BMJ in UK BMJ India BMJ Brazil BMJ in North America BMJ China

BMJ privacy notice

  • BMJ
  • /
  • BMJ privacy notice

BMJ privacy notice

This Privacy Notice explains how BMJ Publishing Group Limited, a company registered in England (company number 3102371) with its registered office at BMA House, Tavistock Square, London, WC1H 9JR (BMJ, we, our, us), processes your personal data and your rights in relation to the personal data we hold.                

You can also look at the cookies policy to find out what cookies we use and why.

For the purposes of any applicable data protection laws in England and Wales, including from 25 May 2018 the EU General Data Protection Regulation 2016/679 (GDPR), BMJ is the data controller of your personal data. We are registered with the ICO on the Data Protection Public Register under registration number Z7607533.

If you have any questions about these rights or how your personal data is used by us, you should contact the Data Protection Officer using the details below:

How we use your personal data will depend upon how you use our services. We have included separate sections in section 1 of this Notice for distinct products and services we offer to help you identify how this Notice is relevant to you. 

Effective May 25, 2018  | Archived versions

This Notice has the following parts:

What personal data we collect, how we use your data, who we share your data with and our legal basis for processing your data.

General processing (e.g marketing and market research, running competitions, administering websites and Apps)

How your personal data is collected

BMJ collects your personal data from the following sources:

  • From you, when you:
    • fill in forms on our website or our apps, for example to order products or services, to sign up to a mailing list, or to register to use our website and apps;
    • enter a competition for which we are a promoter; either online, by email, post, text or phone;
    • participate in a BMJ discussion forum or interact on our social media accounts;
    • communicate with us by post, telephone, fax, email, social media, webinars, online customer services, or in person;
    • complete surveys or testimonials.

 

  • From third parties such as software providers:
    • who analyse your use of our websites and apps;
    • provide our e-commerce solution; as well as those
    • who process Open Access fees on our behalf; as well as those
    • service providers we appoint to host discussion forums, webinars and online chat, or administer surveys and market research on our behalf;
    • The British Medical Association (BMA) who provide details of BMA members in order for us to deliver products that are included as part of BMA membership (or where you have consented to being contacted by us);
    • your hospital, university, trust or other organisation who provide your details when they purchase our products so that we can register and administer your account;

What categories of personal data are collected?

Identification and contact details
  • biographical information such as your name, title, date of birth, age and gender;
  • images and your likeness (as captured in a photograph for identification purposes or on video that we capture for webinars, interviews and when filming for BMJ's other legitimate purposes);
  • your contact details including address, email address, phone number and social media identifiers;

Online and transactional
  • when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
  • information you provide in your communications with us;
  • details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/ );
  • your opinion as you express it in chat, forums and interviews;
  • products you have purchased and details of financial transactions;
  • content and links you accessed in our marketing emails;

Special categories of personal data
  • where appropriate, we may obtain diversity and background information including ethnic origin, race, religious and political beliefs, health data or information concerning your sex life and sexual orientation, that you provide to us in our surveys or for our market research. We may also collect details of trade union membership, for example, where membership (such as membership of the BMA) entitles you to access to, or a discount on, our products.


How we use your data, the basis for processing your data and with whom we share it

As part of a contractual relationship

We may process your personal data because it is necessary for the performance of a contract to deliver products you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data to provide products that you (or your organisation) have requested from us (or which are provided as part of your BMA membership) and to communicate with you in relation to these products.

We will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

  • third party service providers such as shipping companies and our website and app platform providers who assist us in delivering our products to you;
  • our bank to whom payment details are provided in order to process a payment;
  • our data storage providers and those who provide our Customer Relationship Management (CRM) platforms; and
  • Our parent company British Medical Association or to your organisation/institution where we are required to verify your details prior to providing our products to you.

Legitimate interests

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • to administer a competition that you have entered;
  • marketing BMJ and its products online, or by post, telephone, SMS, social media and email (except where we provide communications under contract, or in situations where it is required or appropriate to seek your consent);
  • measuring and understanding the effectiveness of our advertising and to allow us (and third parties who advertise on our website and apps) to deliver relevant advertising to you (including ensuring that we do not advertise medical products that are not licensed in your country);
  • recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
  • processing technical information about your use of our website and apps to ensure that content is presented in the most effective manner and to allow you to use interactive features of our website and apps;
  • processing enquiries, complaints and analysing our services;
  • consulting our professional advisers (including legal) where it is necessary for us to obtain their advice or assistance;
  • providing your data to a buyer or prospective buyer of the whole or a part of our business (except in circumstances where this is necessary for the performance of a contract to which you are a party);
  • dealing with enquiries and investigations by authorities where a statutory or regulatory obligation does not exist (for example, cooperating with the Advertising Standards Agency).

In this respect, in addition to those parties named above, we will provide your data to the following:

  • direct marketing providers;
  • Google Analytics who receive technical information in relation to how you use our website and apps;
  • sponsors who have provided prizes for competitions you have won. We may also share your name and contact details with sponsors where you have entered a competition and provided consent for your details to be shared for this purpose;
  • BMA and other third parties for marketing purposes where we have your consent to share your information for this purpose.

BMJ's Legal Obligations

Your personal data will also be processed by BMJ for compliance with its legal and regulatory obligations such as:

  • the detection and prevention of crime and in order to assist the police and other competent authorities with investigations;
  • to comply with tax legislation and subject access requests of others; and
  • to comply with any regulatory obligations to which we are, or may become, subject.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; HMRC and BMJ's external auditors.


Consent

In some circumstances BMJ may seek your explicit consent to process your personal data: for example, if we wish to use your likeness or an attributed quote in our materials or where it is otherwise appropriate.


Special categories of personal data

Where we process special categories of personal data, we do so under the following bases:

  • to protect your vital interests; for example to inform an emergency contact, the NHS or emergency services in the event of your illness or other emergency;
  • with your explicit consent, for example if you provide information about your health, ethnicity, sexual orientation or religious beliefs, etc in a survey for our market research or information about your BMA membership where this is relevant to access to (or a discount on) a product;
  • where processing is necessary for the establishment, exercise or defence of a legal claim.

Profiling and automated decision making

We use personal characteristics such as age, gender, address, role, your expressed interests, your previous interactions with BMJ or geographical location to target our communications to a specific audience.


Expand all Collapse all
International transfers of data

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area. In these circumstances, your personal data will only be transferred on one of the following bases:

  • where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR).  If you wish to obtain a copy of the standard clauses we use, please contact us;
  • under an approved certification mechanism such as Privacy Shield (Article 42 GDPR);
  • a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);
  • there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent).


How long we retain your information

We retain your data for as long as is required to provide our products to you or is necessary for our legal purposes or our legitimate interests. In particular, we generally retain data in relation to:

  • products provided by us for ten years after the product has been provided, unless our relationship with you continues for a longer period;
  • information gained from the cookies we use on our website and apps for 30 days;
  • competition entries for up to two years following the end of the competition, although where prize winners’ details are published, this data may be archived indefinitely;
  • recordings of telephone calls made to our call centre for 12 months;
  • marketing purposes until you inform us that you no longer wish to hear from us (for example, through clicking ‘unsubscribe’ on an email communication). If you express this preference we may retain your contact details on a suppression list so that you no longer receive communications from us.


BMJ Best Practice, BMJ Learning, OnExamination, Research To Publication and BMJ Masterclasses (online learning)

How your personal data is collected

BMJ collects your personal data from the following sources:

  • From you, when you:
    • register and subscribe for BMJ Best Practice, BMJ Learning, OnExamination, BMJ Masterclasses or RTOP on our website or applications and when you use our online tools;
    • complete feedback forms and surveys in connection to our products;
    • correspond with us or make enquiries via our website or apps, email, post or telephone.

 

  • From third parties such as:
    • your hospital, university, trust or other organisation who may have provided us with your details so that we can provide you with access to our products;
    • British Medical Association (BMA), if BMA membership entitles you to access our products;
    • Worldpay, our payment provider who will confirm details of your payment;
    • Our software platform providers who host and operate our website and applications.

What categories of personal data are collected?

We collect the following categories of personal data:

Identification and contact details
  • biographical information such as your name, title, date of birth, age and gender;
  • your contact details including address, email address and phone number;
  • log in details that you are assigned as part of registration;

Professional
  • your qualifications and professional experience;
  • your hospital, university, trust or other organisation you belong to;
  • your BMA membership number if this is relevant to the provision of our products;
  • content you have accessed, courses and assessments you have attempted or completed and your assessment results, in connection to our products;
  • reviews you post on our websites in relation to our products;

Online and transactional
  • when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
  • details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/);
  • information you provide in your communications with us;
  • your opinion as you express it in chat, forums and interviews;
  • information on the number and type of different devices you are using to access your BMJ accounts;
  • confirmation of financial transactions;

Special categories of personal data
  • details of trade union membership (such as BMA membership) where this is relevant to access to (or a discount on) our products;


How we use your data, the basis for processing your data and with whom we share it

As part of a contractual relationship

We may process your personal data because it is necessary for the performance of a contract to deliver the products you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

  • to create and administer your account and subscription payments;
  • to enable you to use online tools and to track your usage for Continuing Medical Education and Career Professional Development purposes;
  • access authentication and authorisation.

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

  • our bank to whom payment details are provided in order to process a payment;
  • our platform providers who host our websites and apps.

Legitimate interests

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • marketing BMJ and its products online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);
  • recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
  • processing technical information about your use of our products to ensure that content is presented in the most effective manner and to allow you to use interactive features of our products;
  • processing (and replying to) enquiries, complaints, surveys, feedback forms and to analyse our services;
  • providing your data to a buyer or prospective buyer of the whole or a part of our business (except in circumstances where this is necessary for the performance of a contract to which you are a party);
  • sharing information in relation to your use of our products (such as assessment results and content you have accessed) if your hospital, university, trust or other organisation has provided you with access to our products. BMJ will share this data with your parent organisation so that your organisation can offer you relevant support. Prior to sharing your data in this way BMJ will obtain assurances from your organisation as to how the data will be used;
  • consulting our professional advisers where it is necessary for us to obtain their advice or assistance.

In this respect, in addition to those parties named above, we will provide your data to the following:

  • direct marketing providers;
  • Google Analytics who receive technical information in relation to how you use our website and apps;
  • BMA who will receive usage statistics of products for BMA members in order to allow it to assess the value of offering the product as part of its membership package;
  • BMA and other third parties for marketing purposes (unless it is required or appropriate for us to request your consent to share your information for this purpose).

BMJ's Legal Obligations

Your personal data will also be processed by BMJ for compliance with its legal obligations. For example:

  • for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations;
  • to comply with tax legislation, safeguarding duties and subject access requests of others.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; HMRC and BMJ's external auditors.


Special categories of personal data

Where you provide information concerning your health or BMA membership we will only process this information where we have your explicit consent.


Profiling and automated decision making

We may use personal characteristics such as age, gender, address, role, your expressed interests, your previous interactions with BMJ or geographical location to target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).


International transfers of data

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area (EEA).  For example, we may transfer data to your institution, for the purposes given above, which may be established outside of the EEA. We may also pass personal information to our agents outside the EEA (e.g. USA and Mexico) in order for them to contact users in relation to product support and for marketing purposes.

In these circumstances, your personal data will only be transferred on one of the following bases:

  • where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR). Please contact us if you wish to obtain a copy of the standard clauses we use;
  • a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);
  • under an approved certification mechanism such as Privacy Shield (Article 42 GDPR);
  • there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent).


How long we retain your information

We retain your data for as long as is required to provide our products to you or is necessary for our legal purposes or our legitimate interests. In particular, we generally retain data in relation to:

  • our products for seven years after the product has been provided, unless our relationship with you otherwise continues for a longer period;
  •  
  • information gained from the cookies we use on our website and apps for 30 days;
  •  
  • recordings of telephone calls made to our call centre for 12 months;
  •  
  • marketing purposes until you inform us that you no longer wish to hear from us (for example, through clicking ‘unsubscribe’ on an email communication). If you express this preference we may retain your contact details on a suppression list so that you no longer receive communications from us;
  • reviews you post on our website or apps are held for three years unless you delete or unpublish the review.


BMJ Journals

How your personal data is collected

BMJ collects your personal data from the following sources:

  • From you, when you:
    • register and subscribe for BMJ publications through our website, email, post, or by phone;
    • correspond with us and make enquiries through our website or by post, email, phone or online customer services;
    • when you complete feedback forms or surveys.
  • From third parties such as:
    • your hospital, university, trust or other organisation if they have subscribed on your behalf for BMJ's publications;
    • British Medical Association (BMA) if you receive a subscription as part of your BMA membership;
    • Worldpay, our payment provider who will confirm details of your payment;
    • agents who advertise and process orders for our subscriptions on our behalf;
    • aggregator platforms who provide access to our publications on their platforms;
    • our platform providers who host and operate our website and apps.

What categories of personal data are collected?

We collect the following categories of personal data:

Identification and contact details
  • biographical information such as your name, title, date of birth, age and gender;
  • your contact details including address, email address and phone number;
  • log in details that you are assigned as part of registration.

Professional
  • your qualifications, licences and professional experience;
  • your institution or the society you belong to;
  • your ORCID ID (if you have one);
  • your primary speciality (if applicable);
  • your BMA membership number where this is required;

Online and transactional
  • when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
  • information you provide in your communications with us;
  • details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/);
  • information on the number and type of different devices you are using to access your BMJ subscriptions;
  • details of your current and previous subscriptions;
  • payment details and your financial transactions in relation to your subscription;

Special categories of personal data
  • details of trade union membership (such as BMA membership) where this is relevant to access to (or a discount on) our subscriptions.


How we use your data, the basis for processing your data and with whom we share it

As part of a contractual relationship

We may process your personal data because it is necessary for the performance of a contract, for example, to deliver the subscriptions you have requested, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following purposes:

  • to administer and correspond with you about your subscriptions;
  • to administer your subscription plan and payments;
  • to provide you with access to the platforms, websites and apps on which our publications reside;
  • to conclude transactions with you for the purchase of print or online subscriptions or individual articles;

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

  • our website and app platform providers, who may store details such as name, email address and login details to enable online access;
  • third party editorial offices;
  • transport and distribution agents.

Legitimate interests

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • detecting breaches of our subscription terms and conditions;
  • marketing BMJ and its products online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);
  • recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
  • processing technical information about your use of our website and apps to ensure that content on our site is presented in the most effective manner and to allow you to use interactive features of our website and apps;
  • processing enquiries, complaints, surveys, feedback forms and to analyse our services;
  • providing your data to a buyer or prospective buyer of the whole or a part of our business (except in circumstances where this is necessary for the performance of a contract to which you are a party);
  • consulting our professional advisers where it is necessary for us to obtain their advice or assistance.

In this respect, in addition to those parties named above, we will provide your data to the following:

  • direct marketing providers;
  • Google Analytics who receive technical information in relation to how you use our website and apps;
  • BMA, co-owners of journals for marketing purposes (apart from where it is required or appropriate to have your consent to sharing your information for this purpose).

BMJ's Legal Obligations

Your personal data will also be processed by BMJ for compliance with its legal obligations. For example:

  • for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; HMRC and BMJ's external auditors.


Special categories of personal data

Where we process special categories of personal data our bases for processing are:

  • your explicit consent, for example if we process information about your trade union membership;
  • where processing is necessary for the establishment, exercise or defence of a legal claim.

Profiling and automated decision making

We may use personal characteristics such as age, gender, address, role, your expressed interests, your previous interactions with BMJ or geographical location to target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).


International transfers of data

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area.  For example, we will transfer data to our data storage providers, our journal platform provider or distribution agents (for example, in the USA and India).

In these circumstances, your personal data will only be transferred on one of the following bases:

  • where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR). If you wish to obtain a copy of the standard clauses we use, please contact us;
  • a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);
  • under an approved certification mechanism such as Privacy Shield (Article 42 GDPR);
  • there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent).


How long we retain your information

We retain your data for as long as is required to provide our products to you or is necessary for our legal purposes or our legitimate interests. In particular, we generally retain data in relation to:

  • subscriber data for our journals for ten years following the termination of your subscription, unless our relationship with you otherwise continues for a longer period;
  • recordings of telephone calls made to our call centre for 12 months;
  • information gained from the cookies we use on our website and apps for 30 days;
  • marketing purposes until you inform us that you no longer wish to hear from us (for example, through clicking ‘unsubscribe’ on an email communication). If you express this preference we may retain your contact details on a suppression list so that you no longer receive communications from us.


BMJ Events

How your personal data is collected

BMJ collects your personal data from the following sources:

  • From you, when you:
    • register or buy tickets for events through our website, email, post or phone
    • make submissions for consideration of BMJ Awards (or any other BMJ-run awards event) through our website, email, post or phone;
    • when you meet with one of our representatives or correspond with us through our website or by post, email and phone; in connection to events;
    • when you complete feedback forms and surveys;
  • From third parties such as:
    • ticketing agencies who sell tickets or process ticket orders on our behalf;
    • your hospital, university, trust or other organisation who may purchase tickets on your behalf or register your details with us;
    • our website and ticketing platform providers;
    • Worldpay, our payment provider who will confirm details of your payment.

What categories of personal data are collected?

We collect the following categories of personal data, depending on the event:

Identification and contact details
  • biographical information such as your name, title, date of birth, age and gender;
  • your contact details including address, email address and phone number;
  • your image and voice (for example, when captured on video at a BMJ event);

Professional
  • your qualifications, licences and professional experience;
  • your institution;

Online and transactional
  • when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
  • information you provide in your communications with us;
  • details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/);
  • BMJ events you have attended in the past or for which you are registered to attend in the future;
  • payment details and your financial transactions in relation to your purchase;

Special categories of personal data
  • where provided by you or your organisation we process data concerning your health in order to make appropriate adjustments to our event, for example, to accommodate access requirements or your catering needs;

details of trade union membership (such as your British Medical Association (BMA) membership number) if this is relevant to the event, for example if BMA membership provides discounted entry


How we use your data, the basis for processing your data and with whom we share it

As part of a contractual relationship

We may process your personal data because it is necessary for the performance of a contract, for example, to deliver the event you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following (where tickets may have been bought on your behalf then we will conduct the following processing under our legitimate interests):

  • to administer the event and your payment;
  • to correspond with you about the event, including sending you pre-event information.

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

  • third party contractors and service providers who we may engage to assist in delivering the event; for example, event organisers, conference providers, caterers, and instructors;
  • our bank to whom payment details are provided in order to process a payment;
  • our website provider, where attending an event may also involve attendees being provided with an online account.

Legitimate interests

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • creating a delegate or speaker list and distributing the list to speakers and attendees;
  • sharing attendee details with co-organisers, collaborators and sponsors of an event (except in circumstances where it is appropriate to gain your consent);
  • marketing BMJ and its products online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent;
  • recording our events for promotional and educational purposes (for example, when interviewing attendees and recording speakers);
  • recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
  • processing technical information about your use of BMJ websites to ensure that content on our site is presented in the most effective manner and to allow you to use interactive features of our website;
  • consulting our professional advisers where it is necessary for us to obtain their advice or assistance;
  • providing your data to a buyer or prospective buyer of the whole or a part of our business (except in circumstances where this is necessary for the performance of a contract to which you are a party);
  • processing enquiries, complaints, surveys, feedback forms and to analyse our services.

In this respect, and in addition to those parties named above, we will provide your data to the following:

  • direct marketing providers;
  • Google Analytics who receive technical information in relation to how you use our website;
  • BMA for marketing purposes and to update you on products that you may be interested in (unless it is appropriate to gain your consent before sharing your information in this way).

BMJ's Legal Obligations

Your personal data will also be processed by BMJ for compliance with its legal obligations. For example:

  • for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; HMRC and BMJ's external auditors.


Special categories of personal data

Where we process special categories of personal data our bases for processing are:

  • to protect your vital interests for example to inform your specified emergency contact, the NHS or emergency services in the event of your illness or other emergency;
  • your explicit consent, for example if we require information about your BMA membership or dietary or access requirements that we need to process in relation to the event;
  • where processing is necessary for the establishment, exercise or defence of a legal claim.

Profiling and automated decision making

We may use personal characteristics such as age, gender, address, role, your expressed interests, your previous interactions with BMJ or geographical location to target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).


International transfers of personal data

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area.  For example, where events may take place outside the EEA (such as the International Forum on Quality and Safety) we may transfer data to those countries. In these circumstances, your personal data will only be transferred on one of the following bases:

  • where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR). If you wish to obtain a copy of the standard clauses we use, please contact us;
  • a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);
  • under an approved certification mechanism such as Privacy Shield (Article 42 GDPR);
  • there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent) or where the transfer is necessary for the performance of a contract under Article 49.


How long we retain your information

We retain your data for as long as is required to provide our products to you or is necessary for our legal purposes or our legitimate interests. In particular, we generally retain data in relation to:

  • a record of your attendance at the event for seven years following the event;
  • recordings of telephone calls made to our call centre for 12 months;
  • information gained from the cookies we use on our website and apps for 30 days;
  • marketing purposes until you inform us that you no longer wish to hear from us (for example, through clicking ‘unsubscribe’ on an email communication). If you express this preference we may retain your contact details on a suppression list so that you no longer receive communications from us.


Submitting and reviewing articles and content

How your personal data is collected

BMJ collects your personal data from the following sources:

  • From you, when you:
    • correspond with us through our website, or by post, email and phone;
    • when you submit letters for publication or articles directly to BMJ;

 

  • From third parties such as:
    • those who operate the platform through which articles are submitted and reviewed;
    • other peer reviewers who review your articles and provide feedback to BMJ's editorial teams;
    • article authors and peer reviewers who may recommend you as a potential reviewer or editor;
    • publicly available sources in order to identify potential contributors, editors and peer reviewers.

What categories of personal data are collected?

We collect the following categories of personal data:

Identification and contact details
  • biographical information such as your name, title, date of birth, age and gender;
  • your contact details including address, email address and phone number;
  • log in details that you are assigned as part of registration for third party platforms;

Professional
  • your qualifications and professional experience;
  • your institution;
  • any opinions and assessments provided in your article, or in your review of an article;
  • any competing interests that may relate to an article you have submitted or reviewed;

Online and transactional
  • when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
  • information you provide in your communications with us;
  • details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/);
  • payment details and your financial transactions.

Special categories
  • health information in relation to your medical situation where you are a 'Patient Reviewer' in relation to journal content.


How we use your data, the basis for processing your data and with whom we share it

As part of a contractual relationship

We will process your personal data because it is necessary for the performance of a contract to deliver the services you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

  • to edit, review and publish your article or letter;
  • to process article processing charges (APC);
  • to check for plagiarism and to obtain copyright clearance;
  • to credit you as the author, researcher or reviewer of an article.

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

  • peer reviewers;
  • contractors who provide editorial, publishing and printing services;
  • third parties who provide copyright clearance and collect APC;
  • platforms that host our publications.

Legitimate interests

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • researching you using publicly available sources in order to identify suitable reviewers and editors. Once we have identified you as suitable for these purposes we will add you to our reviewers’ database. We will write to you to inform you that this has happened and to give you an opportunity to object to such use of your personal data;  
  • contacting authors and reviewers (and to allow the editorial team to do the same) in relation to the reviewing of articles;
  • identifying your suitability to review a certain article – some authors may specifically request that certain individuals should not review their article, for example where there is a conflict of interest;
  • marketing BMJ and its products online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);
  • recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
  • processing technical information about your use of the BMJ website to ensure that content on our site is presented in the most effective manner and to allow you to use interactive features of our website;
  • consulting our professional advisers where it is necessary for us to obtain their advice or assistance;
  • processing enquiries, complaints, surveys, feedback forms and to analyse our services;
  • providing your data to a buyer or prospective buyer of the whole or a part of our business (except in circumstances where this is necessary for the performance of a contract to which you are a party);
  • to raise concerns with a research council, ethics committee or other supervisory body if we felt it was appropriate for us to do so;
  • Sharing the lay summary of your journal article and the respective authors’ email addresses with Kudos (www.growkudos.com) who will contact the authors in relation to publishing the lay summary on the Kudos website.

In this respect, in addition to those parties named above, we will provide your data to the following:

  • direct marketing providers;
  • Google Analytics who receive technical information in relation to how you use our website and apps;
  • BMA and owners and co-owners of journals for marketing purposes and to update you on products that you may be interested in (unless it is appropriate to gain your consent before sharing your information in this way).

BMJ's Legal Obligations

Your personal data will also be processed by BMJ for compliance with the its legal obligations. For example:

  • for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies.


Special categories of personal data

Where you have provided your data in relation to a research study or article we will request that the person submitting the article provides evidence of your written consent to publication. Where you are a Patient Reviewer we will request your explicit consent prior to processing information in relation to your health. We may also process this information for the establishment, exercise or defence of legal claims.


Profiling and automated decision making

We may use personal characteristics such as age, gender, address, role, your expressed interests, your previous interactions with BMJ or geographical location to target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).


International transfers of personal data

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area.  For example, we will transfer data to our data storage providers and also to platforms that host our journals. In these circumstances, your personal data will only be transferred on one of the following bases:

  • where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission). If you wish to obtain a copy of the standard clauses we use, please contact us;
  • under an approved certification mechanism such as Privacy Shield (Article 42 GDPR).


How long we retain your information

We retain your data for as long as is required to provide our products to you or is necessary for our legal purposes or our legitimate interests. In particular, we generally retain data in relation to:

  • journal articles and the peer review process indefinitely;
  • information gained from the cookies we use on our website and apps for 30 days;
  • recordings of telephone calls made to our call centre for 12 months;
  • marketing purposes until you inform us that you no longer wish to hear from us (for example, through clicking ‘unsubscribe’ on an email communication). If you express this preference we may retain your contact details on a suppression list so that you no longer receive communications from us.


BMJ Careers

How your personal data is collected

BMJ collects your personal data from the following sources:

  • From you, when you:
    • register for an account and subscribe for BMJ Careers on our website or app and when you use our online tools;
    • upload your CV to our website or app;
    • correspond with us or make enquiries via our website or app, email, post or telephone.
  • From third parties such as:
    • our software platform providers who host and operate our website and applications.

What categories of personal data are collected?

We collect the following categories of personal data:

Identification and contact details
  • biographical information such as your name, title and gender;
  • the country in which you are working or studying in;
  • contact details such as your address, email address and phone number;
  • log in details that you are assigned as part of registration;

Professional
  • your qualifications, professional experience and any other detail you provide if you upload your CV or submit a job application;
  • your job aspirations, profession and speciality when you create an account or register for email alerts;

Online and transactional
  • information you provide in your communications with us;
  • when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
  • details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/


How we use your data, the basis for processing your data and with whom we share it

Legitimate interests

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • to create and administer your account;
  • to enable you to use online tools;
  • to pass a job application you submit to us to a prospective employer or recruiter;
  • marketing BMJ and its products online, or by post, telephone, SMS, social media and email (except in situations where it is required or appropriate to seek your consent);
  • processing technical information about your use of our products to ensure that content is presented in the most effective manner, to allow you to use interactive features of our products and to operate our business;
  • recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
  • processing (and replying to) enquiries, complaints, surveys, feedback forms and to analyse our services;
  • providing your data to a buyer or prospective buyer of the whole or a part of our business (except in circumstances where this is necessary for the performance of a contract to which you are a party);
  • consulting our professional advisers where it is necessary for us to obtain their advice or assistance.

In this respect, in addition to those parties named above, we will provide your data to the following:

  • our platform providers, who host our website and apps.
  • direct marketing providers;
  • BMA and other third parties for marketing purposes (apart from where it is required or appropriate for us to have your consent to share your information for this purpose).

BMJ's Legal Obligations

Your personal data will also be processed by BMJ for compliance with its legal obligations. For example:

  • for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.

In this respect, we may in specific circumstances need to share your personal data with the police and other law enforcement agencies.


Profiling and automated decision making

We may use personal characteristics such as age, gender, address, role, your expressed interests, your previous interactions with BMJ or geographical location to target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).


International transfers of data

BMJ uses Google Analytics who will transfer information gained from our use of cookies to its storage centres in the USA. In these circumstances, your personal data will only be transferred under the Privacy Shield gateway in accordance with Article 42 GDPR.


How long we retain your information

We retain your data for as long as is required to provide our products to you or is necessary for our legal purposes or our legitimate interests. In particular, we generally retain data in relation to:

  • information that you provide in relation to your job aspirations and searches (including your CV) until you close your account or amend your online profile;
  • recordings of telephone calls made to our call centre for 12 months;
  • information gained from the cookies we use on our website and apps for 30 days;
  • marketing purposes until you inform us that you no longer wish to hear from us (for example, through clicking ‘unsubscribe’ on an email communication). If you express this preference we may retain your contact details on a suppression list so that you no longer receive communications from us.

Your rights under data protection legislation

Prior to 25 May 2018, you have the following rights:

  • To obtain access to, and copies of, the personal data we hold about you;
  • To require that we cease processing your personal data if the processing is causing you damage or distress;
  • To require us not to send you marketing communications;

Once GDPR comes into force, from 25 May 2018 you will also have the following additional rights:

  • To request that we erase your personal data;
  • To request that we restrict our data processing activities in relation to your personal data;
  • To receive from us the personal data we hold about you, which you have provided to us, in a reasonable format specified by you, including for the purpose of transmitting that personal data to another data controller; and
  • To require us to correct the personal data we hold about you if it is incorrect.

Please note that the above rights are not absolute, and requests may be refused where exceptions apply.

To initiate this process please contact our Customer Services team, and they will record the immediate information we need and this will be followed up by our Data Protection Officer.

If you are not satisfied with how your personal data is used by BMJ you can make a complaint to the Information Commissioner (www.ico.org.uk).