Privacy notice

SGS Clinical Pharmacology Unit

SGS data privacy information notice

The protection of your personal data is important to SGS which has adopted, for the entire Group, strong principles in this area as stated in its Data Privacy Policy available at https://www.sgs.com/en/privacy-at-sgs.

Pursuant to the EU Regulation n. 679/2016 (hereinafter the “GDPR”), SGS Belgium NV division Health & Nutrition / Health Science (hereinafter the “Company” or “SGS”) - provides the following information on the Company’s processing of its volunteers‘ and (potential) clinical trial participants‘ personal data (hereinafter the “Data”), as listed below.

Further information may be provided where necessary e.g. for specific clinical trials

1. Data controller and contact details

The Company is responsible, as a controller, for collecting and processing the Data in context of its activities as investigational site (hereinafter “CPU”) for the management of its volunteers database for participation to clinical trials including the Data needed for the payment of compensation for participation in a clinical trial.

The Company is acting as a processor on behalf of the Sponsor of a clinical trial when collecting Data in the execution of the clinical trial. These are activities which SGS executes as Contracted Research Organization (hereinafter “CRO”).

If you have any questions or comments about this Notice, please contact us through the online privacy request form available at https://www.sgs.com/en/online-privacy-statement/privacy-request-form.

If you have any questions related to the Data collected during the clinical trial you can contact us. We might forward your question to the Sponsor but we will do that in a pseudonymized manner so that your identity is not revealed to the Sponsor. You can also choose to contact the Sponsor of a clinical trial directly which means that your identify will be known by the Sponsor

2. Categories and types of Data collected and processed

The Data processed by the Company may include:

- For the management of our volunteer database including payment of compensation for participation in a clinical trial:

  • contact information (name, home and/or business address, telephone, email addresses); and
  • financial details (bank account details).
  • personal information (date of birth, nationality, pictures, height and weight, travel distance, gender…);
  • living habits (dietary habits, substances use such as alcohol and tobacco, ...);
  • employment information (employment at SGS can be an exclusion criterium for a Sponsor);
  • Information allowing verification of identity (partial social security numbers or partial identity card numbers)
  • medical data (such as general medical history, use of medication)
  • race (ethnicity)

- During the execution of a specific clinical trial for a Sponsor:

  • All information specified in the protocol of a clinical trial
  • All information required for reporting and analyzing a (serious) adverse event during or after a clinical trial.

3. Purpose and legal basis of the processing and nature of the provision of Data

SGS will always process the Data for a specific purpose and will only process the Data which is relevant to achieve that purpose. SGS will process personal data on the following legal basis and for the following purposes:

a) For fulfillment of contractual obligations (Art. 6.1.b of the GDPR).
Data is processed to provide our services in the context of carrying out our contracts or engagements with our volunteers or participants in a clinical trial e.g. for making payments. You can find other details about the purposes of data processing in the relevant contract documents, terms and conditions, ICF, forms or communications

b) In the context of legitimate interests (Art. 6.1.f of the GDPR).Where required and without unduly affecting volunteers and clinical trial participants’ privacy interests or fundamental rights and freedoms, SGS processes the Data for the purposes of SGS legitimate interests pursued directly by SGS or by a Sponsor (data controller in the clinical trial).

These legitimate interests may include:

  • Performing our services as CPU or CRO in a clinical trial as specified in the protocol of the Sponsor in the case the Sponsor processes your Data on the basis of legitimate interest.
  • Helping SGS to learn more about its volunteers and their experiences with Company by conducting opinion research.
  • Assessing legal claims and defending in legal disputes.
  • Guaranteeing SGS IT security infrastructure and environment.

c) As a result of your consent (Art. 6.1.a of the GDPR).

Your consent is very important to us and SGS wants to use it as intended by the privacy legislation. SGS does not consider e.g. your agreement to participate in a clinical study as a consent to do anything at all with your personal data. If SGS uses consent, we want to be very specific on what you are consenting for and offer you a free choice to agree or disagree or no longer agree with the specific matters we ask the consent for. If you revoke your consent, SGS will stop processing your personal data for the specific matter.

SGS might process your Data on basis of consent for:

  • The management of our volunteer database.
  • Contacting you with information on a clinical trial you might be eligible for. 
  • Performing our services as CPU/ CRO in a clinical trial as specified in the protocol of the Sponsor in the case the Sponsor processes your Data on the basis of consent.
  • Sharing information on your participation in a clinical trial with your physician

d) Due to legal obligations (Art. 6.1.c of the GDPR) or in the public interest (Art. 6.1.e of the GDPR).
Furthermore, SGS is subject to various legal obligations, i.e. regulatory and statutory requirements. Purposes of processing include fulfilling control and reporting obligations under fiscal laws or, in certain cases, due to accreditation and / or certification mandatory requirements.

SGS might process your Data on basis of legal obligations or public interest for:

  • The compliance with fiscal laws.
  • The compliance with the Clinical Trial Regulation (law of 07 May 2004 regarding experiment on the human person).
  • Preventing the simultaneous enrolment in multiple clinical trials.
  • Reporting (serious) adverse events to the authorities and to the Sponsor during the conduct of the clinical trial. These Data shall be pseudonymized where possible.
  • Disclosing data to competent authorities during an inspection.

e) To protect vital interests (Art. 6.1.d of the GDPR)
In case there is a vital interest for you or another participant in a clinical trial, SGS might process your Data by providing information relating your participation in a clinical trial. Where the personal data we collect is needed to meet SGS legal or regulatory obligations or to enter into an agreement with you or is needed for legitimate purposes, if SGS cannot collect this personal data we will be unable to
engage you as a volunteer or study participant or provide our services and fulfill our contractual obligations (in which case SGS will inform you accordingly).

4. Who has access to Data and to whom it is shared

The Data may be disclosed:

a) within the SGS Group to other SGS affiliates to provide our services as CPU/ CRO to the Sponsor and ensure a consistent standard of service across our group.

SGS Group Affiliates will act as data processors appointed pursuant to art. 28 GDPR or as autonomous data controllers depending on the circumstances and purposes. These
Data will always be pseudonymized.

b) To third parties who need to carry out specific activities in relation to the Data, according to the purposes of the processing, or to service providers who provide services to Company such as IT and hosting providers, marketing providers and sub-contractors.

When SGS does this, we take steps to ensure they meet our data security standards, so that your personal data remains secure.

c) To authorities, entities and/or subjects to whom they must be communicated according to legal or contractual mandatory provisions.

These authorities, bodies and/or subjects will act as independent data controllers. These Data shall be pseudonymized where possible.

d) To Sponsors for which SGS provides services as CPU and/ or CRO.

SGS will provide your pseudonymized clinical data to the sponsor of the clinical trial where
you participate in.

5. International transfer of Data

When Data is transferred, SGS will ensure to have taken steps to protect the Data before transfer.

SGS transfers Data across national boundaries within the SGS Group or outside the SGS

Group only when:
a) this is justified for business purposes; and
b) safeguards have been implemented to ensure that Data will continue to be protected at a minimum with the same level of protection required in the jurisdiction of origin. To ensure this level of protection for your personal information, SGS may use a data transfer agreement with the third-party recipient based on standard contractual clauses approved by the European Commission or ensure that the transfer is to a jurisdiction that is the subject of an adequacy decision by the
European Commission.

Any transfer of the Data to international organizations
and/or non-EEA countries will take place according to one of the methods permitted
by current legislation.

6. How Data is protected

SGS implements appropriate technical and organizational measures to protect personal data against unauthorized, accidental or unlawful destruction, loss, alteration, misuse, disclosure or access and against all other unlawful forms of processing. These security measures have been implemented considering the state of the art of technology, their cost of implementation, the risks presented by the processing and the nature of the personal data, with particular care for sensitive data.

Adequate awareness, confidentiality undertakings and training are in place to ensure that Data is not shared or disclosed to unauthorized persons.

SGS adheres to the latest technical standards and accepted business practices to protect the Data.

 
7. How long Data is stored

The Data will be stored on paper and/or electronically for only the time necessary for the purposes for which it was collected, respecting the principles of limitation of conservation and minimization referred to in Art. 5.1, letters
c) and e) of the GDPR.

The Data will be kept to comply with regulatory obligations and to pursue the above-mentioned purposes, in compliance with the principles of necessity, minimization and adequacy. The Clinical Trial Regulation imposes a retention period of 25 years for data related to clinical trials.

SGS may retain Data to fulfill regulatory and/or contractual and tax obligations or in case of legal claims. Subsequently, when the aforementioned reasons for the processing will cease, the Data will be anonymized, deleted or destroyed.

The data in the volunteer database will be retained as long as there is a valid consent.

8. Data Subjects Rights

Each Data subject can exercise the following rights referred in articles 15-22 GDPR by sending a request in writing to SGS at the abovementioned contact details:

  • To access: you can obtain information relating to the processing of your Data and a copy of such Data. During a clinical trial Sponsor might limit your access to your Data to comply with requirements in the Clinical Trial regulation.
  • To erase: you can require the deletion of your Data, to the extent permitted by law.
  • To object: you can object to the processing of your Data, on grounds relating to your particular situation. In cases of opposition to the processing of data pursuant to art. 21 GDPR, SGS reserves the right to assess the application, which will not be accepted if there are legitimate reasons to proceed with the processing that prevail over your freedoms, interests and rights.
  • To rectify: where you consider that your Data is inaccurate or incomplete, you can require that such Data be modified accordingly.
  • To restrict: you can request the restriction of the processing of your Data
  • To withdraw your consent: where you have given your consent for the processing of your Data, you have the right to withdraw your consent at any time.
  • To data portability: where legally applicable, you have the right to have the Data you have provided to us returned to you or, where technically feasible, transferred to a third party.

We strive to maintain good relations with our volunteers and study participants and deal with your issues to your satisfaction. If you are not satisfied with the answer of SGS or processing of your Personal Data, please contact us via the methods listed in section 1 above. Should you not be satisfied with us or you believe that the processing of your Data is contrary to the legislation in force, you have the right to lodge a complaint to a supervisory authority pursuant to Art. 77 GDPR.

The Company is committed to keeping your personal data accurate and up to date. Therefore, if your personal data changes, please inform us of the change as soon as possible.

9. Privacy notice status and update

This Data Privacy Notice was updated in January 2022. SGS reserves the right to amend it from time to time. If the notice has been updated, SGS will take steps to inform all concerned of the update by appropriate means, depending on how SGS normally communicates.