Privacy Policy and Terms of Use

Our registered business address is: 48 Chancery Lane, London, WC2A 1JF

This privacy notice is addressed to any identified or identifiable natural person, all customers, vendors, suppliers, contact persons, and other individuals (“Data Subjects”, “you”) of or in contact with ACT (“ACT”, “us”, “we”). It is meant to help you understand what personal data we collect, why we collect it, and how you can exercise your data protection rights. “Personal Data” in this document is any information relating to an identified or identifiable natural person, by direct or indirect means. This can sometimes be called “personally identifiable information”.

You might have been provided with a privacy notice or contract to you for a specific purpose. If that is the case, the terms of the notice or contract will control your interaction with ACT, to the extent that such notice or contract conflicts with this notice.

We take your data privacy and the protection of your personal data seriously and we are committed to the highest data privacy standards, patient confidentiality and adherence to the Data Protection Act 2018 and UK GDPR. We adopt the six core principles of data protection:

  1. Lawfulness, fairness and transparency– we process personal data lawfully, fairly and in a transparent manner in relation to you, the data subject.
  2. Purpose limitation– we only collect personal data for a specific, explicit and legitimate purpose. We clearly state what this purpose is in this Privacy Notice, and we only collect data for as long as necessary to complete that purpose.
  3. Data minimisation– we ensure that personal data we process is adequate, relevant and limited to what is necessary in relation to the processing purpose.
  4. Accuracy– we take every reasonable step to update or remove data that is inaccurate or incomplete. You have the right to request that we erase or rectify erroneous data that relates to you, and we will complete this task as soon as possible but guarantee to do so within a month.
  5. Storage limitation– we delete personal data when we no longer need it. Whilst the timescales in most cases aren’t set, we outline our retention strategy within this Privacy Notice.
  6. Integrity and confidentiality– we keep personal data safe and protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The Personal Data that We Collect

  1. Website Visitors
  • 1.1 We may collect information from individuals who visit our website, such as IP address and geographic location. We also may collect Personal Data from individuals who voluntarily submit enquiries on our website.
  • 1.2 The purpose of collecting and processing this Personal Data is our legitimate business interests.
  • 1.3 For individuals who choose to contact us and provide us with their Personal Data, we will collect and use their Personal Data to respond to them, to provide them with information that they have requested (which may relate to our products or services), or to communicate with them for other purposes which are requested by them in their enquiry. Other purposes may include, from time to time, monitoring our regulatory compliance.
  • 1.4 We may disclose Personal Data within our company and with associates, or contractors when it is necessary for them to have access to complete their assigned responsibilities or provide their contracted services, all of whom agree to treat it in accordance with this Privacy Policy.
  • 1.5. The website contains links to associated websites, if you use these links to travel to an associated site such as the myecare registry, or any other linked site, your data will be processed according to the privacy notice and policies of this website.
  • 1.6. Cookies for this website will be handled in accordance with the cookie policy.
  1. Website Visitors who create an account
  • 2.1 2.1. In addition to the information above for general website visitors, if you choose to create an account we will collect your Name, Email address, Institution and a password. This will be used for the purposes of managing your account only and visible to staff of ACT and third parties for these purposes only.
  • 2.2 Data Display
    The following sections will display personal identifiable data (PID):
    Research > Research opportunities and Research > Translational research: Role, Term, Organisation, Location, and Contact details.
    Clinical Trials and Upcoming Meetings & Opportunities for Junior Colleagues: PID is likely to be displayed to other signed in users of the website
  • 2.3 If you wish to close your account and for your personal data processing to stop you will need to contact the ACT DPO to initiate a Data Subject Access request.

Sharing of Personal Data

Your personal data will only be shared with our own staff, associates, or contractors when it is necessary for them to have access to complete their assigned responsibilities or provide their contracted services. Sharing of your data will be relative to the nature of our engagement with you.

We utilise the services of other organisations who are critical for the provision of our service to you and will be viewed as data processors. Their access is restricted, and they are contractually bound to strict confidentiality and the protection of your personal data.

There may also be legal obligations under which we have to share data as requested by nationally recognised regulators or authorities.

Transferring information outside the UK

Our operations are based in the UK, and your personal information is generally processed within the UK and countries within the European Economic Area (EEA). In some instances, we may transfer your personal information to third countries, for example, where our suppliers or cloud service providers are situated outside the UK and EEA.

If the recipient is situated in a third country that has not received an adequacy decision from the relevant regulator, we will ensure additional safeguards are in place including the use of applicable standard contractual clauses.

Securing and Processing of your Personal Data

We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:

  • only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible;
  • using secure servers to store your information
  • verifying the identity of any individual who requests access to information prior to granting them access to information;
  • using Secure Sockets Layer (SSL) software to encrypt any information you submit to us via any forms on our website and any payment transactions you make on or via our website;
  • only transferring your information via closed system or encrypted data transfers
  • any hard copies of information are stored within a secure environment

We employ physical, electronic, and administrative measures that are designed to protect your Personal Data from loss, misuse and unauthorised access, disclosure, alteration, and destruction.

We undertake regular reviews of our processing activities, their risks and technical and organisational measures in place to ensure that the integrity and confidentiality of your data is protected.

In the unlikely event that we lose your data, or a device on which your data resides, or it is accessed by someone unauthorised, and we identify a risk to your rights and freedoms, we will report this to the Information Commissioner’s Office (ICO) , who are responsible for regulating data protection legislation in the UK. Where the loss or unauthorised access of your data has potential to cause you harm we will notify you without undue delay.

How to contact us?

For all data protection matters or questions relating to how we manage your data, you can contact our Data Protection Officer:

Data Protection Officer: Clinical DPO.
Phone Number: 0203 411 2848
Email: [email protected]

How to exercise your rights

You can exercise your rights by emailing our Data Protection Officer on [email protected]

If you are unhappy with anything we have done with your data, you have the right to complain to the Information Commissioners Office. To make a complaint to the Information Commissioners Office use the link below or call their hotline on Tel No.: 0303 123 1113.
https://ico.org.uk/concerns/

Rights of access, correction, erasure, and restriction

Your rights in connection with personal information

Under UK data protection law, you have following rights:

Right Explanation
Right to be Informed This means that we must be transparent in how we collect and use your personal data
Right of Access You have the right to access your personal data
Right to Rectification If the information we hold about you is inaccurate or incomplete, you can request that we correct this
Right to Erasure You can request that we delete or remove personal data in certain circumstances
Right to Restrict Processing You have the right to request that we cease processing your data if.

  • you consider it inaccurate or incomplete and/or
  • you object to the reason we're processing your data

We will review the validity of your request and respond to you with our decision
Right to Data Portability Where you have consented to our processing your data or where the processing is necessary for us to deliver a contract you can request a copy of that data be provided to a third party
Right to Object You have the right to object to our processing in certain circumstances and an absolute right to object to direct marketing.
Rights relating to Automated Decision-Making including Profiling We do not use automated decision-making or profiling.