Skip to content

Data Protection

This section sets out how data collected through this survey will be used and respondents’ rights under Articles 13 and/or 14 of the UK General Data Protection Regulation (GDPR). Further information can be found at Medicines and Healthcare products Regulatory Agency privacy notice - GOV.UK.

Data controller

The Medicines and Healthcare products Regulatory Agency (MHRA) is the data controller.

What personal data we collect

We will collect data on:

  • whether you are responding on behalf of a department and/or organisation
  • the country and region you live in, or where your organisation provides services in the UK
  • what insights you/your organisation can provide on your understanding of the regulations that apply to Digital Mental Health Technologies 

With your consent, we will also collect data on:

  • your email address; and
  • any other personal data you volunteer by way of evidence or example in your response to open-ended questions in the survey; therefore, to remain anonymous, please refrain from disclosing any personally identifiable information in these questions.

How we use your data

We collect your personal data as part of the consultation process:

  • for statistical purposes, for example, to understand how representative the results are and whether views and experiences vary across demographics
  • so that MHRA can contact you for further information about your response (if you have given your consent)
Legal basis for processing personal data

The legal basis for processing your personal data is to perform a task carried out in the public interest, or in the exercise of official authority vested in the controller.

Data processors and other recipients of personal data

All responses to the survey will be seen by:
  • Professionals within MHRA who are working on this survey
  • MHRA’s third-party supplier (SocialOptic), who is responsible for running and hosting the online survey 

No personally identifiable data will be shared

MHRA may also share your responses, when anonymised, with Department of Health and Social Care, Government Legal Department, Office for Life Sciences, and any other government body identified to be part of this survey.

International data transfers and storage locations

Storage of data by the MHRA is provided via secure computing infrastructure on servers located in the UK. Our platforms are subject to extensive security protections and encryption measures. Storage of data by SurveyOptic is provided via secure servers located in the United Kingdom (UK).

Retention and disposal policy

Personal data will be held by the MHRA for 3 years and disposed of sooner if possible. 

SurveyOptic will securely erase the data held on their system 5 years after the online survey closes, or when instructed to do so by MHRA if the data has served its intended purpose (whichever happens earlier). Data retention will be reviewed on an annual basis. Anonymised data may be kept indefinitely.

How we keep your data secure

The MHRA uses appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited and reviewed at a senior level.

SurveyOptic is Cyber Essentials certified. 

You can find further information on MHRA Privacy Notice here.

Your rights

By law, you have rights as a data subject. Your rights under the UK General Data Protection Regulation and the UK Data Protection Act 2018 apply. You can learn more about your rights from the Information Commissioner’s Office website - For the public | ICO.

Anyone unhappy or wishing to complain about how personal data is used as part of this programme, should contact dataprotection@mhra.gov.uk.

Anyone who is still not satisfied can complain to the Information Commissioner’s Office. Their website address is https://ico.org.uk/.