Privacy notice – invitations to additional research
What’s on this page?
- Background
- Data collection and processing
2.1 What data we collect
2.2 How we collect personal data
2.3 Our legal basis and purpose for processing personal data
2.4 How we share personal data
2.5 How we keep data secure
2.6 How long we keep a participant’s data
2.7 International transfers
2.8 Participant data subject rights
2.9 Contact details
1. Background
Our Future Health will be the UK’s largest ever health research programme. It is designed to help people live healthier lives for longer through the discovery and testing of more effective approaches to prevention, earlier detection and treatment of diseases.
As part of the programme, we will support health research through developing a service that invites participants to take part in additional research opportunities. External research organisations can apply to Our Future Health to make use of this service, so that we can invite participants to take part in their research, which seeks to make new discoveries about human health and diseases.
These research opportunities may combine multiple sources of health and health-relevant information, including genetic data, to identify a representative cohort who may be invited to support health research. Participants may be offered the opportunity to complete further questionnaires or clinic appointments to support the research. Any third-party research organisations involved are considered data controllers in their own right and their own privacy notices will provide more information on how they process data for the purposes of these additional research opportunities.
This privacy notice explains how we process and protect the personal data of Our Future Health participants as part of our service. For more information about how Our Future Health processes participant data, please read our General Privacy Notice.
Our Future Health Limited is the Data Controller responsible for your personal data. We are registered with the ICO (ZA769724).
2. Data collection and processing
2.1 What personal data we collect
In this section, we explain the types of personal data that we process and why, along with any data that third parties process on our behalf.
We collect, use, store and transfer the following types of data:
- Identity data, including a participant’s full name, title, email address, location, address, date of birth, age, sex and gender.
- Contact data, including a participant’s full postcode, region location, telephone number and any records of communication we hold with a participant (including emails, phone calls, voicemail recordings and conversations they have with our support teams).
- Profile data, including the participant ID, consent record, feedback and survey responses
- Special category data, including personal data which reveals a participant’s ethnicity or information about their health. This includes clinical data like weight, waist circumference, blood pressure, heart rate, heart rhythm, cholesterol and genetic markers.
- Web analytics data. For more information, please refer to our Cookie Policy. We also collect technical data such as browser type and version, device type and version and operating system. For more information about technical data processed, please refer to our General Privacy Notice.
- Research opportunity invitation response information, including the participant ID, an invitation tracking ID, and status to indicate acceptance or otherwise of the invitation. The invitation tracking identifier may be shared with the research organisation operating the research. This maintains, as far as possible, the accuracy of the information retained on invitation acceptance and subsequent enrolment in the research, and supports improvement of the invitation process.
This data is required to help us manage a participant’s invitation to, and participation in, the new research opportunity. It will also help us to:- understand how participants would like to be invited to these opportunities
- understand how best to present such information to participants
- analyse and investigate specific impacts on different groups, and how receiving invitations might affect them.
2.2 How we collect personal data
We collect data from our participants in a variety of ways, and we try to make this process as easy and convenient as possible. This may be through Our Future Health directly, or one of our trusted partners (working under contract with us) may do this on our behalf, for example, by sending a survey.
We may collect a participant’s personal data in any of the following ways for the purposes of inviting them to take part in new research:
- Through a participant providing information in any contact they have with us, or our trusted providers of Iterable (the platform used to generate our email invitations) and Whistl (the service used for postal invitations).
- By securely accessing the data a participant has already provided at registration and consented to provide to Our Future Health, including their clinic measurements and health and lifestyle questionnaire responses.
- Through short surveys. We may ask participants to fill in surveys that ask about their reasons for declining an invitation to join new research, and about their experience of the invitation process. This type of survey is anonymous and will be hosted via a trusted third-party supplier (Qualtrics).
- By checking a participant’s consent and participation status for both the Our Future Health programme and any subsequent studies they have been invited to join
- Through web analytics. We collect information about how a participant accesses our website (including browser type and version, device type and version and operating system). We also track actions and events (such as clicks or screen views) to better understand how participants interact with our services. To do so, we use a software tool built by one of our trusted providers that collects this information via a participant’s internet browser, using cookies or similar technology. It does not collect sensitive personal information. Anything a participant types into secure fields — like their name, contact details, password, or health data — is automatically hidden or excluded by the software tool before it’s recorded. We’ve set up the tool carefully to respect participants’ privacy and follow data protection legislation.
- By providing support to participants invited to research opportunities using basic contact details for name, email address and phone number.
- By tracking participant invitation responses using a tracking identifier and status of their participation in the research opportunity.
2.3 Our legal basis and purpose for processing personal data
All collection and processing of personal data must be legally justified with what is called a “legal basis” under the UK GDPR and Data Protection Act 2018.
When processing the personal data of individuals for user research, the legal bases are:
| Purpose/activity | Type of data | Lawful basis for processing |
| Participant selection for invitation to join additional research | Name, postcode, email, age, contact details, consent, joining date, gender, region, health measures (e.g. height, weight, blood pressure), health and lifestyle questionnaire responses and genetic data | Article 6(1)(f) – Legitimate interest in selecting eligible participants and to understand the impact of invitation to additional research. Article 9(2)(j) – Public interest in the area of public health relating to scientific or historical research purposes or statistical purposes. |
| Invitation to participate in additional research | Name, address, postcode, email, participant ID | Article 6(1)(f) – Legitimate interest in conducting user research. |
| Analysing invitation response data | Invitation method, web analytics data used in conjunction with participant registration data: sex, location, age, ethnicity and join date | Article 6(1)(f) – Legitimate interest in analysing participant engagement and experience. Art. 9(2)(g) & DPA Schedule 1, Part 2, Condition 8 – Substantial public interest (research into equality of opportunity or treatment). |
| Programme development & promotion | Web analytics, consent, sex, gender, clinic appointment health measures (e.g. height, weight, blood pressure) and ethnicity | Art. 9(2)(g) & DPA Schedule 1, Part 2, Condition 8 – Substantial public interest (research into equality of opportunity or treatment). |
| Session replay analysis | IP address and web analytics data | Article 6(1)(f) – Legitimate interest in diagnosing issues, analysing user behaviour, and improving user experience. |
| Participant support | Name, email address and phone number | Article 6(1)(f) – Legitimate interest in diagnosing issues, analysing user behaviour, and improving user experience. |
2.4 How we share personal data
The only personal data which may be shared with the research organisation is the invitation tracking identifier, which allows us to maintain a record of a participant’s invitation acceptance. This also helps us maintain, as far as possible, the status of their subsequent enrolment in the study and supports improvement of the invitation process.
Data provided to Our Future Health in the form of an invitation tracking identifier and status of participation in the study is transferred to and stored in a highly secure data environment.
2.5 How we keep data secure
You can find information about how we keep data secure in the Our Future Health Participant Privacy Notice.
2.6 How long we keep a participant’s data
You can find information about how long we keep a participant’s data in the Our Future Health Participant Privacy Notice.
2.7 International transfers
Please see the Our Future Health Participant Privacy Notice for details on international transfers.
2.8 Participant data subject rights
If a participant decides they no longer want to receive any further communications from Our Future Health related to additional research opportunities, they will need to partially withdraw from the Our Future Health programme. For details on how to partially withdraw, please visit Withdrawal and data deletion | Our Future Health.
For more details on participant rights and how to exercise them please see the Our Future Health Participant Privacy Notice.
2.9 Contact details
Our Future Health’s Data Protection Officer is available to answer any questions and address any concerns about Our Future Health’s use of your personal data. You can email: dpo@ourfuturehealth.org.uk.
This privacy notice is version 1 and was published in November 2025. If we make changes to this privacy notice at any time, the most current version will be published here.