This Privacy Notice is for people involved in clinical trials conducted by Cancer Vaccines Limited.  As a participant in one of our trials you will have received detailed written information (Patient Information Sheet) about the trial and may also have been given a website address for the trial where more detailed information is laid out.  This Privacy Notice explains how we process (e.g. collect, use, store and share) your personal data and complements the trial-specific information already provided to you.  We will process any personal data we have about you in accordance with this Notice and with applicable law.

Who are we?

The company processing your personal data and hence the ‘Data Controller’ is:

Cancer Vaccines Limited

IC1.16 the TechnoCentre

Puma Way

Coventry University Technology Park

Coventry CV12TT

Company Registration Number: 3737189

How do we collect personal data about you?

We get your personal data from the following sources:

From parties involved as part of the ACIT-1 clinical trial who collect data from you directly, from your health records, from your GP and from NHS Digital.

Why do we process your personal data?

We process personal data about you for the following purposes:

We will use your data, collected in the course of a research study, in the ways needed to conduct and analyse the research study.

What personal data do we process about you?

Personal Data means any information which relates to you, or identifies you as an individual.  It includes information which can directly identify you, and also information which may identify you if combined with other readily available information.  Examples of Personal Data are: names, addresses, telephone numbers, dates of birth, etc.

Some Personal Data is considered sensitive and is called “special category”.  This includes data concerning racial or ethnic origin, religious beliefs, trade union activities, physical or mental health condition, and sexual life or sexual orientation.

The Personal Data we process includes the following:

  • Name
  • Date of birth
  • Contact details
  • Medical History
  • Medical test results including some genetic markers
  • Gender
  • Ethnicity
  • Smoking habits
  • Alcohol consumption

Your name, contact details and health records are held by the NHS Trust where you receive your clinical trial treatment.  If a clinical trials unit or contract research organisation is providing clinical trial management support they may also keep names and consent form details on file.  Your identity in our records is protected by using a code number.

Why are we allowed to process your personal data?

Our processing of your personal data requires a legal basis.  We will not process your personal data if we do not have a proper justification foreseen in the law for that purpose.  The reason we are allowed to process your personal data is that it is necessary for the purposes of the legitimate interests pursued by Cancer Vaccines Limited which was set up to develop safe, effective and affordable immunotherapies for the treatment of cancer.

The law requires us to give extra protection to “special category” Personal Data and so an additional lawful basis is needed in order to process this.  The additional basis is that ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes… which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.’

We are only able to rely on this additional lawful basis for “special category” data because we use data for scientific research purposes.

How do we protect your data?

We have put in place a number of ‘safeguards’ to ensure your personal data is kept confidential and handled sensitively.  Our staff are required to follow policies and procedures which ensure:

  • The amount and type of data collected is proportionate to the objectives of the research
  • The data collected is only retained as long as necessary for the aims and purposes of the research
  • The data is held and handled safely, securely and confidentially
  • The study has undergone a formal risk assessment which includes assessment of data protection issues
  • The study has been reviewed and approved by a research ethics committee, which ensures that the research will not cause substantial damage or distress to individuals
  • If external companies or individuals not employed by the Sponsor company process data on our behalf, or have joint responsibility for the data with us, we put formal agreements in place, which describe everybody’s roles and responsibilities
  • If data is transferred outside of the UK we ensure that there are adequate data protection laws in place in that country, or that they are part of special schemes providing assurance of privacy and security

How do we share your personal data?

We may share your personal data with:

  • Our own company personnel on a need-to-know basis
  • Health care professionals involved in the study
  • Staff at the Trials Unit or Contract Research Organisation or other company who provide support for the study
  • Personnel who are required to check data to ensure that the study is being or has been conducted properly and that the data are accurate.  This includes the company’s clinical trial monitor and any other relevant auditor.

The above third parties are contractually obliged to protect the confidentiality and security of your personal data in compliance with applicable law. 

Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.

When do we transfer your data outside of the EU/EAA?

Your personal data may be transferred and processed outside the UK and EU/EAA for the purpose of future scientific research and obtaining regulatory approval.  It will not be transferred to a third party for this purpose without a contractual obligation to protect its confidentiality and security and to comply with applicable law.  Information about data being shared outside the UK and EU/EAA can be found at:

How long will we keep your personal data?

We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal and regulatory requirements.  For most investigational medicinal products tested in a clinical trial the legal requirement is 15 years after the conclusion of the trial.  For trials where the product is an Advanced Therapy Medicinal Product the requirement is 30 years after the expiry date of the product.

What are your rights?

In general you have the following rights:

  • If you have agreed to participate in one of our research projects you can withdraw at any time. 
  • If you withdraw from the study, we will keep the information about you that we have already obtained.  Your withdrawal will not affect the lawfulness of the data processing carried out before you withdrew.  
  • If you withdraw from the study we would like to continue collecting information about your health from central NHS records, your hospital or your GP.  If you do not want this to happen, tell us and we will stop, however we may be required by the regulatory organisations to continue to collect some limited information about any side-effects you may have as a result of taking part in the study.
  • You can submit a complaint about how we process your personal data to a Data Protection Authority.

Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate.  This means that we won’t be able to let you see or change the data we hold about you.  

If you are not satisfied with our response to requests for information about your personal data, or believe we are processing it in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO) at