Privacy Notice 

​

Effective Date: 1st January 2025
Last Updated: 29th October 2025

​

1. Who We Are

Docstudies Ltd (“we”, “us”, “our”) is a market research company conducting surveys and interviews with healthcare professionals and patients to gather insights on medical and healthcare-related topics.

Controller: Docstudies Ltd
Registered Address: 85 Great Portland Street, First Floor, London, England, W1W 7LT
Email: info@docstudies.com
 

​

2. What Data We Collect

We collect only the data necessary to manage our research projects and invite you to relevant studies:

• Identification: Name, job title, specialty, workplace, professional registration number.

• Contact details: Email address.

• Research participation details: Survey responses, feedback, honorarium/payment details.

• Technical data: IP address and device information (for fraud prevention).

• Special category data: Health-related information or patient experience data, collected only when explicitly required for a study and only with your explicit consent.

​

3. How We Use Your Data

We process your personal data to:

• Invite you to participate in relevant research studies.

• Manage your participation, communication, and incentives.

• Maintain and update our research participant panel.

• Comply with our legal obligations (e.g., accounting and tax).

We do not sell or share your data with third parties for marketing purposes.

​

4. Legal Basis for Processing

We rely on the following legal bases:

• Legitimate interest – to invite you to participate in relevant market research.

• Consent – when you agree to participate in a specific study or provide information for payment.

• Legal obligation – for financial, tax, and accounting compliance.

​

5. Data Retention

We retain your data:

• As long as you are part of our research panel.

• Until you opt out, or request deletion.

You can withdraw your consent and request deletion of your data at any time by contacting info@docstudies.com.

​

6. Sharing of Data

We may share data with:

• Secure online survey platforms and cloud hosting providers.

• Clients, but only in aggregated or anonymized form.

• Payment providers for distributing incentives via bank transfer or voucher.

All third parties are bound by Data Processing Agreements (DPAs) and are required to comply with GDPR.

​

7. International Transfers

We do not transfer or store any personal data outside the UK or EEA.

​

8. Your Rights

You have the right to:

• Access your data

• Correct inaccuracies

• Request deletion

• Restrict processing

• Object to processing

• Request data portability

​

To exercise these rights, please email info@docstudies.com.

​

9. Contact & Complaints

If you have concerns about your data, please contact our Data Protection Lead:
Email: info@docstudies.com

​

You can also lodge a complaint with the Information Commissioner’s Office (ICO) in the UK.

​

2. Record of Processing Activities (ROPA)

SectionDetails

ControllerDocstudies Ltd, 85 Great Portland Street, First Floor, London, England, W1W 7LT, info@docstudies.com

Purpose of Processing Recruitment and management of healthcare professional and patient panels; conducting paid surveys and interviews.

Data SubjectsHealthcare professionals and patients.

Categories of DataName, contact details, job title, professional credentials, health-related data (with consent), payment details, survey responses.

Lawful BasesLegitimate Interest (panel management), Consent (participation), Legal Obligation (payments).

RecipientsSurvey platforms, payment processors, data hosting providers.

Transfers Outside EEA/UKNone.

Retention PeriodUntil opt out or withdrawal of consent.

Security MeasuresEncryption, restricted access, DPAs with vendors, pseudonymization of survey data.

​

3. Data Breach Policy

Purpose

To define how Docstudies Ltd identifies, assesses, reports, and responds to personal data breaches under GDPR.

​

1. Definition

A data breach is any incident leading to unauthorized access, loss, alteration, or disclosure of personal data.

​

2. Detection & Reporting

All staff must immediately report suspected breaches to the Data Protection Lead at info@docstudies.com.
Incident details must be logged (date, nature, systems affected, data involved).

​

3. Assessment

Within 24 hours of detection, the Data Protection Lead must:

• Assess risk to data subjects.

• Determine if reporting to the ICO is required.

​

4. Notification

If a breach is likely to result in a risk to rights/freedoms:

• Notify the ICO within 72 hours.

• If high risk, notify affected individuals promptly, describing:

  • What happened

  • Likely consequences

  • Steps taken and advice for protection

​

5. Containment & Recovery

• Secure affected systems immediately.

• Change any compromised credentials.

• Implement technical fixes to prevent recurrence.

​

6. Documentation

All breaches, regardless of severity, must be recorded in the Incident Register, including:

• Description

• Cause

• Resolution

• Lessons learned

​

7. Review

The Data Protection Lead will review and update this policy annually.