Research studies privacy notice

Mundipharma Research Limited (“Mundipharma Research”, “we” or “us” or “our”) sponsors clinical trials, studies and research (“research studies”), and acts a data controller. This means that we are responsible for looking after your information and using it properly. Other organisations, such as the site running the research study and a contract research organisation used to help administer the research study, may also be data controllers if they control how personal data is collected and processed. This Privacy Notice explains how Mundipharma Research processes (e.g. collects, uses, stores, and shares) your personal data when you take part in one of our research studies.

This Privacy Notice is reviewed and updated from time to time. If we update the terms, we will provide notice through our home page, or by other means, so you can to review the changes. Please check back if you take part in one of our research studies.

This Privacy Notice supplements other privacy notices that we may provide on our website or through other means from time to time when we are processing your personal data.

Before you participate in one of our clinical trials, you will be asked to read and sign an informed consent form. Please read the information contained in any documents provided to you for the research study carefully before you decide to take part. They may contain additional or different information regarding how your personal data will be used and protected for the purposes of the research study.

How do we collect personal data about you?

We receive your personal data from the following sources:
From you directly or through the parties involved as part of your participation in our research studies, such as the study site and/or clinical research organisation. Any organisation that collects or processes your personal data from you and/or your medical records on our behalf must do so in accordance with our instructions, and are subject to a duty of confidentiality. We will handle all such information in accordance with this Privacy Notice.

Why do we process your personal data?

We use personal information to conduct research and development to improve patient health and care. This means that we will use your data, collected in the course of a research study in the ways needed to conduct, analyse and use the results of the research study.

Patients

For patients, this includes using your personal data to:
• check your suitability to take part in the research study
• monitor your treatment with the study medication
• compare and pool your treatment results with those of other people in clinical studies
• monitor the safety of the investigational drug and report adverse events
• analyse, publish and archive the study results
• support the current and future development of the investigational drug
• support the regulatory approval of the investigational drug anywhere in the world
• support the marketing, distribution, sale and use of the investigational drug (once approved) anywhere in the world, and/or
• ask about your interest to participate in future research studies
and associated activities in accordance with laws and guidance relating to medicinal products and devices.

Healthcare Professionals

For healthcare professionals, this includes using your personal data to:
• check your suitability to take part in the research study
• train you on the research study protocol
• supervise the research study and maintain contact with you prior to, during and after completion of a research study
• process adverse event reports
• analyse, publish and archive the results
• pay for your services and disclose such payments
• submit regulatory product dossiers to pharmaceutical regulatory authorities anywhere in the world
• ask about your interest to participate in future research studies, services and for professional interactions
and associated activities in accordance with laws and guidance relating to medicinal products and devices.

Click here for more information relating to transparency of payments.

Patients and Healthcare Professionals

For both patients and healthcare professionals, we may also use your personal data to:
• improve the services and products provided through the Mundipharma global network of independent associated companies
• prevent fraud or criminal activity, misuses of such services or products as well as the security of our IT systems, architecture and networks
• sell, transfer or assign any part of our business or its assets to a third party
• meet our corporate and social responsibility objectives and
• comply with applicable laws, and other uses for which you have given your consent

What personal data do we process about you?

Patients

When you participate in a research study, the following types of personal data may be collected and processed:
• Contact information (name, address, telephone number, email address)
• Your age and/or date of birth
• Gender
• Weight and height
• Your general practitioner/ family doctor
• Your connection to the study site/ research doctor
• Financial information (e.g. bank account number and amounts paid to you for the research study)
• Emergency contact information (e.g., name and telephone of family members)
• Data revealing racial or ethnic origin
• Data revealing religious or philosophical beliefs
• Data concerning health, including medication and patient histories, details of any adverse reactions and other medical information considered relevant such as lab reports
• Genetic data and/or biometric data, such as blood samples
• Data concerning sex life or sexual orientation

The data described in the last five bullets are considered special categories of data called “sensitive data”, which require a higher level of protection under data protection laws.

The study site will use this information as needed, to contact you about the research study, to make sure that relevant information is recorded for your care, and to oversee the quality of the research study.

For certain research studies, the study data shared by the study site with us as the Sponsor will not include your name or contact details, which shall be kept confidential. Instead a code is assigned to the study data sent to us as the Sponsor, so we will only receive information without any identifying information. The people who analyse the information will not be able to identify you and will not be able to find out your name or contact details. However, certain individuals permitted by us as the Sponsor as well as individuals from the regulatory authorities, government bodies or other supervisory bodies (“Authorised Parties”) may look at your identifiable personal data, such as medical and research records, which are available to the study site. Your identifiable personal data may also be disclosed to the Sponsor and such Authorised Parties in exceptional circumstances where required in conjunction with legal proceedings, due to safety concerns, to investigate fraud, or where otherwise permitted by law.

For other research studies, the study data shared by the study site with us as the Sponsor may include your name or contact details, which shall be kept confidential. The only people who will have access to information that identifies you will be Authorised Parties who need to contact you about the research study, to make sure that relevant information is recorded for your care, to oversee the quality of the research study and/or audit the data collection process. Where this information could identify you, the information will be held securely with strict arrangements about who can access the information.

Sponsors are required to publish the results of most clinical trials. It is important for you to know that you will never be identified by name or contact information in any reports or publications produced following a clinical trial.

Healthcare Professionals

For healthcare professionals, we may collect and process your contact information (name, address, telephone number, email address) as well as additional personal data such as your qualifications, expertise, professional registrations, details of any restrictions, debarments, investigations or other actions taken against you, and other work-related information.

The basis for using your information

Our processing of your personal data requires a legal basis. In general, we will only process your personal data using one or more of the following bases:
• Where you have consented
• To perform a contract to which you are, or will be, a party
• To comply with our legal or regulatory obligations
• Where processing is necessary for our legitimate interests
• Where processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
• Where processing is necessary for reasons of public interest in the area of public health, e.g. where processing is necessary for ensuring high standards of quality and safety of health care and of medicinal products or medical devices

As mentioned above, we use personally-identifiable information to conduct research to improve health and care. As a pharmaceutical company we have a legitimate interest in using information relating to your health and care, when you agree to take part in a research study. This means that we will use your data, collected in the course of a research study, in the ways needed to conduct and analyse the research study. We also have a legitimate interest in pursuing the other activities listed under the section “Why Do We Process Your Personal Data” above. When processing your personal data on the basis of our legitimate interests, we must maintain a balance between our legitimate interests and your privacy.

Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.

Research studies are also governed by laws and guidance relating to medicinal products and devices. Please click here for more information about the use of your personal data for adverse event reporting.

What will happen if I don’t provide information?

For patients, if you do not provide information requested in connection with a research study, you may not be able to participate or you may be withdrawn from the research study.

For healthcare professionals, if you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you), or we may be prevented from complying with our legal obligations. You may not be able to participate in or you may be withdrawn from the research study.

Sharing your personal data

Mundipharma Research limit access to your personal data to those of our and our Associates’ employees, agents, contractors, professional advisers (such as lawyers, bankers, auditors, accountants and insurers), service providers (such as clinical research organisations), and other third parties who have a business need to know. If they are a data processor, they must only process your personal data on our instructions and they are subject to a duty of confidentiality.

Your personal data may need to be shared with one or more national or international government bodies or regulatory authorities where requested or required by them, or to comply with the law. We are unable to control their use of your data. To learn more about how your personal data may be shared, please read our Website Privacy Notice here.

Future research

When you agree to take part in a research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations. These organisations may be universities, charities, national healthcare systems (such as the NHS) or companies involved in health and care research in the United Kingdom or abroad.

In such cases, your information could be used for research in any aspect of health or care, and could be combined with information about you from other sources held by researchers, the NHS or government.

Where this information could identify you, the information will be held securely with strict arrangements about who can access the information. The information will only be used for the purpose of health and care research, or to contact you about future opportunities to participate in research. It will not be used to make decisions about future services available to you, such as insurance.

Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee.

Location of personal data we collect

If we transfer your personal data outside of Europe to our and our Associates’ employees, agents, contractors, professional advisers, service providers or to third parties that collaborate with us, your data will be protected with safeguards such as contracts and suitable security measures.

To learn more about the location of your personal data, please read our Website Privacy Notice here. You can request information about such transfers by contacting us using the details below.

Data retention

The study site and the Sponsor are required to keep the data collected from a research study for a minimum number of years after its completion. For European clinical trials, this minimum period is 25 years after completion of the clinical trial. Subsequently, your personal data will be kept by the clinical site for your healthcare and by the Sponsor for the purposes set out in this Privacy Notice where the law and applicable ethical requirements allows it.

Automated decision making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

Your rights

In general, you have the following rights with respect to your personal data:
• The right to access
• The right to rectification
• The right to restrict processing
• The right to erasure
• The right to object to processing
• The right to data portability

Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the research study, we will keep the information about you that we have already obtained. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew. If you agree to have further study data collected about you after you have withdrawn, this personal data may also be used in accordance with this Privacy Notice. To safeguard your rights, we will use the minimum personally identifiable information possible.

Mundipharma Research has assigned a data protection officer responsible for overseeing our compliance with EU data protection law, which you may contact at [email protected]; or c/o the Data Protection Officer, Mundipharma Research Limited, Unit 194 Cambridge Science Park, Milton Road, CB4 0GW in case of any questions or concerns regarding the processing of your personal data. Please explain your relationship and/or interactions with us, as well as the specifics of your query when contacting us. We may require you to provide proper identification before we comply with any request to access or correct your data.

If you are a patient and would like to exercise your rights, you should contact the research doctor who is treating you at the study site in the first instance. This is because your identity will not be known to us where your data has been coded (see “WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU?” section above). The reason your data is coded is to protect your identity, so we don’t know who you are. If you provide your name to us this protection of your identity will be removed, and we would need to forward your details to the research doctor to action your request.

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer (using the details above) who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).

Definitions used in this privacy notice

Associates” means any organisation within the Mundipharma global network of independent associated companies.
data controller” means the company or organisation that, alone or jointly with others, determines the purpose and means of processing personal data.
data processor” means the company or organisation that processes personal data on behalf of the data controller.
personal data” means information that relates to any living identifiable individual (e.g. you, your
medical practitioner or your family member).

 

This Privacy Notice was last updated on 06 November 2018.