Your information, and how we look after it.

Version 1.0 · Last updated 4 November 2026

1. Who is responsible for your information

Baynard Thurlow Ltd (“Baynard Thurlow”, “we”, “us”) is the controller of the personal information described here. We are registered in England and Wales, company number 17558584, with our registered office at 128 City Road, London EC1V 2NX. We are registered with the Information Commissioner’s Office under reference ZC292064. We run this website, clinical.team, which can also be reached at baynardthurlow.com.

For any privacy question or request, email privacy@baynardthurlow.com or write to us at the address above. Our representative in the European Union is DataRep (Data Protection Representative Limited). Their contact details will be added here shortly; until then, people in the EU can contact us directly about how we handle their information.

2. Whose information this policy covers

• Sponsors and enquirers: people at pharmaceutical, biotech and medical device companies who contact us or become our clients.
• Prospective clients: people in clinical operations and related roles at companies we think may need our services, whom we contact about them.
• Clinical professionals: people who register with us, apply for roles, or are placed through us.
• Referees: people who provide a reference for a professional.
• Website visitors: anyone browsing clinical.team or baynardthurlow.com.

3. What we collect

If you are a sponsor or enquirer

Your name, job title, company, work email and phone number, where your company is based, what you tell us about your study, and our correspondence with you. If you ask the team planner to email you a plan, we send it to the address you give and keep a copy with your enquiry. If you become a client, we also hold contract, billing and contact information for the people we work with at your company.

If we contact you about our services

Your name, job title, company, work email address, and where available your business phone number and professional profile (such as LinkedIn), together with public information about your company’s clinical trials and our correspondence with you. If we hold your details for this purpose, our first message to you links to this policy, says where we found your details, and lets you opt out of further contact with one reply.

If you are a clinical professional

• Contact details, your CV, work history, therapeutic areas, trial phases and systems experience.
• Training and qualification records, such as your ICH-GCP and data protection certificates.
• Identity and right-to-work documents, checked before a placement.
• References, and our notes from conversations and interviews.
• For placed professionals: contract, rate, timesheet, invoicing and company, self-employment or umbrella details, and bank details where we pay you directly.

We do not ask for sensitive information such as health, ethnicity or religion. We carry out criminal record checks only where a client’s role lawfully requires one, and we will tell you first.

If you give a reference

Your name, contact details, your relationship to the professional, and what you tell us about their work.

If you visit the website

Our hosting provider keeps standard technical logs, such as IP address, browser type and the pages requested, to run the site and keep it secure. When a form is submitted, we use the sender’s IP address (and, for emailed plans, the email address) briefly, in memory only, to limit repeated submissions.

To count visits, we use Vercel Web Analytics. For each page view it records the page, the site that referred you, your country, and your device, browser and operating system types. It sets no cookies, stores nothing on your device, and does not identify you: it tells visits apart using a code calculated from the request, which is discarded after 24 hours. We see only totals.

4. Where it comes from

Mostly from you: through our forms, by email, by phone or in conversation. We may also receive information from referees, from colleagues at a client who introduce you, from identity and right-to-work checking services, and from professional profiles you have chosen to make public, such as on LinkedIn. For people we contact about our services, we also use business contact databases, company websites and public clinical trial registries such as ClinicalTrials.gov.

5. Why we use it, and our legal basis

Data protection law requires a legal reason for each use. These are ours:

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us about that assessment, and you can object to the processing (see section 10).

6. Decisions made by people, not machines

Every decision about whether to put a professional forward for a role is made by a person. We do not use automated decision-making or profiling that has legal or similarly significant effects on anyone.

7. Who we share it with

• Clients: a professional’s profile, CV and verification summary go to a client only after the professional agrees to be put forward for that role.
• Professionals: when you engage someone through us, they receive the information they need to do the work, such as your contact details.
• Service providers who help us run the business, under contracts that require them to protect the information and use it only on our instructions: website hosting (Vercel), delivery of the website’s form emails (Resend), email, calendar, call booking and document storage (Google Workspace), business contact data (Apollo.io), accounting (Xero), banking and payments (Wise), and AI assistants used to draft and organise our work, under business terms that do not use your information to train their models.
• Umbrella companies chosen by a professional, so that they can be paid.
• Professional advisers, such as our lawyers, accountants and insurers.
• Authorities such as HMRC, the Home Office or a court, where the law requires it.
• A buyer or successor, if our business is ever sold or reorganised, who would be bound by the same commitments.

We never sell personal information or share it for anyone else’s marketing.

8. Sending information outside the UK

Some of our service providers store information in the European Economic Area or the United States, and our clients are often based outside the UK. When information leaves the UK, we use the protections the law provides: a UK adequacy decision for the destination, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. A professional’s profile is sent to a client outside the UK only with their agreement, for that role. Ask us if you would like details of the safeguard for a particular transfer.

9. How long we keep it

• Enquiries that don’t lead to work: 2 years after our last contact.
• People we contact about our services: 2 years after our last contact, or until you opt out. If you opt out, we keep only your name and email address on a do-not-contact list, so that we don’t contact you again.
• Client records: for the life of our relationship, then 6 years for legal and accounting reasons.
• Registered professionals: until you ask us to delete your details, or 2 years after our last meaningful contact, whichever comes first. We will check in before that period ends.
• Placement records: at least as long as the law requires for employment businesses, for right-to-work checks (two years after a placement ends) and for tax, and otherwise 6 years after the placement ends.
• Website logs: as kept by our hosting provider, typically 30 days.

When a period ends, we delete the information or make it fully anonymous.

10. Your rights

Under UK and EU data protection law you can ask us to:

• give you a copy of the information we hold about you;
• correct anything that is wrong or incomplete;
• delete your information where we no longer have a good reason to keep it;
• pause our use of it while a concern is looked into;
• stop using it where we rely on legitimate interests;
• stop contacting you about our services. This is an absolute right: we will stop as soon as you ask;
• give you, or another organisation, the information you provided in a portable format.

Where we rely on your consent, you can withdraw it at any time, without affecting what we did before. To use any of these rights, email privacy@baynardthurlow.com. We will reply within one month, and there is normally no charge. We may ask you to confirm your identity first, to protect your information.

11. How we protect it

This website is served only over encrypted connections, sends strict browser security headers, loads no third-party scripts other than our hosting provider’s visit counter, and checks every form submission on our server before it is emailed to our team. The website does not store submissions, including uploaded CVs, in a database or on its servers. Inside the business, access to personal information is limited to the people who need it. Our business accounts are protected with multi-factor authentication, and our laptops and phones are encrypted and password-protected.

12. Cookies and similar technology

This website does not set cookies and does not use advertising or social media tracking. The visit counting described in section 3 works without cookies or storing anything on your device. If you use the team planner and then ask for a written quote, your estimate is held in your own browser for that visit so that it can be added to the contact form. It is not sent to us unless you submit the form, and it is cleared when you close the tab. To show the planner’s costs in pounds, euros or US dollars, the site uses the country our hosting provider works out from your connection; it is not stored. If you choose a different currency, that choice is also held in your browser only until you close the tab. If we ever add optional cookies, we will ask for your permission first.

13. Children

Our services are for businesses and working professionals. We do not knowingly collect information about anyone under 18.

14. Concerns and complaints

If you are unhappy with how we have handled your information, please tell us first at privacy@baynardthurlow.com. You can complain in any way that suits you, including by email, by post or in writing to us through any of our channels. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome. We keep a record of every complaint and how we dealt with it. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) or, if you live in the EU, to the data protection authority in your country.

15. Changes to this policy

We will update this policy when our practices or the law change, and show the date of the latest version at the top. If a change materially affects how we use information we already hold, we will tell the people affected directly. Our website terms explain the rules for using this site.