GlaxoSmithKline Clinical Unit Cambridge Privacy Notice
Updated 13 August 2018


GlaxoSmithKline (GSK or we) value your privacy and care about the way in which your personal information is treated. We want you to understand:

• what personal information we collect about you;
• how we obtain your personal information;
• how we use your personal information;
• on what basis we use your personal information;
• how long we keep your personal information;
• with whom we share your personal information;
• the countries to which we transfer your personal information;
• how we protect your personal information; and
• your rights regarding your personal information.

If you have any questions, feel free to get in touch via one of the methods set out in the Contact us section below.


What personal information do we collect about you?

The personal information that we process may include:

• Your basic information - such as name (including name prefix or title), gender, ethnicity, age, date and place of birth;
• Contact information - such as home and work address, email address, phone number(s);
• Professional details - such as your education, occupation, government issued ID;
• Health-related information - such as personal physician information, medical diagnostic data; prescription data; biological samples, other health related information provided (e.g. health information, health risk factors, personal exposure and surveillance data (photographs);
• Technical Information -- information from your visits to our websites (including things like the type of browser and operating system you use, access times, pages viewed, URLs clicked on, your IP address and the page you visited before navigating to our websites);


How do we obtain your personal information?

We gather information about you when you provide it to us, or interact with us directly; e.g. when you complete one of our volunteer health questionnaires, get in touch for customer support or to provide feedback, when you engage with one of our representatives or when you your register on one of our digital platforms.

Otherwise, we collect your personal information while monitoring our technology tools and services, including email communications sent to and from GSK.

How do we use your personal information?

We use your personal information for the following purposes:
• Determining your eligibility to participate in clinical trials
• Responding to and dealing with your queries or requests
• Performing analytics
• Direct Marketing Communications


On what basis do we use your personal information?

We use your personal information because you have given your consent. Your consent allows for use of your information for the purposes of the study and further research. Your information is also needed to comply with legal requirements associated with the study and to carry out scientific research.

At times we may ask for your consent to allow us to use your personal information for one or more purposes. See the Your rights section for information about the rights that you have if we process your information on the basis of your consent.
We also use your personal information for business purposes. Your personal information helps us to operate and improve our business and minimise any disruption to the services that we may offer to you. It also allows us to make our communications with you more relevant and personalised to you, and to make your experience of our products and services efficient and effective.

How long will we keep your personal information?

We will always keep your personal information for the period required by law. We will also keep your personal information when we need to do so in connection with legal action or an investigation involving GSK.

In the event your application is not suitable for current clinical studies, or you fail the initial panel screening your information will be retained for a period of three years. Should you participate in a clinical study however, your information will be retained for a period of thirty years.


With whom do we share your personal information?

We share certain of your personal information with:

• members of the GSK group of companies; and
• the following trusted third parties:
o Amazon Web Services, our data centre provider
o Adobe, our analytics provider
o Zoom Answer call, our call centre provider
See the Protecting your personal information section for information on how we keep your personal information secure when sharing it with others.

Transfers of your personal information outside of your home country


Your personal information may be processed by GSK, its affiliated companies and GSK's trusted third party suppliers anywhere in the world, including in countries where data privacy laws may not be equivalent to, or as protective as, the laws in your home country. These countries include the United States.

We will implement appropriate measures to ensure that your personal information remains protected and secure when it is transferred outside of your home country, in accordance with applicable data protection and privacy laws. These measures include data transfer agreements implementing standard data protection clauses, or GSK's Binding Corporate Rules. You can find more information about data transfer agreements here, and more information about GSK's Binding Corporate Rules here.

Protecting your personal information


We use a variety of security measures and technologies to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable data protection and privacy laws.
For example, when we share your personal information with external suppliers, we may put in place a written agreement which commits the suppliers to keep your information confidential, and to put in place appropriate security measures to keep your information secure.


Your rights

You may be entitled to:
• ask GSK about the processing of your personal information, including to be provided with a copy of your personal information;
• request the correction and/or deletion of your personal information;
• request the restriction of the processing of your personal information, or object to that processing;
• withdraw your consent to the processing of your personal information (where GSK is processing your personal information based on your consent);
• request receipt or transmission to another organisation, in a machine-readable form, of the personal information that you have provided to GSK; and
• complain to your local supervisory authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information.

Where you are given the option to share your personal information with us, you can always choose not to do so.

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.

This could mean that we are unable to perform the actions necessary to achieve the purposes of processing described (see ‘How do we use your personal information?') or that you are unable to make use of the services and products offered by us.

After you have chosen to withdraw your consent GSK may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with research activities.

If you would like to exercise your rights, please let us know by getting in touch via EU.DPO@GSK.com.

Contact us

If you have questions or requests about the processing of your personal information, or need additional information, you can contact GSK's Data Protection Officer at: EU.DPO@GSK.com.

Data controller

GlaxoSmithKline Research & Development Limited is the controller of your personal information.