Privacy Policy


The collection and analysis of the most confidential information about people is of fundamental importance for conducting medical research. MAC Clinical Research understands that in order for individuals to share their most sensitive information with us, we must have a culture of trust and that we will store data following safe data management practices.

MAC Clinical Research Finance Limited (together with its affiliates and subsidiary companies “MAC,” “we,” “us,” and “our”) is committed to ensuring that we handle all individual information in a responsible and careful manner and in accordance with data privacy and confidentiality laws.

This Privacy Policy (“Policy“) outlines our commitment as an organisation to the individuals whose data we manage, the key types of personal data we process and how that information is used. The Policy explains in general terms how we strive to comply with data privacy laws, including the European Union (“EU”) General Data Protection Regulation Article 6(1)(f) and Article 9(2)(j), UK (The Data Protection Act 2018) and any subsequent amendments to this regulation or local law equivalent that is later adopted (“Regulation”) and the privacy and confidentiality requirements of ICH Good Clinical Practice (GCP).

Who Are We?

MAC is a leading European clinical research organisation with a network of clinical research centres.  MAC provides patient engagement and recruitment services and conducts full scope ethically approved clinical research and medical trials for pharmaceutical companies (“Sponsor”), medical device companies and clinical research organisations.  MAC also provides healthcare and consultancy services.

Types of Personal Information Managed by MAC

In our capacity as a clinical research organisation providing services for Sponsors, we host and analyse significant quantities of health data relating to clinical trial participants and individuals assessed for eligibility to enter a clinical trial.  MAC also processes personal information about its employees, clients and other service providers, during the course of its business operations. MAC also processes contact information provided by members of the public via its website.

MAC may be the data processor or the controller for different types of data, and the legal basis for this processing may differ for each activity, the specific arrangements for each type of personal information we process is described in detail below:

1. Clinical Trial Participant Information

The integrity of a clinical trial relies on the accurate delivery of the clinical trial protocol and these stringent measures ensure that new medications, once approved by regulatory authorities for use by humans, can ultimately be used to benefit health and social care.

MAC gathers and manages data from individuals who have expressed their interest in a MAC clinical trial and have provided their consent to their participation.

Personal data is processed to match prospective participants to the eligibility requirements of relevant clinical trials, and to conduct study delivery and analyses. This data includes personal information such as contact details, date of birth, gender, ethnicity, and GP Surgery details; health information including current health status, health behaviours and medical history information obtained from the individual, their GP or NHS Digital; and trial data which includes the individuals eligibility to enter the trial and any treatments administered, clinical tests, observations and assessments collected during the trial and any follow-up period.

We do not use automated individual decision-making when processing medical records, but we do use search tools to identify registered individuals who may be suitable for further assessment. Eligibility is always verified by a qualified healthcare professional prior to participation in any clinical trial.

MAC is the controller of this data and has a legally obligation to process and retain this information in accordance with regulations, even if the individual does not enter the trial or withdraws from the trial after enrolment. Sponsor and regulatory representatives may audit or inspect MACs data for quality and safety purposes. However, this activity is strictly controlled, and these representatives are not permitted to remove any identifiable participant data from MAC.

MAC engages a range of specialist third-party service providers to deliver clinical trial activities and to process personal data on its behalf. All processors are required to put in place appropriate safeguards to ensure the protection of personal data. They are subject to contractual restrictions on the processing of this data which reflect their legal and contractual obligations under GDPR.

We may also process information for individuals who have consented to being considered for participation in future trials.  MAC is the data controller of this information and processes this data under the legal basis of MACs legitimate interest in offering clinical trial recruitment services.

MAC shares the data collected during a trial data with the clinical trial sponsor. This information is pseudonymised, which means that the personal data which could be used to identify the individual is removed and replaced with a special code prior to it being shared. Only MAC can use this code to link the pseudonymised data back to the individual. The Sponsor controls this pseudonymised data and is legally obliged to process and retain it in accordance with regulations.  

2. Industry Professional Information

MAC will liaise with employees, consultants, contractors and other third parties employed or engaged by our clients, when conducting our clinical trials and research activities. MAC will record and control personal data including the names, contact details and other professional information on these individuals for legitimate business-related purposes, including project and financial administration. This information may be used (including email addresses), to provide background on MAC’s services for our clients.

3. Employee and Human Resource Data

We collect and control personal information from applicants pursuing employment with MAC and MAC employees for its legitimate business-related purposes. Such data includes private contact details, professional qualifications and previous employment history, DBS and professional disbarment checks to assist with the personnel recruitment, staff performance, payroll, security, safety of our premises and tax purposes. MAC processes similar information relating to consultants, contractors and other third parties that we engage to deliver products or services.

4. Website Visitors Information

MAC collects names and contact details volunteered by visitors to our company website when making an online enquiry via the site. This includes enquiries, for example by industry professionals regarding information about company services, or when members of the public are interested in contributing to a clinical trial or applying for a job vacancy with the company. MAC may collect various data via cookie-based technologies, linked to virtual identities allocated to visitors when they access our websites. This information is used for website analytics and for first party marketing. These virtual identities are sometimes connected with real world identities of visitors when they submit named details. This enables MAC to personalise marketing messages to make them relevant to those visitors. MAC is the data controller of this information and processes it for legitimate business-related purposes in engaging with members of the public in the delivery of clinical research services, employment opportunities and business development.

Internal and External Disclosures of Personal Information

Personal information is only shared on a “need to know” basis within MAC and its affiliates and with relevant third parties to deliver stated legitimate business purposes and legal obligations. Any access to personal information contained within databases and binders is carefully restricted and only viewable by appropriate staff for legitimate purposes. MAC does not trade or sell personal information.

Under some circumstances, MAC may be required by law enforcement or judicial authorities to disclose certain personal information as part of investigations or for litigation purposes. MAC may disclose personal information to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganisation, dissolution or other sale or transfer of MAC or cases or all of its assets.

Any companies who work as vendors for MAC are required to sign “processor” and/or confidentiality agreements whereby they commit to only process personal information consistent with contracted purposes and to ensure organisational and technical security safeguards for the data​ and in place.

Notice of Data Use and Consent

MAC will provide notice to individuals using clear and conspicuous language at the point of data collection, about how their information will be used and disclosed.  We will make clear what choices are available in relation to how individual data is managed and what rights there are under data privacy law or under this Policy and who to contact with any questions or complaints. MAC’s privacy notices are tailored according to specific data collection circumstances.  In providing such notice, MAC meets its obligations to be transparent and fair with individuals as is required by General Data Protection Regulation. Dependent on the medium, notice may be given in person, by email, post, telephone, or by posting on our website.

In accordance with data privacy law and good practice, MAC will seek consent of individuals to collect, use and disclose their data consistent with the relevant privacy notice. In certain cases where law allows, particularly where gaining consent will involve a disproportionate effort, where intended processing of the data is in MAC’s or our clients’ legitimate interests and the privacy risks are low, MAC will proceed to process personal information absent of consent. MAC will also use and disclose personal information without consent where required by law and judicial order. MAC will collect all necessary informed consents of clinical trial participant on behalf of clients, according to good clinical practice, laws on confidentiality and data privacy regulations. MAC’s interests are in conducting ethically approved clinical trials and following good clinical practice to the highest medical and scientific standards. 

Data Quality, Integrity and Retention of Records

Data quality and accuracy is essential in ensuring the safety and integrity of clinical trials and the reliability of the scientific knowledge they generate. MAC employs a number of in-house specialists to ensure that data processing standards comply with all legal requirements. Our privacy notices provide individuals with a straight-forward way of updating and validating information and enabling error corrections. MAC retains personal information in accordance with contractual and regulatory requirements which may vary across clinical trials. We will retain this information for as long as necessary for the uses set out in this Policy or while there is a legitimate business or regulatory reason for doing so.  If you ask us to delete your information before this time, we may not be able to do so for technical, regulatory or contractual constraints.  If you agree to take part in one of our clinical trials, we will provide detailed information regarding retention periods prior to your enrolment.

Your Rights

In accordance with data privacy laws and contractual commitments, MAC ensures that individuals can exercise all relevant informational rights with respect to their personal information processed by the organisation. Where no overriding interest prevails, MAC will endeavour to allow the following informational rights under this Policy as a matter of good practice:

  • to allow access to copies of personal information within a reasonable timeframe; and

  • to correct personal information where inaccurate; and

  • to withdraw a previously provided consent to processing of personal information.

Information collected about individuals who are assessed for eligibility or enrolled in a clinical trial is subject to overriding legal obligations to ensure the safety and integrity of the trial. This means that some informational rights are restricted in these circumstances, including the individual’s right to access the personal data we hold about them,  to the correction of their personal data when incorrect, out of date or incomplete, to withdraw consent or object to further processing of their personal data, to request deletion of personal data we hold about them, to restrict aspects of data processing, or to request transmission of personal data in a common digital format (e.g. pdf) to the themselves or another organisation. ​

Participants enrolled in a clinical trial should discuss any concern with their Principal Investigator, who will be able to identify the participant and progress their request accordingly. Principal Investigators contact details are provided in the trial specific information leaflet, or they can be contacted via the MAC trial site. Contact details for MAC trial sites are available at the following web address:

If you wish to exercise any of these rights, please contact our Data Protection Officer using the details shown in the section titled “Inquiries, Complaints and Requests to Exercise Rights” below.​

Information Security

MAC maintains wide-ranging information security policies to apply technical and organisational security measures.  This is to ensure we protect sensitive and personal information that participants provide to us (particularly sensitive clinical data), against unauthorized access or loss. MAC’s security breach policy provides a procedural response for managing any breach of personal information, including making necessary notifications to individuals or governmental authorities.  MAC stores information on servers within the UK and use commercial measures to ensure that your data is kept safe and treated in accordance with this privacy policy and data protection and privacy laws.

Considerations When Online

The pages on MAC’s websites may contain links to external websites, i.e. outside of the company. These external websites are not controlled or endorsed by MAC. This Policy does not apply to linked websites outside the MAC organisation.  MAC recommends that visitors review the privacy policy of each individually linked website before submitting any personal information.  We do not accept any responsibility or liability for external/other websites’ privacy policies.

Our web pages also use cookies. A cookie is a data file that is placed by a website operator on the hard drive of a visitor to their website. MAC and third parties with whom we work, may place cookies with the following functions on the computers of visitors to MAC websites: to allow the site to deliver the service requested by the visitor; to remember repeat visitors; to improve the user experience of the site; to allow the company to perform site analytics; and to serve and help tailor our marketing messages on our websites and elsewhere on the internet, based on the visitor’s previous browsing activity.

The web browser and cookie settings on your electronic devices can be tailored to manage your online relationship with MAC. At this time, we do not respond to “do not track” signals, however most web browsers will allow users to choose which cookies can be placed on their electronic device and to delete or disable cookies.  Visitors should be aware that disabling cookies may prevent them from using certain features on MAC websites. For more information, please see our Cookie Policy.

Children’s Online Privacy Protection

MAC does not collect information through our websites from individuals who are known to be under the age of 13, and no part of our online presence is directed to anyone less than 13 years.

Inquiries, Complaints and Requests to Exercise Rights

Communications, queries, requests to exercise informational rights (e.g., access to data) or complaints can be addressed for the attention of the Data Protection Officer, MAC Clinical Research Finance Limited, Kaman Court, 1 Faraday Way, Blackpool, Lancashire, FY2 0JH, United Kingdom.

Within UK individuals have the right in law to complain about how their information is managed to a supervisory authority that is responsible for regulating compliance with the Regulation. The following URL links to the relevant authority

Legal Status of Policy and Policy Changes

This Policy is not a contract, and it does not create any legal rights or obligations. MAC reserves the right to modify or amend this Policy and may do so according to new or amended legislation.  The updated Policy will be posted on and (Last Updated: 30th November 2022)