Privacy notice

About Join Dementia Research

Join Dementia Research is a service that offers members of the public the chance to take part in dementia related research in the UK. It also enables researchers to contact people about potential dementia research opportunities.

Purpose of this notice

This privacy notice tells you what to expect when Join Dementia Research collects personal information. It applies to information we collect about those who:

 

Important roles

Data Controller

A data controller decides why and how personal data is processed.

 

The Department of Health and Social Care (DHSC) is the Data Controller for Join Dementia Research under the current data protection law that includes the Data (Use and Access) Act 2025 (DUAA), the Data Protection Act 2018 and the UK GDPR.  

Data Processor

A data processor processes personal data on behalf of the controller.

 

The University of Leeds (The Host Organisation) is the Data Processor for Join Dementia Research. The University of Leeds provides the National Institute for Health and Care Research (NIHR) Research Delivery Network Coordinating Centre (RDNCC) on behalf of the DHSC. 
 

The RDNCC is responsible for the processing of your personal data.

Our Partners

We partner with:
 

  • Alzheimer’s Society
  • Alzheimer’s Research UK 
  • Alzheimer Scotland

 

Our partner organisations collect and store personal information when you contact them for support via the Join Dementia Research helpdesk numbers. Alzheimer’s Research UK also processes our paper application forms on behalf of the data controller, DHSC.

Information we collect

At Join Dementia Research, we may use technology to collect information both directly and indirectly.

 

We collect personal information directly from users via:
 

  • online registration form (including when you register over the phone with our helplines)
  • paper applications, which are securely destroyed after being scanned and uploaded to our system
  • the get in touch with us form
  • the callback form

 

The personal data we collect may vary depending on how you use the website. However, we always protect your personal data within the terms of this Privacy Notice.

Registration

When you register with Join Dementia Research, we request the following through our registration forms: 
 

  • name
  • home address
  • telephone number
  • email address
  • date of birth
  • sex at birth and gender identity
  • ethnicity
  • health, healthcare information, and any disabilities you may have
  • whether or not you have a carer
  • any other personal information you choose to share
  • your contact preferences for Join Dementia Research


 

Once you are registered, we use the information you provide to match you to potential research studies. We retain information about which studies you match to and whether you have taken part in these studies.

Get in touch with us form

We request the following personal details from you:

 

  • your name
  • email address
  • telephone number
  • any personal information you provide as part of your query

Callback form

We request the following personal details from you:

 

  • your name
  • telephone number(s)
  • reason you would like us to call you back
  • where you have been referred from, such as a healthcare professional that referred you to the service

Cookies

The cookies that we use identify you only as a number. We use cookies that save and retrieve information about your visit to our site. This can be information such as how you navigated through the site and what interested you. This helps us develop the service going forward. 

 

You can disable cookies by changing the settings in the preferences or options menu of your internet browser. For more information, read our Cookie Policy.
 

We collect information indirectly such as your Internet Protocol (IP) address, which is commonplace across all internet services. This information is then kept in internet access logs.

How and why we use your data

We collect and use your personal data to:

 

  • provide you with the Join Dementia Research service which matches you appropriately to potential research opportunities across the UK
  • enable researchers across the UK to contact you about taking part in their research studies
  • provide you with responses to queries
  • call you back to discuss the service to tailor it to you 
  • report the numbers and types of volunteers who are registered to the service
  • contact you with updates about the service by email or post, as requested by you
  • keep you informed about any changes to the service
  • continue to improve the Join Dementia Research service
  • ensure that the data we hold is accurate and up to date

The lawful basis for processing

In conjunction with the UK GDPR, the Data Protection Act 2018 sets out valid lawful bases for processing personal data.

 

Your consent for creating a Join Dementia Research account will not be used as the lawful basis for processing your data under the data protection legislation. Rather, the legal basis for processing your personal data will be as follows: 
 

  • Article 6.1 (e) - performance of a task in the public interest or in the exercise of official authority vested in the controller.
  • Article 9.2 (j) - research purposes. The NIHR funds, enables, and delivers world leading health and social care research that improves people's health and wellbeing and promotes economic growth. The NIHR RDNCC acts as an agent of the DHSC in this endeavour. The Secretary of State for Health and Social Care has a duty to promote health and care research and a public sector equality duty; thus this service falls within the public interest task of the DHSC.   

 

For further information please refer to the ICO’s webpage on lawful basis for processing.

Your contact preferences

When you register, we ask you whether you’d like to:
 

  • receive automated study alerts
  • receive our quarterly newsletter and annual survey
  • hear about ethically-approved non-dementia studies 
  • opt-out of any contact from the service

 

We also ask you the best way to contact you - phone, email, by post, or not at all.

 

You can log into your account or contact the helpdesks to change your preferences at any time.

How we protect your data

The information you provide to register with Join Dementia Research is stored and processed on a secure MySQL database hosted by Google SQL in the UK and Ireland. 

 

We have strict training and terms of use policies for staff and researchers accessing the system, for the purposes of matching you to studies and contacting you about research. We regularly review our policies, as well as access roles for all staff and researchers.

 

The following emails are processed and stored electronically by us via Twilio in the USA:

 

  • account verification
  • welcome pack
  • study matching
  • forgotten password

 

To understand how your data is used and protected, read Twilio’s Terms of Service and Privacy Notice. Data we process via Twilio is stored for 30 days only and is never passed on to third parties.

 

Personal information entered into the callback form is stored in a protected Google sheet. It is accessible only to authorised Join Dementia Research staff. We will store your personal data for a maximum of six months.

 

We process your data from our website to Google sheets using Zapier software. The data is processed using servers based in the USA. Zapier is a GDPR compliant company. To understand how your data is used and protected, read Zapier’s Privacy Statement. Data we process via Zapier is stored for 30 days only and is never passed on to third parties. 

 

Our email newsletters are processed and stored electronically via Mailchimp in the USA. For more information on how your data is processed and protected, read Mailchimp Privacy FAQs. Your data is stored for a maximum of six months. Data processed and stored in Mailchimp is never sold to third parties.
 

We send welcome packs and newsletters by post, which are processed by third party contracted printers. Once your data has been used by our printers for the purposes of sending you this information it is immediately electronically deleted.

 

We will respond to your queries through the Servicenow email management platform, when you use the get in touch with us using the form on our contact page, or if you email us using the following addresses:

 

Servicenow securely processes and stores the information you provide and all data is processed within the UK.

How we share your personal information

Once you register with Join Dementia Research, your data is viewable by Join Dementia Research staff who administer the service and by researchers involved in dementia research. The researchers include NHS staff and approved researchers working in commercial research organisations or academic institutions.

 

The information on Join Dementia Research is held separately from your medical records kept by your GP and/or your hospital. In some cases, your medical records may help researchers to see if you are a suitable volunteer to take part in their study. Therefore, when signing up to Join Dementia Research, we ask for your permission for your medical records to be accessed.

 

Only approved researchers and NHS staff who have been assessed in accordance with “Research in the NHS Human Resource (HR) Good Practice” will be allowed to access your medical records, and those accessing your medical records must follow the NHS Confidentiality Code of Practice and the Data Protection Act 2018.

 

Non-NHS organisations (commercial research organisations, or academic institutions) who wish to use the service must sign a Data Sharing Agreement, which prevents them from sharing your data with other non-authorised third parties and provides for the secure disposal of your data once processed by their researchers.

 

To support research in the UK, we have partnered with Health Data Research Gateway and the Dementia Trials Accelerator programme. Aggregated and anonymised volunteer data is made available to their Cohort Discover Tool to help researchers estimate the number of volunteers matching their criteria.

 

On behalf of DHSC, NIHR RDNCC also provides the Be Part of Research service. We shall, on occasion, share your email address between these services to ensure you do not receive duplicate communications from NIHR RDNCC. Data sharing of this kind will be time-limited and will only take place on NIHR RDNCC local secure systems.
 

We contact NHS Digital approximately twice a year, Public Health Scotland yearly, and the Northern Ireland General Registry Office every two to three years to identify volunteers who are deceased across England and Wales, Scotland, and Northern Ireland respectively. We share basic personal information about volunteers in a secure way with these organisations in order to carry out a search. Once the search is carried out, the information shared and the accounts and all personal information of deceased volunteers are deleted.

Deleting your Join Dementia Research account

You can delete your Join Dementia Research account at any time, either by logging into your account and deleting it under “My account”, or by contacting us.

 

Once your account is deleted, we keep an anonymised record of your past activities. This is to ensure that we can trace all changes made to any account, for reporting and improving the website. Access to this information is restricted to those managing Join Dementia Research and all investigations will be recorded. Additionally, this information cannot be used to create another account.

Your rights over your personal data

You can contact the Data Protection Officer at:

  • Address: Department of Health and Social Care, 1st Floor North, 39 Victoria Street, Westminster, London, SW1H 0EU
  • Email: data_protection@dhsc.gov.uk

Under the Data Protection Laws, you have the right to:

  • access any personal data related to you 
  • correct any mistakes in your information
  • ask us to stop contacting you with direct marketing
  • ask for a review of decisions made automatically about you  
  • ask us to limit how we use your personal data
  • ask us to transfer your personal data to another organisation
  • ask us to delete your personal data
  • withdraw your consent at any time

You can also read about these rights in detail.

If you wish to exercise these rights, get in touch with NIHR Service Desk at:

  • Address: The NIHR Service Desk, Back Lane, Melbourn, Royston, SG8 6DP
  • Email: gdpr_requests@nihr.ac.uk

We will respond in a timely manner to any rights that you wish to exercise. For Subject Access Requests (SARs), we will respond within a month of receiving your request, unless the request is particularly complex.

 

Contacting the regulator

It is important that you ensure you have read this privacy notice. You should let us know if you think that we have not processed your data in accordance with this privacy notice. 
 

Similarly, you may also complain to the Information Commissioner's Office.