Market Research Privacy Notice
1. Who we are
Nexcea Limited (“Nexcea”, “we”) is an independent life sciences consultancy registered in England and Wales, company number 12542772, with its registered office at Adamson House, Wilmslow Road, Manchester, M20 2YY, United Kingdom. We are the data controller for the personal information described in this notice. Contact us about anything in this notice at dpo@nexcea.com. We are registered with the Information Commissioner’s Office (ICO), registration ZA768010.
2. What this notice covers
This notice explains how we handle personal information when we carry out market research studies — for example, paid research interviews with healthcare practitioners in the United Kingdom, Spain, Germany and Australia. This notice is provided in English and applies to all of these studies. It applies from the moment we first contact a potential participant through to the deletion of the study records. Where a study has extra terms, we set them out in the participant information and service agreement for that study.
3. The information we collect, and where it comes from
Professional contact details. Name, role, clinic or employer, work email address and work phone number. We collect these from publicly available professional sources — clinic websites, professional directories and public registers — or directly from you.
Screening and eligibility information. Qualifications, professional registration details, insurance status and relevant clinical experience, provided by you. We may check registration details against the relevant public register.
Booking information. The details you enter when booking an interview through our scheduling provider.
Interview information. The recording and transcript of the interview, our notes, and the views you express.
Payment information. The bank account details you give us for the honorarium, collected through the service agreement process rather than by email, and our record of the payment.
Please do not share information that could identify a patient at any point. If patient-identifying details are mentioned inadvertently, we redact or delete them.
4. How we use the information
The lawful bases below are cited from the UK GDPR; for participants in the EU, the equivalent articles of the EU GDPR apply.
Identifying and inviting potential participants, using professional contact details from public sources. Lawful basis: legitimate interests (UK GDPR article 6(1)(f)) — conducting market research and contacting professionals about their area of practice.
Screening answers and verifying eligibility, including checking professional registration. Lawful basis: legitimate interests, and steps taken at your request before entering the participation agreement (article 6(1)(b)).
Conducting, recording and analysing the interview. Lawful basis: legitimate interests; we record the interview only with your consent.
Paying the honorarium and keeping payment records. Lawful basis: performance of the participation agreement (article 6(1)(b)); legal obligation (article 6(1)(c)) for tax and accounting records.
Reporting adverse events or product complaints mentioned during research (pharmacovigilance). Lawful basis: legal obligation and legitimate interests — the safety reporting duties that apply to medicines.
Keeping a minimal suppression list of people who have opted out. Lawful basis: legitimate interests — making sure we respect opt-out requests.
Where we rely on legitimate interests, we have balanced those interests against your rights and interests, and we limit what we collect to what the study needs. You can object at any time (see section 8).
5. Who we share information with
Research findings given to the client that commissioned a study are anonymised and aggregated. We do not tell the client who took part, and we do not attribute quotes to named individuals, unless you agree to this in writing beforehand. The exception is safety reporting: if you describe an adverse event or product complaint, medicines safety rules may require us to pass a report — which can include your professional contact details as the reporter — to the relevant marketing authorisation holder’s safety team.
We use a small number of service providers who process personal information on our instructions: Calendly (interview scheduling), Microsoft (Teams and Microsoft 365, where interviews are held and recordings and documents are stored) and our bank (honorarium payments). We may also use AI research assistants (for example, Anthropic’s Claude) as tools to help find and organise publicly available professional information; these providers process data on our instructions. We do not sell personal information, and we do not use it for advertising.
6. International transfers
Our service providers may process some information outside the UK — for example, Calendly processes data in the United States. Where this happens, we rely on a UK adequacy decision (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or on the ICO’s International Data Transfer Agreement or Addendum. For participants in the EU: your data is transferred to the United Kingdom under the European Commission’s adequacy decision for the UK. For participants in Australia: your information is held outside Australia, mainly in the UK.
7. How long we keep information
Invitation lists: for the duration of the study’s recruitment, then deleted within three months.
Recordings and transcripts: deleted six months after the study is completed, unless a legal duty requires longer.
Payment and contract records: six years plus the current financial year, to meet tax and accounting requirements.
Safety (pharmacovigilance) reports: for as long as medicines safety law requires.
Suppression list: the minimal details needed to honour an opt-out, kept until the opt-out is withdrawn.
8. Your rights
Under UK data protection law you have the right to ask for access to your information, to have it corrected or deleted, to restrict or object to our use of it (including objecting to any further research invitations), and to data portability. Where we rely on your consent — for example, for recording an interview — you can withdraw it at any time; this does not affect processing that took place before you withdrew it.
To use any of these rights, contact dpo@nexcea.com. We respond within one month. If you are unhappy with how we handle your information, you can complain to the ICO at ico.org.uk or on 0303 123 1113 — or to your local supervisory authority: in Spain the AEPD (www.aepd.es), in Germany the data protection authority of your federal state, and in Australia the OAIC (oaic.gov.au) — although we would welcome the chance to resolve the issue first.
9. Opting out of future invitations
Reply “opt out” to any invitation, or email us, and we will stop contacting you about research. We keep your name and email address on a suppression list purely so that we do not contact you again.
10. Automated decision-making and changes to this notice
We do not make decisions about you by automated means that have legal or similarly significant effects. We may use software tools, including AI tools, to help identify potential participants from public sources and to organise research information; a person reviews the results and makes all decisions about invitations, eligibility and payment. If we change this notice, we will update the version number and date above; significant changes that affect a live study will be communicated to its participants directly.