• biographical information such as your name, title, date of birth, age and gender;
• images and your likeness (including your voice) as captured in a photograph, a recording or on video for webinars, interviews and when filming for BMJ's other legitimate purposes; and
• your contact details including address, email address, phone number and social media identifiers;

• when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
• information you provide in your communications with us (including information provided in competition entries or grant applications);
• details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/ );
• your opinion as you express it in chat, forums and interviews;
• products and services you have purchased and details of financial transactions; and
• content and links you accessed in our marketing emails;

• where appropriate, we may obtain diversity and background information including ethnic origin, race, religious and political beliefs, health data or information concerning your sex life and sexual orientation, that you provide to us in our surveys or for our market research. We may also collect details of trade union membership, for example, where membership (such as membership of the BMA) entitles you to access to, or a discount on, our products and services. We will explain the reasons for needing such information when it is collected.

We may process your personal data because it is necessary for the performance of a contract to deliver products and services you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data to provide products and services that you have requested from us and to communicate with you in relation to these products and services.

We will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

• third party service providers such as shipping companies and our website and app platform providers who assist us in delivering our products and services to you;
• our bank to whom payment details are provided in order to process a payment;
• our data storage providers and those who provide our Customer Relationship Management ( CRM ) platforms; and
• our parent company, the BMA or to your organisation/institution where we are required to verify your details prior to providing our products and services to you.

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• delivering access to our products and services which your organisation or institution has purchased on your behalf;
• to administer a competition that you have entered or to process a grant application;
• marketing BMJ and its products and services (including third party products and services) online, or by post, telephone, SMS, social media and email (except where we provide materials under contract, or in situations where it is required or appropriate to seek your consent);
• researching, identifying and contacting business contacts for marketing BMJ products and services on a business to business basis;
• carrying out market research;
• improving our products and services;
• measuring and understanding the effectiveness of products and services and advertising and to allow us (and third parties who advertise on our website and apps) to deliver relevant advertising to you (including ensuring that we do not advertise medical products that are not licensed in your country);
• recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
• processing technical information about your use of our website and apps to ensure that content is presented in the most effective manner and to allow you to use interactive features of our website and apps;
• processing enquiries, complaints and analysing our services;
• consulting our professional advisers (including legal) where it is necessary for us to obtain their advice or assistance;
• providing your data to a buyer or prospective buyer of the whole or a part of our business;
• dealing with enquiries and investigations by authorities (for example, cooperating with the Advertising Standards Agency).

In this respect, in addition to those parties named above, we will provide your data to the following:

• our platform providers, who store your account information and who host our website and apps;
• direct marketing providers;
• Google Analytics who receive technical information in relation to how you use our website and apps;
• sponsors  or other organisations who have provided prizes for competitions you have won or who are involved in the delivery of a grant award. We may also share your name and contact details with sponsors where you have entered a competition and provided consent for your details to be shared for this purpose;
• BMA and other third parties for marketing purposes where we have your consent to share your information for this purpose.

Your personal data will also be processed by BMJ for compliance with its legal and regulatory obligations such as:

• the detection and prevention of crime and in order to assist the police and other competent authorities with investigations;
• to comply with tax legislation and subject access requests of others; and
• to comply with any legal or regulatory obligations to which we are, or may become, subject.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; HMRC and Your personal data may also be shared with BMJ's internal and external auditors, insurers, financial and legal advisors for the purpose of enabling BMJ to comply with its financial and legal obligations.

In some circumstances BMJ may seek your explicit consent to process your personal data: for example, if you ask us to send you updates or alerts by subscribing to these services. Where we rely on your consent, we will provide an easy means to withdraw that consent.

Where we process special categories of personal data, we will explain at the time what our basis for using that data is. The most common bases we seek to rely on are:

• to protect your vital interests (for example to inform an emergency contact, the NHS or emergency services in the event of your illness or other emergency);
• with your explicit consent for example if you provide information about your health, ethnicity, sexual orientation or religious beliefs in a survey for our market research or where you provide information about your BMA membership where this is relevant to access to (or a discount on) a products and services;
• where processing is necessary for the establishment, exercise or defence of a legal claim.

We may use personal characteristics such as age, gender, geographical location, role, your expressed interests and medical conditions, your previous interactions with BMJ to understand, and where appropriate, target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).

Certain BMJ websites (The BMJ and JNNP) are members of the DMD Healthcare Communications Network (the “HCN”). HCN is owned and managed by DMD Marketing Corp (“DMD”) and is designed to enable DMD and HCN members to provide medically relevant business communications to authenticated health care professionals.

For healthcare workers based in the USA who have consented to the use of cookies and similar technologies, your use of these websites includes registration in the HCN. As a result, your contact and other professionally relevant information will be disclosed to DMD and each HCN member, to provide you medically relevant content as described in the HCN privacy policy available at https://HCN.health/privacy-policy . The HCN privacy policy provides details on how to manage your information, including opting out of participation in the HCN.

DMD can use the data collected to understand whether you have accessed content on other sites in the HCN. DMD, HCN members, and customers who purchase information from DMD, can access the data DMD collects. DMD may pass data to other countries.

To the extent that BMJ’s privacy policy conflicts with the HCN privacy policy, with respect to the use of your information by HCN, the conflict will be resolved in favour of the HCN policy.

While BMJ works with DMD, it does not have any direct control over DMD’s processing, and questions about DMD’s processing should be directed to DMD in the first instance.

• biographical information such as your name, title, date of birth, age and gender;
• your contact details including address, email address and phone number;
• log in details that you are assigned as part of registration;
• images and your likeness (including your voice) as captured in a photograph, a recording or on video for webinars;
• your social media identifiers.

• your qualifications and professional experience;
• your hospital, university, trust or other organisation you belong to;
• your BMA membership number if this is relevant to the provision of our products and services;
• content you have accessed, courses and assessments you have attempted or completed and your assessment results, in connection to our products and services;
• reviews you post on our websites in relation to our products and services;

• when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
• details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/ );
• information you provide in your communications with us;
• information you provide in chat, forums and interviews;
• information on the number and type of different devices you are using to access your BMJ accounts;
• payment details and your financial transactions in relation to your subscription.

• details of trade union membership (such as BMA membership) where this is relevant to access to (or a discount on) our products and services.

We may process your personal data because it is necessary for the performance of a contract to deliver the products and services you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

• to create and administer your account and subscription payments;
• to enable you to use online tools and to track your usage for Continuing Medical Education(CME) and Career Professional Development(CPD) purposes;
• access authentication and authorisation.

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

• our bank to whom payment details are provided in order to process a payment;
• our platform providers who host our websites and apps.
• our data storage providers and those who provide our Customer Relationship Management (CRM) platforms.

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• delivering access to our products and services which your organisation or institution has purchased on your behalf;
• detecting breaches of our subscription terms and conditions;
• marketing BMJ and its products and services (including third party products and services) online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);

• recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);

• processing technical information about your use of our products and services to ensure that content is presented in the most effective manner and to allow you to use interactive features of our products and services;
• processing (and replying to) enquiries, complaints, surveys, feedback forms and to analyse our services;
• sharing information in relation to your use of our products and services (such as assessment results and content you have accessed) if your hospital, university, trust or other organisation (including BMA) has provided you with access to our products and services. BMJ will share this data with your parent organisation so that your organisation can;
• offer you relevant support or if your organisation is a Continuing Medical Education (CME) or Continuing Professional Development (CPD) provider and requires the data in order to certify your CME or CPD achievement; and/or
• to enable them to assess the value of offering BMJ’s products and services to you;
• consulting our professional advisers where it is necessary for us to obtain their advice or assistance.

addition to those parties named above, we will provide your data to the following:

• direct marketing providers;
• Google Analytics who receive technical information in relation to how you use our website and apps;
• BMA and other third parties for marketing purposes (unless it is required or appropriate for us to request your consent to share your information for this purpose).

Your personal data will also be processed by BMJ for compliance with its legal obligations. For example:

• for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations;

• to comply with tax legislation, safeguarding duties and subject access requests of others; and
• to comply with any legal or regulatory obligations to which we are, or may become, subject.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; and HMRC. Your personal data may also be shared with BMJ's internal and external auditors, insurers, financial and legal advisors for the purposes of enabling BMJ to comply with its financial and legal obligations.

Where you provide information concerning your health or BMA membership , we will inform you of the reasons for that processing at the time of collection.

We may use personal characteristics such as age, gender, geographical location, role, your expressed interests and medical conditions, your previous interactions with BMJ to understand, and where appropriate, target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).

Certain BMJ websites (The BMJ and JNNP) are members of the DMD Healthcare Communications Network (the “HCN”). HCN is owned and managed by DMD Marketing Corp (“DMD”) and is designed to enable DMD and HCN members to provide medically relevant business communications to authenticated health care professionals.

For healthcare workers based in the USA who have consented to the use of cookies and similar technologies, your use of these websites includes registration in the HCN. As a result, your contact and other professionally relevant information will be disclosed to DMD and each HCN member, to provide you medically relevant content as described in the HCN privacy policy available at https://HCN.health/privacy-policy . The HCN privacy policy provides details on how to manage your information, including opting out of participation in the HCN.

DMD can use the data collected to understand whether you have accessed content on other sites in the HCN. DMD, HCN members, and customers who purchase information from DMD, can access the data DMD collects. DMD may pass data to other countries.

To the extent that BMJ’s privacy policy conflicts with the HCN privacy policy, with respect to the use of your information by HCN, the conflict will be resolved in favour of the HCN policy.

While BMJ works with DMD, it does not have any direct control over DMD’s processing, and questions about DMD’s processing should be directed to DMD in the first instance.

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area (EEA).  For example, we may transfer data to your institution, for the purposes given above, which may be established outside of the EEA. We may also pass personal information to our agents outside the EEA (e.g. USA and Mexico) in order for them to contact users for support and marketing purposes.

In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR);
• the European Commission determines that the country or territory to which the transfer is made ensures an adequate level of legal protection (Article 45 GDPR);
• under an approved certification mechanism (Article 42 GDPR);
• the transfer is already permitted under applicable law (for example, where it is necessary for the performance of a contract).

• biographical information such as your name, title, date of birth, age and gender;
• your contact details including address, email address and phone number;
• log in details that you are assigned as part of registration; and
• your social media identifiers.

• your qualifications, licences and professional experience;
• your institution or the society you belong to;
• your ORCID ID (if you have one);
• your primary speciality (if applicable);
• your BMA membership number where this is required;

• when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
• information you provide in your communications with us;
• details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/ );
• information on the number and type of different devices you are using to access your BMJ subscriptions;
• details of your current and previous subscriptions;
• payment details and your financial transactions in relation to your subscription;
• information when you disclose it in comments and reviews.

• details of trade union membership (such as BMA membership) where this is relevant to access to (or a discount on) our subscriptions.

We may process your personal data because it is necessary for the performance of a contract, for example, to deliver the subscriptions you have requested, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following purposes:

• to administer and correspond with you about your subscriptions;
• to administer your subscription plan and payments;
• to provide you with access to the platforms, websites and apps on which our publications reside;
• to conclude transactions with you for the purchase of print or online subscriptions or individual articles;

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

• our bank to whom payment details are provided in order to process a payment;
• our data storage providers and those who provide our Customer Relationship Management (CRM) platforms;
• our website and app platform providers, who may store details such as name, email address and login details to enable online access;
• third party editorial offices;
• transport and distribution agents.
• journal owners and/or replacement publishers where BMJ ceases to publish a journal.

Your personal data will also be processed because it is necessary for BMJ's legitimate interests, or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• delivering access to our journals which your organisation or institution has purchased on your behalf;
• detecting breaches of our subscription terms and conditions;
• marketing BMJ's products and services online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);
• recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
• processing technical information about your use of our website and apps to ensure that content and advertising on our site is presented in the most effective and relevant manner and to allow you to use interactive features of our website and apps (including ensuring that we do not advertise medical products or services that are not licensed in your country);
• processing enquiries, complaints, surveys, feedback forms and to analyse our services;
• providing your data to an owner of a publication which is made available by us;
• providing your data to a buyer or prospective buyer of the whole or a part of a publication which is made available by us;
• consulting our professional advisers where it is necessary for us to obtain their advice or assistance.

In this respect, in addition to those parties named above, we will provide your data to the following:

• direct marketing providers;
• Google Analytics who receive technical information in relation to how you use our website and apps;

• BMA, owners and co-owners of journals (apart from where it is required or appropriate to have your consent to sharing your information for this purpose).

Your personal data will also be processed by BMJ for compliance with its legal obligations. For example:

for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.

• to comply with tax legislation and subject access requests of others;
• to comply with any legal or regulatory obligations to which we are, or may become, subject.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; and HMRC. Your personal data may also be shared with BMJ's internal and external auditors, insurers, financial and legal advisors for the purpose of enabling BMJ to comply with its financial and legal obligations.

Where we process special categories of personal data our bases for processing are:

• your have given your explicit consent (for example, where we process information about your trade union membership);
• it is necessary for the establishment, exercise or defence of a legal claim.

We may use personal characteristics such as age, gender, geographical location, role, your expressed interests and medical conditions, your previous interactions with BMJ to understand, and where appropriate target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).

Certain BMJ websites (The BMJ and JNNP) are members of the DMD Healthcare Communications Network (the “HCN”). HCN is owned and managed by DMD Marketing Corp (“DMD”) and is designed to enable DMD and HCN members to provide medically relevant business communications to authenticated health care professionals.

For healthcare workers based in the USA who have consented to the use of cookies and similar technologies, your use of these websites includes registration in the HCN. As a result, your contact and other professionally relevant information will be disclosed to DMD and each HCN member, to provide you medically relevant content as described in the HCN privacy policy available at https://HCN.health/privacy-policy . The HCN privacy policy provides details on how to manage your information, including opting out of participation in the HCN.

DMD can use the data collected to understand whether you have accessed content on other sites in the HCN. DMD, HCN members, and customers who purchase information from DMD, can access the data DMD collects. DMD may pass data to other countries.

To the extent that BMJ’s privacy policy conflicts with the HCN privacy policy, with respect to the use of your information by HCN, the conflict will be resolved in favour of the HCN policy.

While BMJ works with DMD, it does not have any direct control over DMD’s processing, and questions about DMD’s processing should be directed to DMD in the first instance.

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area.  For example, we will transfer data to our data storage providers, our journal platform provider or distribution agents (for example, in the USA and India).

In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR). If you wish to obtain a copy of the standard clauses we use, please contact us;

• a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);
• the transfer is already permitted under applicable law (for example, it is necessary for the performance of a contract).

• biographical information such as your name, title, date of birth, age and gender;
• your contact details including address, email address and phone number;
• your image and voice (for example, when captured at a recorded BMJ event or webinar)
• your identifier when you participate in online events;
• your social media identifiers.

• your role qualifications, licences and professional experience;
• your institution;
• your areas of professional interest.

• when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
• information you provide in your communications with us;
• details about how you use our website and apps including how you navigate and participate in online events, the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/ );
• information you provide in webinars, questions, chat, forums and interviews;
• BMJ events you have attended previously and forthcoming events you have registered for;
• payment details and your financial transactions in relation to your purchase;

• provided by you or your organisation, concerning your health (for example your dietary requirements) to enable us to make appropriate adjustments;

details of your trade union membership (such as your British Medical Association ( BMA ) membership number) where relevant for the purposes of administering any discount.

We may process your personal data because it is necessary for the performance of a contract, for example, to deliver the products and services you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data

• to deliver the event/webinar to you and;
• to communicate with you in relation to those services (for example, to send you pre-event information.).

We will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

• third party contractors and service providers who we may engage to assist in delivering the event; for example, event organisers, conference providers, caterers, and instructors;
• our bank to whom payment details are provided in order to process a payment;
• our website and app providers, who assist us in delivering our services to you and administering your order;
• our data storage providers and those who provide our Customer Relationship Management (CRM) platforms;
• our parent company, the BMA, or to your organisation/institution where we are required to verify your details prior to providing our services to you.

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• providing access to our events which your organisation or institution has purchased on your behalf;
• creating a delegate or speaker list and distributing the list to speakers and attendees;
• sharing attendee details with co-organisers, collaborators and sponsors of an event (except in circumstances where it is appropriate to gain your consent);
• marketing BMJ and its products and services (including third party products and services) online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent;
• recording our /webinars for promotional and educational purposes (for example, when interviewing attendees and recording speakers)
• recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
• processing technical information about your use of BMJ websites to ensure that content on our site (including advertising) is presented in the most effective and relevant manner, and to allow you to use interactive features of our website;
• consulting our professional advisers where it is necessary for us to obtain their advice or assistance;
• detecting breaches of our subscription terms and conditions;
• processing enquiries, complaints, surveys, feedback forms and to analyse our services.; and
• where you are participating in a panel or other group, details of your gender for the purposes of monitoring diversity and inclusion.

In addition to those parties named above, we will provide your data to the following:

• direct marketing providers;
• Google Analytics who receive technical information in relation to how you use our website and apps;

• sponsors or other organisations involved with the relevant event or webinar;
• BMA and other third parties for marketing purposes and to update you on products and services that you may be interested in (unless it is appropriate to gain your consent before sharing your information in this way).

Your personal data will also be processed by BMJ for compliance with its legal and regulatory obligations. For example:

• for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations;
• to comply with tax legislation and subject access requests of others; and
• to comply with any legal or regulatory obligations to which we are, or may become, subject (for example, health and safety).

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; and HMRC. Your personal data may also be shared with BMJ's internal and external auditors, insurers, financial and legal advisors for the purpose of enabling BMJ to comply with its financial and legal obligations.

Where we process special categories of personal data our bases for processing are:

• to protect your vital interests for example to inform your specified emergency contact, the NHS or emergency services in the event of your illness or other emergency;
• your explicit consent, for example if we require information about your dietary or access requirements that we need to process in relation to the event;
• where processing is necessary for the establishment, exercise or defence of a legal claim.

We may use personal characteristics such as age, gender, geographical location, role, your expressed interests and medical conditions, your previous interactions with BMJ to understand, and where appropriate, target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).

Certain BMJ websites (The BMJ and JNNP) are members of the DMD Healthcare Communications Network (the “HCN”). HCN is owned and managed by DMD Marketing Corp (“DMD”) and is designed to enable DMD and HCN members to provide medically relevant business communications to authenticated health care professionals.

For healthcare workers based in the USA who have consented to the use of cookies and similar technologies, your use of these websites includes registration in the HCN. As a result, your contact and other professionally relevant information will be disclosed to DMD and each HCN member, to provide you medically relevant content as described in the HCN privacy policy available at https://HCN.health/privacy-policy . The HCN privacy policy provides details on how to manage your information, including opting out of participation in the HCN.

DMD can use the data collected to understand whether you have accessed content on other sites in the HCN. DMD, HCN members, and customers who purchase information from DMD, can access the data DMD collects. DMD may pass data to other countries.

To the extent that BMJ’s privacy policy conflicts with the HCN privacy policy, with respect to the use of your information by HCN, the conflict will be resolved in favour of the HCN policy.

While BMJ works with DMD, it does not have any direct control over DMD’s processing, and questions about DMD’s processing should be directed to DMD in the first instance.

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area. For example, where events may take place outside the EEA (such as the International Forum on Quality and Safety) we may transfer data to those countries. In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission under Article 46(2)(c) GDPR). If you wish to obtain a copy of the standard clauses we use, please contact us;

• a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);

• biographical information such as your name, title, date of birth, age and gender;
• your contact details including address, email address and phone number;
• log in details that you are assigned as part of registration for third party platforms
• identifiers such as names, codes, (for example, your ORCiD or Ringgold identifier);
• identifying features in a patient consent form or manuscript including patient data;
• images of your likeness as captured in a patient photograph included in a manuscript; and
• your social media identifiers.

• your qualifications and professional experience;
• your institution;
• any opinions and assessments provided in your article, or in your review of an article;
• any competing interests that may relate to an article you have submitted or reviewed;

• when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
• information you provide in your communications with us, or in an article or review;
• details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/ );
• articles or reviews you have submitted previously or which are currently being processed;
• payment details and your financial transactions.

We collect the following special categories of personal data from authors, peer-reviewers and patient reviewers:

• racial and ethnic origin.

Where you are a patient reviewer, we also collect the following additional special categories of personal data where appropriate, relating to your review and reviewer registration preferences:

• health information in relation to your medical situation
• genetic data;
• information relating to your sex life and sexual orientation; and
• your religious and philosophical beliefs.

Where you are a case study or featured in a submitted article, special categories of personal data may include:

• data relating to health;
• genetic data;
• data about your sexual life or sexual orientation;
• information about your race or ethnicity; and
• data about your religious or philosophical beliefs.

We may also collect data concerning criminal behaviour or allegations of criminal behaviour referenced in a submitted article.

We will process your personal data because it is necessary for the performance of a contract to deliver the services you have engaged us for, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

• to edit, review and publish your article, letter or review;
• to process article processing charges ( APC )and any related discounting;
• to check for plagiarism and to obtain copyright clearance;

• to credit you as the author, researcher or reviewer of an article or review.
• our data storage providers and those who provide our Customer Relationship Management (CRM) platforms;
• to enable your reviewer profile to be searched more effectively by users of our database (data profiling) through targeted keywords linked to your author or reviewer profile.

In this respect we will provide your data to the following (but only for purposes connected with our fulfilling contracts with you):

• authors, peer reviewers and patient reviewers;

• contractors who provide editorial, publishing and printing services;
• third parties who provide copyright clearance services;
• your organisation / institution where we are required to verify your details in order to process a payment or discount;
• our third party e-commerce solutions and our bank in order to process payments;

• our platform providers that host our websites and apps;
• our data storage providers;
• journal owners and/or replacement publishers where BMJ ceases to publish a journal.

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• researching you using publicly available sources in order to identify suitable reviewers and editors (once we have identified you as suitable for these purposes we will add you to our reviewers’ database and we will contact you to inform you that this has happened and to give you an opportunity to object to such use of your personal data);
• contacting authors and reviewers (and allowing the editorial team to do the same) in relation to writing and reviewing articles;
• contacting authors and reviewers (and instructing researchers to do the same) for development, monitoring and quality improvement of our processes;
• identifying your suitability to review a certain article – some authors may specifically request that certain individuals should not review their article, for example where there is a conflict of interest;
• marketing BMJ and its products and services (including third party products and services) online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);
• recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
• processing technical information about your use of the BMJ website to ensure that content on our site is presented in the most effective manner and to allow you to use interactive features of our website;
• consulting our professional advisers where it is necessary for us to obtain their advice or assistance;

• processing enquiries, complaints, surveys, feedback forms and to analyse our services;
• monitoring diversity and inclusion;

• to raise concerns with a research council, ethics committee or other supervisory body if we felt it was appropriate for us to do so;
• sharing the lay summary of your journal article and the respective authors’ email addresses with companies that provide services for authors and publishers such as Kudos Innovations Limited ( www.growkudos.com ). Kudos provides services for authors and publishers and invites authors to register directly with Kudos to use its services, for example to generate his/her own shareable PDF directly on the Kudos website post-publication;
• to enable your reviewer profile to be searched more effectively by users of our database (data profiling) through targeted keywords linked to your reviewer profile;
• providing your data to the owner of a journal which we publish on their behalf;
• detecting breaches of our publication terms and conditions.

In this respect, in addition to those parties named above, we will provide your data to the following:

• direct marketing providers;
• Google Analytics who receive technical information in relation to how you use our website and apps;

• BMA and owners and co-owners of journals for marketing purposes and to update you on products and services that you may be interested in (unless it is appropriate to gain your consent before sharing your information in this way).

Your personal data will also be processed by BMJ for compliance with its legal and regulatory obligations. For example:

• for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.
• to comply with tax legislation and subject access requests of others; and
• to comply with any legal or regulatory obligations to which we are, or may become, subject.

In this respect, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection law; the police and other law enforcement agencies; HMRC. Your personal data may also be shared with BMJ's internal and external auditors, insurers financial, and legal advisors for the purpose of enabling BMJ to comply with its financial and legal obligations.

Where you are a patient whose data has been included in a research study or article we will require that the corresponding author either retains or provides evidence of your written understanding that your data will be processed for the purposes of journalism.

Where you are a patient reviewer, any special categories or personal data you disclose:

• in your profile will be searchable within our author and reviewer database; and
• or in your review will be published on our website (bmj.com).

Where you are an author, reviewer or patient reviewer we may also monitor and record details on racial or ethnic origin for the purposes of monitoring diversity and inclusion.

We may use personal characteristics such as age, gender, geographical location, role, your expressed interests and medical conditions, your previous interactions with BMJ to understand, and where appropriate target our communications to a specific audience.

Where you are a patient reviewer, your profile will be linked to specific keywords to enable your profile to be searched more effectively by users of our database. The keywords linked to your profile will be chosen to try to reflect the information you have provided to us on registration and may include the names of any health conditions you have disclosed to us.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).

Certain BMJ websites (The BMJ and JNNP) are members of the DMD Healthcare Communications Network (the “HCN”). HCN is owned and managed by DMD Marketing Corp (“DMD”) and is designed to enable DMD and HCN members to provide medically relevant business communications to authenticated health care professionals.

For healthcare workers based in the USA who have consented to the use of cookies and similar technologies, your use of these websites includes registration in the HCN. As a result, your contact and other professionally relevant information will be disclosed to DMD and each HCN member, to provide you medically relevant content as described in the HCN privacy policy available at https://HCN.health/privacy-policy . The HCN privacy policy provides details on how to manage your information, including opting out of participation in the HCN.

DMD can use the data collected to understand whether you have accessed content on other sites in the HCN. DMD, HCN members, and customers who purchase information from DMD, can access the data DMD collects. DMD may pass data to other countries.

To the extent that BMJ’s privacy policy conflicts with the HCN privacy policy, with respect to the use of your information by HCN, the conflict will be resolved in favour of the HCN policy.

While BMJ works with DMD, it does not have any direct control over DMD’s processing, and questions about DMD’s processing should be directed to DMD in the first instance.

BMJ will, in limited circumstances, disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside of the UK and the European Economic Area.  For example, we will transfer data to our data storage providers and also to platforms that host our journals. In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission). If you wish to obtain a copy of the standard clauses we use, please contact us;
• the European Commission determines that the country or territory to which the transfer is made ensures an adequate level of protection (Article 45 GDPR);
• the transfer is already permitted under applicable law (for example, where the transfer is necessary for the performance of a contract).

• biographical information such as your name, title and gender;
• the country in which you are working or studying;
• contact details such as your address, email address and phone number;
• log in details that you are assigned as part of registration; and
• your social media identifiers.

• your qualifications, professional experience and any other information you provide if you upload your CV or submit a job application;
• your job aspirations, profession and speciality when you create an account or register for email alerts;

• information you provide in your communications with us;
• when you visit our website or use our apps we collect details of your Internet Protocol (IP) address, location (including institution), browser type and version, and operating system;
• details about how you use our website and apps including the content you accessed, any searches you conducted, your length of visit, login details, time and date of visit and what method you used to browse away from our website (for detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy https://www.bmj.com/company/your-privacy/cookies-policy/

Your personal data will also be processed because it is necessary for BMJ's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• delivering any products and services which you have purchased;
• to create and administer your account;
• to enable you to use BMJ Careers' online tools;
• to share a job application you have submitted with prospective employers and recruiters;
• to match you with prospective employers and recruiters who we believe meet the parameters indicated in your profile;
• marketing BMJ and its products and services (including third party products and services) online, or by post, telephone, SMS, social media and email (except where we provide material under contract, or in situations where it is required or appropriate to seek your consent);
• processing technical information about your use of our products and services to ensure that content(including advertising) is presented in the most effective and relevant manner, to allow you to use interactive features of our products and to operate our business (and ensuring that we do not advertise medical products or services that are not licensed in your country);
• recording calls to our call centres for staff training and quality assurance purposes (including for the purposes of establishing the existence of facts in connection to the content of a call);
• processing (and replying to) enquiries, complaints, surveys, feedback forms and to analyse our services;
• consulting our professional advisers where it is necessary for us to obtain their advice or assistance.

In this respect, in addition to those parties named above, we will provide your data to the following:

• our platform providers, who host our website and apps.
• direct marketing providers;
• BMA and other third parties for marketing purposes (apart from where it is required or appropriate for us to have your consent to share your information for this purpose).

Your personal data will also be processed by BMJ for compliance with its legal and regulatory obligations. For example:

• for the detection and prevention of crime and in order to assist the police and other competent authorities with investigations.
• to comply with tax legislation and subject access requests of others; and
• to comply with any legal regulatory obligations to which we are, or may become, subject

In this respect, we may in specific circumstances need to share your personal data with the police and other law enforcement agencies and HMRC. Your personal data may also be shared with BMJ's internal and external auditors, insurers financial, and legal advisors for the purpose of enabling BMJ to comply with its financial and legal obligations.

We may use personal characteristics such as age, gender, geographical location, role, your expressed interests and medical conditions, your previous interactions with BMJ to understand, and where appropriate, target our communications to a specific audience.

BMJ also uses a range of advertising technologies like pixels, ad tags, cookies and mobile identifiers as well as specific services used by some websites and social media networks, such as Facebook, to present BMJ adverts to you when you are on other websites and apps. These adverts will be based on information we hold about you about your previous use of BMJ sites (for example, your BMJ search history, the content you accessed and the adverts you clicked on).

Certain BMJ websites (The BMJ and JNNP) are members of the DMD Healthcare Communications Network (the “HCN”). HCN is owned and managed by DMD Marketing Corp (“DMD”) and is designed to enable DMD and HCN members to provide medically relevant business communications to authenticated health care professionals.

For healthcare workers based in the USA who have consented to the use of cookies and similar technologies, your use of these websites includes registration in the HCN. As a result, your contact and other professionally relevant information will be disclosed to DMD and each HCN member, to provide you medically relevant content as described in the HCN privacy policy available at https://HCN.health/privacy-policy . The HCN privacy policy provides details on how to manage your information, including opting out of participation in the HCN.

DMD can use the data collected to understand whether you have accessed content on other sites in the HCN. DMD, HCN members, and customers who purchase information from DMD, can access the data DMD collects. DMD may pass data to other countries.

To the extent that BMJ’s privacy policy conflicts with the HCN privacy policy, with respect to the use of your information by HCN, the conflict will be resolved in favour of the HCN policy.

While BMJ works with DMD, it does not have any direct control over DMD’s processing, and questions about DMD’s processing should be directed to DMD in the first instance.

BMJ uses Google Analytics who will transfer information gained from our use of cookies to its storage centres in the USA. In these circumstances, your personal data will only be transferred under using the standard contractual clauses in accordance with Article 42 GDPR.