PATIENT PRIVACY NOTICE

Under which legal basis will your personal data be processed?

The legal basis we rely upon for the processing of your personal data in connection with the above-mentioned purposes is your consent, provided under the consent form. We may need to further retain your personal data to comply with our legal obligations.

How do we protect your privacy?

To protect your privacy, we give your personal data a code. We put this code on all your personal data. We keep the key to the code in a secure place. When we process your personal data, we always use only that code. Coded data will also be used for reports and publications about the scientific research. We also maintain physical, administrative and technical safeguards intended to prevent personal data from accidental or unauthorized loss, alteration access or use. We will notify you and any applicable regulator of any breach of personal data according to legal requirements.

Who has access to your personal data and for what purposes?

Your personal data may be shared with the following recipients:

• ClearNote, its affiliates and licensing partners may have access to your coded personal data for the purposes of the research, for product regulation and safety reporting purposes and for ensuring compliance with legal requirements.
• Auditors and others may check records to make sure that our research is being run properly and in accordance with applicable legal requirements and guidelines.

• Service providers working with the research team and ClearNote (such as laboratories, data storage companies, other doctors) may also have access to your information for the conduct of the research.

How long do we store your personal data?

Your personal information will be used for only as long is needed for the research and may be retained for longer, where required by law. Your personal data may also still be of interest after the end of the research for future scientific research. With your consent, we will use your personal data for future research.

Can you withdraw your consent for the use of your personal data?

At any time, you can withdraw your consent for the use of your personal data. This applies to the use in this research and for the use for future research. No new information will be collected without your permission, except to follow up on safety events that might have happened while you were part of the research.

Will your personal data be transferred to countries outside the European Economic Area and the United Kingdom?

We will transfer your personal data to countries outside the European Economic Area and/or the United Kingdom, including to ClearNote in the United States. Your personal data may be also transferred to trusted persons in other countries. Data protection laws may not be as strong in these countries as the laws in the European Economic Area and/or the United Kingdom. To address any risks to the protection of your personal data, we will make sure that appropriate and suitable safeguards are used, including by entering into standard contractual clauses issued by the European Commission, as replaced from time to time. 

What rights do I have with respect to my personal data?

You have the following rights with regard to the processing of your personal data in connection to the research:

• right to request information what data is processed about you, for what purpose and on what legal basis and whether your data is transferred to any recipients;
• right to access your personal data;
• right to rectification of your inaccurate or incomplete personal data;
• in situations foreseen by the GDPR, right to erasure of personal data to the extent that processing of your personal data is no longer necessary for a legitimate reason; and,
• in situations foreseen by the GDPR, right to restriction of processing and right to portability of your personal data provided to the controller, if the processing is carried out by automated means and unless it adversely restricts the rights and freedoms of others.

If you feel that any of your rights have not been granted to your satisfaction, you also have the right to complain about the processing of your personal data to the European supervisory authority in your place of residence, which can be found here: https://edpb.europa.eu/about-edpb/board/members_en, or here if you are based in the United Kingdom: https://ico.org.uk/make-a-complaint/.