Privacy Notice for Personal Data Processed as Part of Programme Delivery

Purpose of this notice

This notice tells you how Grow MedTech will collect and process your personal data. 

Change in the law

From 25th May 2018, we will process your personal data in accordance with the General Data Protection Regulations (GDPR).

Where do we get your personal data from?

If you are directly involved in any aspect of the programme, your contact details will be recorded as part of the programme administration. This Notice outlines the uses of your data. When you are required to provide personal data as part of the programme, you will be directed to this Notice.

What personal data do we collect and store?

  • Your name
  • Your employer and job title
  • Your email address and telephone number
  • A keyword tag describing your role
  • Our interactions with you, such as when we’ve met, if we’ve entered into a contract with you, your mailing preferences

What is our lawful basis for processing your data?

The work of the Medical Technologies Portfolio is not considered part of the core academic activity of the University of Leeds. Grow MedTech is funded by Research England. Our contract with this body sets out the required activities for the programme to be delivered effectively. This contract is our lawful basis to store personal data in our secure database. This relates to Article 6 of the legislation:

Article 6 (1) (b), necessary for the performance of a contract to which the data subject is part or in order to take steps at the request of the data subject prior to entering a contract

Your details are used to contact you about project progress, relevant funding and development opportunities, to broker collaborations, to arrange meetings, and for us to log interactions. This allows us to deliver the support available through the programme, and to continually develop our business relationship with you.

Additionally, we require your consent to opt-in to MedTech programme mailing lists. To opt-in, please use the linked form:

This basis also relates to Article 6 of the legislation:

Article 6 (1) (a), the data subject has given consent to the processing of his or her data for one or more specific purposes

Data sharing

Grow MedTech is a consortium of six universities: University of Leeds, University of Huddersfield, University of Bradford, University of York, Leeds Beckett University and Sheffield Hallam University. The University of Leeds is the organisation in charge of your data, and the data will be shared with the partner universities for the purposes of delivering the programme. We do not submit your data to third parties beyond the consortium.

We are required by Research England to submit annual progress reports. We use a series of keyword tags to report on metrics such as the total numbers of academics, clinicians, and industry partners engaged in the programme. This is done manually, and submitted as an anonymised statistical report.

Who can access your data?

No more than 25 programme employees with access to a cloud-based CRM system and shared online working space.

How long do we keep your data?

We keep your information for the duration of the programme + no more than 6 years, based on central university retention schedules. For Grow MedTech, this is March 2027.

Additional notices and guidance/policies

While the work of the Medical Technologies Portfolio sits outside the core academic activity of the University of Leeds, we have based our guidance on central University policies.

The University’s Data Protection Code of Practice   

University of Leeds Retention Policy. MedTech retention schedules are based on the general maximum period, 6 years after a programme ends.

This Notice is based on the University of Leeds Student Privacy Policy

Your rights as a data subject

You have the right to:

  • Withdraw consent where that is the legal basis of our processing (marketing and communications);
  • Access your personal data that we process;
  • Rectify inaccuracies in personal data that we hold about you;
  • Be forgotten, that is your details to be removed from systems that we use to process your personal data;
  • Restrict the processing in certain ways;
  • Obtain a copy of your data in a commonly used electronic form; and
  • Object to certain processing of your personal data by us

Please see for further information on the above rights. You may also contact the University of Leeds Data Protection officer for further information.

You have the right to complain to the Information Commissioner’s Office about the way in which we process your personal data.

Changes to this notice

This notice and therefore the ways in which your data may be processed can be changed from time to time. Any changes will only be notified via this web page and the Grow MedTech newsletter.

Further information and contact

If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice, please contact the University of Leeds Data Protection Officer, Adrian Slater at

Our general postal address is University of Leeds, LS2 9JT, UK.

The postal address for data protection issues is University of Leeds, Room 11.72, EC Stoner Building, Leeds, LS2 9JT

The University of Leeds data controller registration number provided by the Information Commissioner’s Office is Z553814X.

Privacy notice – website

1. Purpose of this notice
This notice tells you how the University of Leeds will collect and process your personal data when you access this website.

2. Automated collection of personal information
As with most other web servers, when you access these web pages certain information you provide will automatically be recorded by the University. This will include your IP address, browser type, and information relating to the page you last visited. This information is processed to estimate how much use of the server is made by different categories of users and, in the event of a breach of security, may be used to aid detection.

3. Non-automated collection
Where you are required under this website to provide personal data, the uses of this data will be indicated at the point of collection – for example, when requesting a brochure or registering for an event.

4. Third-party access
Your personal data that you have provided will not routinely be sent to third parties (unless notified – see above).

5. Cookies
Cookies are small text files that are placed on your device by websites that you visit.

Our website uses cookies for three purposes:

  • Essential: These are essential to the website and ensure it works. They are first party cookies set by our web server;
  • Performance: These collect anonymous information about the use of our website and help us making continued improvements to the site;
  • Targeted advertising: These cookies are used in parts of our website to capture users’ subjects of interest and then serve targeted advertising on other websites.

We do not use cookies to collect personal information about you.

Should you wish to restrict or block cookies which are set by our website you can do this through your browser settings. The ‘help’ function within your browser or the manual that comes with your device should tell you how. You may also wish to visit which contains comprehensive information on how you can do this on a wide variety of browsers. Please be aware that restricting cookies may impact on the functionality of our website.

The table below explains the cookies we use and why:

Essential Cookies

NetScaler Appliance session cookie (NSC*)

  • Purpose – These cookies are set by our Citrix NetScaler appliance and are used to ensure your browsing session remains on the same web server. It is deleted when you close your browser.
  • Information –


  • Purpose – This cookie stores a unique ID assigned by the web server. It is used to enable some site functionality to work properly. It is deleted when you close your browser
  • Information –

Performance and advertising cookies

Google Universal Analytics cookies (__utma,__utmb,__utmc,__utmv,__utmz,__ga,__gat)

  • Purpose – These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. These cookies are also used to track users’ interests and then provide targeted advertising on other websites. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.The information stored in the first-party Universal Analytics cookie is simply a randomly generated identifier, for example 12345.67890.
  • Information – How Google uses data:, Google analytics, Google analytics terms of serviceUniversal Analytics opt-opt browser add-on: information on Google re-marketing and managing your privacy 

6. University Code of Practice
The University’s Data Protection Code of Practice also applies to the use of personal data under this website. The Code can be accessed at

7. Changes to this notice
This notice and therefore the ways in which your data may be processed can be changed from time to time. Any changes will only be notified via this web page and you may be prompted to accept any changes.

8. Further information and contact
If you have any queries relating to this privacy notice or the way your data is being processed through this website then please contact If you are dissatisfied with their response please contact the Translate Webmaster