Privacy Notice

The NIHR BioResource manages a large panel of participants who can be invited to take part in research related to health, based on the data we hold about them. Studies often require participants to be in a particular age range, or living near a particular hospital, or living with a particular health condition.

In each case, we search the databases for likely candidates, then our team of experts carefully check known preferences and availability before sending out invitations.

Participants always have a right to decline these invitations, and do not need to give a reason why.

Participants are recruited from:

• blood donor centres
• hospital clinics and wards
• GP practices
• community and public events
• schools
• online through our website
  

The BioResource sits between the researchers and the participants to facilitate the research: we do not carry out the research, nor give clinical care.

The studies we support are run by academic researchers, clinicians or industry.

If a study requires that we contact participants for an additional sample or to complete an online survey, separate ethical review is required before we approach participants on behalf of the researchers.

UK National Research Ethics Committees can allow health researchers, including those from universities, the NHS or companies to use clinical information including samples, images or data (with identifiable personal information removed) for health research where this does not require any additional contact with participants.

All such cases of approved research on de-identified samples or data from BioResource participants is listed on our website.

We regularly monitor access to confirm whether data is still required. If your identifiable personal information (the information that identifies you) is to be used in research you will be asked for your consent, and separate review by a Research Ethics Committee will be sought. A list of all approved studies is available online, identifying for each study the lead researcher, the institution for which they work, a title and a plain language summary.

For the re-contact part of the BioResource to work, we need to know who you are.

Personal information can be held in a variety of formats, including electronically in our secure databases, in other computer systems, in video and audio files and in paper format. Access to this information is limited to selected staff only.

Personal information about you is collected in a number of ways. This is mostly directly from you or your representative when consenting to join the NIHR BioResource.

It may also be from your clinical team if you have been recruited to one of the patient cohorts in the BioResource.

We will likely hold the following basic personal information about you:

• your name, including your preferred name or maiden name
• address (including any correspondence with you)
• telephone number(s)
• date of birth
• your GP details
• your email address
• your NHS/CHI number, which can be used to link to your patient records.

In addition to the above, we may hold genetic data derived from your sample/DNA, and may also hold sensitive personal information such as ethnic origin (as declared by you) and information from your healthcare records, which could include:

• any medical conditions and other information such as smoking status
• results of investigations, such as x-rays and laboratory tests
• other personal information such as any learning disabilities
• in some cases your social care and educational information, e.g., level of education
• data from other research registries and studies that may be relevant (but only where you have given them your permission to share that information).

It is important for us to have a complete picture of you as this will assist staff in inviting the correct participants to each study according to the specific inclusion/exclusion criteria.

Any personal information we hold about you is processed in accordance with the Data Protection Act (2018) and the UK General Data Protection Regulation (GDPR), under Articles 6(1)(e) and 9(2)(j), namely that we are processing data for “scientific or historical research purposes” and that this is “necessary for the performance of a task carried out in the public interest.”

The NIHR BioResource protocols are reviewed by an independent NHS Health Research Authority Research Ethics Committee. Our registered studies are recorded as NIHR BioResource 2022 renewal and NIHR BioResource - Rare Diseases.

For further information on Data Protection legislation please visit: Data protection: The UK's data protection legislation - GOV.UK

Our main use of your personal data is to contact you to invite you to participate in studies. However, we may also use your NHS number and other personal details to request additional data from central records from the NHS and other agencies. This is why we ask for your consent to link data from your medical and health-related records, which may include social care and education records.

In rare occasions, when it is required to share your identifiable personal information (e.g. name, date of birth, NHS number, contact details) this will only be passed to researchers with your explicit consent.

What we may do with your personal information

The personal information we collect about you may also be used to:

• remind you about your appointments in relation to the BioResource and research studies, and send you relevant correspondence
• describe the characteristics of the BioResource population (no identifiers would be used)
• report and investigate any complaints, claims and untoward incidents
• report events to the appropriate authorities, e.g. when we are required to do so by law
• contact you for feedback on your experiences as a participant in BioResource studies
  

The BioResource would also like to inform you of our activities, and how your de-identified data and samples have contributed to medical research, and may send you correspondence from time to time that you may find of interest. You can decide whether you wish to receive this type of correspondence.

Where possible, we will always look to de-identify your personal information to protect confidentiality.

Personal information you provide to the NIHR BioResource in confidence will only be used for the purposes explained to you and to which you have consented.

However, there may be exceptional circumstances as listed below, where we may be obliged to share data with other official bodies.

• There are occasions where the BioResource is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, e.g. to prevent and detect fraud.
• There may also be situations where we are under a duty to share your information, due to a legal requirement. This includes, but is not limited to,
  • disclosure under a court order,
  • sharing with the Health & Safety Executive if you are involved in a reportable accident whilst taking part in one of our studies,
  • the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to others, and
  • other public bodies (e.g. HMRC for the misuse of public funds).

The BioResource is required to protect your personal information, inform you of how your personal information will be used, and allow you to decide if and how your personal information can be shared.

Your personal information is held in both paper and electronic forms.

The NIHR BioResource will hold data for 10 years beyond the end of our funding, which currently runs until March 2029, subject to renewal.

We hold and process your information in accordance with the Data Protection Act 2018 and UK GDPR explained above.

 In addition, everyone working for the BioResource must comply with the Common Law Duty of Confidentiality and take yearly training in data protection and cyber security.

We have a duty to:

• maintain full and accurate records
• keep records about you confidential and secure
• provide information in a format that is accessible to you

The following staff groups at the BioResource have access to the personal information we hold about you:

• study coordinators
• research nurses
• IT staff who support these staff members

In certain circumstances, for example during an audit or inspection, the governance staff members may also temporarily have access:

Use of Email - The BioResource may want to communicate with participants via email. This could include invitations to research studies or BioResource-related events, as well as BioResource newsletters.

Please be aware that we cannot guarantee the security of this information whilst in transit, and by accepting this service you are accepting this risk.

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. The Data Protection Act 2018 and UK GDPR gives you certain rights, including the right to:

• Request access to the data we hold about you. This is described below.
• Request the correction of inaccurate or incomplete information recorded in our records. This is also explained on our website.
• Withdraw consent to the sharing of your records, or to the BioResource as a whole. The process is explained on the “Leaving the BioResource” page of our website.
• Please note that the BioResource is not part of the NHS opt-out provisions, and exercising your right to opt-out of NHS data sharing, will not impact your membership of the BioResource.
• Request that we delete your personal data, subject to certain safeguards. We might not always be able to do this. This is also explained further on our website.

If you wish to discuss how we handle your personal data, you can contact us:

Telephone: 0800 090 22 33

Email: nbr@bioresource.nihr.ac.uk

To request a copy of the data we hold on you, please email us as above, or write to:

NIHR BioResource Box 299
University of Cambridge and Cambridge University Hospitals NHS Foundation Trust Cambridge Biomedical Campus
Hills Road
Cambridge
CB2 0QQ
 

We will confirm receipt of your application as soon as possible and we may need to clarify your request further.

We aim to process information within one calendar month from receipt of this information and will update you if it will take longer.

If you wish to raise a complaint on how we have handled your personal data, you can raise this with us, as above.

If you are not satisfied with the response or believe we are processing your personal data not in accordance with the law you can contact the Trust’s Data Protection Officer who will investigate the matter.

The Data Protection Officer is the Information Governance Lead at Cambridge University Hospitals NHS Foundation Trust:

Michelle Ellerbeck
Information Governance Lead/Data Protection Officer
Cambridge University Hospitals NHS Foundation Trust
Box 153
Hills Road Cambridge
CB2 0QQ

Or email: cuh.gdpr@nhs.net

This version, v3, 25^th June 2026