Last updated: 25 May 2023

Purpose of this privacy notice

This privacy notice provides you with information about how Health Data Research UK collects and processes your personal data in order to assess your application for the HDR Big Data for Complex Disease PhD Programme (the “PhD Programme“). The purpose of this document is to make you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for.

HDR UK are managing the recruitment process for the PhD Programme and successful applicants will be employed by the relevant University Partner and subject to their policies and process. The relevant University Partners are University of Cambridge, University of Oxford, University of Bristol, University of Swansea and University College London.  Any personal data processed once a candidate receives an offer letter will be controller by the Relevant University Partner.

HDR UK uses an external platform, Applied, to manage the application process. For more information on how Applied uses and collects your data please see their privacy notice.

We will comply with data protection law and principles, which means that your data will be:

  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
  • Relevant to the purposes we have told you about and limited only to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we have told you about.
  • Kept securely.

Controller and contact details

Health Data Research UK (“HDR UK”) is a limited company registered in England and Wales under company number 10887014, with its registered office at 215 Euston Road, London, England, NW1 2BE. HDR UK is the controller and responsible for your personal data (“we”, “us” or “our” in this privacy notice).

If you have any questions about this privacy notice, including any requests to exercise your legal rights as set out in this privacy notice, please contact the data privacy manager using the following details:

  • Email: dataprotection@hdruk.ac.uk
  • Postal address: Data Protection Lead, Health Data Research UK, Gibbs Building, 215 Euston Road, London, NW1 2BE

The personal data we process about you

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

  • personal identification and communication information: including your name, email address, phone number, current home address and immigration status;
  • application-related information; including responses to application questions, fee status, studentship preferences and reference contact information and references; and
  • academic and employment experience: including previous qualifications and skills, curriculum vitae and employment history.

We will use the personal information we collect about you to assess your skills, qualifications, and suitability for the role and arrange for interview for candidates who make it to that stage of the process.

When completing your application on Applied you have the option to answer some questions on your gender, age, ethnicity, sexuality, disability, socio-economic background to help with equal opportunity monitoring. These questions are completely optional and HDR UK will not receive the raw data and only see statistics about whole groups, not individuals.

Automated decision-making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Data sharing

How we share your personal data

In the course of recruiting for the PhD Programme the personal data you provide to use will be shared with the relevant University Partners. Your personal data may be shared with the following organisations:

  • Funders of your studentship on the PhD Programme;
  • Organisations in the wider HDR UK Community may assist with assessing and reviewing application forms if required.
  • other partner organisations for the PhD Programme, including those that may provide tutorials or other contributions to the PhD Programme.

We may share your personal data with external third-party system providers who provide services including IT, online training, system administration and cloud-based software services.  We will not share your personal data with other third parties unless you give your permission for us to do so, and we will not share your information with any other organisations for their own marketing, market research or commercial purposes. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We may share your personal information with regulators or other authorities if we have a legal obligation to do so. If HDR UK is transferred or integrated with another business, your details will be disclosed to our advisers and the other party’s advisors.

How long we retain your personal data

We follow retention procedures for storing data in line with data protection legislation and principles. In particular, we will retain your personal data for the purposes set out above whilst you are a student on the PhD Programme and, once your studentship is finished, for an appropriate period so as to be able to deal with any legal claims linked to your participation in the PhD Programme and for any periods we are required to keep your personal data under applicable law. After this period, we will take steps to delete your personal data or hold it in a form that no longer identifies you.

If you would like further detail about the retention of your personal data, please contact us using the details set out in the ‘Controller and contact details’ section above.

Your choices and rights

You have the right to ask HDR UK for a copy of your personal data; to correct, delete or restrict processing of your personal data; and to obtain the personal data you provide in a structured, machine readable format. In addition, you can object to the processing of your personal data in some circumstances (in particular, where we do not have to process the data to meet a contractual or other legal requirement and in relation to processing for direct marketing purposes). Where we have asked for your consent, you may withdraw consent at any time. If you ask to withdraw your consent to HDR UK processing your data, this will not affect any processing which has already taken place at that time.

These rights may be limited, for example if fulfilling your request would unfairly reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. We will inform you of relevant exemptions we rely upon when responding to any request you make.

If you would like to exercise any of these rights, or to get a copy of our legitimate interest balancing test for any processing activity, you can contact us using the details set out in the ‘Controller and contact details’ section above.  If you have unresolved concerns you also have the right to complain to data protection authorities in the country where you live or work, or where you consider a breach of data protection law has occurred.

Updates to this privacy notice

This privacy notice may be updated periodically. We will update the date at the top of this privacy notice accordingly and encourage you to check for changes to this privacy notice, which will be available on this website. On some occasions, we may also actively advise you of specific data handling activities or significant changes to this privacy notice, as required by applicable law.