Safe Harbor

DrugDev Inc. and its US subsidiaries Clinical Financial Services, LLC and Epernicus, LLC (“DrugDev”) are committed to protecting the privacy of those who entrust it with their personal data. DrugDev Inc. has certified to the U.S.-Swiss Safe Harbor Framework with respect to personal data DrugDev obtains in support of its business in the field of clinical trials. Accordingly, DrugDev adheres to the Safe Harbor privacy principles and frequently asked questions, as agreed to by the U.S. Department of Commerce and the Federal Data Protection and Information Commissioner of Switzerland (the “Safe Harbor Privacy Principles”).

Scope

This Safe Harbor Privacy Policy outlines DrugDev’s general policy and practices for implementing the Safe Harbor Privacy Principles for personal data connected to prospective, current and former:  research subjects, patients, clinical investigators and staff, health care professionals, service providers and business partners, suppliers, officials and industry experts, all in support of DrugDev’s business in the field of clinical trials.

DrugDev’s Safe Harbor certification can be found at https://safeharbor.export.gov/list.aspx. For more information about the Safe Harbor Privacy Principles, please visit http://www.export.gov/safeharbor.

Definitions

The following terms are used throughout this Safe Harbor Privacy Policy and are defined here for clarification.

  • “Agent” means a third party that processes personal data solely on behalf of and under the instructions of DrugDev.
  • “Personal data” means any information or set of information, including sensitive personal information, that (i) is transferred to DrugDev in the U.S. from Switzerland, (ii) is recorded in any form, (iii) identifies or can reasonably be used to identify an individual, and (iv) can be linked to that individual.
  • “Sensitive personal data” means personal data that reveals race, ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that concerns health or sex life.

Notice

In circumstances other than those set out in the next paragraph, DrugDev informs individuals about the purposes for which it collects and uses personal data about them, how to contact it, the types of third parties with whom it may share personal data, and any ways that individuals may limit the use and sharing of such data. Such notice is provided when we first collect personal data, when individuals are first asked to provide personal data or in either case as soon thereafter as is practicable.

In circumstances in which DrugDev obtains personal data as a service provider for its clients or affiliates, DrugDev’s clients or affiliates are responsible for providing appropriate notice to the individuals whose personal data are transferred to the U.S. and obtaining any requisite consent.

Choice

In circumstances other than those set out in the next paragraphs, DrugDev offers individuals the opportunity to choose (opt out) whether personal data may be (a) shared with a non-agent third party or (b) used for a purpose other than that for which the data were originally collected or subsequently authorized by the individual.

For sensitive personal data, DrugDev offers individuals an affirmative or explicit (opt in) choice if the information is to be disclosed to a third party or used for a purpose other than those for which it was originally collected or subsequently authorized by the individual.

In circumstances in which DrugDev obtains personal data as a service provider for its clients or affiliates, DrugDev’s clients or affiliates are responsible for providing the relevant individuals with certain choices with respect to the client’s use or disclosure of the individual’s personal data.

DrugDev may disclose personal data without offering an opportunity to opt out (i) to agents the company has retained to perform services on its behalf, (ii) if it is required to do so by law or legal process, (iii) to law enforcement or other government authorities, or (iv) when DrugDev believes disclosure is necessary to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual illegal activity. DrugDev also reserves the right to transfer personal data in the event it sells or transfers all or a portion of its business or assets (including in the event of a reorganization, dissolution or liquidation).

Access

Where appropriate, DrugDev provides individuals with a reasonable opportunity to correct, amend or delete their personal data where the data are inaccurate. DrugDev may limit or deny access to personal data where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the Safe Harbor Privacy Principles. The right to access personal data also may be limited in some circumstances by local law requirements.

In circumstances in which DrugDev maintains personal data as a service provider for its clients or affiliates, DrugDev’s clients or affiliates are responsible for providing individuals with access to their personal data and the right to correct, amend or delete the data where they are inaccurate. In these circumstances, individuals should direct their questions to the appropriate DrugDev client or affiliate. When an individual is unable to contact the appropriate DrugDev client or affiliate, or does not obtain a response, DrugDev will provide reasonable assistance in forwarding the individual’s request.

Onward Transfers

DrugDev may share personal data with third parties as indicated in the “Choice” section above.

Except as permitted or required by applicable law, DrugDev transfers personal data only to agents that either (i) subscribe to the relevant Safe Harbor Privacy Principles or are subject to another adequacy finding, or (ii) contractually agree to provide at least the same level of privacy protection as is required by the relevant Safe Harbor Privacy Principles.

Data Integrity

DrugDev will only use and share personal data about individuals in a way that is (i) consistent with the purposes for which the data were collected or subsequently authorized by those individuals (and to the extent necessary for those purposes, DrugDev will take reasonable steps to ensure that the data are accurate, complete, current and reliable for their intended use), or (ii) in accordance with its clients’ or affiliates’ instructions (where DrugDev is acting as a service provider). Individuals and (where DrugDev is acting as a service provider) clients or affiliates may contact DrugDev as indicated below to request that DrugDev update or correct relevant personal data.

Information Security

DrugDev takes reasonable precautions to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction.

Enforcement

DrugDev has put in place mechanisms to verify periodically its adherence to the Safe Harbor Privacy Principles. DrugDev has also agreed to cooperate and comply with the Federal Data Protection and Information Commissioner of Switzerland.

Individuals may file a complaint concerning DrugDev’s processing of their personal data by contacting DrugDev as indicated below. In circumstances in which DrugDev obtained or maintains personal data about individuals as a service provider for its clients or affiliates, individuals may submit complaints concerning the processing of their personal data to the relevant client or affiliate, in accordance with the client’s or affiliate’s dispute resolution process. DrugDev will participate in this process at the request of the client or affiliate or the individual. DrugDev will take steps to remedy any issues arising out of a failure to comply with the Safe Harbor Privacy Principles.

How to Contact DrugDev

Please forward any questions about the way in which DrugDev uses personal data to: privacy@drugdev.com

Changes to This Privacy Policy

This Policy may be amended from time to time, consistent with the requirements of the Safe Harbor Privacy Principles.

 

Last updated: October 2016