Dowload this page content in an MS Word document

Who we are

We are the Health Research Board (‘HRB’), a statutory body which acts under the auspices of the Department of Health, with an address at Grattan House, 67-72 Lower Mount Street, Dublin 2, D02 H638.

We are the lead agency responsible for facilitating, supporting and funding health research in Ireland. Our role is to assist the Department of Health in its planning for certain health care services.

This notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.  Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

We use certain expressions throughout this document such as Personal data. This means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Special categories of Personal Data and Sensitive personal data means information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

For the purpose of the Data Protection Acts 1988 and 2003 (as amended) (the ‘DPA’) and from 25 May 2018, the General Data Protection Regulation (the ‘GDPR’), the data controller is the HRB.

Our data protection officer for the purpose of the DPA is: The Director of Corporate Operations.


To top

What information do we collect from you?

You may give us information by:

  • corresponding with us by phone, e-mail or otherwise. We ask you to disclose only as much information as is necessary for the purpose of your interaction with us or when submitting a question/suggestion/comment in relation to our website or our services.
  • applying to work with us as an employee or contractor or to act as a Peer Reviewer for the assessment of grants on our behalf. The type of information you may provide includes your CV, a cover letter, your name, address, e-mail address and phone number. CVs should include information relevant to your employment history and education (degrees obtained, places worked, positions held, relevant awards, and so forth). We ask that you do not disclose sensitive personal information (e.g. gender, height, weight, medical information, religion, philosophical or political beliefs, financial data) in your application.
  • you or your team applying for a research grant with us.
  • using healthcare services and facilities in Ireland provided by the Health Service Executive and a number of independent healthcare service providers, in the treatment and provision of services in respect of drug and alcohol addiction, intellectual and physical disability and mental health.
  • using our National Drugs Library service. Users are required to complete a form for the purposes of protecting copyrighted material and information collected includes name, address, phone number and e-mail address.

To top

Why do we collect this information

We collect the information in order to comply with our statutory function as set out under S.I. No. 279/1986 and to operate our organisation, to distribute research grants, to improve our website, to recruit staff, to engage Peer Reviewers and contracted researchers. We will use this information:

  • to liaise with you about projects that we are undertaking with you;
  • to carry out our obligations arising from any contracts entered into between you and us;
  • to create a candidate profile for you;
  • to communicate any upcoming HRB events;
  • to assess a grant application which you submit to us and to distribute a grant where you are successful in your application to us;
  • to fulfil our statutory function which includes an obligation to maintain and develop Health Information Systems databases for healthcare research and planning purposes; 
  • to administer and improve our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. For further information please see our Cookie Policy on our website;
  • as part of our efforts to keep our website safe and secure;
  • to make suggestions and recommendations to you and other users of our website about services that may interest you or them.

The legal bases for the processing of your data are:

  1. that you have provided consent for the processing for one or more specific purposes. For example, when you subscribe to our Ezine or website alerts or the assessment of a grant application which you submit to us; or when you use certain healthcare services and facilities in Ireland and you provide your consent on foot of a notification received from the healthcare service provider;
  2. processing necessary for the performance of a contract which you have entered into with us or to take steps at your request prior to entering into a contract;
  3. processing necessary for compliance with a legal obligation to which we are subject;
  4. processing necessary is for the performance of a task in the public interest or in the exercise of official authority vested in us by virtue of our statutory functions as set out in SI No. 279/1986 and Section 2(b) of SI No. 305/2007.

To top

What information about you do we obtain from others?

Health Service Providers

In order to fulfil our statutory functions, when you use healthcare services and facilities in Ireland provided by the Health Service Executive and a number of independent healthcare service providers, for the treatment and provision of services in respect of drug and alcohol addiction, intellectual and physical disability and mental health, we obtain the following categories of personal data from others:

  • Name and address;
  • Date of birth;
  • Occupation;
  • Nationality and ethnicity;
  • Diagnosis;
  • Previous admissions;
  • Treatment or services received;
  • Discharge date;
  • Condition at date of discharge;

Grant Applications

Your research body/institution may provide us with your contact details and CV as part of a research grant application.

To top

Where did we get this information?

Healthcare Service Providers

We obtain this information from the Health Service Executive and other independent healthcare service providers from whom you are receiving treatment or services.  In these circumstances, you will have provided your consent to the service providers that your data may be used in this way.

Grant Applications

We obtain this information from your research body/institution as part of a research grant application submitted to us.

To top

Who might we share this information with?

In order for us to fulfil our statutory function, we may share your personal data with selected third parties including:

  • the Health Service Executive, the Department of Health,  and the European Medicines Agency, in the performance of our statutory functions, the aims of which are to improve health and the effectiveness of health services in Ireland.
  • Government agencies such as the Revenue Commissioners, Garda Síochana, or other agencies for the detection, investigation or prosecution of offences and to enable them to perform their functions.

To top

Disclosure of your information

We may also share your information with selected third parties including:

  • Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you and to assist us in fulfilling our statutory functions.

We have set out below a list of third parties with whom we share your data:

  1. HSE, Department of Health and other government & European health agencies
  2. Sub-contractors e.g. Peer Reviewers
  3. Cloud Service Providers
  4. IT Back-up Providers
  5. Archive/shredding companies
  6. Email and IT service providers
  7. Auditors
  8. Accounting software
  9. CCTV service providers
  10. Security software
  11. Cookie analytics service provider

To top

How long do we keep hold of your information?

The time periods for which we retain your information depends on the type of information and the purposes for which we use it. We will keep your information for no longer than is required or permitted. For further information please see our Data Retention Policy on our website.

We do not transfer your data outside of the EU.

To top

What are your rights with respect to your information?

You have the following rights:

  • The right to access the information we hold about you.
  • The right to require us to rectify any inaccurate information about you without undue delay.
  • The right to have us erase any information we hold about you in circumstances such as where it is no longer necessary for us to hold the information for your use of our services or if you have withdrawn your consent to the processing.
  • The right to object to us processing information about you such as processing for profiling or direct marketing.
  • The right to ask us to provide your information to you in a portable format or, where technically feasible, for us to port that information to another provider provided it does not result in a disclosure of information relating to other people.
  • The right to request a restriction of the processing of your information.

Where our processing of your information is based on your consent to that processing, you have the right to withdraw that consent at any time but any processing that we have carried out before you withdrew your consent remains lawful.

You may exercise any of the above rights by: writing to The Director of Corporate Operations at or by post to Health Research Board, Grattan House, 67-72 Lower Mount Street, Dublin 2.

You may lodge a complaint with your local supervisory authority with respect to our processing of your information.  In Ireland, the local Supervisory Authority is the Office of the Data Protection Commissioner with an address at Canal House, Station Road, Portarlington, Co. Laois.

What will happen if we change our privacy notice?

This notice may change from time to time, and any changes will be posted on our website and will be effective when posted. Please review this notice each time you use our website or our services. This notice was last updated on the date appearing on the cover hereof. (2 May 2018)

To top

How can you contact us?

You can contact us:

by phone: 01 2345000

Our Data Protection Officer can be contacted by email at or by post to;

Health Research Board,

Grattan House,


Lower Mount Street,

Dublin 2, D02 H638.


To top