This document sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
We are the Health Research Board (‘HRB’), a statutory body which acts under the auspices of the Department of Health, with an address at Grattan House, 67-72 Lower Mount Street, Dublin 2, D02 H638.
We are the lead agency responsible for facilitating, supporting and funding health research in Ireland. Our role is to assist the Department of Health in its planning for certain health care services.
This notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.
We use certain expressions throughout this document such as Personal data. This means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Special categories of Personal Data and Sensitive personal data means information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
For the purpose of the Data Protection Acts 1988 and 2003 (as amended) (the ‘DPA’) and from 25 May 2018, the General Data Protection Regulation (the ‘GDPR’), the data controller is the HRB.
Our data protection officer for the purpose of the DPA is: The Director of Corporate Operations.
You may give us information by:
- corresponding with us by phone, e-mail or otherwise. We ask you to disclose only as much information as is necessary for the purpose of your interaction with us or when submitting a question/suggestion/comment in relation to our website or our services.
- applying to work with us as an employee or contractor or to act as a Peer Reviewer for the assessment of grants on our behalf. The type of information you may provide includes your CV, a cover letter, your name, address, e-mail address and phone number. CVs should include information relevant to your employment history and education (degrees obtained, places worked, positions held, relevant awards, and so forth). We ask that you do not disclose sensitive personal information (e.g. gender, height, weight, medical information, religion, philosophical or political beliefs, financial data) in your application.
- you or your team applying for a research grant with us.
- using healthcare services and facilities in Ireland provided by the Health Service Executive and a number of independent healthcare service providers, in the treatment and provision of services in respect of drug and alcohol addiction, intellectual and physical disability and mental health.
- using our National Drugs Library service. Users are required to complete a form for the purposes of protecting copyrighted material and information collected includes name, address, phone number and e-mail address.
We collect the information in order to comply with our statutory function as set out under S.I. No. 279/1986 and to operate our organisation, to distribute research grants, to improve our website, to recruit staff, to engage Peer Reviewers and contracted researchers. We will use this information:
- to liaise with you about projects that we are undertaking with you;
- to carry out our obligations arising from any contracts entered into between you and us;
- to create a candidate profile for you;
- to communicate any upcoming HRB events;
- to assess a grant application which you submit to us and to distribute a grant where you are successful in your application to us;
- to fulfil our statutory function which includes an obligation to maintain and develop Health Information Systems databases for healthcare research and planning purposes;
- as part of our efforts to keep our website safe and secure;
- to make suggestions and recommendations to you and other users of our website about services that may interest you or them.
The legal bases for the processing of your data are:
- that you have provided consent for the processing for one or more specific purposes. For example, when you subscribe to our Ezine or website alerts or the assessment of a grant application which you submit to us; or when you use certain healthcare services and facilities in Ireland and you provide your consent on foot of a notification received from the healthcare service provider;
- processing necessary for the performance of a contract which you have entered into with us or to take steps at your request prior to entering into a contract;
- processing necessary for compliance with a legal obligation to which we are subject;
- processing necessary is for the performance of a task in the public interest or in the exercise of official authority vested in us by virtue of our statutory functions as set out in SI No. 279/1986 and Section 2(b) of SI No. 305/2007.
Health Service Providers
In order to fulfil our statutory functions, when you use healthcare services and facilities in Ireland provided by the Health Service Executive and a number of independent healthcare service providers, for the treatment and provision of services in respect of drug and alcohol addiction, intellectual and physical disability and mental health, we obtain the following categories of personal data from others:
- Name and address;
- Date of birth;
- Nationality and ethnicity;
- Previous admissions;
- Treatment or services received;
- Discharge date;
- Condition at date of discharge;
Your research body/institution may provide us with your contact details and CV as part of a research grant application.
Healthcare Service Providers
We obtain this information from the Health Service Executive and other independent healthcare service providers from whom you are receiving treatment or services. In these circumstances, you will have provided your consent to the service providers that your data may be used in this way.
We obtain this information from your research body/institution as part of a research grant application submitted to us.
In order for us to fulfil our statutory function, we may share your personal data with selected third parties including:
- the Health Service Executive, the Department of Health, and the European Medicines Agency, in the performance of our statutory functions, the aims of which are to improve health and the effectiveness of health services in Ireland.
- Government agencies such as the Revenue Commissioners, Garda Síochana, or other agencies for the detection, investigation or prosecution of offences and to enable them to perform their functions.
We may also share your information with selected third parties including:
- Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you and to assist us in fulfilling our statutory functions.
We have set out below a list of third parties with whom we share your data:
- HSE, Department of Health and other government & European health agencies
- Sub-contractors e.g. Peer Reviewers
- Cloud Service Providers
- IT Back-up Providers
- Archive/shredding companies
- Email and IT service providers
- Accounting software
- CCTV service providers
- Security software
- Cookie analytics service provider
The time periods for which we retain your information depends on the type of information and the purposes for which we use it. We will keep your information for no longer than is required or permitted. For further information please see our Data Retention Policy on our website.
We do not transfer your data outside of the EU.
You have the following rights:
- The right to access the information we hold about you.
- The right to require us to rectify any inaccurate information about you without undue delay.
- The right to have us erase any information we hold about you in circumstances such as where it is no longer necessary for us to hold the information for your use of our services or if you have withdrawn your consent to the processing.
- The right to object to us processing information about you such as processing for profiling or direct marketing.
- The right to ask us to provide your information to you in a portable format or, where technically feasible, for us to port that information to another provider provided it does not result in a disclosure of information relating to other people.
- The right to request a restriction of the processing of your information.
Where our processing of your information is based on your consent to that processing, you have the right to withdraw that consent at any time but any processing that we have carried out before you withdrew your consent remains lawful.
You may exercise any of the above rights by: writing to The Director of Corporate Operations at email@example.com or by post to Health Research Board, Grattan House, 67-72 Lower Mount Street, Dublin 2.
You may lodge a complaint with your local supervisory authority with respect to our processing of your information. In Ireland, the local Supervisory Authority is the Office of the Data Protection Commissioner with an address at Canal House, Station Road, Portarlington, Co. Laois.
This notice may change from time to time, and any changes will be posted on our website and will be effective when posted. Please review this notice each time you use our website or our services. This notice was last updated on the date appearing on the cover hereof. (2 May 2018)