Introduction

The Institute of Cancer Research is one of the world's most influential cancer research organisations. Access to patient data is vital for the research conducted at ICR, and we implement high security and governance standards to ensure patient confidentiality within our research studies. The ICR obtains appropriate ethical and legal approvals for all research and ensures that it is strictly in the public interest when we use personal information. We do this by following the UK Policy Framework for Health and Social Care Research.

This privacy notice is in addition to the ICR’s main privacy statement and applies specifically to personal information held for research purposes for which the ICR is the Data Controller.

Collecting personal information

To safeguard your rights, we will use the minimum personal information necessary. We collect personal information (which includes information about your health and treatment) for research purposes from the following sources:

1. Directly from you with your consent
2. From third-party sources (e.g. NHS organisations, disease registries, other research institutions, NHS England (or predecessor organisations), Office for National Statistics) with your consent or, under exceptional circumstances (where consent is not possible), with relevant approval from the Health Research Authority to do so. A list of studies where we obtain data from national third-party sources (such as the Office for National Statistics) is maintained here.
3. Pseudonymised (key-coded) information from third-party sources – this information is linked to you as an individual but will not be used by the ICR to identify you. For example, if we receive a unique identifier, such as trial ID, we will not make efforts to ascertain your name, address or any other demographic details from other sources. We place safeguards in all of our processes to protect your identity.

Using your personal information

All of the personal information we collect is used solely for the purposes of carrying out our research. Personal information collected for research will not be used for any other purpose.

Under the General Data Protection Regulation, the ICR’s legal basis for processing this information is for the performance of a task carried out in the public interest. The ICR processes sensitive health and genetic information for the purposes of scientific research with appropriate safeguards in place to protect personal information, as required by the General Data Protection Regulation.

If we have asked for your consent to process your personal information, you can find more information about the use of this on the participant information sheet and consent form.

Retention of personal information

We retain personal information in line with our research retention schedules and regulatory requirements specific to research. We only store and use information that we believe to be factually correct, relevant to our work and not excessive for the purpose it was collected for.

Disclosure of your information to third parties 

Whenever possible, the information we share with third parties will not be identifiable. We disclose personal information (including information about health and treatment) that can identify you to third parties only where there is a legal basis to do so (e.g. with your consent).

Personal information collected for our research may be shared with associated researchers or companies within or outside the United Kingdom (UK) now or in the future. Certain countries outside of the UK may not have laws which protect your privacy to the same extent as the Data Protection Act in the UK. In the event that your information is transferred outside of the UK or Europe, the ICR will take all reasonable steps to protect your privacy including de-identifying information wherever possible.

Your personal information is never disclosed for any purpose other than ethically approved scientific research.

Your rights

You have rights over your personal information by law; these apply to information processed for research purposes, however there are some specific exemptions and your rights to access, erase, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate.

The ICR is committed to making every effort to respect your wishes.

If you would like further information or have any concerns about the use of your personal information, please contact our Data Protection Officer by emailing [email protected] or by writing to:

Data Protection Officer,
123 Old Brompton Road,
London,
SW7 3RP.

You also have the right to lodge a complaint about any use of your personal information with the Information Commissioners’ Office (ICO), UK’s national data protection regulator. 

The Institute of Cancer Research is registered with the Information Commissioner's Office under number Z6775661.

We keep our research privacy notice under regular review. This notice was last updated on 23 October 2023.