Principles of personal data protection
Hereby, we would like to introduce information regarding personal data processing with regard to the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (further referred to as „GDPR“).
We have created the Principles of personal data protection in order to let you know how we collect, process and protect personal data.
1. Who processes personal data?
Controller and processor of personal data according to GDPR is company HD TRIAL, s.r.o. with company ID: 04302672, based at Husova tř. 684/2, 370 05, České Budějovice 2, registered in the Commercial Register maintained by the Municipal Court in České Budějovice under file No. C 24014/KSCB (further referred to as „HD TRIAL“). As a controller and processor, we process personal data based on the below conditions.
Controller is a subject which determines the purposes and means of the processing of personal data; resp. processing is imposed by legal regulation. Processor is a subject which processes personal data on behalf of the controller.
In the context of clinical trials of medicinal products and medical devices, it is necessary to look at the GDPR from the perspective of all involved parties and the nature of the data concerned.
· Sponsor of the clinical trial shall act as a controller for data obtained for the purposes of clinical trial. In the chain of delegation its activities to other suppliers (contract research organisations, laboratory service providers, providers of administration of clinical trial subject reimbursement etc.), these subjects then act as further processors of relevant personal data. Therefore, HD TRIAL s.r.o. is a personal data processor in the context of clinical trials.
· Health care institution participating in the clinical trial as well as Principal Investigator act both as data controllers (for personal data resulting from the documentation of medical care provided to the trial subjects) and as data processors (for data obtained for the purposes of the clinical trial).
Data subject categories processed by HD TRIAL:
- suppliers – service providers, consultants, advisors and other professionals
- clients – persons who have concluded a service contract with HD TRIAL and their employees
- controller employees – persons, who are full or part-time HD TRIAL employees (further referred to as „employees“)
- health care institutions representatives, investigators, clinical trial subjects, other members of clinical trial teams participating in clinical trials of medicinal products and medical devices, and suppliers of other clinical trial services
2. What personal data do we process?
- Suppliers, clients, other professionals – natural persons: first name, last name; business name and address; bank account; tax ID; personal data resulting from particular contract; contact details enabling contact with data subject
- Employees - first name, last name and all other personal data in accordance with relevant legal requirements
- Health care institution representatives – natural persons: contact details of relevant institution representatives
- Clinical trial subjects
- personal data of trial subjects in a form of reviewing medical records of the subjects in the health care institution participating in the clinical trial; pseudonymized data may be transferred (see Chapter 7)
- bank account number of the trial subjects for purposes of administration of reimbursement in the trial. In exceptional cases of non-existing bank account, first name, last name and permanent residence address of trial subject is collected. These data are never transferred to any third party.
3. Why do we process personal data and for what purposes?
Lawful basis of personal data processing is:
- Performance of an inquiry/contract and providing services
- Data subject (clinical trial subject) has given consent to the processing of his/her personal data (for purposes of trial monitoring and ensuring a proper conduct as well as for purposes of administration of subject reimbursement for participation in the trial)
- Compliance with a legal obligation (mainly accounting, tax and archiving)
4. Which entities have access to personal data and how personal data are protected?
To ensure security and confidentiality of personal data, we use technical and organizational measures, particularly to protect against unauthorized access to and misuse of data, to ensure the security of our IT systems and to recover data in the event of an incident. Where appropriate, we use secure encryption to protect data. Other third parties may have access to personal data, depending on the nature of the service provided, to ensure a proper functioning of HD TRIAL. These include, but are not limited to, state regulatory authorities, ethics committees, financial institutions, contract carriers, clinical trial sponsors and their authorized representatives, IT and accounting providers, law firms, translation agencies, ancillary clinical trial service providers. Wherever applicable, HD TRIAL has entered into a fair personal data processing agreement with service providers.
5. How long do we store personal data?
Only authorized persons have access to personal data. The processing of personal data shall take place for as long as is necessary to fulfil purposes for which it was collected.
As a processor, HD TRIAL keeps personal data for the time necessary to exercise rights and obligations arising from the contractual relationship. Then, the documents are deleted/shredded.
As a controller, HD TRIAL keeps personal data for a period defined by legal requirements, up to 30 years. After the retention period, personal data are deleted/shredded.
6. What rights do data subjects have in relation to the processing of personal data?
Data subjects have the right to contact HD TRIAL at any time to request information about the processing and access to their personal data. They also have the right to be erased, the right to correct inaccurate or incomplete personal data, the right to restrict processing, to object to processing and the right to data portability. These rights may be exercised at HD TRIAL’s contacts given below.
If data subject believes that the processing of his/her personal data by HD TRIAL has violated the privacy policy, he/she has the right to file a complaint with the supervisory authority, i.e. Office for Personal Data Protection.
7. When do we transfer personal data to third countries?
Ensuring that certain services provided by HD TRIAL are fulfilled – if the sponsor of the clinical trial or its authorized representative is located outside the Czech Republic – requires HD TRIAL to transfer personal data to recipients in that foreign country.
HD TRIAL transfers personal data to third countries at all times in accordance with legal requirements, in particular GDPR.
When transferring personal data outside the Czech Republic but within the EU, a free flow of personal data with regard to the processing of personal data is not restricted or prohibited, as GDPR applies the same high standard of legal framework for personal data protection.
If the personal data is transferred to a (third) country outside the EU, HD TRIAL ensures that personal data is transferred to countries that the Comission has decided to ensure that these countries provide an adequate level of protection, resp. appropriate safeguards to Article 46 have been provided. In the absence of an adequacy decision pursuant to Article 45, or of appropriate safeguards to Article 46, HD TRIAL transfers personal data in justified cases to clinical trial sponsors, their authorized representatives or other necessary entities pursuant Article 46 (1) a) or c).
8. How can we be contacted?
You can contact us by email: info@hdtrial.cz or by phone at +420 725 549 537.
The request can also be addressed by mail: HD TRIAL s.r.o., Husova tř. 684/2, 370 05, České Budějovice, Czech Republic.