FluCamp
Apply
Apply Now Apply Now
0207 756 1414 0207 756 1414

Privacy Notice for Volunteers

hVIVO Services Limited (“hVIVO“) is committed to protecting and respecting your privacy.

In this privacy notice, the terms “we“, “our“, and “us” are used to refer to hVIVO We are registered in England and Wales under company number 02326557 and have our registered office at 40 Bank Street, Floor 24, London, E14 5NR.

hVIVO is a data controller under the UK General Data Protection Regulation (“UK GDPR“).

This Privacy Notice sets out how we handle your personal data in accordance with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any replacement, and the guidance and codes of practice issued by the data protection regulator, the Information Commissioner’s Office (‘ICO‘) (“data protection law”).

This Privacy Notice also explains how we comply with data protection law where we collect and use the following kinds of your more sensitive personal data – called “special category data“:

  • racial or ethnic origin;
  • political opinions;
  • religious or philosophical belief;
  • trade union membership;
  • genetic data;
  • biometric data;
  • sex life and sexual orientation;
  • health (mental and physical)

Please read the following very carefully to understand our views and practices regarding your personal data, how we will treat it and the rights which you have in relation to your personal data.

This privacy notice covers all types of study that hVIVO conducts, which includes:

  • Studies sponsored either by hVIVO or by pharmaceutical/biotech companies to test new vaccines or medical treatments. These studies are governed by the Medicines for Human Use (Clinical Trial) Regulations 2004.
  • Studies sponsored by hVIVO to assess the general suitability of volunteers for participation in future studies.
  • Studies sponsored either by hVIVO or by pharmaceutical/biotech companies to conduct research that does not involve a new vaccine or medical treatment.

Our legal basis for collecting and using your personal information (as described later in this notice) will depend on the type of study you are involved in.

The personal data we collect and use

Information collected by us

We will continue to use the information which you will have previously provided to us at the application stage for the clinical trial. Please refer to the FluCamp Website Privacy Policy at https://flucamp.com/privacy/. This information includes your contact details and answers to screening questions about your health and lifestyle including such special category data as:

height, weight, BMI, family medical history, smoking, alcohol and recreational drug habits, allergies, reproductive status, contraceptive use, blood donation, clinical research study participation.

Once you progress to the Screening, Quarantine/Challenge and final follow-up stages of the clinical study, we may additionally process the following personal data as set out in the Participant Information Sheet ,which you have been provided with, which relates to the study you are participating in:.

  • details about your previous and present medical history and any medicines and treatments you are or have been recently taking;
  • national insurance number;
  • bank details;
  • data obtained from screening tests as set out in the Participant Information Sheet which may reveal if you have Hepatitis A, B or C or the Human Immunodeficiency Virus (“HIV”);
  • data obtained from tissue samples taken from you and measurements in relation to the state of your health, including any abnormalities which we might find as a result of our procedures, as set out at sections 6-9 of the Participant Information Sheet;
  • digital photographs or video footage of you alone or in a group;

Information collected from other sources

We also obtain personal information from other sources as follows:

Your General Practitioner (“GP“)/doctor will be asked to provide relevant information from your medical history and to confirm that you may participate in the clinical trial.

How we use your personal information

We use your personal data:

  • to manage the process in relation to your recruitment for one of our clinical trials;
  • to determine your suitability for the clinical trial for which you have applied and, where relevant, for any future clinical trials for which you may be suitable;
  • for inclusion and analysis for our clinical research purposes as explained to you in the Participant Information Sheet;
  • to notify you and your GP where our screening tests suggest that you may have a health condition or abnormality (of which you may be currently unaware);
  • to provide you with the appropriate medical care during the Quarantine phase of the trial;
  • to respond to your queries or requests;
  • to provide you with information about other clinical research studies (including those of our partners) which may be of interest to you and for which you may be suitable in terms of your participation;
  • to provide you with information about our research and our products;
  • to provide you with the compensation payment which may be due to you as a result of your participation in one of our clinical trials;
  • for our marketing and promotional purposes; where you have provided your consent for this;
  • for our monitoring purposes (see ‘Legitimate Interests’ below)
  • to aggregate and anonymise your personal data so that we can conduct research and analysis to better understand the types of individuals who may be interested in participating in clinical research studies;
  • to produce aggregated data analytics, statistical research and reports which may be used to review and change our services;
  • to measure, understand or monitor the effectiveness of advertising, promotions, marketing material and content and any joint iniatives with our affiliates, suppliers, partners, subcontractors, and other selected third parties.

Our legal basis for collecting and using your personal information

Data protection law requires us to meet certain conditions before we are allowed to use your data in the manner described in this privacy policy.  We take our responsibilities under data protection laws extremely seriously, including meeting these conditions.  To use your personal data, we will rely on the following conditions, depending on the type of study you are involved in and activities we are carrying out in relation to your personal data:

Consent:  We are legally required to obtain your informed consent, under clinical trials regulations, to participate in any of our clinical trials. However, the rules which apply to the processing of your personal data in connection with those clinical trials, once you have given your informed consent to participate, are based upon separate and quite different legislation (data protection law). This means that we will sometimes ask you to provide your consent for the collection and/or further use of your personal data, whilst on other occasions a different legal basis may be more legally appropriate depending on the purposes for which your personal data are to be used by us.

When you applied to take part in one of our clinical trials, we asked you to provide your explicit consent for the use of your personal data for this purpose. We provided you with our website Privacy Policy (https://flucamp.com/privacy/) prior to you providing your consent for your use of your personal data at the application stage so that you were fully informed as to how your personal data would be used between the initial application stage and the screening stage.

Following the application and screening stages, where you are accepted on to one of our clinical trials, the personal data which we have collected from you during those application and screening stages and any further personal data collected from you from this point onwards may be processed on different legal bases (under data protection law) and not your consent where it is necessary for the purposes of the clinical research project (see ‘Legitimate Interests’ and ‘ Collection and use of your special category data’).

Photography and video recording: we ask you to provide your consent for us to use your digital images and/or video images in our FluCamp promotional and marketing materials. Please note that you may still participate if you do not agree to this and where you provide your consent you may withdraw it at any time.

Necessary for the performance of a contract

Where you provide us with your personal data, such as bank details so that we can pay you the compensation due to you following your participation in one of our clinical trials, the ‘contractual necessity’ ground will form the legal basis for our use of this kind of personal data.

Compliance with legal obligations: As an entity established under the laws of England and Wales, hVIVO is obliged to comply with UK laws and guidance provided by UK regulatory bodies, including, but not limited to, the Medicines for Human Use (Clinical Trial) Regulations 2004 and any replacement UK legislation.

Where we are legally required to retain or handle your personal data in a specific manner, including disclosing your personal data to a third party, such as a regulatory body, in line with a mandatory legal provision within the terms of the above legislation or other UK laws, our legal basis under data protection law will fall within this category. You will not be able to object to the processing or ask for the deletion of your personal data when it is processed upon this legal basis.

Vital interests: this legal basis will apply where we need to protect your vital interests or that of another person in limited circumstances e.g. where we need to share your personal data with a third party such as a hospital in an emergency situation. You will not be able to object to the processing or ask for the deletion of your personal data when it is processed upon this legal basis.

Legitimate interests: To use your personal data for any other purpose described in this privacy policy, we may rely on a condition known as “legitimate interests”. This legal basis requires us to carry out a balancing test of our interests in using your personal data (for example, to aggregate and anonymise your personal data so that we can conduct research and analysis to better understand the types of individuals who may be interested in participating in clinical research studies) against the interests you have as a citizen and the rights you have under data protection laws. The outcome of this balancing test will determine whether we can use your personal data in the ways described in this privacy policy. We will always act reasonably and give full and proper consideration to your interests in carrying out this balancing test. The legitimate interests condition in the UK GDPR is likely to form the legal basis for our use of your personal data for our research purposes, in conjunction with the Research ground – see below (Collection and use of your special category data).

We also rely upon this legal basis for processing your personal data (e.g. your image) in the Closed Circuit Television (“CCTV”) recording which we carry out in public areas of the Quarantine Unit. Please note that this footage is only seen by hVIVO staff and their clients, and occasionally by people inspecting our facilities and/or research processes. The CCTV footage does not include sound and is not stored electronically or on tapes. You will not be named in any images. The purpose of this processing is to monitor your well-being and to minimise the risk of cross-contamination and protect the integrity of the results of the clinical trial. Where we process your personal data upon this legal basis, you may have certain rights to object to this kind of use of your personal data – see Your Rights.

Collection and use of your special category data

Where we use this kind of personal data about you, we must identify an additional legal basis for this use. These include grounds set out at Article 9(2) of the UK GDPR:

  • the processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (paragraph c) e.g. where we need to share your personal data with a third party such as a hospital in an emergency situation;
  • the processing is necessary for the establishment, exercise of defence of legal claims (paragraph f);
  • the processing is necessary for medical purposes: where we need to use your personal data in order to provide you with the relevant health care or treatment during the clinical trial (paragraph h);
  • the processing is necessary for reasons of public interest in the area of public health (paragraph (i)) e.g. in certain circumstances we may be legally required to notify a public body where we detect certain types of disease;
  • the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (paragraph (j)) (the ‘research‘ ground). Where personal data is processed upon this ground, your right to subject access and to make objections and rectifications in relation to the data are more limited where access to these rights would prevent or seriously impair the clinical study results. In this case, the results from the research would not be made available in any form which identifies you.

The central purpose for the collection and further processing of your personal data, including special categories of data will be for use within our clinical research so that we (and our Sponsor if that is not hVIVO) can better understand the human biological response to viral infections in order to inform our drug research to treat these illnesses, something which is, in turn, of ultimate benefit to society as a whole and in the public interest.

In accordance with the UK GDPR we carry out such processing with appropriate safeguards in place, in order to protect your privacy rights and demonstrate our compliance with the UK GDPR principles. For further guidance on how we apply appropriate technical and organisational measures to safeguard your personal data and protect your privacy rights see ‘Keeping your information secure’ below.

Who we share your personal information with

We may share your personal data with any member of our Group, which means its subsidiaries, and its ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006 (our “Group“) and with the Sponsor of the clinical study (if that is not hVIVO) where there is a legal basis for doing so under data protection law and to meet stated legitimate business purposes.

We will only share your personal data with other members of the Group or any partners with whom we work for marketing purposes where you have expressly consented to the disclosure of your personal data for these purposes and where you are aware of the identity of such third parties.

We will only share your personal data with the following where there is a business need to do so and where there is also a clear legal basis under data protection law:

  • business partners, suppliers and sub-contractors for the performance of any contract we enter into with them (please contact our Data Protection Officer at the email address provided below if you require further information about these recipients in the context of the clinical trial in which you are participating).
  • third party suppliers and service providers to the extent they assist the Group with its legal / regulatory obligations;

hVIVO may share your personal and medical information (i.e. your personal data and special categories of data) with partners or those working with partners for research purposes as described above. We will only share such data on a ‘need to know’ basis and access to databases and folders containing personal data is restricted to appropriate staff.

hVIVO, the Sponsor of the clinical study (if that is not hVIVO), Sponsor representatives, independent auditors, regulatory authorities and the Research Ethics Committee (REC) may need to check your medical and study records., Your information and samples may also be used in other research relating to the study drug (where there is one), the virus used in the study, or the disease being investigated in the study but this will always be in line with the law.

Sometimes we may be required by law enforcement, clinical trials regulators or judicial authorities to disclose certain personal data as part of compliance audits, to protect the public and our own staff from harm, to comply with investigations or for litigation purposes.

We may also need to disclose personal data to third parties:

  • in the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets;
  • if we, or substantially all of its assets, are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets;
  • in the unlikely event of any insolvency situation (e.g. the administration or liquidation) of hVIVO PLC or any of its Group;

We will not share your personal information with any other third party, unless there is a clear legal basis for to do so.

How long your personal information will be kept

hVIVO will keep your information (including your results and data) in paper records and in computer databases for the period of time required by the regulations which govern the study. You will not be identified personally in any publication or presentation about the study.

You should not take part in too many clinical trials, or in several clinical trials at the same time. Research units like hVIVO keep a linked database of clinical trial subjects in which your National Insurance number, or passport number and country of origin, and the dates you were given a study virus and/or a study drug (if you have taken part in a drug trial) are recorded. Your details are kept for at least 2 years. We will check the database before you join a study, and if necessary, we may be able to trace you through it.

Storage and use of samples and information from this study

hVIVO (and/or the Sponsor of the study, where that is not hVIVO) will own all the samples and related data collected from you during the study, and the rights comprised in or related to such samples or data. hVIVO (and/or the Sponsor of the study, where that is not hVIVO) may send your samples for testing in laboratories where they will be stored securely until the end of the study, or until they are unusable or finished. Your samples and information will be labelled, but we will not use your name or information that could identify you.

Leftover samples and use of your study information for future use

At the end of the study, some of your leftover samples and data from this study could be useful for other health research and laboratory testing at hVIVO (and/or the Sponsor of the study, where that is not hVIVO).The leftover samples and their related information will be stored properly (according to the local laws) and may be used for ethically approved research (even after your incapacity or death). You would not be told the results of such research. You may opt out of the retention of such samples and data at any point but please be aware that where you do so we will not be able to erase any data which has already been included within research trials.

You can still take part in the study if you do not want your leftover samples and information to be stored for future research.

Transfer of your information out of the UK or the European Economic Area (“EEA”)

hVIVO (and/or the Sponsor of the study, where that is not hVIVO) may send some of your samples to research laboratories in other parts of the EEA, to the United States of America (USA), and possibly to other recipients outside of the EEA for research. Any movement and storage of samples will be in accordance with the Human Tissue Act 2004 and other relevant laws in the countries they are sent to.

hVIVO shares personal data with partners that have facilities in other countries, including countries outside of the EEA. Some use of this information may take place in countries with lower data protection standards than the UK. hVIVO’s partners will ensure that information transferred outside your country of residence is treated in accordance with the content of this Privacy Notice and the Informed Consent Form. Where your personal data is transferred to a country outside of the EEA, hVIVO will adopt the appropriate safeguards in compliance with the UK GDPR in order to protect your privacy rights. Where a partner with whom we may need to share personal data has not received an adequacy decision, we protect this data with approved contractual mechanisms in accordance data protection law.

Your rights

Under the UK GDPR you have a number of important rights free of charge. In summary, those include rights to:

NUMBER DESCRIPTION OF RIGHT
 Right 1  A right to access personal data held by us about you.
Right 2  A right to require us to rectify any inaccurate personal data held by us about you.
Right 3  A right to require us to erase personal data held by us about you.  This right will only apply where (for example): we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below).
Right 4  A right to restrict our processing of personal data held by us about you.  This right will only apply where (for example): you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but you require the data for the purposes of dealing with legal claims.
Right 5  A right to receive personal data, which you have provided to us, in a structured, commonly used and machine readable format. This right will only apply where the processing is based on consent or a contract (see above) and the processing is carried out by automated means.  You also have the right to require us to transfer this personal data to another organisation, at your request.
Right 6  A right to object to our processing of personal data held by us about you (including for the purposes of sending marketing materials to you).
 Right 7 A right to withdraw your consent, where we are relying on it to use your personal data, for example, where you have asked to receive marketing information about our services or products). 

Please note that some of the above rights (particularly in relation to subject access) may not be available to you, to the extent that you seek personal data about you which has been incorporated into, and where it forms part of, study results and data (this kind of data would be unlikely to identify you in any event as we remove identifying features from personal data wherever this is possible).

Please ask the study staff if you have any questions about the way your information is collected and used.

If you have any concerns regarding our processing of your personal data, or if you have any questions, comments and requests, including in relation to your rights, please email, call or write to our Data Protection Officer in the first instance at [email protected] and please provide us with proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill).

You also have the right to make a complaint to the Information Commissioner’s Office.  Their address is:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Keeping your personal information secure

We recognise that you will be providing special category data to us relating to your health and medical conditions. Whilst all personal data which we process is processed in a secure and confidential manner, we are especially careful when handling this kind of personal data.

Your personal data is only shared with staff within our organisation and with any partners who work closely with us on a ‘need to know’ basis for our legitimate business purposes and access to databases and folders containing personal data is restricted to appropriate staff. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We have implemented organisational and technical security measures to safeguard and protect against unauthorised access to, use or accidental loss of your personal data, including but not limited to:

  • Our physical facilities are security manned and monitored, access to hVIVO’s premises is security controlled, only those personnel who have a legitimate need have access to the locations where personal information is stored.
  • We have embedded pseudonymisation and anonymisation practices into our processes, which means that where possible any personal information is removed from data before it is processed or shared.
  • Effective security architecture. This is fundamental to our IT activities, we continue to adapt and evolve our operational security infrastructure and approach ensuring our activities continue to protect data.  Our security infrastructure includes encryption techniques, active security monitoring and intervention systems and services.
  • Our email and file sharing systems use encryption technology to protect data and prevent unauthorised access to personal information.

You will not be identified personally in any publication or presentation about the study

Our suppliers are also required to agree to data protection measures to protect your personal data which includes the requirement for them to commit to only process individuals’ personal data consistent with contractual purposes and with appropriate technical and organisational security safeguards.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Changes to this privacy notice

This privacy notice was published in May 2018 and last updated in October 2022

We may change this privacy notice from time to time. If we make changes whilst you are participating in a study we will inform you of these at the time.