1. What is the purpose of this document?

We are providing you with this Privacy Notice because you are participating in a market research study conducted by Ashfield Healthcare Communications Group Limited (“we”, “our” or “us”) which is a specialist healthcare communications and market research consultancy company. It operates through a network of agencies and has its Registered Office at Ashfield House, Resolution Road, Ashby de la Zouch LE65 1HW, United Kingdom.

We collect information and data on a broad range of topics. The information and data that we gather are used to develop research findings and inform market insight on behalf of our clients. We respect your privacy and are committed to protecting your personal data.

This Privacy Notice gives you information on how we collect and use your personal data when you participate in a market research study, who we might share it with, and how long we usually keep it. It also explains your legal rights and how the law protects you.

We are part of the UDG Healthcare group and this Privacy Notice supplements UDG Healthcare plc’s Privacy Policy (https://www.udghealthcare.com/privacy-policy/) and is not intended to override it.

Please read the following information carefully to understand our practices regarding your personal data. By providing your personal data to us by any means, you are accepting the practices described in this Privacy Notice. If you do not understand or do not agree with any of the terms described in this Privacy Notice, please contact us before providing any personal data.

2. What personal data do we collect?

Personal data means any information about an individual from which that person can be identified, directly or indirectly. It does not include data where any identifying information has been removed (anonymous data).

 

We may collect, use, store and (where appropriate) transfer any personal data that you provide to us, as described in this Privacy Notice. The types of personal data that we collect during market research studies may vary according to the objective of the study, and whether or not the market research is conducted directly by us or in conjunction with a third party fieldwork partner, but may include:

  • Name, work and/or home address, and contact details such as telephone number and email address, and contact preferences
  • Demographic data such as gender, sex, age (or age range), employment status, relationship to patient (e.g. caregiver), country, region/state, and (for certain groups of respondents) professional details such as job title, medical specialty, areas of expertise, and experience in role
  • ‘Special category’ (or ‘sensitive’) demographic data such as ethnicity or sexual orientation, if this is relevant to the objective of the market research
  • Health information such as diseases or disorders, diagnoses, disability, medical history, symptoms, treatments, and disease- and treatment-related experiences (this is regarded as ‘special category’ or ‘sensitive’ personal data)
  • Your responses to our research questions, including your views and opinions, which may include personal data (and ‘special category’ data)
  • Technical data such as browser type and IP address if surveys are completed electronically
  • Your ‘Pseudonym’, which is an identification number assigned to you when you click on a survey link in a survey invitation that we have sent to you
  • Bank account details.

In order to invite potential participants to take part in research activities, we may also collect contact information that is freely available online. (For example, we may collect contact details of persons in particular job roles within certain types of organisations, so that we can invite them to take part in primary research activities.) When taking part in research, participants are made aware of the purpose of the research. Participants also have the right to refuse to answer any questions, or take part at all, at any time during the research and without needing to provide a reason. There are no statutory or contractual requirements to provide your personal data.

3. How do we collect your personal data?

We collect your personal information from the following sources:

  • You, the participant
  • Publicly available sources such as hospital websites, professional society websites
  • Our client who is sponsoring the research.

For market research projects that we are conducting, we will let you know where we obtained your information from when we contact you. We will provide you with full information regarding the purpose of the research, what is required from you, and describe how the data will be used, before we ask for your consent to participate. In these cases, we will hold all personal data and responses related to the study.

Some of our market research projects involve working with a delivery partner, such as a provider of fieldwork services. If we use such a delivery partner, they may handle participant identification and recruitment, collection and collation of responses and study data, and reimbursement of respondents on our behalf. In these cases, our delivery partners may contact you to invite you to participate in the study, and provide you with information regarding the study, before they ask for your consent to participate. Our delivery partners will hold your name, contact details, and any other identifying information, but this is not shared with us. We will only hold the anonymised responses to the market research questions.

Some of our studies are a collaboration between us and our delivery partners. Where we conduct the study in collaboration with a delivery partner, either party may conduct the identification, recruitment, data collection, data analysis, and respondent reimbursement. Both we and our delivery partner will only hold the personal information relevant to the specific role that each plays in the market research.

Each delivery partner organisation that we use is required to abide by our terms & conditions and privacy policies, and the relevant market research codes of conduct when carrying out work with us or on our behalf.

Your personal data may be collected in various formats, including online surveys, apps or other digital tools, email surveys, paper-based surveys, recorded telephone interviews, or recorded (video or audio) face-to-face interviews which most frequently take place at your place of work or home, in our offices or in a market research facility.

Your participation in market research studies is voluntary and our lawful basis for processing your personal data is based upon your consent. You can withdraw your consent at any time by telling the person who contacted you in relation to the study, or by contacting us at the address shown at the end of this document and referencing the study in which you are participating.

If our market research studies include children, we will ensure we have age-verification measures in place before obtaining consent (and parental consent measures for younger children).


4. If you fail to provide personal data

If you fail to provide certain personal data that we believe is necessary to participate in the market research, we may not be able to include you in the study or to evaluate your responses and include them as part of our final report. If you fail to provide your bank account details, we may not be able to pay you for your participation in the study.


5.
How do we use your personal data?

Our market research is conducted primarily on behalf of our clients within the pharmaceutical, biopharma, medical devices, healthy beauty, animal health, consumer health or other healthcare areas, and occasionally we conduct market research to support our own business insights.

We use the data that we collect for market research purposes only, and do not use it for any other purpose without your consent. More specifically, we use your personal data in the following ways.

  • We (or our agents or partners) hold your name and contact details to request your participation in our market research studies and to communicate with you about the market research study. On the occasions where we hold your name and contact details, they will be deleted at the end of the research project, unless explicit consent has been obtained for us to retain them.
  • We use your demographic information to ensure you meet the market research enrolment criteria or to determine if there are differences in responses from different types of respondents.
  • We analyse and evaluate your responses to our market research questions in order to fulfil our market research purposes, such as to understand needs, preferences, opinions or experience regarding a product, service, disease, treatment or healthcare area, or to better understand future opportunities in a market, or to monitor market performance.
  • Technical data may be used to help improve user experience.
  • We use your bank account details to pay you, if there is any payment for your time involved in participating in the market research.

 

We consolidate your survey responses with those of other participants and report the results to our clients in a form that does not personally identify you. In some cases we may report the data on an individual respondent level, but we use a pseudonym instead of your name so that you cannot be identified by our client, unless you have given your consent otherwise. In the small number of cases where we obtain your consent to share data in a form that allows you to be identified, we will ensure that the data will be used only for the purposes stated.


6. How we use your ‘special category’ (or sensitive) personal data?

Some ‘special category’ data, such as ethnicity or sexual orientation, if collected, is used to segment the respondent data where such analysis is relevant to the objective of the study. The information would only be included in the study report in an aggregated, anonymised format.

We use any health information that you provide to us (or our agents/partners) in a consolidated, anonymised format to include in our research report (as described above), unless you have explicitly consented to us sharing this information with our clients is a form that allows you to be identified.

We also use your health information for pharmacovigilance (drug safety) reporting. Our pharmaceutical clients who sponsor the market research are required by law to report to the healthcare regulatory authorities the details of any adverse events, technical problems, or complaints related to any of their products, should these be mentioned by respondents during market research activities. We are therefore required to pass any such information on to our client to comply with these legal obligations. The client may require your name and contact details so that they can follow up with you regarding further details for any reportable events. If we observe any reportable events in your market research responses, we will contact you to request your explicit consent to share your name and contact details with our client for this purpose. You are not obliged to provide consent, though we are still legally required to report the adverse events, technical problems or product complaints anonymously.


7. How do we share your personal data?

Personal data held by us is only accessible to members of our team who are involved in market research activities and, on an as-needs basis, to our IT and support services.

We may use third-party service providers, contractors or partners to support our market research activities, such as hosting online surveys, providing audio, video or other technical support, or data analysis services. The personal data shared with such third parties is limited to the extent necessary to fulfil the contracted services. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We take appropriate steps to ensure that third parties respect the security of your personal data and to treat it in accordance with the law.

Only where you have given us specific consent to do so, we may share personal data that may identify you with our client (the market research sponsor) for drug safety reporting purposes so that they may follow up with you, where necessary. With your consent, we may also share certain potentially identifiable formats of market research (such as video or audio recordings) with the sponsoring client or so that they can better understand respondent views and opinions.

As early as possible in a market research study, we use pseudonyms or anonymise your personal data where possible, so that it can no longer be associated with you. Where this is not possible (such as in video or audio recordings), we are ethically obliged to not attempt to identify you, unless we have conducted the recordings ourselves and therefore your identity is already known to us. This obligation is also enforced on the sponsoring client if you have consented to the video/audio recording being shared with them.

In any circumstance where we request your consent to share information from which you can or may be personally identifiable, we will inform you who the information will be shared with, the purposes for which they will use it, and how this may affect you (e.g. whether our client may want to contact you), so that you can make an informed choice of whether to consent.

We may also disclose your personal information in order to comply with any legal obligation; or in order to enforce any contracts between us and other parties; or to protect the rights, property, or safety of UDG Healthcare, our customers, or others. In the event that we sell any of our business assets, we may disclose your personal data to the prospective purchaser.


8. How do we transfer your data?

The personal data that we collect from you may be transferred to, and stored (whether in hard copy or electronically) outside the European Economic Area (“EEA”). It may also be processed by our employees or suppliers operating outside the EEA. We ensure that your personal data is subject to appropriate safeguards as defined by European data protection laws. By submitting your personal data, you agree to this transfer, storing or processing.


9. What security measures do we have in place to protect your personal data?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed, and we require similar technical and organisational safeguards from any agents, partners or third-party suppliers that we use to conduct or support market research on our behalf. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.


10.
For how long do we retain your personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements of our own or of the client who sponsored the market research. Your data will be anonymised as early as possible in the market research study.


11. What are your legal rights in relation to your personal data?

Under certain circumstances, by law you have the right to:

  • Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data that we hold about you and to check that we are processing it lawfully.
  • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
  • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
  • Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this basis.
  • Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal data to another party.
  • Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

 

If you wish to exercise any of the rights set out above, please contact our Data Protection Officer in writing at the address given below.


12. Data Protection Officer and contact details

Our Data Protection Officer (DPO) is responsible for overseeing compliance with this Privacy Notice.

If you have any questions about this Privacy Notice or how we handle your personal data, including any requests to exercise your legal rights, please contact the DPO using the details set out below. You have the right to make a complaint at any time to the supervisory authority for data protection issues in the country in which you reside, but we would welcome the opportunity to resolve any complaint with you directly, so please contact us in the first instance.

Name or title of DPO: Group Data Protection Officer

Email address: data.protection@udghealthcare.com

Postal address: 20 River Walk, Citywest Business Campus, Dublin 24, D24 NR23, Ireland

Telephone number: +353 (1) 468 9000.

You can view the UDG Healthcare plc Privacy Policy here:

https://www.udghealthcare.com/privacy-policy/