User Research Privacy Notice

Cambridge Design Partnership Limited (CDP) is an end-to-end design, product development and innovation partner, trading since 1996. We provide services, including user, consumer and stakeholder research [RESEARCH] to global organizations across healthcare, consumer and industrial market sectors.

Our contact details are:

Our commitment to your privacy

CDP is a Company Partner of the Market Research Society (MRS) and a Member of the British Healthcare Business Intelligence Association. We undertake RESEARCH in accordance with the MRS Code of Conduct and BHBIA Legal and Ethical Guidelines.  We will collect, store and manage your Personal Data [DATA] in an ethical and secure way.  We will only use your DATA for purposes that we have informed you about.  We will always be transparent about the DATA we collect and how we use it. We will only process your DATA, including collecting it, storing it and sharing it, in accordance with the relevant Data Protection legislation (UK GDPR and EU GDPR).

If you have any questions about this Privacy Notice, you can contact us using the details provided above. 

Where the RESEARCH Sponsor is a Data Controller of your DATA, the RESEARCH Sponsor’s Privacy Notice will also apply. 

Where our RESEARCH recruitment partners are Data Controllers of your DATA, our RESEARCH recruitment partner’s Privacy Notice will also apply. 

What types of personal data do we collect and how do we get It?

Most of the DATA we process is provided to us directly when you participate in RESEARCH or indirectly by our RESEARCH recruitment partners. We may also collect Personal Data from publicly available sources, such as through social media channels.

The DATA that we collect for the purposes of RESEARCH includes, but is not limited to, the following DATA and information about you:

• First name

Demographic data such as your age, gender, educational background; job role; income bracket

Image and/or voice captured through photography, filming, and/or audio recording

• Medical data such as any medical diagnoses and prescription medication you take
• Information you provide relating to your experiences when undertaking activities that are relevant to you
• Information you provide relating to your opinions, attitudes, experiences and use of certain products or services

Occasionally, for example, if we undertake RESEARCH in your home or place of work, DATA we collect may include:

• Full name
• Contact details such as email address; home and/or work postal address, postcode; phone number

Please note you are under no contractual or legal obligation to provide us with your Personal Data, but you may not be able to participate in the RESEARCH if you fail to do so.

How do we use your personal data?

We use your DATA to provide RESEARCH services to our clients (the RESEARCH sponsor(s)) through collection and analysis of RESEARCH information.

We will not use it for any purposes other than those set out in this Privacy Notice. Participating in specific RESEARCH projects run by CDP is completely voluntary.

What legal bases do we use for processing your personal data?

The UK GDPR and EU GDPR requires us to rely on one or more lawful bases to use your DATA. We consider the bases listed below to be relevant:

• Legitimate Interests: Where our use of your DATA is necessary for our legitimate interests in conducting RESEARCH or the legitimate interests of our client in conducting RESEARCH (unless there is a good reason to protect your DATA which overrides our legitimate interests). You have the right to object to processing where the lawful basis is legitimate interests.
• Consent: Where there is not a legitimate interest basis we will only process your DATA where you have given us clear consent for a specific purpose. You have the right to withdraw your consent at any time. 
• Legal Obligation: Where we are legally obligated to process your DATA (e.g., Adverse Event Reporting).
• Vital Interests: Where we must process your DATA in order to protect your vital interests (save your life), or the vital interests of another natural person.

Will we share your personal data?

We may share your DATA with the following groups:

The RESEARCH sponsor(s);

An Independent Review Body (IRB), where appropriate; 

• Adverse Event and Medical Device Regulators as may be appropriate.

We may disclose your DATA to the following categories of trusted Data Processor:

• Selected agencies, such as translators, transcription service providers and online research platforms to who we may ask to process DATA on our behalf;
• RESEARCH Recruitment agencies; and,
• Other Service Providers (e.g., Microsoft).

If we share DATA that may be used to identify you, we will do so in accordance with the relevant Data Protection legislation (UK GDPR and EU GDPR).

In exceptional circumstances, we may share your DATA when we are legally required to do so.

We will not:

• Sell or rent any of your DATA to third parties
• Share your DATA with third parties for marketing purposes

Transfer of your DATA out of the EEA

Your DATA may be transferred outside the United Kingdom or the European Economic Area. If this happens, it will be subject to appropriate safeguards – such as standard data protection clauses – in order to safeguard your Personal Data. Where there is the case, you can request a copy of this documentation by contacting us directly. 

How do we store your personal data?

Your DATA will be stored securely.  We have appropriate security measures in place to prevent data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your DATA to those who have a need to know it. 

We also have procedures in place to deal with any reportable data breach. We will notify you and any applicable regulator of a reportable security breach of your DATA where we are legally required to do so.

How long do we keep your personal data for?

We will hold your DATA on our systems only for as long as necessary to provide RESEARCH services to our clients, or for other essential purposes such as complying with our legal obligations. It will then be deleted. 

You will be informed of your DATA retention period in a specific RESEARCH information sheet.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your DATA. 
• Your right to rectification – You have the right to ask us to rectify DATA you think is inaccurate. You also have the right to ask us to complete data you think is incomplete. 

Your right to erasure – You have the right to ask us to erase your DATA in certain circumstances.  Your right to restriction of processing – You have the right to ask us to restrict the processing of your DATA in certain circumstances. 

• Your right to object to processing – You have the right to object to the processing of your DATA in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the DATA you gave us to another organization, or to you, in certain circumstances.
• Your right to know the source of your DATA – You have a right to know the source of your DATA and whether it came from publicly accessible sources.

You also have the right to lodge a complaint with the relevant supervisory authority. In the UK, this is the Information Commissioner’s Office (https://ico.org.uk/).

Your DATA will not be subject to automated decision-making at any time. 

Please note that many of these rights do not apply when the DATA is being used for RESEARCH purposes, but we will always try to respond to concerns or queries that you may have. Please contact us if you wish to make a request.