunteer who nominated you
    • if we have important new information about the study medicine taken by the volunteer who nominated you, and we can’t get in touch with the volunteer

    We’ll ensure that the information we collect and use is appropriate for this purpose, and doesn’t constitute an invasion of your privacy. We won’t contact you for any other purposes.

    What personal information will HMR collect about me?

    We’ll store your name, contact details and your relationship with the staff member or volunteer who nominated you, alongside their details.

    What is the lawful basis for processing my personal information?

    The legal basis for processing your information will be the legitimate interest of HMR, because HMR has a duty of care for its staff and volunteers.  HMR is the data controller, and you can contact our Data Protection Officer as described below.

    Will HMR share my personal data with anyone else?

    HMR will not share your personal data with anyone else, unless that’s required by law. 

    How will HMR use the personal data it collects about me?

    HMR will process (collect, store and use) the information you provide, in line with the GDPR.

    How long will HMR keep my personal data?

    If you’ve been nominated by a staff member, we’ll keep your information for 7 years after that staff member leaves HMR. 

    If you’ve been nominated by a volunteer who took part in a clinical trial at HMR, we’ll keep your information indefinitely, in case there’s new, important information about the study medicine – if we can’t get in touch with the volunteer, we may try to contact them through you.  If you’ve been nominated by a volunteer who was screened to take part in a clinical trial, but never went on to take part in the trial, we’ll keep your details only until the end of the trial.

    Automated decision making

    We don’t use automated decision making when we process your personal information.

    Cookies

    Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]

    Google Analytics

    We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google.  Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.

    What rights do I have over my personal data?

    Under the GDPR, you have the right to access, correct, or delete your information.

    Can I find out the personal data that HMR holds about me?

    HMR, at your request, can confirm what information we hold about you and how it is processed. Under the GDPR, you can request the following information.

    • The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
    • Contact details of the Data Protection Officer.
    • The purpose of the processing, and the legal basis for processing.
    • If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
    • The categories of personal data collected, stored and processed.
    • Details of who will see your data.
    • If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
    • How long the data will be stored.
    • Details of your rights to correct or erase your data or to restrict or object to the processing.
    • Information about your right to withdraw consent at any time.
    • How to make a complaint to the supervisory authority.
    • Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
    • The source of personal data if it wasn’t collected directly from you.
    • Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

    What should I do if I want to access, correct, or delete my information, or if I have any concerns or complaints?

    Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com.  If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).

    What forms of ID will I need to provide to access my personal information held by HMR?

    We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):

    • passport
    • driving licence
    • birth certificate
    • credit or debit card
    • utility bill (from last 3 months)
    • bank statement (from last 3 months)

    Contact details of the Data Protection Officer / GDPR Owner:

    Data Protection Officer

    Hammersmith Medicines Research

    Cumberland Avenue

    Park Royal

    London NW10 7EW

    privacy@hmrlondon.com

    close
  • Privacy statement for volunteers
    close

    Personal data

    All personal data processing in the UK must conform to the European Union (EU) General Data Protection Regulation (GDPR) and to the UK Data Protection Act 2018. The GDPR defines personal data as:

    any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

    Personal information held by HMR might include your name, address, date of birth and photograph.

    How we use your information

    This privacy notice tells you how we, HMR (Hammersmith Medicines Research Ltd), will collect and use your personal data. We’ll ensure that information is kept confidential in line with the GDPR. We’ll use your information to contact you in the future about clinical studies. If you take part in a clinical study, we’ll keep your records for as long as required by law and international guidelines for clinical studies.

    Why does HMR need to collect and store personal data?

    The information that you submit to HMR will be held by us for the purpose of checking your suitability for future clinical studies, and contacting you to tell you about those clinical studies. We’ll ensure that the information we collect and use is appropriate for this purpose, and doesn’t constitute an invasion of your privacy. We won’t contact you for any other marketing purposes, without first obtaining your consent.

    You’re under no obligation to give your personal information to HMR.  But, if you want to take part in clinical studies at HMR, we’ll need your personal details, including medical information about you.

    If you take part in a clinical study, HMR will use your personal information to meet the aims of the clinical study. What information will you collect from me?

    To register you to take part in clinical studies, we’ll collect basic identifiers (your name, sex and date of birth), your contact details, your nationality and ethnic origin, and limited information about your health and lifestyle (such as whether you smoke, your alcohol consumption, your height and weight, and whether you have certain medical conditions such as asthma or obesity).  We’ll also ask you to confirm that you’re eligible to work in the UK.

    If you go on to take part in a study, we’ll collect detailed information about your health and lifestyle, including your medical history and information about your sex life, sexual orientation and use of recreational drugs.  We’ll also take copies of your official identity documents (such as your passport or driving licence and, if applicable, evidence of your National Insurance number).  During a clinical study, we’ll record the results of many medical tests (such as blood pressure and medical examinations) and record the results in the study records.  We’ll also collect information that doesn’t form part of the clinical trial records – please see the section below: What is the lawful basis for processing my personal information?.

    What is the lawful basis for processing my personal information?

    If you complete an enquiry form and/or any of our assessments, but don’t take part in a clinical study, the legal basis for processing your information will be the legitimate interest of HMR, because HMR is a company that does clinical studies and needs to be able to identify suitable study participants from a group of people who are interested in taking part in clinical studies. HMR is the data controller, and you can contact our Data Protection Officer as described below.

    The legal basis for processing the data from projects sponsored by HMR to collect blood or urine samples to help develop tests in our laboratory is HMR’s legitimate interest, because HMR needs to set up and check new tests to use in clinical trials.  HMR is the data controller, and you can contact our Data Protection Officer as described below.

    If you take part in a clinical study, the sponsor (the company or organisation paying for the clinical study) will be the data controller for the clinical study data.  The sponsor may use one of the following legal bases for processing your information:

    • the legitimate interest of the sponsor—  because the sponsor needs the information to develop new medicines or do other health-related scientific research 
    • your consent — please note that, if you withdraw your consent during the clinical study, the sponsor will use legitimate interest as the legal basis for keeping and processing the data we’ve already collected about you

    For most of our studies, HMR is a data processor.  But some sponsors might appoint HMR to be a co-controller of the clinical study data.  In those cases, HMR’s legal basis for processing your information is HMR’s legitimate interest because HMR is a contract research organisation that does clinical trials of potential new medicines.  Whether HMR is a data processor or a co-controller doesn’t change anything for volunteers – being a co-controller gives HMR extra responsibilities, such as reporting data breaches and handling requests from volunteers to access their data.

    To contact the data controller, please refer to the information and consent form for the study or the data privacy statement on the sponsor’s website, or talk to your study doctor.

    Data that aren’t part of the clinical trial records

    If you volunteer to take part in a clinical study, HMR will collect and process some information that doesn’t form part of the clinical study records. For example:

    • we’ll collect details of your next of kin – in case of emergency or in case we need to contact you in the future because we have important new information about the study medicine
    • we’ll record your bank details – so we can pay you for taking part in the study
    • we’ll take your photograph and a copy of an official identification document (such as your passport, national insurance number and NHS number) – so we can check that no-one else uses your name, and make sure you don’t take part in clinical studies too often
    • we’ll ask for confirmation that you can work in the UK – because that’s a legal requirement
    • if you decide to withdraw from a study, we’ll encourage you to have a follow-up –we do that because it’s in your best interest and, if you don’t want us to share your results with the study sponsor, HMR will keep them confidential
    • we’ll write to your GP if we find any results that show something might be wrong
    • we may test you for recreational drugs or COVID-19 – we do those tests to make sure it’s safe for you to take part in the study
    • we’ll ask you to fill in optional questionnaires about your experience in the study – we use the feedback in the questionnaires to monitor our performance and find ways to improve our service to volunteers
    • we’ll make records of when you visited HMR, including CCTV images from cameras around the entrances and perimeter of HMR – we keep CCTV images for up to 10 days, and we have access to CCTV images from the business park for up to 24 days; the images are then deleted unless they’re needed (for example, if there’s a break-in)

    We’ll enter your details in our volunteer database and, if you attend a screening visit, we’ll create a medical record containing your health information – we’ll refer to those records each time you volunteer to do a clinical study, and keep them up to date.

    We may use your information for supporting functions at HMR, such as staff training, investigating problems, and quality checks (audits) of our processes.

    The legal basis for processing all that information is the legitimate interest of HMR.  HMR is the data controller, and you can contact our Data Protection Officer as described below.

    COVID-19 precautions

    To limit the spread of COVID-19, and protect our staff and volunteers, all volunteers who want to take part in a trial must agree to have tests for COVID-19.  Our laboratory must, by law, report all the results of COVID-19 tests to Public Health England (PHE), along with some personal details of the people who have been tested, including:  name, date of birth, sex, ethnic group and contact details.  If you have a COVID-19 test, we’ll collect those details and send them with your test result to PHE.  HMR is the data controller and the legal basis for the processing is our legitimate interest; the legal basis for collecting and sharing the information required by PHE is legal obligation.

    If I take part in a clinical study, how will HMR collect information about me?

    In addition to information that you give to us, HMR will process the results of the medical tests and procedures (such as blood tests, blood pressure and x-rays) described in the information and consent form for the study.  When you’re screened to see if you’re suitable to take part in a clinical study, we’ll ask your GP, or another doctor responsible for your care, to give us medical information about you, in case there’s any medical reason why you shouldn’t take part.  For some research studies sponsored by HMR, that don’t involve a study medicine, we won’t ask your GP for information – we’ll simply tell your GP that you’re taking part.

    In some studies, medical professionals outside HMR may need to do specialist tests, such as an x-ray by a hospital department or a scan by a specialist company.  HMR will receive the results of those tests.  Full details will be in the study consent form.

    Will HMR share my personal data with anyone else?

    HMR will store your information, including personal and medical details. We may keep the information about you on paper, in files on computers and in a computer database. HMR will keep that information confidential, but we’ll inform your GP if our tests show that something might be wrong.  Also, as noted above, if you have a COVID-19 test at HMR, we’ll share your personal details and test result with Public Health England.  We won’t send any other information outside HMR unless that’s required by law, but some of the information might be seen by the authorities that control medicines, so that they can check our processes.

    However, if you consent to take part in a clinical study, your information will form part of the clinical study records and will be processed in line with the laws and international guidance that control clinical studies. We’ll give you full details before you agree to take part in a study.

    If you take part in a clinical study, your personal identifiable information might be seen at HMR by:

    • HMR staff
    • medical professionals who work on the study or help with your care
    • the authorities that control medicines, such as the UK Medicines and Healthcare products Regulatory Agency (MHRA) or the US Food and Drug Administration (FDA)
    • representatives of the sponsor (the company paying for the study), who check that the study procedures are being done correctly

    As part of a clinical study, we might share your personal identifiable information with other parties (such as a specialist doctor or scanning unit who work on the study). Those parties must keep your information confidential and use it only for the clinical study. However, unless required by law, we won’t send your name, address or any other information that identifies you, to anyone else outside HMR except for medical professionals responsible for your care (such as your GP). When HMR sends your information to anyone else, we’ll replace your name with a code, so they won’t know that it came from you. HMR will keep the key that links your results to you; we won’t share that key with anyone else.

    HMR will send your coded study results to the sponsor at the end of the study.  If the sponsor is not in Europe, we’ll make sure that safeguards are in place, for example by using standard contract terms. We’ll never allow third parties access to your personal information for their own marketing purposes, and we’ll never sell personally identifiable information to third parties.

    How will HMR use the personal data it collects about me?

    HMR will process (collect, store and use) the information you provide in line with the GDPR. We’ll do our best to keep your information accurate and up to date, and not keep it for longer than is necessary.

    How long will HMR keep my personal data?

    If you never do a clinical study, we’ll keep your personal information for at least 5 years after you’ve last been in contact with us. 

    By law, HMR must keep certain types of information (such as information for clinical trials, income tax and audit) for fixed periods of time. If you’ve ever taken part in a clinical study, we can’t delete you from our records because we need to keep clinical study information for at least 15 years, in line with the law and international guidance, and because we might need to contact you if there is any new information about the study medicine.

    We’ll use your bank details only to pay you.  We must keep your bank details for up to 7 years, but we won’t share them with anyone outside HMR, except our bank, unless we’re required to do so by law.

    Under what circumstances will HMR contact me?

    We’ll ask your consent to contact you in future by email or telephone to tell you about forthcoming studies. We’ll stop contacting you about clinical studies if you inform us at any time that you no longer wish to be contacted. We aim not to be intrusive, and not to ask irrelevant or unnecessary questions.

    Automated decision making

    We don’t use automated decision making when we process your personal information.

    Cookies

    Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]

    Google Analytics

    We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google.  Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.

    Can I find out the personal data that HMR holds about me?

    HMR, at your request, can confirm what information we hold about you and how it is processed. If you give HMR your personal information but you never take part in a clinical study, you can request the following information under the GDPR.

    • The name and the contact details of the person or organisation that has decided how and why to process your data. In some cases, this will be a representative in the EU.
    • Contact details of the Data Protection Officer.
    • The purpose of the processing, and the legal basis for processing.
    • If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
    • The categories of personal data collected, stored and processed.
    • Details of who will see your data.
    • If we intend to send the personal data to a country outside the EU or international organisation, information about how we ensure that this is done securely. The EU has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure that there are specific measures in place to secure your information.
    • How long the data will be stored.
    • Details of your rights to correct or erase your data or to restrict or object to the processing.
    • Information about your right to withdraw consent at any time.
    • How to make a complaint to the supervisory authority.
    • Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
    • The source of personal data if it wasn’t collected directly from you.
    • Any details and information about automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

    What rights do I have over my personal data if I take part in a clinical study?

    If you take part in a clinical study, information we hold about you will form part of the clinical study records, and will be processed as described in the information and consent form for the study. Because the information is used for a clinical study that has been approved by a research ethics committee, your rights to access, change, delete or move your information are limited, as follows:

    you can’t make us delete study information and results we’ve already collected, or object to or limit our processing them
    we might not have to make corrections to your study results and information if you ask us to
    you can ask to see your study results and information at any time, but you don’t have an automatic right to have a copy – the data controller (usually the sponsor of the clinical study) will decide if we can give you a copy of your study results; however, the study doctor will share any important medical information with you and other doctors responsible for your care.

    The rules are different for information we hold that is not part of clinical study records (such as your entry in our volunteer database).  You can ask us for a copy of that information and request corrections.  You can object to our processing those records, or ask us to restrict our processing or erase the records.  We may not be able to erase all your data – for example, we must, by law, keep records of volunteer payments for 7 years).  In addition, for medical reasons, we advise people who have taken part in trials to remain on our database in case any important safety information comes to light in future.  If you want us to restrict or stop our processing, or erase your records, it’s likely that you won’t be eligible for future clinical studies.

    What forms of ID will I need to provide to access my personal information held by HMR?

    We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):

    • Passport
    • driving licence
    • birth certificate
    • credit or debit card
    • utility bill (from last 3 months)
    • bank statement (from last 3 months)

    What should I do if I have any concerns or complaints?

    Please write to the HMR Data Protection Officer, at the address given above or email privacy@hmrlondon.com.  If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).

    Contact details of the Data Protection Officer / GDPR Owner:

    Data Protection Officer

    Hammersmith Medicines Research

    Cumberland Avenue

    Park Royal

    London NW10 7EW

    privacy@hmrlondon.com

     

    Staff volunteers

    HMR staff who volunteer for clinical studies should also refer to SOP SV217.

    close
  • Privacy statement for COVID-19 testing, for visitors and patients at external clinics
    close

    Personal data

    All personal data processing in the UK must conform to the European Union (EU) General Data Protection Regulation (GDPR) and to the UK Data Protection Act 2018.  The GDPR defines personal data as:

    any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

    How we use your information

    This privacy notice tells you how we, HMR (Hammersmith Medicines Research Ltd), will collect and use your personal data for COVID-19 testing. We’ll ensure that information is kept confidential in line with the GDPR.  We’ll use your information to provide a COVID-19 testing service and to meet our legal obligation to report to Public Health England. 

    Why does HMR need to collect and store personal data?

    The information that you submit to HMR will be held by us for the purpose of doing COVID-19 tests, and providing the results to:  you, either directly or via your clinic; and Public Health England. We won’t use the data you provide for COVID-19 testing for any other purpose, including marketing.  We’ll ensure that the information we collect and use is appropriate for this purpose, and doesn’t constitute an invasion of your privacy.

    If you don’t provide the required personal details to HMR, we can’t process your COVID-19 test.

    What information will HMR collect from me?

    We’ll collect basic identifiers (including your name, sex, date of birth, ethnic origin and contact details).  We’ll get the information from you (if you’re a visitor) or from your clinic (if you’ve requested a test via an external clinic).

    What is the lawful basis for processing my personal information?

    If you’re a visitor to HMR, the legal basis for processing your information will be the legitimate interest of HMR, because HMR needs to take precautions to limit the spread of COVID-19, to protect all our staff and volunteers.  HMR is the data controller, and you can contact our Data Protection Officer as described below.

    If you have requested a COVID-19 test through an external clinic, the clinic is the data controller and the legal basis is usually contract, consent or their legitimate interest – you can ask the clinic for further information.

    Will HMR share my personal data with anyone else?

    HMR will store your information, including personal details and the results of your tests.  HMR will keep that information confidential, but we must, by law, share your personal details and test result with Public Health England.  If you requested a test via an external clinic, we’ll send your test result to the clinic, and they will give it to you.  We’ll never allow third parties access to your personal information for their own marketing purposes or for any purpose other than that described in the section ‘Why does HMR need to collect and store personal data?’.  We’ll never sell personally identifiable information to third parties.

    How will HMR use the personal data it collects about me?

    HMR will process (collect, store and use) the information you provide in line with the GDPR. We’ll do our best to keep your information accurate and up to date, and not keep it for longer than is necessary.

    Automated decision making

    We don’t use automated decision making when we process your personal information.

    Cookies

    Cookies are small files sent from websites (or through a service from a third party such as Google via Google Analytics) and stored in your internet browser. They allow a website’s systems to recognise your internet browser and remember certain information. However, we cannot collect your personal information (name, date of birth, contact details etc) from cookies on our website. Also, you can reject receiving cookies from websites through the settings on your internet browser. If you’d like to reject cookies from Google Analytics, please refer to the link below. [Google Analytics Opt-out Browser Add-on]https://tools.google.com/dlpage/gaoptout/eula.html

    Google Analytics

    We use Google Analytics to analyse visits to our website and help us improve it. Google may set up cookies or read current cookies on your internet browser to collect data. We may use the information to track our website visitors and to improve their experience. Google use this information to evaluate your use of our website, and to prepare reports on website activity. Google will not link your computer’s IP address with any other data held by Google.  Further information about Google’s privacy policy may be found at http://www.google.com/privacy.html.

    Can I find out the personal data that HMR holds about me?

    HMR, at your request, can confirm what information we hold about you and how it is processed. You can request the following information under the GDPR.

    • The name and the contact details of the person or organisation that has decided how and why to process your data.
    • Contact details of the Data Protection Officer of HMR.
    • The purpose of the processing, and the legal basis for processing.
    • If the processing is based on the legitimate interests of HMR or a third party, information about those interests.
    • The categories of personal data collected, stored and processed.
    • Details of who will see your data.
    • Confirmation that we do not intend to send the personal data to a country outside the EU
    • How long the data will be stored.
    • Details of your rights to correct or erase your data or to restrict or object to the processing.
    • How to make a complaint to the supervisory authority.
    • Whether your providing your personal data is a statutory or contractual requirement, or is necessary to enter into a contract, whether you‘re obliged to provide the personal data, and the possible consequences of not providing such data.
    • The source of personal data if it wasn’t collected directly from you.
    • Confirmation that we do not use automated decision making, such as profiling.

    Under the GDPR, you can ask us for a copy of your data and request corrections.  You can object to our processing those records, or ask us to restrict our processing or erase the records.  However, if we’ve processed your COVID-19 swab, you can’t object to our sharing your personal data and result with Public Health England, because that is a legal requirement.  At your request, HMR can correct your personal data (such as your postal address or phone number), but we can’t modify the result of the COVID-19 test.

    What forms of ID will I need to provide to access my personal information held by HMR?

    We must make sure that we don’t give your personal information to anyone else. So, if you want to access your personal information, you should provide two of the following forms of ID as evidence of your identity (at least one must have your photo and signature):

    • Passport
    • driving licence
    • birth certificate
    • credit or debit card
    • utility bill (from last 3 months)
    • bank statement (from last 3 months)

    What should I do if I have any concerns or complaints?

    Please write to the HMR Data Protection Officer, at the address given below or email privacy@hmrlondon.com.  If you’re not happy with our response, or you think we’re using your information unlawfully, you can call the Information Commissioner’s Office (ICO) helpline (0303 123 1113) or use the website (www.ico.org.uk/).

    Contact details of the Data Protection Officer / GDPR Owner:

    Data Protection Officer

    Hammersmith Medicines Research

    Cumberland Avenue

    Park Royal

    London NW10 7EW

    privacy@hmrlondon.com

    close
  • back to top
National Training Awards Cyber Essentials Digital XRaid A proud member of UK BioIndustry Association one nucleus
certificate