Privacy Policy

Introduction

UK Biobank respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, share and use personal information about you, and how you can exercise your privacy rights. 

This privacy policy only applies to personal information you provide to us when you visit our website www.ukbiobank.ac.uk (the “website”) regardless of where you visit it from; sign up to attend one of our events; apply to take part in participant and public involvement and engagement (PPIE) activities; provide us with feedback, either through this website or at an event; provide us with a testimonial; interact with us, or we interact with you, via a social media platform, telephone, post or in person; if you sign up to receive information about us (including marketing information); or if you are a researcher and make an application to access the UK Biobank Resource (the "resource"), access the UK Biobank Access Management System ("AMS") or register to access the Researcher Community Forum; or if you are the emergency contact of a UK Biobank participant, through our interactions with the UK Biobank participant.

For personal information that we collect from UK Biobank participants in relation to the UK Biobank study, please see our 'Basis of your participation' page.

For personal data that we collect from job applicants, please see our ‘Candidate Privacy Notice’.

1. Important information about who we are
Purpose of this privacy policy

This privacy policy gives you information on how UK Biobank collects and processes your personal data:

• through your use of this website, including any data you may provide through this website when you provide feedback to us, apply to take part in PPIE activities or sign up to attend one of our events.
• when you provide feedback to us following a UK Biobank event that is not provided through the website (i.e. in paper format);
• when you interact with us over social media, by email, by telephone, post or in person;
• when you provide us with a testimonial for public use;
• when we book travel or accommodation on your behalf; or
• if you are a researcher, when you register or make an application to access the resource, sign up to access the AMS, register for access to the UK Biobank Researcher Community Forum, if you have publications of interest to UK Biobank containing your details or if you subscribe to receive materials and communications from us.
• If you are the emergency contact of a UK Biobank participant, through our interactions with that UK Biobank participant.

The website is not intended for children and we do not knowingly collect data relating to children.

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide from time to time when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

Controller and contact details

UK Biobank Limited is the controller responsible for your personal data (collectively referred to as "we", "us" or "our" in this privacy policy).

We have appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy you can contact our DPO using the email address dpo@ukbiobank.ac.uk or via post to UK Biobank, 1-2 Spectrum Way, Adswood, Stockport SK3 0SA. We hope that we can deal with any questions you have about UK Biobank's use of your personal data, but you have the right to make a complaint at any time to the Information Commissioner's Office (“ICO”), the UK supervisory authority for data protection issues.

The ICO’s address:      

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

If you are based in the EU, we have appointed DataRep as our Data Protection Representative in the European Union for the purposes of the GDPR. If you wish to contact DataRep you can contact them by email at datarequest@datarep.com quoting "UK Biobank Limited", via post addressed to Datarep, at the address most appropriate to you listed here or via their online forum at www.datarep.com/data-request.

Changes to the privacy policy

We keep our privacy policy under regular review. This version was last updated on 1st August 2024.

Third-party links on the website

From time to time our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes your name, title, date of birth and sex/gender;
• Contact Data includes your postal address, email address, social media handle(s), telephone numbers and correspondence history (including recordings of phone calls with you);
• Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, language preference, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website;
• Financial Data includes bank account number, sort code and building society roll number;
• Travel Data includes passport details (including passport number, issuing country and expiry date) and frequent flyer membership or travel loyalty details;
• Profile Data includes participant ID, feedback, survey responses and testimonials.
• Education Data includes the type of qualifications you may have.
• Event Registration Data includes information about your dietary requirements or accessibility requirements when you attend an event;
• Usage Data includes information about how you use our website;
• Researcher Data includes your name, date of birth, CV, publications, any complaints regarding your publications, your department and associated institution / employer, allocated unique identifying number (if applicable) and Access Management System access details (such as user name and password); and
• Special Category Data includes any personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying you, data concerning health or data concerning your sex life or sexual orientation. You may provide this to us voluntarily, for example as part of a testimonial or using another method of communication with us.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

3. How is your personal data collected?

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your identity data, contact data, profile data, financial data, education data, travel data and/or special category data by filling in our feedback form, participant expense or engagement claim form, applying to take part in PPIE activities, signing up to receive communications from us, or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you contact us, give us feedback or provide us with a testimonial. If you are a researcher this will include personal data you provide us when you make an application to access the resource; sign up to access the UK Biobank Access Management System or register as a member of the UK Biobank Community Forum.
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns (and the type of information we collect will depend on which cookies we are permitted to set). We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details; and
• Third parties or publicly available sources. This would include analytics providers such as Google Analytics, publicly-available information on social media platforms such as twitter or Instagram or publicly-available information contained in research publications. If you are a researcher, this would include publicly-available information on public registers and publicly-available internet sites as well as subscription services that provide screening against prohibited and/or sanctioned persons.
• Emergency Contact. When we interact with a UK Biobank participant, they may provide us with your name and contact details as an emergency contact. When we collect this data, we ask the UK Biobank participant to make you aware of this and ask them to refer you to this privacy policy.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. When we talk about our legitimate interest, this generally means the interest of UK Biobank in conducting, running and promoting the UK Biobank study. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We may have other legitimate interests, and if appropriate, we will make clear to you at the relevant time what those legitimate interests are;
• Where we need to comply with a legal obligation. This means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to; and
• Where it is necessary for scientific research purposes.

Generally, we do not rely on consent as a legal basis for processing your personal data (where we do rely on consent, we will ask for it before we process the information).

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
To manage our relationship with you which will include: (1) responding to an enquiry you may make (2) asking you to leave feedback (3) notifying you about changes to our privacy policy (4) enabling proper management of UK Biobank events and to ensure compliance with equality law and / or food safety law (5) enabling recruitment to our PPIE activities and to ensuring a balanced group for these activities (6) arranging payment of your travel expenses or honoraria payments (7) sending you materials and communications, such as newsletters and invitations to events.	(a) Identity Data (b) Contact Data (c) Financial Data (d) Profile Data (e) Event Registration Data (f) Education Data (g) Special Category Data	Necessary for our legitimate interests – we want to respond to your queries, take note of your feedback, arrange payment of your travel expenses and facilitate recruitment to PPIE activities to ensure the best operation of the UK Biobank Necessary to comply with a legal obligation Necessary for scientific research purposes Necessary for substantive public interest – to comply with the Equality Act 2010 and pursuant to health and safety legislation
To book travel or accommodation on your behalf	(a) Identity Data (b) Contact Data (c) Travel Data (d) Event Registration Data	Necessary for our legitimate interests – to arrange travel and accommodation for you when you attend UK Biobank events
To enable you to complete a survey	(a) Identity Data (b) Contact Data (c) Profile Data (d) Usage Data (e) Special Category Data	Necessary for our legitimate interests – we want to take note of your feedback to ensure the best operation of the UK Biobank Necessary for scientific research purposes
To promote the UK Biobank study, for example, (1) where you voluntarily agree to provide us with a testimonial about your participation in the UK Biobank study or research you have published or conducted in connection to the UK Biobank study (2) communicating with you directly (i.e. direct message or private message) on a social media platform if you create a post that relates to the UK Biobank study	(a) Identify Data (b) Contact Data (c) Profile Data (d) Researcher Data (e) Special Category Data	Necessary for our legitimate interests – improving our website and generating interest in the UK Biobank study If you voluntarily provide any Special Category Data (e.g. as part of a testimonial) this will be processed based on explicit consent and this will be obtained before we process this data
To allow researchers to access the resource, AMS and the Researcher Community Forum	(a) Identity Data (b) Contact Data (c) Researcher Data (d) Technical Data	Necessary for our legitimate interest (e.g. to verify the bona fides of researcher as part of the application process, for access to the resource and / or AMS (including for authentication purposes when accessing the resource through our third party provider (DNANexus)), to verify your access to the Researcher Community Forum, and to perform due diligence and regulatory checks such as checks against sanctions lists and to enable dialogue with researchers regarding research outcomes) Necessary to comply with a legal obligation
To administer and protect UK Biobank and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity Data (b) Contact Data (c) Technical Data	Necessary for our legitimate interests - for running our business, provision of administration and IT services, network security and to prevent fraud Necessary to comply with a legal obligation
To use data analytics to improve our website, stakeholder relationships and experiences	(a) Technical Data (b) Usage Data	Necessary for our legitimate interests - to keep our website updated and relevant, to develop UK Biobank and to inform our communications strategy)
To ensure that we can contact someone on behalf of a UK Biobank participant in the event of an emergency	(a) Identity Data (b) Contact Data	Necessary for our legitimate interests – as an emergency contact for a UK Biobank participant

 

Please note that where we have indicated in the table above that our processing of your personal data is necessary for us to comply with a legal obligation and you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our engagement with you.

Cookies

You can change your cookie preferences at any time by clicking on the Manage Your Consent icon. You can also set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our cookie policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Disclosures of your personal data

From time to time we ask third parties to carry out certain business functions for us. These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties so that they can perform those functions. Before we disclose your personal data to other people, we will make sure that they have appropriate security standards in place to make sure your personal data is protected and we will enter into a written contract imposing appropriate security standards on them. Examples of these third party service providers include service providers and/or sub-contractors, such as our IT systems software and maintenance, back up, and server hosting providers and external legal providers.

We may share your personal data with the following parties:

• The University of Oxford for the purpose of managing our relationship with you;
• If you are a researcher: (i) our Access Committee and Ethics Advisory Committee for the purpose of considering your application to access the resource; (ii) our third party sanction screening provider for the purpose of conducting regulatory checks when you register with us; (iii) our third party platform provider (DNAnexus) for the purpose of validating your access to the platform and; (iv) our third party platform provider (Zendesk) for your registration and access to the Researcher Community Forum.

In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above, in particular:

• If we transfer, purchase, reorganise, merge or sell any part of our business or the business of a third party, and we disclose or transfer your personal data to the prospective seller, buyer or other third party involved in a business transfer, reorganisation or merger arrangement (and their advisors); and
• If we need to disclose your personal data in order to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our employees, Participants or others.

We may also share your personal data with third parties, as directed by you.

In limited circumstances, and only on a voluntary basis with your permission, we may share your testimonial about your research or participation in the UK Biobank study on our website.

6. International transfers

If any of our processing activities require your personal data to be transferred outside the UK, we will only make that transfer if:

• the country to which the personal data is to be transferred ensures an adequate level of protection for personal data;
• we have put in place appropriate safeguards to protect your personal data, such as an appropriate contract with the recipient;
• the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
• you explicitly consent to the transfer.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention – how long will you use my personal data for?

We keep some types of personal data for longer than others. We will only retain your personal data for a limited period of time. This will depend on a number of factors, including:

• any laws or regulations that we are required to follow;
• whether we are in a legal or other type of dispute with each other or any third party;
• the type of information that we hold about you; and
• whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

9. Your data protection rights

Under certain circumstances, you have legal rights under data protection laws in relation to your personal data which we hold and are briefly summarised in the table below.

You have the right to opt-out of marketing communications we send you at any time. This can be done by contacting us using the email address: ukbiobank@ukbiobank.ac.uk If you choose to opt out of marketing communications, we may still send you non-promotional communications, such as emails about your account or our ongoing business relations. If you are a researcher, you can also opt-out of non-essential communications by updating your notification settings in your AMS profile.

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point.

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Should you wish to exercise any of your rights please contact the DPO using the details set out under the Controller heading in section 1 above.

Your right	What does it mean?	Limitations and conditions of your right
Right of access	Subject to certain conditions, you are entitled to have access to your personal data (this is more commonly known as submitting a “data subject access request”).	If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations. We must be able to verify your identity. Your request may not impact the rights and freedoms of other people, e.g. privacy and confidentiality rights of our staff.
Right to data portability	Subject to certain conditions, you are entitled to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format.	If you exercise this right, you should specify the type of information you would like to receive (and where we should send it) where possible to ensure that our disclosure is meeting your expectations. This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (i.e. not for paper records). It covers only the personal data that has been provided to us by you.
Rights in relation to inaccurate personal or incomplete data	You may challenge the accuracy or completeness of your personal data and have it corrected or completed, as applicable. You have a responsibility to help us to keep your personal information accurate and up to date. We encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details and telephone number.	This right only applies to your own personal data. When exercising this right, please be as specific as possible.
Right to object to or restrict our data processing	Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your personal data.	As stated above, this right applies where our processing of your personal data is necessary for our legitimate interests. You can also object to our processing of your personal data for direct marketing purposes.
Right to erasure	Subject to certain conditions, you are entitled to have your personal data erased (also known as the “right to be forgotten”), e.g. where your personal data is no longer needed for the purposes it was collected for, or where the relevant processing is unlawful.	We may not be in a position to erase your personal data, if for example, we need it to (i) comply with a legal obligation, or (ii) exercise or defend legal claims.
Right to withdrawal of consent	As stated above, where our processing of your personal data is based on your consent you have the right to withdraw your consent at any time.	If you withdraw your consent, this will only take effect for future processing.