Privacy Policy - United Kingdom
Effective Date: 21 October, 2026 | Last Updated: 21 October, 2026
Assured Clinical Research Limited (“ACR”, “we”, “us” or “our”) is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit our website at https://assuredclinical.com/ (the “Site”) from the United Kingdom, or otherwise engage with our UK clinical research operations, and describes your rights regarding that data.
ACR operates clinical research sites in the United Kingdom. This policy is designed to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). Where we process personal data of individuals in the European Union, we also comply with the EU General Data Protection Regulation (EU GDPR) where it applies.
If you are located in the United States, please refer to our separate US Privacy Policy.
By using the Site, you acknowledge that you have read and understood this Privacy Policy.
1. Who We Are (Data Controller)
For the purposes of the UK GDPR, Assured Clinical Research Limited is the data controller responsible for personal data collected through this Site.
• Organisation: Assured Clinical Research Limited
• Registered address: Campingland Surgery, Campingland, Swaffham, Norfolk, PE37 7RD, United Kingdom
• General enquiries: hello@assuredclinical.com
• Privacy enquiries: privacy@assuredclinical.com
• ICO registration number: ZC068422
ACR is registered with the Care Quality Commission (CQC) as a provider of regulated activities in England.
2. Information We Collect
2.1 Contact and identity information. When you submit an enquiry, register interest in a clinical trial or contact us through the Site, we may collect your name, email address, phone number and any other information you choose to provide.
2.2 Health and special category data. If you are a potential study participant, you may choose to provide information about your health, medical history or demographic characteristics so we can assess your eligibility for clinical trials. This is special category data under the UK GDPR and is handled with the additional protections described in Section 5.
2.3 Professional information. If you are an investigator, research professional or healthcare provider, we may collect your curriculum vitae, professional qualifications, registration details (for example, GMC or NMC) and professional contact information.
2.4 Automatically collected information. When you visit the Site, we automatically collect certain technical information, including:
• IP address and approximate geographic location
• Browser type, version and operating system
• Pages visited, time spent on the Site and referring URLs
• Device identifiers and cookie data
This information is collected using cookies and similar technologies, as described in Section 7.
3. Lawful Basis for Processing
Under the UK GDPR, we must identify a lawful basis for processing your personal data. We rely on the following:
• Consent (Article 6(1)(a) and Article 9(2)(a)): where you have given clear consent for a specific purpose, including the collection of health information for clinical trial eligibility assessment and receiving SMS communications.
• Legitimate interests (Article 6(1)(f)): where processing is necessary to operate and improve the Site, respond to enquiries and keep our systems secure, and your interests and fundamental rights do not override those interests.
• Legal obligation (Article 6(1)(c)): where processing is necessary to comply with our legal obligations, including those under clinical research regulations (ICH GCP, MHRA requirements and applicable UK law).
• Scientific research (Article 9(2)(j) and Schedule 1, Data Protection Act 2018): where health data is processed for clinical research, subject to appropriate safeguards and in line with UK research governance frameworks, including Health Research Authority (HRA) requirements.
4. How We Use Your Information
We use the information we collect to:
• Assess your eligibility for current or upcoming clinical trials and research studies.
• Communicate with you about research opportunities, study enquiries or your requests.
• Maintain and improve the Site’s functionality and user experience.
• Comply with our legal, regulatory and ethical obligations in clinical research, including those set by the MHRA, HRA, ICH GCP and applicable sponsor requirements.
• Send you SMS messages where you have explicitly opted in to receive them.
• Analyse how the Site is used and maintain its security.
• Respond to legal requests and prevent harm.
5. Health and Special Category Data
Health information is special category data under the UK GDPR and receives additional legal protection. Where you voluntarily provide health information through the Site:
• We process it only on the basis of your explicit consent and/or for scientific research under Article 9(2)(j) UK GDPR and Schedule 1 of the Data Protection Act 2018.
• Access is restricted to authorised ACR personnel and, where applicable, appropriately authorised sponsor representatives.
• It is protected to the same security standards we apply to our clinical research records.
Submitting health information through the Site does not enrol you in a clinical trial. Formal enrolment requires a separate informed consent process conducted with a qualified investigator.
6. Disclosure of Your Information
We do not sell your personal data. We may share it in the following circumstances.
6.1 Clinical trial sponsors and partners. Where you have expressed interest in a specific study, we may share your information with the relevant sponsor or contract research organisation (CRO) to facilitate your potential participation. This sharing is governed by data sharing agreements and limited to what is necessary for the research purpose.
6.2 Group operations. ACR also has business operations in the United States. We may share personal data with our US operations where needed to administer our business, subject to the safeguards described in Section 10.
6.3 Service providers. We use third-party service providers to support the Site, including website hosting, analytics (for example, Google Analytics) and security services (for example, Google reCAPTCHA). They act as data processors on our behalf and are contractually bound to process your data only on our instructions and to keep it secure.
6.4 Legal and regulatory requirements. We may disclose your information where required by law or in response to valid requests from public authorities, including the MHRA, HRA, CQC or law enforcement agencies. We may also disclose information to protect the rights, property or safety of ACR, our participants or others.
6.5 Business transfers. If we undergo a merger, acquisition, reorganisation or sale of all or part of our business, your information may be transferred to the successor entity, subject to the same protections described in this policy.
7. Cookies and Similar Technologies
7.1 What we use. Our Site uses cookies and similar technologies in the following categories:
• Strictly necessary cookies: essential for the Site to function. These cannot be disabled.
• Analytics cookies: we use Google Analytics to understand how visitors use the Site, in aggregated form.
• Security cookies: we use Google reCAPTCHA to protect forms against automated abuse.
7.2 Your choices. Under PECR and the UK GDPR, we must obtain your consent before placing non-essential cookies on your device. When you first visit the Site, a cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time through [cookie settings link] or your browser settings. Disabling some cookies may affect how parts of the Site work.
8. SMS and Text Messaging
If you provide your mobile number and tick the consent box on our forms, you agree to receive service-related text messages from ACR. We send these only with your consent, in line with PECR.
• Opt out: reply STOP to any message to unsubscribe at any time.
• Help: reply HELP for assistance.
• Frequency: message frequency varies.
• Charges: standard network rates may apply.
Withdrawing your consent does not affect the lawfulness of messages sent before you withdrew it.
9. Data Retention
We keep personal data only as long as necessary for the purposes in this policy, or as required by law.
Type of data
Retention period
Website enquiry and contact data
Up to 2 years from your last interaction with us, or until you ask us to delete it
Clinical trial eligibility and health information submitted through the Site
Up to 3 years, or longer if required by the study protocol, sponsor or regulators
Professional information from investigators or research professionals
Up to 5 years from submission
Technical and analytics data
Up to 26 months, in aggregated form
Data about participants formally enrolled in a clinical trial follows separate retention schedules set by UK clinical trials legislation, ICH GCP and sponsor agreements, which typically require retention for 15 to 25 years.
10. International Data Transfers
ACR has business operations in the United States, and some of our service providers are based outside the UK. Your personal data may therefore be transferred to, stored in or processed in the United States or other countries.
Where we transfer personal data outside the UK to a country without UK adequacy regulations, we put appropriate safeguards in place, which may include:
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• The UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), where the US recipient is certified.
• Other transfer mechanisms recognised under the UK GDPR.
For more information about these safeguards, contact privacy@assuredclinical.com.
11. Your Rights
Under the UK GDPR, you have the following rights regarding your personal data:
• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete data.
• Right to erasure: to ask us to delete your data where there is no compelling reason to keep it. This right may be limited where we must retain data by law or for legitimate research purposes.
• Right to restrict processing: to ask us to limit how we use your data in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: at any time, where processing is based on consent. This does not affect processing carried out before you withdrew.
• Right to complain: to the Information Commissioner’s Office (ICO) at www.ico.org.uk or on 0303 123 1113. If you are in the EU, you may contact your local supervisory authority.
12. How to Exercise Your Rights
To exercise any of these rights, or to ask how we handle your personal data, contact us:
• Email: privacy@assuredclinical.com
• Post: Data Privacy, Assured Clinical Research Limited, Campingland Surgery, Campingland, Swaffham, Norfolk, PE37 7RD, United Kingdom
We will respond within one month of receipt. In complex cases we may extend this by up to two further months, and we will tell you if we do. We may need to verify your identity before acting on your request. We do not charge for reasonable requests, but may charge a reasonable fee for requests that are manifestly unfounded or excessive.
13. Data Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These include encryption in transit (TLS/SSL), access controls and regular security reviews.
No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and notify affected individuals without undue delay where required.
14. Children’s Privacy
Our Site is not directed at children. We do not knowingly collect personal data from children under 13 without consent from a parent or guardian. If you believe we have collected information from a child, contact privacy@assuredclinical.com and we will promptly delete it.
15. Third-Party Links
Our Site may contain links to third-party websites. This policy applies only to information collected through our Site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy policies before providing personal data.
16. Changes to This Policy
We may update this policy to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the “Last Updated” date at the top and, where appropriate, give more prominent notice. We encourage you to review this policy periodically.
17. Contact Us
If you have questions, concerns or complaints about this policy or how we handle your data, contact us:
Assured Clinical Research Limited Campingland Surgery, Campingland, Swaffham, Norfolk, PE37 7RD, United Kingdom
• General enquiries: hello@assuredclinical.com
• Privacy and data protection: privacy@assuredclinical.com
You may also contact the Information Commissioner’s Office at www.ico.org.uk or on 0303 123 1113.
This Privacy Policy was prepared for Assured Clinical Research Limited and does not constitute legal advice. ACR recommends periodic review by a qualified data protection solicitor.