Privacy notice

We take your privacy and the protection of your personal data very seriously. This privacy notice sets out how:

  • Nucleus Network Pty Ltd;
  • its affiliates in Australia: Napa Topco Pty Ltd, Napa Bidco Pty Ltd, NN Holdco Pty Ltd, NN Bidco Pty Ltd, Q-Pharm Pty Ltd;
  • its affiliates in the United States: Prism Research LLC, Prism Research Holdings, LLC., Nucleus Network USA; and
  • its affiliate in the United Kingdom: Hammersmith Medicines Research Ltd (HMR),

(each a Nucleus Network Company, we, us or our, together Nucleus Network) may collect and process your personal data (Privacy Notice).

This Privacy Notice was last updated on 19 October 2026 and we may from time to time make changes to it. You should check our website at www.nucleusnetwork.com from time to time to view the most up-to-date version. Where required by law, we will contact you about material changes to this Privacy Notice and provide information about any associated rights.

If you are required to provide any personal data to us which relates to other individuals, such as family members, you agree that you will inform them about the contents of this Privacy Notice and obtain any required consent in accordance with this Privacy Notice.

2.1 Overview

Nucleus Network is a global early-phase clinical trials provider with sites in Australia, the United Kingdom (UK) and the United States of America (USA).

In order for us to provide our services and run our business, we use personal data.

Depending on which Nucleus Network Company is communicating with you and/or providing you with services, there may be different data protection laws that apply, for example:

  • in relation to the UK and EU: the General Data Protection Regulation (EU 2016/679) (the GDPR), the GDPR as it forms part of the law of the United Kingdom (the UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (together referred to as UK/EU Data Protection Laws);
  • in relation to Australia: the Privacy Act 1988 (Cth) and associated Australian Privacy Principles (Australian Data Protection Laws); and
  • in the United States: state- and federal-level privacy laws applying to processing of personal data in a business-to-business context, such as the California Consumer Privacy Act (CCPA) (together referred to US Privacy Laws),

(together referred to as Data Protection Laws).

As different Data Protection Laws apply when we use your personal data and/or certain rights may not apply in certain jurisdictions, we have indicated throughout this Privacy Notice, as applicable, if certain information/sections/rights will not apply in particular jurisdictions.

2.2 HMR as Controller

This Privacy Notice applies to the use of personal data where HMR is acting as a controller under UK/EU Data Protection Laws.

To clarify, when you sign up with us to be a potential trial participant, HMR is the controller of all pre-participant data it collects from you. When you become a participant as part of a clinical trial, HMR will be acting as a processor on behalf of any third-party sponsors of the trial, who are the controller. A processor is different to a controller; as a processor, HMR will only process personal data in accordance with the sponsor’s instructions and HMR does not use the personal data for its own purposes. This Privacy Notice does not cover the processing of any personal data when HMR acts as the processor.

If you are unsure about who the controller of your personal data is or whether HMR is acting as a controller or processor of your personal data, please contact HMR using the contact details provided in section 10.

3.1 Overview

Personal data is any information or opinion about an identified individual or a reasonably identifiable individual or from which you can be directly or indirectly identified and process or processing refers to the collection, recording, storage, use, disclosure and generally any other uses, form of operations or dealings with personal data that we have.

Under UK/EU Data Protection Laws and Australian Data Protection Laws, there are certain specified categories of personal data that are afforded higher protection and these are known as special category data in the UK and EU or sensitive information in Australia. Special category data or sensitive information will be any personal data relating to your health, genetic or biometric data, criminal convictions, sex life or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical affiliations or beliefs, political membership or trade union membership. US Privacy Laws similarly recognise these categories as sensitive personal data with certain nuances that may depend on the applicable law. We may, in some circumstances, need to collect and process your special category data/sensitive information.

More information on the types of personal data that we will collect and process about you, who we share it with and how we use your personal data is detailed below. Please note that depending on your relationship with us, the personal data that we collect about you will vary so please view the relevant section below which best describes your relationship with us. We do not knowingly obtain the personal data of anyone under the age of 18.

UK/EU Data Protection Laws requires companies to have a “lawful basis” to collect and use personal data for a purpose. Each lawful basis that HMR relies on to process personal data for a particular purpose is set out in the tables under sections 3.3 to 3.9 below. Additionally, under Australian Data Protection Laws, we must only process your personal data for a permitted purpose i.e. for the primary purpose of collection, where such purpose is reasonably necessary for our functions or activities, or such other purposes permitted by law. Where we refer to a ‘purpose for processing’ in the tables under sections 3.3 to 3.9 below, we are referring to our primary purpose of collection or other purposes permitted by law.

3.2 Standard Recipients

There are a few categories of recipients of personal data which we refer to as Standard Recipients in this Privacy Notice with whom we may share your personal data.

The Standard Recipients are:

  1. (a) other group company members of Nucleus Network;
  2. (b) organisations who manage our business strategies, including those involved in managing our business risk and funding functions;
  3. (c) our third-party service providers, which include but are not limited to IT / security suppliers, marketing agencies, integration support, website providers and information security providers;
  4. (d) professional advisors such as auditors, insurance and legal organisations;
  5. (e) government authorities, regulators, law enforcement agencies and other organisations as required or authorised by law; and
  6. (f) in the event of a restructuring or re-organisation, merger, sale of the business or acquisition:
    1. (i) any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party;
    2. (ii) any companies that are in the process of joining the Nucleus Network or acquiring any Nucleus Network Company; and
    3. (iii) legal and technical advisers to facilitate the transaction.

3.3 Website users

This section will apply to you if are visiting a Nucleus Network Company’s website.

(a) What personal data do we collect and process about you?

We only collect and process information obtained through our use of cookies and similar technologies such as:

  1. (i) IP address;
  2. (ii) device identification (such as device type, browser type, operating system and language),
  3. (iii) web logs (such as pages visited, time spent on the site, referring URL and clickstream data),
  4. (iv) interactions with our website features, including any AI-powered chat or agent functionality; and
  5. (v) advertising, campaign and conversion identifiers (such as how you arrived at our website, and whether you have interacted with our advertising).

For more information about our use of cookies and similar technologies, please see our cookies notice in section 3.3(e) below.

(b) How will we collect your personal data?

Directly from you or your device.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) where we have your consent;
  2. (ii) it is necessary to comply with our legal obligations; and
  3. (iii) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
Purpose for processing Lawful basis
To deploy cookies and other similar tracking technologies.
  • We have a legitimate business interest (to deploy cookies to ensure our websites can operate and function or for statistical/analytics purposes, or appearance purposes).
  • We have your consent.
For internal business management purposes and administration such as auditing, security and accounting purposes, or obtaining legal or professional advice from external advisers.
  • We have a legitimate business interest (to operate and run our business and to comply with audit requirements).
  • We have a legal obligation to protect your personal data.
  • We have your consent
To conduct research and development in respect of our website and commercial services (other than clinical research).
  • We have a legitimate business interest (to improve our services).
  • We have your consent
In connection with business strategies
  • We have a legitimate business interest (business administration and operations).
  • We have your consent
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
  • We have your consent
In the pursuance, establishment or defence of legal claims
  • We have a legitimate business interest (business administration and operations)
  • We have your consent

(d) Who may we share your personal data with?

We may share your personal data with the Standard Recipients (please refer to section 3.2 above).

(e) Cookies Notice

This section relates to our use of cookies on our website: www.nucleusnetwork.com (our Cookies Notice). Please read it carefully, alongside the other information set out in section 3.3 of this privacy notice.

A “cookie” is a small text file that is stored on your browser, hard drive or mobile device. Cookies are generated by web servers when a user lands on an internet page and are passed to the user’s computer or mobile device and stored for subsequent future access. Cookies perform a number of functions and different purposes. You can find more information about the individual cookies we use on our website and the purposes for which we use them here.

How do I change my cookies settings?

You can change your cookies preferences and opt-out via our website: www.nucleusnetwork.com

Alternatively, most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including to see what cookies have been set, visit: www.aboutcookies.org or www.allaboutcookies.org.

To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

3.4 Potential trial participants

This section will apply to you if you are applying to be a potential trial participant.

(a) What personal data do we collect and process about you?

  1. (i) name, date of birth, gender and nationality;
  2. (ii) contact details including your address and address history, telephone numbers and email address;
  3. (iii) identity information and documents (e.g. passport or driving licence);
  4. (iv) financial information, including bank details for payment;
  5. (v) your marital/dependent status including next of kin and emergency contact details;
  6. (vi) lifestyle information (such as whether you smoke, your alcohol consumption);
  7. (vii) images, CCTV recordings or photographs;
  8. (viii) security and monitoring information such as CCTV footage when you visit our office; and
  9. (ix) any information captured during any correspondence with you such as telephone calls and other written or email correspondence.

We also typically process the following types of special category data about you:

  1. (x) health information – broadly including screening and medical test results, current health status and medical history (e.g. history of asthma and smoking);
  2. (xi) information about race or ethnicity;
  3. (xii) information about your sex life and sexual orientation; and
  4. (xiii) genetic data (blood swabs or skin cells from a cheek swab) or biometric data (i.e. fingerprints).

(b) How will we collect personal data?

  1. (i) directly from you when you indicate your interest in participating in a clinical trial;
  2. (ii) your doctor, when you’re screened to see if you’re suitable to take part in a clinical study;
  3. (iii) medical professionals outside HMR that may need to do specialist tests; and
  4. (iv) third party service providers.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) it is necessary to comply with our legal obligations; and
  2. (ii) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.

Where we process your special category data for the purposes specified below, we do so on the basis that:

  1. (i) it is necessary for scientific research purposes;
  2. (ii) it is necessary for reasons of public interest in the area of public health; or
  3. (iii) it is necessary for the establishment, exercise or defence of legal claims.
Purpose for processing Lawful basis
For the purposes of recruitment of potential trial participants including:

  • registering interest in a trial;
  • maintenance of our potential trial participants database;
  • random testing for drugs of abuse;
  • panel screening; and
  • checking eligibility to work in the Nucleus Network Company’s jurisdiction.
 We have a legitimate business interest (to recruit and maintain a database of potential trial participants).

Special category data

For scientific research purposes.
For identity verification. We have a legal obligation to verify your identity to protect your personal data.
In connection with a clinical trial you registered interest in and are considered for participation in. We have a legitimate business interest (to facilitate the clinical trial you registered for).

Special category data

For scientific research purposes.
To correspond with you about future clinical trials that may match your profile (including based on the health information referred to at 3.4(a)(x), collected during recruitment and screening) We have a legitimate business interest (to facilitate the clinical trial you registered for).

Special category data

For scientific research purposes.
Contacting transportation companies if you require transport following a clinical trial. We have a legitimate business interest (to facilitate the clinical trial).
Informing UK Health Security Agency (UKHSA) / local Health Protection Team and GPs about any abnormal results. We have a legitimate business interest (to facilitate the clinical trial).

Special category data

For reasons of public interest in the area of public health
Dealing with any queries, feedback, enquiries, complaints or other related activities. We have a legitimate business interest (to facilitate the clinical trial and improve our services).
To send you:

  • general/educational information about the conduct of clinical trials; and
  • related market research surveys.
 We have a legitimate business interest (to send you genuine market research surveys and general/educational information about how clinical trials are conducted).
To conduct research and development in respect of our services. We have a legitimate business interest (to improve our services).
For general internal business management and administrative purposes such as security, staff training, account management and record-keeping purposes.
  • We have a legal obligation to protect your personal data.
  • We have a legitimate business interest (for business administration and operations).
In connection with business strategies or with a business transaction such as merger, restructuring or sale of the business. We have a legitimate business interest (business administration and operations)
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
In the pursuance, establishment or defence of legal claims
  • We have a legitimate business interest (for the establishment, exercise or defence of legal claims).

Special category data

  • As necessary for the establishment, exercise or defence of legal claims.

(d) Who may we share your personal data with?

We may share your personal data with:

  1. (i) your doctor in the event you have abnormal results;
  2. (ii) other medical research institutions, hospitals, clinics associated with a clinical trial, and the personnel of such institutions;
  3. (iii) partners and Institutional Review Boards (IRBs), Independent Ethics Committees (IECs) and Human Research Ethics Committees (HRECs) on a case-by-case basis; and
  4. (iv) the Standard Recipients (please refer to section 3.2 above), although please note that we will only share identifiable information about you with third party sponsors of a clinical trial in the event of a compensation claim that you make against a third-party sponsor.

3.5 Next of kin or emergency contacts for volunteers participating in a clinical trial or Nucleus Network employees

This section will apply to you if you are the appointed next of kin or emergency contact for a clinical trial participant or a Nucleus Network employee.

(a) What personal data do we collect and process about you?

  1. (i) name and contact details including your address and address history, telephone numbers and email address;
  2. (ii) your relationship with the potential trial participant or Nucleus Network employee; and
  3. (iii) any information captured during any correspondence with you such as telephone calls and other written or email correspondence.

(b) How will we collect personal data?

All personal data is collected directly from the potential trial participant or member of staff who nominates you as their next of kin or emergency contact.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) it is necessary to comply with our legal obligations; and
  2. (ii) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
Purpose for processing Lawful basis
To contact you in the event of an emergency affecting the participant or member of staff who nominated you. We have a legitimate business interest (because we owe a duty of care to our participants and members of staff).
To provide important new information about the study medicine taken by the participant if we cannot contact the participant who has participated in a clinical trial. We have a legitimate business interest (because we owe a duty of care to our participants).
For general internal business management and administrative purposes such as security, account management and record-keeping purposes.
  • We have a legitimate business interest (to record all next of kin information)
  • We have a legal obligation to protect your personal data.
In connection with business strategies or with a business transaction such as merger, restructuring or sale of the business. We have a legitimate business interest (business administration and operations).
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
In the pursuance, establishment or defence of legal claims. We have a legitimate business interest (for the pursuance, establishment or defence of legal claims).

Special category data

As necessary for the establishment, exercise or defence of legal claims.

(d) Who may we share your personal data with?

We may share your personal data with certain Standard Recipients (please refer to section 3.2 above) i.e. other group company members of the Nucleus Network, our third-party service providers, government authorities, regulators, law enforcement agencies and other organisations as required or authorised by law and third parties in the event of a restructuring or re-organisation, merger, sale of the business or acquisition.

3.6 Candidates applying to working at Nucleus Network

This section will apply to individuals applying to work at Nucleus Network. If, in your application, you provide us with details of anyone else (e.g. references, emergency contacts or family members) you should also show this Privacy Notice to them.

(a) What personal data do we collect and process about you?

  1. (i) name, date of birth and gender;
  2. (ii) contact details, including address and address history, telephone numbers and email address;
  3. (iii) your employment data (e.g. skills and experience, details of employment, employment history);
  4. (iv) identity information and documents (e.g. passport or driving licence);
  5. (v) financial information, including bank details for payment;
  6. (vi) information relevant to the recruitment process such as your job title, information about your job role, your CV or cover letter and any other information which you have shared with us as part of the recruitment process and any notes taken from an interview with you;
  7. (vii) your marital/dependent status including next of kin and emergency contact details;
  8. (viii) any information captured during any correspondence with you such as telephone calls and other written or email correspondence;
  9. (ix) security and monitoring information such as CCTV footage when you visit our office for an interview.

We also typically process the following types of special category data about you:

  1. (i) information about any criminal convictions or workers compensation claims that you declare or are disclosed to us; and
  2. (ii) information about your current or former physical and/or mental health including disability information and medical conditions (where required or where you disclose to us).

(b) How will we collect your personal data?

  1. (i) directly from you when you apply to work at Nucleus Network or during any form of communications such as face to face, written and phone correspondence or interviews during the recruitment process;
  2. (ii) from correspondence with you on LinkedIn or similar sources;
  3. (iii) from recruitment talent management and employment agencies; and
  4. (iv) background check providers.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) it is necessary in order to take steps to enter into a contract with you;
  2. (ii) it is necessary to comply with our legal obligations;
  3. (iii) we have your consent; and
  4. (iv) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.

Where we process your special category data for the purposes specified below, we do so on the basis that:

  1. (i) it is necessary for the purposes of carrying out the obligations of being your potential employer and to exercise our rights as your potential employer;
  2. (ii) it is necessary for the establishment, exercise or defence of legal claims; or
  3. (iii) we need to use your special category data to prevent or detect unlawful acts and this use is in the substantial public interest.
Purpose for processing Lawful basis
For the purposes of recruitment including:

  • verifying your identity;
  • verifying your qualifications where it may relate to role specific requirements;
  • considering your suitability for the role;
  • conducting and arranging interviews;
  • collecting references;
  • determining the terms on which you would work for us and negotiating your employment contract;
  • record-keeping purposes;
  • checking eligibility to work in the Nucleus Network Company’s jurisdiction;
  • to consider you for future roles, if you provide your consent; and
  • general correspondence with you.
  • It is necessary in order to take steps to enter into a contract with you.
  • It is necessary for legitimate business interests (to undertake recruitment).
  • We have your consent

Special category data

  • It is necessary to exercise our rights and carry out our obligations as your potential employer
  • It is in the substantial public interest to prevent/detect unlawful acts.
For internal business management purposes and administration such as auditing, security and accounting purposes, or obtaining legal or professional advice from external advisers.
  • We have a legitimate business interest (to effectively manage our business and undertake recruitment).
  • We have a relevant legal obligation to protect your personal data.

Special category data

We need to use your information in order to establish, exercise or defend our legal rights.
To conduct research and development in respect of our recruitment processes. We have a legitimate business interest (to improve our recruitment processes).
In connection with business strategies or with a business transaction such as merger, restructuring or sale of the business. We have a legitimate business interest (business administration and operations).
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
In the pursuance, establishment or defence of legal claims. We have a legitimate business interest (for the pursuance, establishment or defence of legal claims).

Special category data

It is necessary for the establishment, exercise or defence of legal claims.

(d) Who may we share your personal data with?

We may share your personal data with:

  1. (i) recruiters and your referees; and
  2. (ii) the Standard Recipients (please refer to section 3.2 above).

3.7 Suppliers or third parties we engage with as part of our business operations

This section will apply to you if you are a supplier or third party with whom we engage with as part of our business operations.

(a) What personal data do we collect and process about you?

  1. (i) name and contact details, including address and address history, telephone numbers and email address;
  2. (ii) financial information, including bank details for payment;
  3. (iii) information we collect about your employment status, the company you work for, your job title and work industry;
  4. (iv) information we collect about you as a result of our onboarding, procurement or due diligence checks; and
  5. (v) information captured during any correspondence with you such as telephone calls or written or email correspondence.

We do not collect your special category data.

(b) How will we collect personal data?

  1. (i) directly from you; and
  2. (ii) from third parties including:
    1. (A) referees or introducers; and
    2. (B) publicly available sources.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) it is necessary to perform our contract with you;
  2. (ii) it is necessary to comply with our legal obligations; and
  3. (iii) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
Purpose for processing Lawful basis
To engage and onboard suppliers, business partners and third parties and fulfil our contractual obligations.
  • It is necessary to perform our contract with you.
  • We have a legitimate business interest (to engage third parties for business purpose).
For internal business management purposes and administration such as auditing, security and accounting purposes, or obtaining legal or professional advice from external advisers.
  • We have a legitimate business interest (to comply with audit requirements).
  • We have a relevant legal obligation or regulatory obligation to protect your personal data.
To conduct research and development in respect of our services. We have a legitimate business interest (to improve our services).
To communicate with you and assist with any complaints you may have.
  • It is necessary to perform our contract with you.
  • We have a legitimate business interest (to handle and assist with any complaints you may have).
  • We have a legal obligation.
To comply with our legal obligations. We have a legal obligation.
In connection with business strategies or with a business transaction such as merger, restructuring or sale of the business. We have a legitimate business interest (business administration and operations).
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
In the pursuance, establishment or defence of legal claims. We have a legitimate business interest (for the pursuance, establishment or defence of legal claims).

(d) Who may we share your personal data with?

We may share your personal data with the Standard Recipients (please refer to section 3.2 above).

3.8 Sponsor contacts

This section will apply to you if you are a key contact or representative with whom we liaise with at a prospective or existing sponsor.

(a) What personal data do we collect and process about you?

  1. (i) name and telephone numbers and email address;
  2. (ii) information we collect about your employment status, the company you work for and your company’s address, typically Head Office address, your job title and work industry; and
  3. (iii) information captured during any correspondence with you such as telephone calls or written or email correspondence.

We do not collect your special category data.

(b) How will we collect personal data?

  1. (i) directly from you; and
  2. (ii) from third parties including:
    1. (A) referees or introducers; and
    2. (B) publicly available sources such as search engines and artificial intelligence apps.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) it is necessary to comply with our legal obligations; and
  2. (ii) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
Purpose for processing Lawful basis
To use publicly available sources such as search engines and artificial intelligence apps to search for publicly available sponsor contact details. We have a legitimate business interest (to search for up-to-date sponsor contact details)
To manage our relationships with you, generally communicate with you and assist with any complaints you may have. We have a legitimate business interest (to handle and assist with any complaints you may have, correspond with you as our key sponsor contact and maintain our relationships with sponsors).
For internal business management purposes and administration such as: auditing, security and accounting purposes, or obtaining legal or professional advice from external advisers.
  • We have a legitimate business interest (to comply with audit requirements).
  • We have a legal obligation to protect your personal data.
To comply with our legal obligations. We have a legal obligation.
In connection with business strategies or with a business transaction such as merger, restructuring or sale of the business. We have a legitimate business interest (business administration and operations).
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
In the pursuance, establishment or defence of legal claims. We have a legitimate business interest (for the pursuance, establishment or defence of legal claims).

(d) Who may we share your personal data with?

We may share your personal data with:

  1. (i) other medical research institutions, hospitals, clinics associated with a clinical trial, and the personnel of such institutions as needed to facilitate the clinical trial and third-party suppliers supporting the clinical trial. Whilst your personal data will not routinely or automatically be shared with those institutions, it may be shared with them to facilitate direct contact or engagement; and
  2. (ii) the Standard Recipients (please refer to section 3.2 above).

3.9 Business contacts

This section will apply to you where you are a supplier or partner contact at a biotech, pharmaceutical and contract research organisation or a prospective supplier or partner contact with whom we are liaising with at a biotech, pharmaceutical and contract research organisation.

(a) What personal data do we collect and process about you?

  1. (i) name and contact details such as phone or mobile phone number, work phone number, fax number and email address;
  2. (ii) workplace information such as your job title and the name and address of the business or organisation who you work for; and
  3. (iii) any information captured during any correspondence with you such as telephone calls, and/or other written or email correspondence.

We do not collect your special category data.

(b) How will we collect personal data?

  1. (i) directly from you when we meet you at events or when we correspond with you;
  2. (ii) through engagements following direct referrals; and
  3. (iii) from publicly available sources, such as your company’s website or professional networking platforms such as LinkedIn.

(c) What will we use your personal data for?

We rely on the following lawful bases when processing your personal data for the purposes set out below:

  1. (i) it is necessary to comply with our legal obligations; and
  2. (ii) it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
Purpose for processing Lawful basis
To maintain a database of our business contacts to enable our business development team to engage with you on a one-to-one basis regarding potential or ongoing business relationships. We have a legitimate business interest (to develop and maintain business working relationships with suppliers and partners).
To generally communicate with you and assist with any queries you may have. We have a legitimate business interest (to correspond with you as our existing or prospective supplier or partner contact).
For general internal business management purposes such as audit; security and accounting purposes; record-keeping and obtaining legal or professional advice from external advisers.
  • We have a legitimate business interest (to comply with audit requirements).
  • We have a legal obligation to protect your personal data.
In connection with business strategies or with a business transaction such as merger, restructuring or sale of the business. We have a legitimate business interest (business administration and operations).
To comply with applicable laws, court orders, government and law enforcement agencies’ requests.
  • We have a legitimate business interest to comply with law enforcement agencies’ requests and assist with the prevention/detection of criminal activity.
  • We have a legal obligation.
In the pursuance, establishment or defence of legal claims. We have a legitimate business interest (for the pursuance, establishment or defence of legal claims).

(d) Who may we share your personal data with?

We may share your personal data with the Standard Recipients (please refer to section 3.2 above).

For more information regarding the marketing to business contacts, please refer to section 3.9 above. To opt-out of receiving direct marketing from us, you may:

  • contact us using the details set out in section 10;
  • select the “unsubscribe” link provided in our marketing emails, or
  • follow the instructions in a text message.

Message and data rates may apply for any messages sent to you from us and to us from you.

We do not use your data for mass mailed marketing campaigns. We also do not sell personal data or use personal data for cross-context behavioural or targeted advertising. If you have set a “do not track” signal, our website will not recognise it.

Personal data (such as age/date of birth, location, ethnicity, height and weight, sex, contraception status, current medical conditions for example history of asthma or use of cigarettes or tobacco or nicotine-containing products) may be processed using automated tools, including Artificial Intelligence (AI) systems, to assist in matching participants to suitable clinical trials and to pre-screen eligibility criteria during the early stage of clinical trial recruitment and screening. AI is used to support, not replace, human judgment. Final eligibility decisions will always involve human oversight and will be completed by qualified and trained medical personnel.

Automated decision-making and profiling is the process of making a decision without any human (or in the US meaningful human) involvement based on characteristics set out in personal data provided to us by you. However, please note that we will not use your personal data to carry out any automated decision-making or profiling, including profiling that produces legal or similarly significant effects on you.

Where we transfer data overseas, we will ensure that such transfers are appropriately safeguarded and undertaken in compliance with Data Protection Laws.

Nucleus Network operates facilities in Australia, the UK and the USA. We may, to the extent permitted by law and as required to undertake our primary operations, share your personal data between those countries.

We may also need to transfer your personal data to our suppliers or service providers who might be located overseas. Personal data may be stored and processed by our suppliers or service providers in locations including Australia, the UK, the USA, the European Economic Area, India and Canada. We complete thorough vendor qualification processes to ensure service providers maintain appropriate privacy and security controls. We rely solely on reputable organisations for such services.

Where you are based in Australia, we may transfer your personal data outside of Australia, for any of the purposes set out in this Privacy Notice.

When we transfer your data outside the UK/European Economic Area, we will always ensure your personal data is appropriately protected by taking the necessary steps set out by UK/EU Data Protection Laws. For example, we may enter into the EU Standard Contractual Clauses and the UK’s Data Transfer Addendum with the recipient to whom we are transferring personal data. These are a set of contractual wording which has been issued by the European Commission and UK’s Information Commissioner’s Office to safeguard transfers compliantly in accordance with UK/EU Data Protection Laws. To find out more about how your personal data is protected when it is transferred outside the UK and the European Economic Area (and if you wish to obtain a copy of the appropriate and suitable safeguards), please contact us using the details set out in section 10.

We are committed to safeguarding and protecting your personal data. We will take reasonable steps to protect information from misuse, interference and loss, and unauthorised access, modification or disclosure.

This includes by implementing appropriate technical and organisational measures to protect your personal data. These measures are designed to provide a level of security appropriate to the type of personal data processed and to protect it from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

We will only retain your personal data as long as is necessary to fulfil the purposes listed in this Privacy Notice and to comply with our legal requirements. If we hold personal data about you and we do not need that data for any purpose, we will take reasonable steps to destroy or de-identify that data in accordance with applicable Data Protection Laws, unless we are prevented from doing so by law.

The retention period for which we keep your personal data will therefore depend on your relationship with us and the type of personal data we have collected and processed. For example:

  • if you are a potential trial participant, we’ll keep your personal data for at least 5 years from when you last contracted with us.
  • if you are a business contact, we refresh and re-verify business contact details every 24 months and will delete any contacts that are inactive or unverified.
  • if you are a supplier, third party or sponsor, we will retain related financial records and personal data for 7 years after the transaction contemplated by those records is completed;
  • if you are a nominated next of kin or emergency contact for a participant, we will retain your personal data 10 years after the clinical trial has concluded (subject to any extension if required to comply with local regulatory requirements);
  • if you are a nominated next of kin or emergency contact for an employee, we will retain your personal data for 3 months after the member of staff leaves Nucleus Network;
  • if you are a candidate applying to work at Nucleus Network and:
    • have been successful in your application, we will retain your personal data in line with our company policies;
    • your application is unsuccessful, we will retain your personal data for 6 months from the data we inform you in the event that we need we need to respond to a claim of discrimination. If you provide your consent to retaining your personal data on file so that we can consider you for future roles or opportunities, we will retain your personal data for a further 12 months.

If you have any questions in relation to the retention of your personal data, please contact us using the details provided in section 10.

Please keep us informed if there are any changes in your details or the information you have provided us with as our record should reflect accurate and up-to-date personal data.

9.1 If you are based in the UK/EU or USA

UK/EU Data Protection Laws and US Privacy Laws give you a number of rights (as set out below) which you, or someone you authorise to act for you, can exercise at any time by contacting us using the details provided in section 10:

  1. (a) the right to access your personal data: you are entitled to a copy of the personal data we hold about you and certain details of how we process it, including for California residents the right to ask about the categories and sources of personal data, our business or commercial purposes for processing personal data and the categories of third parties that receive personal data from us;
  2. (b) the right to rectification or correction: you can ask us to correct any information about you that may be out of date, incorrect or incomplete;
  3. (c) the right to restrict processing: you are entitled to ask us to stop using your personal data in limited circumstances, for example where you think the personal data we hold about you is inaccurate or no longer necessary (please note this right does not apply in the United States);
  4. (d) right to erasure: you have the right to ask us to erase your personal data in certain circumstances, for example where the personal data we obtained is no longer necessary for the original purpose;
  5. (e) right to data portability: you have the right, under certain circumstances, to ask that we transfer personal data that you have provided to us to another third party of your choice;
  6. (f) the right to object to processing: where we process your personal data based on our legitimate business interests, you can object to our processing. We will always consider your objection and determine whether or not our legitimate business interests prejudice your privacy rights please note this right does not apply in the United States);
  7. (g) the right to object to marketing: please note that we do not use your Business Contact information to market to you; and
  8. (h) the right to lodge a complaint with a data protection supervisory authority or with us. If you are dissatisfied with how we have handled your personal data, please contact us using the contact details in section 10 and we would be happy to liaise with you to resolve your complaint or consider an appeal to our decision. Alternatively, you can contact your applicable data protection supervisory authority:
    1. (i) If you are in the European Economic Area, the relevant data protection supervisory authority can be found here: https://edpb.europa.eu/about-edpb/board/members_en.
    2. (ii) If you are in the UK, the relevant data protection supervisory authority is the Information Commission (IC), more information on how to undertake this process can be found here at the ICO website: https://ico.org.uk/.
    3. (iii) If you are in the United States and a resident of a state with a consumer privacy law, you should file a complaint with your state privacy regulator, typically the State Attorney General’s office or, in California, CalPrivacy.

9.2 If you are based in Australia

In Australia, you have the right to access and seek the correction of your personal data using the contact details in the section below and may lodge a complaint about a breach of the Australian Privacy Principles with the Office of the Australian Information Commissioner which can be contacted at either www.oaic.gov.au or by calling 1300 363 992.

Please note that not all of your data subject rights will be absolute; this means that there may be some circumstances where we may not be able to comply with your request, for example if it would conflict with our responsibility to comply with our legal obligations or may be permitted to deny your request for other reasons, such as if we cannot adequately verify your identity. However, if we cannot comply with your request, we will tell you the reason and we will always respond to any request you make. We will not discriminate or retaliate against you for exercising your lawful privacy rights.

If you have a question about this Privacy Notice, how we use your personal data, if you wish to exercise your rights, or if you’re not happy with how we process your personal data, please contact us at:

  1. (a) By email –
    1. (i) Australia and United States: [email protected]
    2. (ii) United Kingdom: [email protected]
  2. (b) By post – Data Protection Officer –
    1. (i) Australia and United States: Level 5, Burnet Tower, 89 Commercial Road, MELBOURNE VIC 3004, AUSTRALIA
    2. (ii) United Kingdom: Data Protection Officer, Hammersmith Medicines Research, Cumberland Avenue, Park Royal, London NW10 7EW.