Privacy

Last Updated 11/09/2026 

 

Who we are 

The NIHR Innovation Observatory (NIHR IO) is hosted by Newcastle University. 

Newcastle University is the data controller for all personal data described in this privacy notice. 

Newcastle University
King’s Gate
Newcastle upon Tyne
NE1 7RU
United Kingdom 

 

What this privacy notice covers 

This privacy notice explains how we collect, use and protect personal data when you interact with NIHR IO, including when you: 

• Contact NIHR IO or members of the NIHR IO team (for example by email or via the website) 

• Engage in meetings, working relationships and collaboration 

• Register for or attend events, training or associated engagement activity 

• Sign up to receive newsletters or email alerts 

 

What personal data we collect 

We collect different types of personal data depending on how you interact with NIHR IO. 

Ongoing engagement and meeting management 

For the purposes of coordinating engagement, and managing meetings, actions and follow‑up, we may collect:  

• Names 
• Email addresses 
• Job titles
• Organisations individuals work at 
• Dates of meetings 
• Meeting purposes 
• Meeting attendees 
• Notes and discussion points 
• Action points arising from meetings 
• Deadlines and timescales linked to agreed actions 

This information is used to support ongoing professional working relationships and collaboration. 

 

Events, training and engagement activities 

Where you register for or attend an NIHR IO event, training or engagement activities, we may collect: 

• Name 
• Job title and organisation (if relevant) 
• Contact details 
• Event or training attendance records 
• Photographs taken during events and engagement activities (where consent has been provided)
• Video recordings made during events and engagement activities (where consent has been provided)

On occasion, we may ask for information about dietary or access requirements. This information may include special category data, is provided voluntarily, used only to support your participation in the specific engagement activity, and is deleted shortly after the event has taken place. 

We may also take photographs and video recordings during NIHR IO events, training and engagement activities. These images and recordings may be used for promotional and communications purposes, including social media posts, NIHR IO websites, printed materials, marketing publications and press releases. We will only use photographs and video recordings where you have provided your consent. Consent may be obtained during event registration or when you arrive at the event. You may withdraw your consent at any time by contacting us.

Where appropriate, we may offer you the opportunity to remain in contact with NIHR IO after an event or engagement activity (for example, to stay up to date with our work or future opportunities). Where you choose to do so, your contact details will be retained for this purpose on the basis of your consent, and you can withdraw this consent at any time. 

 

Newsletter and email alerts 

Where you sign up to receive NIHR IO newsletters or alerts, we may collect: 

• First and last name 
• Email address 
• Organisation (if applicable/relevant) 
• Information about your professional background or interest group 
• Your preferences for the type of communications you wish to receive 

This information is used only for the purposes of managing and delivering NIHR IO communications. 

 

Website contact forms and correspondence 

Where you contact us via the NIHR IO website (for example using a “Contact us” form) or correspond with members of the NIHR IO team directly, we may collect: 

• First and last name 
• Email address 
• Telephone number 
• Organisation (where relevant/applicable) 
• Information you choose to include in your message 

We do not routinely collect special category data, and we only collect such information where it is necessary, voluntary, and limited to a specific purpose (for example, access requirements for an event). 

 

How we use your data 

We use personal data to: 

• Respond to enquiries and correspondence 
• Maintain and manage ongoing engagement and professional working relationships 
• Coordinate meetings, record outcomes, and manage agreed actions and follow‑up 
• Deliver NIHR IO events, training and engagement activities 
• Carry out research, horizon scanning and analysis in support of health and care strategic and/or policy decision‑making
• Maintain contact with individuals who have chosen to stay engaged with NIHR IO following an event or engagement activity 
• Promote and communicate the work of NIHR IO through photographs and video recordings used in social media, websites, printed materials, marketing publications and press releases, where consent has been provided.

 

Lawful basis for processing 

Under UK GDPR, our lawful bases for processing personal data are: 

• Public task – where processing is necessary for the performance of a task carried out in the public interest, including NIHR‑funded research, horizon scanning, stakeholder and ecosystem engagement, meeting management, and activities that support health and care strategic and/or policy decision‑making. 

• Consent – where you choose to receive optional communications such as newsletters or email alerts.
• Consent – where you agree to the collection and use of photographs or video recordings taken during NIHR IO events, training and engagement activities for promotional and communications purposes. 

You can withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us. Where consent relates to photographs or video recordings, we will stop future use of your images wherever reasonably practicable. However, it may not always be possible to remove images or recordings that have already been published in printed materials, distributed publications, press releases, social media content, or archived communications.

 

Who we share your data with 

We only share personal data where necessary and with appropriate safeguards in place. 

Personal data may be processed on our behalf by trusted third‑party service providers who support our website, relationship management and communications. These organisations act under contract and are required to protect your data and use it only in accordance with our instructions. 

Where you attend an NIHR IO event hosted in a Newcastle University building (such as The Catalyst), we may share your name internally within the University with building reception for the purposes of visitor management and security. 

Where NIHR IO events or engagement activities are hosted at external venues or jointly with partner organisations, we may share limited attendee information (such as names and organisations) with the event host for their own event management purposes. 

Where photographs or video recordings are used for promotional and communications purposes, they may appear on NIHR IO websites, social media platforms, printed publications, marketing materials, media releases and other communications channels operated by Newcastle University or NIHR IO. 

Some service providers may process data outside the UK. Where this happens, appropriate safeguards are in place to ensure your personal data remains protected. 

 

How long we keep your data 

We keep personal data only for as long as it is necessary for the purposes for which it was collected. Retention periods vary depending on the type of data and how it is used. 

Stakeholder contact and engagement records 

Contact details and records relating to ongoing engagement activities are retained while there is an active and relevant working relationship. These records are reviewed periodically (for example, every 2–3 years) and are securely deleted or archived when they are no longer required. 

Correspondence and meeting records 

Emails, meeting notes, action logs and related correspondence are retained to support operational delivery, accountability and follow‑up. Such records are typically retained for between 2 and 5 years after the last meaningful interaction, depending on the nature of the engagement, and are reviewed regularly to ensure they remain necessary. 

Research, analysis and horizon‑scanning outputs 

Where personal data is used as part of NIHR IO’s research and analytical work, it is retained only for as long as needed for those purposes. Research outputs are generally retained long‑term in anonymised or aggregated form, and identifiable personal data is removed or anonymised as soon as practicable. 

Newsletter and communications data 

Personal data processed on the basis of consent (such as newsletter subscriptions) is retained for as long as you remain subscribed and is deleted when you unsubscribe or request removal. 

In all cases, retention is managed in line with Newcastle University’s records management requirements and NIHR IO’s internal data management practices. 

Photographs and video recordings

Photographs and video recordings collected with your consent for promotional and communications purposes are normally retained for between 3 and 5 years. Records are reviewed periodically and deleted when they are no longer required for the purposes for which they were collected, or sooner where consent is withdrawn and continued retention is no longer necessary.

 

Your data protection rights 

Under UK GDPR, you have the right to: 

• Access your personal data 
• Request correction of inaccurate or incomplete data
• Request deletion of your data in certain circumstances 
• Object to or restrict processing 
• Withdraw consent at any time (where consent is the lawful basis) 

 

How to contact us 

If you have questions about how NIHR Innovation Observatory uses your personal data, please contact: 

NIHR Innovation Observatory – Data Manager
Email: dan.gittins@newcastle.ac.uk 

If your query relates specifically to stakeholder engagement activities or meeting management, you may also contact: 

NIHR Innovation Observatory – Engagement Team
Email: io.engagement@newcastle.ac.uk 

For data protection queries, to exercise your rights, or to raise a concern, please contact Newcastle University’s Data Protection Officer: 

Email: rec-man@newcastle.ac.uk 

 

Complaints 

If you are unhappy with how your personal data has been handled, you can complain to the Information Commissioner’s Office (ICO):
https://ico.org.uk/