Introduction

The collection and analysis of the most confidential information about people is of fundamental importance for conducting medical research. MAC Research understands that in order for individuals to share their most sensitive information with us, we must have a culture of trust and that we will store data following safe data management practices. 

MAC Research Limited (together with its affiliates and subsidiary companies “MAC,” “we,” “us,” and “our”) is committed to ensuring that we handle all individual information in a responsible and careful manner and in accordance with data privacy and confidentiality laws.

This Privacy Policy (“Policy“) outlines our commitment as an organisation to the individuals whose data we manage, the key types of personal data we process and how that information is used. The Policy explains in general terms how we strive to comply with data privacy laws, including the European Union (“EU”) General Data Protection Regulation Article 6(1)(f) and Article 9(2)(j), UK (The Data Protection Act 2018) and any subsequent amendments to this regulation or local law equivalent that is later adopted (“Regulation”) and the privacy and confidentiality requirements of ICH Good Clinical Practice (GCP).

Who Are We?

MAC is a leading European clinical research organisation with a network of clinical research centres.  MAC provides patient engagement and recruitment services and conducts full scope ethically approved clinical research and medical trials for pharmaceutical companies (“Sponsor”), medical device companies and clinical research organisations.  MAC also provides healthcare and consultancy services.

As an employer and clinical research organisation we act as Data Controller over individual personal data and healthcare information.  When conducting clinical trials MAC will be regarded as the Data Controller and the Sponsor will be regarded as a Data Processor and participants should consider our respective roles in processing the personal data.  For example, with regard to coded clinical trial data provided to Sponsor, MAC is the Data Controller and the Sponsor is a Data Processor of the personal data.  Importantly, both act in accordance with the applicable data protection law. Under some particular circumstances, where MAC is involved jointly in determining purpose and/or means of processing data, MAC may be regarded as Joint Controller of Clinical Trials Data. 

MAC has internal policies, procedures and training programs designed to support compliance with the above laws and this Policy.  All our policies, procedures and training programs are reviewed on a regular basis and overseen by our legal team and senior executives.

Types of Personal Information Managed by MAC Research

Clinical and Medical Information

In our capacity as a clinical research organisation providing services for Sponsors, our clinical research sites collect, host and analyse significant quantities of health data and bio-medical samples relating to clinical trial participants.  This is because it is necessary to establish the identity of participants accurately and to ensure they are participating in clinical trials that are appropriate for them. MAC is regarded as the Data Controller and the clinical trial Sponsors are considered to be a Data Processor in the terms established by Regulation. However, under some particular circumstances, where MAC is involved jointly in determining purpose and/or means of processing data, MAC may be regarded as Joint Controller of Clinical Trials Data.  To adhere to good clinical practice and to ensure the privacy of clinical trial participants is maintained, identification numbers (i.e. not names) are applied to specific clinical trial documentation and any samples taken during the course of clinical trials.

Clinical Trial Participant Engagement and Recruitment Information

MAC gathers and manages personal and demographic contact details, date of birth, supporting personal information and data relating to health, medical indications and relevant areas of research from individuals who have expressed their interest in clinical trial participation. We also gain appropriate consents from participants to retain information and access medical records. MAC uses this information to correctly identify participants and access medical health records via a participant’s doctor or NHS Digital. MAC considers all of this information to match prospective participants against relevant future clinical trials and to conduct study recruitment analyses. We do not use automated individual decision-making when processing medical records but do use search tools when matching participants for studies. MAC does this because participant safety is of paramount importance when conducting clinical trials. Therefore, matching participants accurately against the participation eligibility criteria of a clinical trial protocol, forms a vital part of the clinical research process.  This is important because the objective of all clinical trials is to determine the safety and efficacy of the new medication or device under investigation.  The integrity of a clinical trial relies on the accurate delivery of the clinical trial protocol and these stringent measures ensure that new medications once approved by regulatory authorities for use by humans, can ultimately be used to benefit health and social care.

Industry Professional Information

MAC will liaise with employees, consultants, contractors and other third parties employed or engaged by our clients, when conducting our clinical trials and research activities. MAC will record and use the names, contact details and other professional information on these individuals for legitimate business-related purposes, including project and financial administration. This information may be used (including email addresses), to provide background on MAC’s services for our clients.

Employee and Human Resource Data

We collect personal information from applicants pursuing employment with MAC, including private contact details, professional qualifications and previous employment history to assist with the personnel recruitment process. MAC carries out a range of background inspections on applicants, including DBS and professional disbarment checks. Consistent with the operation of a business, MAC systems collect information on employed staff for human resource, performance, payroll and tax purposes. MAC processes similar information relating to consultants, contractors and other third parties that we engage to deliver products or services.

Website Visitors

MAC collects named information about visitors to our company websites when there is a request volunteered from an individual. This includes requests, for example by clients regarding information about company services, or when medical professionals are interested in contributing to a clinical trial or where job applicants are applying for a vacancy. MAC may collect various data via cookie-based technologies, linked to virtual identities allocated to visitors when they access our websites. This information is used for website analytics and for first party marketing. These virtual identities are sometimes connected with real world identities of visitors when they submit named details. This enables MAC to personalise marketing messages to make them relevant to those visitors.

Internal and External Disclosures of Personal Information

Personal information is only shared on a “need to know” basis within MAC and its affiliates and with relevant third parties to deliver stated legitimate business purposes. Any access to personal information contained within databases and binders is carefully restricted and only viewable by appropriate staff for legitimate purposes. MAC does not trade or sell personal information.

Under some circumstances, MAC may be required by law enforcement or judicial authorities to disclose certain personal information as part of investigations or for litigation purposes. MAC may disclose personal information to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganisation, dissolution or other sale or transfer of MAC or cases or all of its assets.

Any companies who work as vendors for MAC are required to sign “processor” and/or confidentiality agreements whereby they commit to only process personal information consistent with contracted purposes and take organisational and technical security safeguards for the data.

Notice of Data Use and Consent

MAC will provide notice to individuals using clear and conspicuous language at the point of data collection, about how their information will be used and disclosed.  We will make clear what choices are available in relation to how individual data is managed and what rights there are under data privacy law or under this Policy and who to contact with any questions or complaints. MAC’s privacy notices are tailored according to specific data collection circumstances.  In providing such notice, MAC meets its obligations to be transparent and fair with individuals as is required by General Data Protection Regulation. Dependent on the medium, notice may be given in person, by email, post, telephone, or by posting on our website.

In accordance with data privacy law and good practice, MAC will seek consent of individuals to collect, use and disclose their data consistent with the relevant privacy notice. In certain cases where law allows, particularly where gaining consent will involve a disproportionate effort, where intended processing of the data is in MAC’s or our clients’ legitimate interests and the privacy risks are low, MAC will proceed to process personal information absent of consent. MAC will also use and disclose personal information without consent where required by law and judicial order. MAC will collect all necessary informed consents of clinical trial participant on behalf of clients, according to good clinical practice, laws on confidentiality and data privacy regulations. MAC’s interests are in conducting ethically approved clinical trials and following good clinical practice to the highest medical and scientific standards.  In order to facilitate the safe delivery of clinical trials and to enable the development of new medications for health and social care, it is of vital importance that MAC has personal and demographic information that will enable participants to be correctly identified. Furthermore, is also critical that additional personal information including medical history, medical conditions and medications are recorded to ensure that participants meet the medical criteria to deliver the clinical trial objectives and most importantly in consideration of participant safety.

Data Quality, Integrity and Retention of Records

Data quality and accuracy is essential in clinical trials and MAC understands the vital importance of this. The accuracy of data relating to clinical trial participants is critical for the integrity clinical research, particularly where bio-medical samples are concerned. MAC employs an in-house quality assurance department to ensure that standards are commensurate with all legal requirements. Our privacy notices provide individuals with a straight-forward way of updating and validating information and enabling error corrections. MAC retains personal information for up to 15 years, in accordance with contractual, legal and regulatory requirements. We will retain your information for as long as necessary for the uses set out in this Policy or while there is a legitimate business reason for doing so.  If you ask us to delete your information before this time, we may not be able to do so for technical, legal, regulatory or contractual constraints. 

Your Rights

In accordance with data privacy laws and contractual commitments, MAC ensures that individuals can exercise all relevant informational rights with respect to their personal information processed by the organisation, including but not limited to the right of access and correction, to withdraw consent at any time, object to data processing, request data deletion, restrict aspects of data processing, prevent direct marketing and request transmission of personal data in a common digital format (e.g. pdf) to the themselves or another organisation.

In all other respects, where no overriding interest prevails, MAC will endeavour to allow the following informational rights under this Policy as a matter of good practice:

• to allow access to copies of personal information within a reasonable timeframe;
• to correct personal information where inaccurate; and
• to withdraw a previously provided consent to processing of personal information.

Participants enrolled in clinical trials run by MAC’s clients must contact the principal investigator at their MAC research centre, who will be able to identify the participant and progress their request accordingly. The contact details for MAC research centres are available at the following web address: https://researchforyou.co.uk/clinical-trial-centre-locations/

Information Security

MAC maintains wide-ranging information security policies to apply technical and organisational security measures.  This is to ensure we protect sensitive and personal information that participants provide to us (particularly sensitive clinical data), against unauthorized access or loss. MAC’s security breach policy provides a procedural response for managing any breach of personal information, including making necessary notifications to individuals or governmental authorities.  MAC stores information on servers within the UK and use commercial measures to ensure that your data is kept safe and treated in accordance with this privacy policy and data protection and privacy laws.

Considerations When Online

The pages on MAC’s websites may contain links to external websites, i.e. outside of the company. These external websites are not controlled or endorsed by MAC. This Policy does not apply to linked websites outside the MAC organisation.  MAC recommends that visitors review the privacy policy of each individually linked website before submitting any personal information.  We do not accept any responsibility or liability for external/other websites’ privacy policies.

Our web pages also use cookies. A cookie is a data file that is placed by a website operator on the hard drive of a visitor to their website. MAC and third parties with whom we work, may place cookies with the following functions on the computers of visitors to MAC websites: to allow the site to deliver the service requested by the visitor; to remember repeat visitors; to improve the user experience of the site; to allow the company to perform site analytics; and to serve and help tailor our marketing messages on our websites and elsewhere on the internet, based on the visitor’s previous browsing activity.

The web browser and cookie settings on your electronic devices can be tailored to manage your online relationship with MAC. At this time, we do not respond to “do not track” signals, however most web browsers will allow users to choose which cookies can be placed on their electronic device and to delete or disable cookies.  Visitors should be aware that disabling cookies may prevent them from using certain features on MAC websites. For more information, please see our Cookie Policy.

Children’s Online Privacy Protection

MAC does not collect information through our websites from individuals who are known to be under the age of 13, and no part of our online presence is directed to anyone less than 13 years.

Inquiries, Complaints and Requests to Exercise Rights

Communications, queries, requests to exercise informational rights (e.g., access to data) or complaints can be addressed for the attention of the Data Protection Officer, MAC Research, Kaman Court, 1 Faraday Way, Blackpool, Lancashire, FY2 0JH, United Kingdom.

Within UK individuals have the right in law to complain about how their information is managed to a supervisory authority that is responsible for regulating compliance with the Regulation. The following URL links to the relevant authority https://ico.org.uk/make-a-complaint/your-personal-information-concerns/

Legal Status of Policy and Policy Changes

This Policy is not a contract, and it does not create any legal rights or obligations. MAC reserves the right to modify or amend this Policy and may do so according to new or amended legislation.  The updated Policy will be posted on https://www.macplc.com/mac-privacy-policy and https://researchforyou.co.uk/privacy-policy/ (Last Updated: 7 October, 2020).