Privacy Policy - CliniLink Ltd

CliniLink — Privacy Policy

Last Updated: 4th April 2026

⚠Important Notice to Delegates

Where you register for a sponsored CliniLink event or webinar, we will share your name, job title, organisation name and postcode with the event sponsor or sponsors and, where relevant, the presenters, for regulatory compliance and reporting purposes. The lawful basis is legitimate interests and this sharing is a condition of attending a sponsored event.

Your professional registration number is collected for verification purposes only. It is not shared with sponsors or any other third party.

Your email address will only be shared with a sponsor where you have given separate, explicit consent at the point of registration. This is optional and you may attend any event without giving it.

Please read Section 8 of this policy carefully before completing your registration.

1. About Us

CliniLink Ltd ("CliniLink", "we", "us", "our") is a company registered in England and Wales under company number 16243215. We operate a clinical education platform at https://clinilink.co.uk, through which we deliver in person and online educational events, webinars, programmes and continuing professional development for healthcare professionals. We also operate CliniLink Academy, our digital learning platform at www.clinilinkacademy.com, which has its own privacy policy covering activity on that platform.

Registered Office: CliniLink Ltd, Stockport Pyramid, Yew Street, Stockport Trading Estate, Stockport, SK4 2JZ, United Kingdom

Email: admin@clinilink.co.uk

Website: https://clinilink.co.uk

ICO Registration Number: ZB896601

CliniLink Ltd is registered with the Information Commissioner's Office ("ICO") as a data controller. We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018") and the Privacy and Electronic Communications Regulations 2003 ("PECR"). Where we deliver activities commissioned or funded by pharmaceutical companies, we also operate in a manner intended to support those companies in meeting their obligations under the ABPI Code of Practice for the Pharmaceutical Industry.

2. Purpose of This Privacy Policy

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. It explains what data we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have.

Please read this Policy carefully. If you have any questions, contact us at admin@clinilink.co.uk.

3. Who This Policy Applies To

This Policy applies to you if:

you visit our website at https://clinilink.co.uk;
you register for or attend a CliniLink event, webinar, programme or training activity;
you create or use an account on our platform;
you contact us with an enquiry or feedback; or
you receive communications from us.

This Policy does not apply where CliniLink processes personal data solely on behalf of another organisation as a data processor. In that case, the privacy policy of that organisation applies.

4. Personal Data We Collect

Identity and Registration Data: full name; professional job title; GMC, NMC, GPhC, HCPC or other UK healthcare regulator professional registration number.

Contact Data: email address; telephone number; workplace or billing address; organisation name and postcode.

Event, Programme and CPD Data: records of activities registered for and attended; participation in online polls; CPD progress, certificates and learning activity.

Payment Data: billing information processed securely by our third party payment providers. We do not store card details.

Technical Data: IP address; browser type and version; device information; cookies and similar tracking technologies, see Section 10.

Marketing and Permission Data: your marketing preferences; communication opt ins and opt outs; and a separate record of whether you have given prior permission to receive promotional communications relating to medicines, including the wording shown to you, the version of that wording, the date, and the method and source by which permission was given.

We do not knowingly collect personal data from individuals under the age of 18.

5. How We Collect Your Personal Data

We collect personal data:

directly from you when you register for an account, register for or attend an activity, respond to a preferences prompt, make a payment, or contact us;
via our website through online forms, cookies and other tracking technologies; and
from third party platforms used to facilitate delivery of our webinars, events and programmes, such as video conferencing and event management providers.

6. Lawful Bases and Purposes of Processing

We only process your personal data where we have a lawful basis under Article 6 of the UK GDPR.

Purpose: Registration for and delivery of events, webinars and programmes

Data used: Name, job title, organisation, registration number, contact and billing details

Lawful basis: Performance of a contract, Article 6(1)(b)

Purpose: Provision of members' area access

Data used: Login credentials, name, email

Lawful basis: Performance of a contract, Article 6(1)(b)

Purpose: Verification of professional registration status

Data used: GMC, NMC, GPhC, HCPC or other regulatory registration number

Lawful basis: Legitimate interests, Article 6(1)(f), ensuring activities are attended by qualified healthcare professionals

Purpose: Maintenance of CPD and revalidation records

Data used: Attendance records, certificates, CPD data

Lawful basis: Legitimate interests, Article 6(1)(f), and contractual necessity

Purpose: Mandatory sharing with event sponsors for compliance reporting, see Section 8

Data used: Name, job title, organisation name and postcode

Lawful basis: Legitimate interests, Article 6(1)(f), ABPI and regulatory compliance

Purpose: Sharing email address with sponsors for marketing, see Section 8

Data used: Email address

Lawful basis: Consent, Article 6(1)(a), separately obtained at registration

Purpose: Sending CliniLink marketing communications about our own events, courses, programmes and educational content

Data used: Name, email address

Lawful basis: Consent, Article 6(1)(a), or legitimate interests, Article 6(1)(f), where permitted by PECR following your registration with us

Purpose: Sending communications about activities funded by pharmaceutical companies which may contain promotional content relating to medicines and content developed by or on behalf of those companies, see Section 8.5

Data used: Name, email address, record of permission given

Lawful basis: Consent, Article 6(1)(a). We rely on consent only. We do not rely on legitimate interests or on soft opt in for these communications.

Purpose: Pharmacovigilance and adverse event reporting, see Section 8.6

Data used: Name, contact details and the details of the report

Lawful basis: Legal obligation, Article 6(1)(c)

Purpose: Compliance with other legal and regulatory obligations

Data used: As required by law

Lawful basis: Legal obligation, Article 6(1)(c)

Where we rely on legitimate interests, we have carried out a legitimate interests assessment to ensure our interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interests at any time, see Section 12.

7. Special Category Personal Data

We do not routinely collect or process special category personal data as defined in Article 9 of the UK GDPR.

Your professional registration number is processed solely to verify your professional standing. It identifies you as a registered practitioner and does not constitute health data for the purposes of UK GDPR.

In the event that we need to process special category data, we will identify the applicable condition under Article 9(2) UK GDPR, provide you with further information, and where required obtain your explicit consent.

8. Sharing Your Personal Data With Third Parties

Important, please read before registering

Where you register for a sponsored CliniLink event or webinar, certain personal data will be shared with third party event sponsors and presenters as described in Sections 8.1 and 8.2. This sharing is a condition of participation for reporting and regulatory compliance purposes. Where sharing of your email address for marketing purposes is proposed, your separate and explicit consent will be sought before any such sharing takes place.

8.1 Mandatory Sharing with Event Sponsors and Presenters

When you register for and attend a sponsored CliniLink event or webinar, the following personal data will be disclosed to the relevant sponsor or sponsors and, where relevant, the presenters:

full name;
professional job title; and
organisation name and postcode.

This disclosure is necessary in order to:

enable sponsors to comply with their obligations under the ABPI Code of Practice for the Pharmaceutical Industry, or equivalent applicable codes, regarding the recording and reporting of transfers of value to healthcare professionals;
verify that attendees are registered healthcare professionals; and
meet legitimate regulatory reporting and audit requirements.

The lawful basis is our legitimate interests and the legitimate interests of sponsors in complying with applicable regulatory requirements, Article 6(1)(f) UK GDPR.

Your professional registration number is not disclosed to sponsors.

Independent Controller Notice: once your data has been disclosed to a sponsor, that sponsor acts as an independent data controller in respect of its subsequent processing, and its own privacy notice applies. CliniLink is not responsible for a sponsor's processing of that data. We encourage you to review the relevant sponsor's privacy notice. You will need to contact the sponsor directly to exercise your data subject rights in relation to data they hold.

8.2 Consent Based Sharing of Email Address with Sponsors

Your email address will only be shared with event sponsors for direct marketing or follow up communications where you have given your explicit, freely given, specific, informed and unambiguous consent at the point of registration.

This consent is entirely optional. You will not be excluded from attending an activity for declining to give it.

You may withdraw it at any time by contacting admin@clinilink.co.uk, or by clicking the unsubscribe link in any marketing email you receive from a sponsor. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.3 Service Providers

We share personal data with carefully selected third party service providers who process it on our behalf. These include providers of website hosting, email delivery, event management platforms, video conferencing, learning platform hosting, payment processing and analytics.

All such processors are engaged under written data processing agreements compliant with Article 28 UK GDPR and may only process your data on our documented instructions.

8.4 Other Permitted Disclosures

We may also disclose your personal data to law enforcement or regulatory authorities where required by law, in response to a court order or legal process, to a successor organisation in connection with a sale, merger or transfer of our business or assets, and to protect the vital interests of any person.

We do not sell, rent or trade your personal data to any third party for commercial purposes.

8.5 Promotional Communications Relating to Medicines

Some of our events, webinars and programmes are commissioned and funded by pharmaceutical companies. The content of those activities, and the emails we send about them, may be developed, written, reviewed, approved or certified by, or on behalf of, the pharmaceutical company concerned, and may contain promotional content about that company's medicines. Where we send you such an email, we do so on behalf of that company as well as on our own behalf.

We send these emails only to people who have given us prior permission to receive communications of that kind.

That permission:

is separate from, and additional to, your general marketing preferences;
is given by a positive action and never by silence, inactivity or a pre ticked box;
is informed, meaning that before you give it we tell you that the communications may contain content developed, written, reviewed or approved by or on behalf of a named pharmaceutical company, that they may be promotional in nature, and that we send them on that company's behalf;
is recorded together with the wording shown to you, the version of that wording, the date and the source; and
may be withdrawn at any time using the unsubscribe link contained in every such email, or by contacting admin@clinilink.co.uk.

Withdrawing this permission does not affect your service communications, your general marketing preferences, or your access to any activity you have registered for.

If you have not given this permission we will not send you promotional communications relating to medicines, and we will not email you to ask you to give it.

We keep our mailing lists up to date. Requests to be removed from a promotional mailing list are actioned promptly, and your name will not be restored to that list except at your request or with your permission.

8.6 Activities Containing Promotional Content, and Adverse Event Reporting

Where an event, webinar or programme contains promotional content relating to medicines, we will tell you before you register who developed the content, who commissioned and funded it, whether the funding company wrote, reviewed, approved or certified any part of it, that it is promotional, and which parts contain information about a medicine. The company will be named. Access is restricted to UK registered healthcare professionals, and we record your confirmation of professional status and your agreement to access promotional content.

If you report a suspected adverse reaction, side effect or product complaint relating to a medicine, whether during an activity, through a survey response or comment, or by email, we are required to pass the relevant details to the pharmaceutical company concerned and, where appropriate, to the Medicines and Healthcare products Regulatory Agency. This processing is necessary to comply with a legal obligation. It does not rely on your consent and cannot be withdrawn by you.

9. International Data Transfers

We store and process personal data in the United Kingdom wherever possible. Some of our service providers operate outside the United Kingdom, for example in the European Economic Area or the United States, and personal data may be transferred to them for the purposes described in this Policy.

Where we transfer personal data outside the United Kingdom, we ensure that an appropriate safeguard is in place. This may be a transfer to a country covered by UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. You can request details of the safeguards we use by contacting admin@clinilink.co.uk.

Where a sponsor to whom your data is disclosed as an independent controller under Section 8.1 proposes to transfer your data outside the United Kingdom, that sponsor is solely responsible for ensuring compliance with the applicable international transfer provisions of the UK GDPR and DPA 2018. We encourage you to review that sponsor's privacy notice.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. The following types may be set:

Strictly Necessary Cookies: essential for site operation, including temporary session cookies set on the login page to verify browser cookie support. These are discarded when you close your browser and no consent is required.

Functional and Login Cookies: save your login information and display preferences. Login cookies last two days, or two weeks if you select Remember Me. Screen options cookies last one year.

Comment Cookies: optionally save your name, email and website when leaving a comment. Duration one year, opt in only.

Analytics Cookies: help us understand how visitors use our site, for example Google Analytics. Duration varies by provider. Some analytics providers process data outside the United Kingdom, see Section 9.

For all cookies other than strictly necessary cookies we will seek your consent via our cookie banner in accordance with PECR. You may manage or withdraw cookie consent at any time.

11. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, and to satisfy our contractual, legal, regulatory and legitimate business obligations.

Event and programme registration and attendance records: up to six years from the date of the activity, to comply with ABPI reporting obligations and applicable limitation periods under the Limitation Act 1980.

CPD records, certificates and learning activity: for the duration of your account and for such further period as may be required to support professional revalidation, typically up to five years.

Financial and payment records: seven years from the date of the transaction, in accordance with HMRC requirements.

Records of consent and permission, including permission to receive promotional communications relating to medicines and consent to sponsor sharing: for the duration of the permission and for a minimum of three years after it is withdrawn or expires, so that we can evidence the basis on which we contacted you.

Marketing preference records: until withdrawal of consent or opt out, and thereafter as a record of that withdrawal.

Technical and log data: up to twelve months from collection.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data has been shared with sponsors acting as independent controllers, those organisations are responsible for their own retention practices.

12. Your Rights Under UK Data Protection Law

You have the following rights in relation to the personal data we process about you. These rights are not absolute and may be subject to exemptions under the UK GDPR and DPA 2018.

Right to be Informed, Articles 13 and 14: to receive clear information about how your data is processed. This Policy fulfils that obligation.

Right of Access, Article 15: to obtain confirmation of whether we process your data and to receive a copy.

Right to Rectification, Article 16: to have inaccurate or incomplete personal data corrected without undue delay.

Right to Erasure, Article 17: to request deletion of your personal data where there is no compelling reason for its continued processing. This right may be limited where we have a legal obligation or legitimate reason to retain data.

Right to Restriction of Processing, Article 18: to request that we limit how we use your data in certain circumstances.

Right to Data Portability, Article 20: to receive your data in a structured, machine readable format where processing is based on consent or contract and carried out by automated means.

Right to Object, Article 21: to object at any time to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes.

Right to Withdraw Consent, Article 7(3): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Withdrawing your permission to receive promotional communications relating to medicines is free, takes effect promptly, and does not affect your access to any activity you have registered for.

Rights Related to Automated Decision Making, Article 22: you have the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects. We do not carry out such processing.

Right to Lodge a Complaint, Article 77: you have the right to complain to the ICO:

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

We would appreciate the opportunity to address any concern before you approach the ICO, and encourage you to contact us in the first instance at admin@clinilink.co.uk.

Note on third party controllers: where your data has been shared with sponsors acting as independent data controllers, you must contact those organisations directly to exercise your rights in relation to the data they hold.

To exercise any of your rights with CliniLink, contact us using the details in Section 13. We may require proof of your identity. We will respond without undue delay and within one calendar month of receipt, extendable by a further two months in complex cases, in which event we will notify you. You will not usually be charged a fee unless a request is manifestly unfounded, repetitive or excessive.