TRI Privacy Notice

Everyone has rights with regard to how their personal information is handled. During the course of our activities, TRI will collect, store and process personal data (which may be held on paper, electronically, or otherwise) about our staff, donors, funding partners, patients, suppliers, customers and any other business contacts and we recognise the need to treat it in an appropriate and lawful manner, in accordance with the applicable data protection legislation such as the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

TRI respects your privacy and is committed to protecting your personal data. This privacy notice explains how we collect, use and protect your information, and outlines your rights regarding your personal data.

  1. Personal data collected

“Personal data” means recorded information we hold about you from which you can be identified. It may include contact details, other personal information, photographs, and expressions of opinion about you or indications as to our intentions about you.

“Processing” means doing anything with the data, such as accessing, disclosing, destroying or using the data in any way.

During the course of our relationship, TRI may collect the following types of personal data from you:

  • Identification details: name, email address, phone number, postal address, national insurance number, passport details, etc.
  • Employment details: job title, role, office location, company represented;
  • Financial details: billing address, bank account details, payment details;
  • Special categories of personal data, including health and genetic data;
  • Data which has been de-identified, which can include identification details, information about your health, lifestyle, behavioural data, demographics and genetic information.

We collect this data through forms you fill out or directly during communications with you.

  1. Fair and lawful processing

The applicable data protection legislation allows processing of data for specific purposes, which are where it is needed:

  • for the performance of a contract, such as an employment contract;
  • to comply with a legal obligation;
  • in order to pursue our legitimate interests (or those of a third party) and where the interests and fundamental rights of the data subject do not override those interests
  • to protect the data subject’s vital interests;
  • in the public interest; or
  • in situations where the data subject has given explicit consent.

We will only process data on the basis of one or more of the above lawful bases.

We will usually only process your personal data where you have given your consent or where the processing is necessary to comply with our legal obligations. In other cases, processing may be necessary for the protection of your vital interests, for our legitimate interests or the legitimate interests of others.

We will only process “special categories of personal data” about ethnic origin, political opinions, religious or similar beliefs, trade union membership, health, sex life, criminal proceedings or convictions, where a further condition is also met. Usually this will mean that you have given your explicit consent, or that the processing is legally required for employment, public interest or research purposes.

  1. How we are likely to use your personal data

We will process data for legal, personnel, administrative and management purposes and to enable us to meet our legal obligations as an organisation or in order to comply with our contract with you. This means we may use your data in the following ways:

  • Where you applied for a vacancy within TRI, to conduct interviews and manage the recruitment process;
  • Where you become a research partner, to communicate with you in order to fulfill our obligations under our contract;
  • Where you are a candidate for a research study, to conduct medical research for public interest and research purposes;
  • Where you are a third party contacting our President, to respond to your query and facilitate communications with you;
  • Where you are one of our donors, to ensure the fair and legal processing of your donation;
  • Where you are a supplier, to be able to pay you any amounts due under our contract and manage the supplier relationship.

We ensure that your data is only used for the purposes outlined in our contract or for our legitimate purposes and rely on lawful bases for processing, such as contract necessity, public interest or legitimate interests.

  1. How We Share Your Data

Your personal data is kept securely on our internal systems. For the purposes of managing our organisation, we may share your data with:

  • Service providers: third parties who assist in delivering our services such as payment processors, HR systems, etc.
  • Legal Authorities: only when required by law or in response to legitimate legal requests.

All third parties are contractually obliged to protect your data.

  1. Accurate data

We will endeavour to keep the personal data we store about you accurate and up to date. Please notify us if your personal details change or if you become aware of any inaccuracies in the personal data we hold about you.

  1. Data collected from other sources

In some cases, we may collect personal data about you from sources other than directly from you. These sources include:

  • Third parties such as our research partners who can provide your data to us in line with our agreements.
  • Referrals, such as individuals who refer you to us or donors who listed us as a beneficiary in their will and provided your contact details.

We process this data in accordance with applicable legislation and for purposes such as verifying your identity, delivering our services, or complying with our obligations under our agreements.

  1. Data retention

We retain your data only for as long as necessary to fulfill the purposes outlined in this notice or to comply with our legal obligations. In circumstances where we are required to remove your data from our records after a certain period of time (such as personal data collected for employment purposes) we will remove your data in line with our legal requirements. In circumstances where data can be retained indefinitely in line with the law (such as data collected for medical research), your data will be kept secure on our systems and access will be restricted.

  1. Processing in line with your rights

You have the following rights under applicable data protection legislation:

  • Access: Request a copy of your personal data TRI holds about you.
  • Correction: Request correction of inaccurate or incomplete data TRI holds about you.
  • Deletion: Request erasure of your personal data, subject to legal limitations, such as where TRI is required by law to retain your personal data.
  • Restriction: Request limited processing of your data in some circumstances, such as when pending a complaint.
  • Portability: Request that TRI transfers your data to another organisation, in some circumstances.
  • Objection: Object to TRI processing your data in some circumstances, such as when our legal basis is legitimate interest;

In order to exercise any of your rights, you can contact us using the details provided in this privacy notice.

  1. Data security

We will ensure that appropriate measures are taken against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

We have in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. We will only usually transfer personal data to a third party if they agree to comply with those procedures and policies, or if they put in place adequate measures themselves.

  1. Contact Us

If you have questions or concerns about this Privacy Notice or how we process your data, please contact us:

Email: info@tri-london.ac.uk

Address: Thrombosis Research Institute, Third Floor, 66 St James’s Street, London, SW1A 1NE

  1. Monitoring and Review of the policy

We will continue to review the effectiveness of this privacy notice to ensure it is achieving its stated objectives.

Last updated: June 2025