1. About this notice

This privacy notice explains how Orizzonte Clinical Research Ltd collects, uses, shares, stores and protects personal information relating to:

• visitors to our website;
• people who contact us;
• healthcare professionals, representatives of Sponsors, CROs, suppliers and other professional contacts;
• people who join the Orizzonte Research Registry;
• people who express an interest in a clinical researchstudy;
• people who make a general careers enquiry; and
• people who exercise their data-protection rights or make a complaint.

It also explains your rights and how to contact us about the use of your personal information.

A clinical study may involve different organisations with different responsibilities for personal information. If you are invited to take part in a study, you will receive study-specific privacy information explaining how your information will be used, which organisation or organisations are responsible for it, the applicable lawful basis, how long it will be retained and with whom it may be shared.

This general notice does not replace a study’s Participant Information Sheet, consent documentation or study-specific privacy notice.

2. Who we are

Orizzonte Clinical Research Ltd is a company registered in England and Wales under company number 15388883.

Our registered office is:

Orizzonte Clinical Research Ltd
1st Floor North
Westgate House
The High
Harlow
United Kingdom
CM20 1YS

Website: www.orizzonte.co.uk
Telephone: +44 (0)333 015 2632
Privacy contact: enquiries@orizzonte.co.uk

You may also contact us through the Contact page on our website or write to us at our registered office. Mark postal correspondence “Private and confidential – Data Protection”.

For the website, our own business communications, the Orizzonte Research Registry and general study-enquiry information, Orizzonte Clinical Research Ltd will normally be the controller where it decides why and how the personal information is used.

For a particular clinical study, the Sponsor, a participating healthcare organisation, Orizzonte or another research organisation may have controller or processor responsibilities. The study-specific information provided to you will explain the applicable arrangement.

3. The personal information we may collect

The information we collect depends on how you interact with us.

Website and technical information

This may include:

• internet protocol address;
• browser, device and operating-system information;
• pages visited and actions taken on the website;
• approximate location derived from an internet protocol address;
• cookie and similar-technologyidentifiers;
• security, access and error logs; and
• consent preferences recorded through our cookie controls.

General enquiries

This may include:

• name;
• email address;
• telephone number;
• organisation and professional role;
• the contents of your enquiry;
• your preferred contact method; and
• records of our communications with you.

Please do not include medical information or other sensitive information in a general contact enquiry unless we have specifically asked you to provide it through an appropriate, secure process.

Business and professional contacts

If you represent a Sponsor, CRO, healthcare organisation, supplier or other business, or you are a healthcare professional, we may collect:

• professional contact details;
• job title, organisation and work location;
• areas of professional interest or expertise;
• correspondence and meeting records;
• contractual, due-diligence and relationship-management information; and
• information required for financial, legal, governance or compliance purposes.

We may obtain professional information directly from you, your organisation or appropriate public professional sources.

Orizzonte Research Registry

If you choose to join our Research Registry, we may collect:

• name;
• date of birth or age;
• email address and telephone number;
• postcode or broad geographical area;
• preferred method of contact;
• research or health areas in which you have expressed an interest;
• limited health information that you choose to provide;
• your consent choices;
• records of research opportunities discussed with you; and
• records of contact, withdrawal or changes to your preferences.

Health information is special-category personal information and receives additional legal protection.

Joining the Research Registry does not mean that you are eligible for any study, that you have agreed to participate in a study or that a place in a study is guaranteed.

Joining the Registry does not, by itself, authorise Orizzonte to access your GP, hospital or other medical records. If access to medical records may be required for a particular study, you will be given separate information explaining the proposed access, the organisations involved and the relevant authority or consent.

Expressions of interest in a particular study

If you ask to be contacted about a particular study, we may collect:

• identity and contact information;
• age or date of birth;
• postcode or geographical area;
• preferred contact method;
• limited answers relating to the study’s initial eligibility requirements;
• relevant health information that you choose to provide;
• the source through which you heard about the study;
• records of contact with you; and
• your consent and communication preferences.

An initial enquiry or preliminary screening discussion is not a clinical assessment, confirmation of eligibility or consent to participate in the study.

Before your information is transferred to a Sponsor, CRO, research site, healthcare organisation or other study team, you will be told who will receive it, why it is being shared and what data-protection arrangements apply, unless the recipient and purpose have already been clearly identified in the study-specific notice presented to you.

Careers enquiries

If you make a general careers enquiry, we may collect your name, contact details, professional history and information that you choose to include in your message or curriculum vitae.

If Orizzonte operates a formal recruitment process, candidates should receive a separate applicant privacy notice before detailed application, assessment, equality-monitoring, background-check or employment information is collected.

Rights requests and complaints

If you contact us about your data-protection rights or make a complaint, we may collect:

• your identity and contact details;
• information needed to confirm your identity;
• details of your request or concern;
• relevant correspondence and evidence; and
• records of our investigation and response.

4. How we collect personal information

We may collect personal information:

• directly from you through our website, forms, email, telephone or in-person communications;
• from your organisation or professional representatives;
• from service providers acting on our instructions;
• from publicly available professional sources;
• from a Sponsor, CRO, research site or healthcare organisation where sharing is lawful and appropriately explained; or
• through website cookies and similar technologies, subject to your choices.

Where information is obtained from another source, we will provide appropriate privacy information within the legally required period unless an exemption applies.

5. Why we use personal information and our lawful bases

We use personal information only where we have an appropriate legal basis.

Activity	Why we use the information	UK GDPR lawful basis
Operating and securing the website	To provide the website, prevent misuse, diagnose faults and protect our systems	Legitimate interests in operating a reliable and secure website; legal obligation where applicable
Responding to general enquiries	To understand and answer your enquiry and maintain an appropriate record	Legitimate interests; or steps requested by you before entering a contract where applicable
Managing professional and business relationships	To communicate with Sponsors, CROs, healthcare organisations, suppliers and other professional contacts	Legitimate interests; contract; steps before entering a contract; or legal obligation, depending on the circumstances
Operating the Research Registry	To record your research interests, consider whether opportunities may be relevant and contact you in accordance with your choices	Consent under Article 6(1)(a)
Using health information in the Research Registry	To consider whether research opportunities may be relevant to the health interests you have identified	Explicit consent under Article 9(2)(a)
Responding to a study expression of interest	To review the limited information submitted, conduct appropriate preliminary screening and contact you about the identified study	Consent under Article 6(1)(a), unless a study-specific notice clearly identifies another appropriate basis
Using health information in a preliminary study enquiry	To assess whether it may be appropriate to discuss the study with you	Explicit consent under Article 9(2)(a), unless a study-specific notice clearly identifies another condition
General careers enquiries	To respond to your enquiry and, where applicable, take steps requested before a possible employment contract	Steps before entering a contract; legitimate interests; and legal obligation where applicable
Electronic communications and marketing	To send communications that you have requested or that we are otherwise permitted to send	Consent where required by the Privacy and Electronic Communications Regulations; otherwise legitimate interests where lawful
Non-essential cookies and analytics	To understand website use and improve the website	Consent
Handling rights requests, complaints and regulatory matters	To meet our legal duties, establish relevant facts and maintain appropriate records	Legal obligation; legitimate interests in managing complaints and protecting legal rights
Preventing or investigating unlawful activity	To protect participants, staff, systems, assets and legal rights	Legitimate interests; legal obligation; or substantial public-interest conditions where applicable

Where we rely on legitimate interests, we consider whether the proposed use is necessary and balance our interests against your rights and reasonable expectations.

We do not use consent where you have no genuine choice. Where we do rely on consent, you may withdraw it at any time.

6. Health information and other special-category information

Health information receives additional protection under data-protection law.

For the general Research Registry and consent-based preliminary study-enquiry forms, Orizzonte will ordinarily rely on your explicit consent before using health information. The consent request must be separate, specific and clearly identify what health information will be used and for what purpose.

For information processed as part of a clinical study, the lawful basis and special-category condition may differ. These will be identified in the study-specific privacy information.

Your ethical or clinical consent to participate in research is distinct from the lawful basis used to process personal information under data-protection law.

We will not ask for genetic information, complete medical records, detailed diagnoses or other extensive health information through a general website form unless it is demonstrably necessary, appropriately secured and covered by clear study-specific information.

7. The Orizzonte Research Registry

Participation in the Research Registry is voluntary.

We use Registry information to:

• record the areas of research in which you have expressed an interest;
• identify research opportunities that may be relevant;
• contact you using your chosen method;
• ask limited preliminary questions where appropriate;
• maintain accurate consent and communication records; and
• honour a request to withdraw or change your preferences.

We will not treat Registry membership as consent to participate in a study.

If a potentially relevant study is identified, we will provide further information. Any decision about participation will be made separately, after the appropriate study information and consent process.

You may leave the Registry or change your preferences at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We may retain a minimal record of a withdrawal where necessary to ensure that the person is not contacted again or to demonstrate that the request was honoured.

8. Clinical research studies

Clinical research involves study-specific governance, ethical and legal requirements.

If you enter a formal screening or participation process, the study information should explain:

• the identity of the Sponsor;
• the participating research site or healthcare organisation;
• which organisation or organisations are controllers;
• Orizzonte’srole;
• the information collected;
• why it is required;
• the lawful basis and special-categorycondition;
• whether information is obtained from medical records;
• who will receive coded, identifiable or anonymised information;
• whether information will leave the United Kingdom;
• how long it will be retained;
• whether you can withdraw from the study and what happens to information already collected; and
• how to exercise your information rights.

Where Orizzonte acts only on the documented instructions of a Sponsor or another controller, requests concerning study data may need to be handled by that controller. Orizzonte will help direct the request appropriately.

Information already collected for a clinical study may sometimes need to be retained after a participant stops taking part, for example to preserve the reliability, safety and regulatory integrity of the research. The study-specific information should explain this clearly.

9. Who we may share information with

We may share personal information, where necessary and lawful, with:

• authorised Orizzonte personnel who need it for their work;
• organisations providing secure hosting, communications, information technology, database, form-management or other services to Orizzonte;
• professional advisers, auditors and insurers;
• regulators, research ethics bodies, public authorities, courts or law-enforcement bodies where disclosure is required or permitted by law;
• a relevant Sponsor, CRO, research site, Visit Centre, healthcare organisation or authorised study team where this is necessary for a clearly identified study and has been appropriately explained; and
• another organisation involved in a business reorganisation, subject to appropriate confidentiality and data-protection safeguards.

Service providers acting on our instructions must be subject to appropriate contractual and security requirements.

We disclose only the information reasonably necessary for the identified purpose.

We will not disclose Registry or study-enquiry health information to an unrelated organisation for its independent marketing purposes.

10. International transfers

Some technology or research arrangements may involve access to personal information from outside the United Kingdom.

Before publication, Orizzonte must confirm whether any current website, Registry, communications, hosting, analytics, CRM, cloud-storage or study systems involve international access or storage and identify the relevant countries or service-provider locations here or in an accessible supporting notice.

Where a transfer of personal information outside the United Kingdom is a restricted transfer, we will use a legally recognised safeguard. This may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s standard contractual clauses; or
• another legally permitted transfer mechanism.

Where required, we will also complete an appropriate transfer risk or data-protection assessment and apply supplementary safeguards.

Study-specific international transfers will be explained in the relevant study information.

You may contact us for further information about the safeguards relevant to your information.

11. How long we retain information

We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, including legal, regulatory, contractual, safety, audit and dispute-management requirements.

The following periods are the recommended Orizzonte public retention rules. They must be checked against the actual Orizzonte retention schedule, study contracts and system-deletion capability before publication.

Information	Proposed retention rule requiring final approval
General website or contact enquiry	Up to 24 months after the enquiry is closed or the last meaningful contact, unless a continuing relationship or legal reason requires longer
Business, Sponsor, CRO, healthcare-professional or supplier relationship	For the relationship and up to six years afterwards where required for contract, accounting, audit, insurance or legal-claim purposes
Research Registry information	Until consent is withdrawn or 24 months have passed since the person last confirmed an interest or meaningfully interacted with the Registry, whichever occurs first
Unsuccessful preliminary study enquiry	Until 12 months after recruitment for the relevant study closes, unless a shorter study-specific period applies or the person separately consents to remain in the Registry
Information about an enrolled or formally screened study participant	The period stated in the study-specific privacy information and approved study documentation
General careers enquiry or unsuccessful application	Six months after the recruitment decision; up to 12 months only where the individual separately agrees to consideration for future roles
Cookie and analytics information	For the period identified in the Cookie Notice and cookie settings
Website security and access logs	Normally no more than 12 months unless an incident requires longer investigation or retention
Consent, withdrawal, rights-request and data-protection complaint records	Up to six years after closure where necessary to demonstrate compliance or manage legal claims

When a retention period ends, information will be securely deleted, anonymised or placed beyond routine use in accordance with the applicable retention process.

Anonymised information that can no longer identify a person may be retained for statistical, research-planning or service-improvement purposes.

12. Security

We use proportionate organisational and technical measures designed to protect personal information against:

• unauthorised or unlawful access;
• accidental loss, destruction or damage;
• inappropriate alteration or disclosure; and
• avoidable collection or retention.

Measures may include access controls, staff confidentiality obligations, system monitoring, encryption where appropriate, supplier due diligence, documented procedures and incident management.

No internet or information-storage system can be guaranteed to be completely secure. If a personal-data breach occurs, we will investigate it and make any notifications required by law.

Please do not send detailed medical records or other highly sensitive information through ordinary email or a general website contact form.

13. Cookies and similar technologies

Strictly necessary cookies may be used to operate and secure the website.

Non-essential cookies, including analytics, advertising or social-media cookies, must not be set until you have made an affirmative choice through the website’s cookie controls.

The Cookie Notice should identify:

• each cookie or technology used;
• its provider;
• its purpose;
• how long it remains active;
• whether information is shared with another organisation; and
• how consent can be changed or withdrawn.

Withdrawing cookie consent must be as straightforward as giving it.

This section must be verified against a current technical cookie scan and the consent banner actually implemented on the website before publication.

14. Communications and marketing

We may contact you to respond to an enquiry, administer the Registry, discuss a study in which you have expressed an interest or manage an existing professional relationship. These are service or relationship communications and are not necessarily marketing.

Where electronic-marketing consent is required, we will ask for it separately. We will identify Orizzonte in the communication and provide a straightforward way to unsubscribe.

Withdrawing marketing consent will not prevent essential communications about an enquiry, Registry withdrawal, complaint, rights request or study process with which you are already involved.

15. Children’s information

Unless a particular study and its approved materials clearly state otherwise, the general Research Registry and general study-enquiry forms are intended for adults aged 18 or over.

A parent or guardian should not submit a child’s health information through a general Orizzonte form.

Where research involving children or young people is conducted, the study will use age-appropriate information, consent and assent arrangements approved for that study. The study-specific privacy information will explain how the child’s and parent’s or guardian’s information is used.

16. Automated decision-making

Orizzonte must confirm this statement against its actual Registry and screening systems before publication:

Orizzonte does not use information submitted through its general website or Research Registry to make a decision based solely on automated processing that produces legal or similarly significant effects.

Digital tools may assist with searching, organising or identifying potentially relevant records, but an expression of interest must not be treated as confirmed eligibility without appropriate human review and the study’s approved screening process.

If Orizzonte introduces significant solely automated decision-making, we will provide the legally required information about the logic involved, the likely consequences and the available safeguards.

17. Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about the use of your personal information;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information;
• ask us to restrict its use;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent; and
• ask for human intervention in relation to qualifying solely automated decisions.

These rights are not absolute. For example, research, regulatory, safety, legal-claim or record-integrity requirements may limit what can be erased or changed. If an exemption or restriction applies, we will explain this unless the law prevents us from doing so.

To make a request, contact us using the details in section 2. Please describe the information or processing concerned and the right you wish to exercise.

We may ask for information reasonably necessary to confirm your identity. We will not request more identification than is proportionate.

We will normally respond within one month after receiving a valid request and any reasonably required identity information. Where the law allows additional time because a request is complex or numerous, we will tell you and explain the reason.

There is normally no fee. A reasonable fee may apply, or a request may be refused, where the law permits this because the request is manifestly unfounded or excessive.

18. How to make a data-protection complaint

If you are concerned about the way Orizzonte has used your personal information, contact:

Data Protection Complaints
Orizzonte Clinical Research Ltd
1st Floor North
Westgate House
The High
Harlow
United Kingdom
CM20 1YS

Email: enquiries@orizzonte.co.uk

Please provide:

• your name and contact details;
• a clear description of the concern;
• relevant dates, communications or reference numbers; and
• the outcome you would like us to consider.

We will:

• acknowledge a data-protection complaint within 30 days;
• take appropriate steps to investigate it;
• keep you informed where more time or information is reasonably required; and
• communicate the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office.

Information Commissioner’s Office:
Make a data-protection complaint
Telephone: 0303 123 1113

You are not prevented from contacting the Information Commissioner’s Office directly, although giving Orizzonte the opportunity to investigate first may allow the matter to be resolved more quickly.

19. Changes to this notice

We may update this notice to reflect changes in our activities, technology, suppliers or legal obligations.

The current version will be published on our website with its effective date. If a change materially affects information already held about you, we will take reasonable steps to bring the change to your attention where required.

20. Contact us

For privacy questions, rights requests, consent withdrawal or complaints:

Email: enquireies@orizzonte.co.uk
Telephone: +44 (0)333 015 2632
Online: www.orizzonte.co.uk/contact

Postal address:

Orizzonte Clinical Research Ltd
1st Floor North
Westgate House
The High
Harlow
United Kingdom
CM20 1YS

 

Last reviewed:04 September 2026