These guidelines define the principles, responsibilities, mechanisms and time periods for the University’s management and retention of personal information held by the NIHR Innovation Observatory for use in day to day business communications and information held for subscribers to the NIHR Innovation Observatory Website.
Welcome to the Newcastle University’s privacy notice for those working with NIHR Innovation Observatory and users of the NIHR Innovation Observatory (NIHRIO) website. NIHRIO is a national medical horizon scanning facility located at Newcastle University. This privacy notice will inform you as to how we look after your personal data when you contact us or we contact you or when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.
2. Purpose of this Privacy Notice
This privacy notice aims to give you information on how the NIHR Innovation Observatory as part of Newcastle University collects and processes your personal data during day to day business interactions and when using the NIHR Innovation Observatory website. Information on the website is not intended for children and we do not knowingly collect data relating to children. It is important that you read this privacy notice so that you are fully aware of how and why we are using your data.
3. Data Controller and Data Protection Officer
The University of Newcastle upon Tyne, trading as Newcastle University is the controller and responsible for your personal data (referred to as Newcastle University, the University, “we”, “us” or “our” in this privacy notice). We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below. The contact details of the University’s DPO and the relevant supervisory authority are available at:
4. What Information is Collected and the Purpose of Processing
During day to day business interactions, the NIHR Innovation Observatory collects and processes information provided by you. These include details of your job (position, organisation details, email and telephone number). The NIHR Innovation Observatory is using legitimate interests as a legal basis for processing the personal data details outlined above. Those legitimate interests are:
4.1 Processing Data for the National Institute for Health and Care Excellence (NICE) Technology Appraisal Process or the Highly Specialised Technology Evaluation
If we are contacting you about new technologies for consideration for the National Institute for Health and Care Excellence (NICE) Technology Appraisal process or the Highly Specialised Technology evaluation, then this will be to enable two-way business communications to obtain important information about technologies being developed by your company. This is to enable us to produce documentation to send to the NICE as a first step in the Technology Appraisal process or the Highly Specialised Technology evaluation process. As part of this process we may pass on your company contact details to NICE to allow someone to contact you to discuss moving to the next stage of processing.
4.2 Using the NIHRIO Website
If using the NIHRIO website, we collect and process personal data about you to send email alerts about new reports published by NIHRIO on the website and to advertise events or news updates of interest. If you have completed the form ‘Let us know about your new technology’, you have provided the type, name and brief description of your new technology. You have also provided your name, name of company, telephone and email. This information is provided to allow someone from NIHRIO to contact you to discuss this further. All information is provided in confidence and treated as commercially sensitive information.
4.3 Other Correspondence
If we contact you or you contact us for other reasons such as general queries or other types of work you would like us to do, we believe the impact on you is minimal as this would be a business based relationship of mutual benefit to both parties.
5. Data Held
General data held when carrying out day to day business interactions is varied but is most often your contact details provided by you. The record we hold on the website is created by you from data you enter when subscribing for alerts about new content on our website, when joining our mailing list or informing us about a new technology. The data for alerts and the mailing list consists of your email (either your personal email or work email as entered by you), your first name and your surname. The data when informing us about a new technology also includes some basic, summary information about the technology.
6. Data Retention
The NIHRIO record (and any subsequent updates to the information fields held in that record) is retained indefinitely unless you contact us to request your data to be removed. You have the right to request that the University deletes this personal data at any time.
7. Data Location
Our email and documents processed through Newcastle University are held on password protected computers with servers located in the United States of America under EU-US Privacy Shield safeguards. During 2018 the University plans to move such processing to the EEA. The data held on the NIHRIO website is processed on servers managed by the website developers, Indigo Multimedia Limited. The server is provided by a company called Linode and is located in London, UK.
8. Data Sharing
Your data in the form of your company email, job title and telephone number could be shared with NICE as a third party only when essential as part of the NICE review and appraisal process. Additionally, groups in the devolved administrations such as the All Wales medicines Strategy Group, the Scottish Medicines Consortium and the Northern Ireland Department of Health, Social Services and Public Safety use information we have produced through horizon scanning about new technologies. They may ask us to pass on contact information if they want to discuss new products with you. You will be given the option to tell us if you do not want your contact details passed on to a third party. For other interactions, the University will not share personal data with third parties unless the third party is acting as an agent for the University on the instruction of the University (e.g. third party mailing house to send printed materials; external venues such as hotels to assist in event administration).
9. Your Rights
You have the right of access to your data; to update, amend and rectify your data; change your communication preferences, including opting out of receiving any marketing materials. You have both the right of erasure and the right to object to the University processing any Additional Information; given its legal obligation, you do not have the right of erasure nor the right to object to the University processing the NIHRIO Record. Please contact firstname.lastname@example.org to exercise any of these rights.