Privacy Policy

Privacy Policy

1.     Purpose of the policy

This privacy policy details what personal information Morningside Pharmaceuticals Ltd (MPL) collects, why MPL collects it and from whom; and for how long MPL retains it.

It applies to information MPL collects about:

  • People who call or email MPL regarding a medical enquiry
  • People who use the ‘Send Enquiry’ service on the website
  • Customers and Suppliers
  • Job applicants, current and former employees

2.     People who call or email MPL regarding a medical enquiry

When an individual calls or emails MPL regarding a medical enquiry, the trained personnel in the Quality Assurance (QA) Department will collect from the caller or sender personal data such as patient name, address, contact details, medicines and relevant health data. This is necessary to perform a task in the public interest and to comply with EU regulatory requirements in support of gaining a valid Marketing Authorisation for a Medicinal Product. This data will be provided to Morningside Healthcare Ltd as the MA holder of the Medicinal Product and the Pharmacovigilance Provider, APCER Life Sciences.

2.1 People who email MPL

MPL uses Transport Layer Security (TLS), MessageLabs and SOPHOS to encrypt and protect email traffic in line with government guidelines. If the individual’s email service does not support TLS, they should be aware that any emails MPL send or receive may not be protected in transit. MPL will also monitor any emails sent to them, including file attachments, for viruses or malicious software. Please be aware that the individual has a responsibility to ensure that any emails they send is within the bounds of the law.

3.     People who use the ‘Send Enquiry’ service on the website

If an individual uses the ‘Send Enquiry’ service, MPL will receive an email which contains their name, email address and the contents within the message. This information will not be shared with any other organisations.

4.     Customers and Suppliers

MPL’s primary market is Business to Business therefore MPL will only email, call or direct mail prospects where there is either evidenced consent or where there is a legitimate interest to do so. Where legitimate interest is considered the ground for processing, an assessment shall be made to ensure that this legitimate interest is valid and that this interest does not outweigh an individual’s right to privacy.

5.     Job applicants, current and former employees

MPL is the Data Controller for the information provided during the recruitment process unless otherwise stated. Any queries about the process or how information is handled should eb forwarded to the DPO in the ‘Contact Us’ section.

5.1 What will MPL do with the information provided?

All information provided during the application process will only be used for the purpose of progressing applications, or to fulfil legal or regulatory requirements if necessary.

MPL will not share any of the information provided during MPL’s internal recruitment process with any third parties for marketing purposes. Data sent electronically or processed beyond the initial application will be stored within the UK at the Loughborough offices and in the European Economic Area by our third-party processors – all processors have appropriate levels of security and organisational controls to meet data protection requirements. The information provided will be held securely by MPL and/or the data processors whether the information is in electronic or physical format.

MPL will use the contact details provided to contact the applicant via the method they wished to be contacted. MPL will use the other information provided to assess the Applicant’s suitability for the role.

5.2 What information do MPL ask for, and why?

MPL do not collect more information than needed to fulfil the stated purposes and will not retain it for longer than is necessary.

The information asked for is used to assess the Applicant’s suitability for employment. The Applicant does not have to provide what is asked for, but it might affect their application if they chose not to.

5.3 Application stage

Applications may be received by email, physically by post or through a third-party recruitment agency. MPL may ask the Applicant for their personal details including name and contact details. MPL will also ask about the Applicant’s previous experience, education, referees and for answers to questions relevant to the role they have applied for. The Human Resources (HR) Department and the hiring manager will have access to this information.

The Applicant may also be asked to provide equal opportunities information. This is not mandatory information – if they do not provide it, it will not affect their application. This information will not be made available to anyone other than the HR Department. Any information they do provide, will be used only to produce and monitor equal opportunities statistics.

5.4 Shortlisting

The hiring managers shortlist applications for interview. They will be provided with the Applicant’s name and contact details. However, they will not be provided with equal opportunities information if it has been provided it.

5.5 Assessments

MPL might ask the Applicant to participate in assessment days; complete tests or occupational personality profile questionnaires; and/or to attend an interview – or a combination of these. Information will be generated by the Applicant and by MPL. For example, the Applicant might complete a written test, or the hiring manager might take interview notes. This information is held by the MPL HR Department.

If the Applicant is unsuccessful following assessment for the position they have applied for, MPL may retain the Applicant’s details in the talent pool for a period of up to two years.

5.6 Conditional Offer

If MPL make a conditional offer of employment they will ask the Successful Applicant for information so that the HR Department can carry out pre-employment checks. The Successful Applicant must successfully complete pre-employment checks to progress to a final offer. MPL are required to confirm the identity of their staff, their right to work in the United Kingdom (UK) and seek assurance as to their trustworthiness, integrity and reliability.

The Successful Applicant will therefore be required to provide:

  • Proof of identity – they will be asked to attend the Head Office with original documents, the HR Department will take copies.
  • Proof of qualifications – they may be asked to attend the Head Office with original documents, the HR Department will take copies.

The Successful Applicant may be asked to complete a criminal records declaration to declare any unspent convictions and the HR Department will contact referees, using the details provided in the Application Form, directly to obtain references.

MPL will also ask the Successful Applicant to complete a questionnaire about their health. This data is only provided to the Health and Safety Manager or Health and Safety Senior Officer to establish the Successful Applicant’s fitness to work.

If MPL make a final offer, MPL will also ask for the following:

Bank details – to process salary payments.

Emergency contact details – to contact in case of an emergency at work.

5.7 Use of Data Processors related to Recruitment and Employment

Data processors are third parties who provide elements of MPL’s recruitment or employment service on their behalf. MPL have contracts in place with these data processors. This means that third parties cannot do anything with individual’s personal information unless MPL have instructed them to do so. These third parties will not share any personal information with any organisation unless MPL has given explicit permission or where there is a legal obligation to do so. They will hold it securely and retain it for the period MPL instruct.

If an individual is employed by MPL, relevant details about them will be provided to a number of third-party providers, including payroll and pensions providers. All employees will be given an Employee Data Privacy Notice to explain this in detail.

5.8 How long is the information retained for?

If an Applicant is successful, the information they provided during the application process will be retained by MPL as part of their employee file for the duration of their employment plus 7 years following the end of their employment. This includes their criminal records declaration, fitness to work, records of any security checks and references.

If they are unsuccessful at any stage of the process, their CV shall be retained for up to 24 months and any other information they have provided until that point will be retained for 6 months from the closure of the campaign. If an Applicant would prefer for MPL to delete their CV, they must contact the HR Department or the DPO whose details are provided in the ‘Contact Us’ section below.

Information generated throughout the assessment process, for example interview notes, is retained by MPL for 6 months following the closure of the campaign. Equal opportunities information is retained for 6 months following the closure of the campaign whether the Applicants are successful or not.

When MPL have no ongoing legitimate business need to process the personal information, MPL will either delete or anonymise it or, if this is not possible (for example, because the personal information has been stored in backup archives), then MPL will securely store the personal information and isolate it from any further processing until deletion is possible.

MPL’s online services portals (Atlas and e-payslip portal provided by RSM) record data relating to human resources and health and safety for employees. In these cases, Citation and RSM are acting as Data Processors on behalf of Morningside Pharmaceuticals Ltd. For more information, please refer to Annex A or speak to the HR Manager.

Any personal information collected will be retained where there is an ongoing legitimate business need to do so (for example, to provide a service or to comply with applicable legal, tax or accounting requirements). Citation or RSM will not send targeted advertising to employees.

6.     Your rights

Personal data will be processed in recognition of an individuals’ data protection rights, as follows:

  • the right to be informed;
  • the right of access;
  • the right for any inaccuracies to be corrected (rectification);
  • the right to have information deleted (erasure);
  • the right to restrict the processing of the data;
  • the right to portability;
  • the right to object to the inclusion of any information;
  • the right to regulate any automated decision-making and profiling of personal data.

More information about these rights can be found on the ICO website (

7.     Complaints or queries

MPL tries to meet the highest standards when collecting and using personal information. For this reason, MPL take complaints about this very seriously. MPL encourages individuals to bring it to the attention of the DPO if they think that the collection or use of information is unfair, misleading or inappropriate. MPL would also welcome any suggestions for improving the current procedures.

This privacy notice was produced with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of MPL’s collection and use of personal information. However, MPL is happy to provide any additional information or explanation needed. Any requests for this should be sent to the DPO below.

If an individual wants to make a complaint about the way MPL has processed their personal information, they can contact the ICO in their capacity as the statutory body which oversees data protection law –

8.     Access to Personal information

MPL tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if MPL holds any personal information by making a ‘subject access request’. If MPL does hold information about an individual, MPL will:

  • give the individual a description of it;
  • tell the individual why MPL are holding it;
  • tell the individual who it could be disclosed to; and
  • let the individual have a copy of the information in an intelligible form.

To make a request for any personal information MPL may hold regarding the individual requesting the information; they need to put the request in writing to the address provided below.

If the individual agrees, MPL will try to deal with the request informally, for example by providing the individual with the specific information that they need over the telephone.

If MPL do hold information which is incorrect, you can ask us to correct any mistakes by contacting the HR Manager or DPO.

9.     Disclosure of personal information

In many circumstances MPL will not disclose personal data without consent, unless legally obliged to do or as part of contractual obligations with business customers (where an individual is party to the agreement or service).

MPL may disclose an individual’s personal information to the following categories of recipients:

  • to the Morningside Group (MPL as the release site and legal manufacturer Morningside Healthcare Ltd as the as the MA holder, Morningside Leicester, a Pharmacy chain)
  • to a third-party service provider and partner who provide data processing services to MPL (for example, to provide payroll or pension services), or who otherwise process personal information for purposes that are described in this Privacy Policy or notified to an individual when MPL collect personal information.
  • to any competent law enforcement body, regulatory, government agency, court or other third party where MPL believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect an individual’s vital interests or those of any other person;
  • to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of MPL’s business, provided that MPL inform the buyer it must use an individual’s personal information only for the purposes disclosed in this Privacy Policy;
  • to enforce or apply MPL’s terms of service or other agreements or to protect MPL and its customers (including with other companies and organisations for the purposes of fraud protection and credit risk reduction)
  • to any other person with an individual’s consent to the disclosure.

10.  Legal basis for processing personal information

MPL will normally collect personal information from individuals’ only where MPL have consent to do so, where MPL need the personal information to perform a contract with/involving an individual, or where the processing is in MPL’s legitimate interests and not overridden by the individual’s data protection interests or fundamental rights and freedoms.  In some cases, MPL may also have a legal obligation to collect personal information from individuals or may otherwise need the personal information to protect the individual’s vital interests or those of another person.

If MPL ask an individual to provide personal information to comply with a legal requirement or to perform a contract, MPL will make this clear at the relevant time and advise the individual whether the provision of their personal information is mandatory or not (as well as of the possible consequences if they do not provide the personal information).

Similarly, if MPL collect and use their personal information in reliance on MPL’s legitimate interests (or those of any third party), MPL will make clear to the individual at the relevant time what those legitimate interests are.

If an individual has any questions about or requires further information concerning the legal basis on which MPL collect and use their personal information, they can contact MPL using the contact details provided under the “How to contact us” heading below.

11.  Links to other websites

Please note that MPL procedures do not cover the links on the MPL website linking to other websites. MPL encourages individuals to read the privacy statements on the other websites that they visit.

12.  Changes to this Privacy Policy

MPL keeps the Privacy Notice and documents under regular review. This privacy notice was last updated June 2018.

13.  How to contact us

If an individual wants to request information about the Privacy Policy, they can email MPL or write to:

Mr. A Claydon

Data Protection Officer

Morningside Pharmaceutical Ltd

5 Pavilion Way

Castle Business Park



LE11 5GW


Disclaimer and Privacy Statement | Terms & Conditions
  • A A A