Privacy Policy

Introduction

Welcome to our Privacy Statement.  The Evestia Clinical Group respects your privacy and is committed to protecting your Personal Data. Please note that in this Privacy Statement, Personal Data means any information (direct or indirect) that relates to an individual from which that individual can be identified, and which is processed by or on behalf of an Evestia Clinical company.

This Privacy Statement explains how Evestia Clinical collects, uses and looks after your Personal Data in connection with the Group’s services, apps and websites (collectively, referred to in this Statement as our Data Activities), both online and offline. It also sets out your privacy rights.

Who are we?

The Evestia Clinical Group comprises Evestia Clinical Limited (a UK company) and its affiliate companies, which include but are not limited to, Evestia Clinical, Inc. and Atlantic Research Group, LLC. (both US companies). Together, the companies comprising the Evestia Clinical Group are referred to in this Privacy Statement as Evestia Clinical.

What do we do?

Evestia Clinical is a CRO (Contract Research Organisation), providing clinical research services to its global pharmaceutical and biotech clients, along with businesses in related fields (Evestia Clinical clients being referred to in this Privacy Statement as Clients).

This Privacy Statement relates to all of Evestia Clinical’s services (which are referred to in this Privacy Statement as Evestia Clinical Services). Evestia Clinical Services include but are not limited to:

• The conduct and/or management of clinical trials on behalf of Clients, which includes handling of site requests, data management and Pharmacovigilance (as defined below). These Evestia Clinical Services are referred to in this Privacy Statement as Clinical Trial Services.
• Pharmacovigilance is the monitoring of Adverse Events relating to use of healthcare treatments, including pharmaceutical products. Adverse Events are defined as unwanted or unexpected reactions experienced by a patient undergoing healthcare treatment.
• Real world data studies (referred to in this Privacy Statement as Real World Data Services). Real World Data refers to observational data as opposed to data gathered in an experimental setting such as a controlled clinical trial.
• Consulting  projects relating to various elements of pharmaceutical product development.

As part of its provision of Evestia Clinical Services, Evestia Clinical engages in communications with users of our websites or apps: for example, responding to enquiries made via our websites.

Evestia Clinical operates globally in this highly-regulated, safety-focused field. As a necessary element of providing the Evestia Clinical Services, Evestia Clinical carries out Data Activities.

Our Vendors

Evestia Clinical engages a number of different types of specialist suppliers to aid it in providing the Evestia Clinical Services. Such Evestia Clinical suppliers are referred to in this Privacy Statement as Vendors.

Data relationships – controller and processor

In almost all cases where we supply Evestia Clinical Services to a Client, the applicable Client (usually the sponsor of a clinical trial) is considered to be the ‘controller’ of the Personal Data collected (for the purposes of EU and UK data protection law), with Evestia Clinical and its Vendors being considered to be ‘processors’ (or ‘sub-processors’) of such Personal Data. However, where Personal Data is collected by Evestia Clinical for its own business uses and not on behalf of a Client, Evestia Clinical is usually considered to be the ‘controller’ of such Personal Data. This Privacy Statement applies to all Personal Data processed by Evestia Clinical, whether Evestia Clinical is controller or processor (where those concepts apply).

Use of your Personal Data and this Privacy Statement

Please read this Privacy Statement before using Evestia Clinical Services or submitting Personal Data to Evestia Clinical. This Privacy Statement is intended to explain how we collect, use, disclose, retain and protect Personal Data.

Processing* of Personal Data requires a legal basis.  One legal basis is the informed consent to the Processing, of the person whose Personal Data we are Processing.  We rely on consent only where consent is required by applicable law or where we have specifically asked for and obtained it. In other cases, we will process Personal Data on another applicable legal basis, as described below.

*The term ‘Processing’, as used in this Privacy Statement, has the meaning given to it at the section below, “What Type of Personal Data might we Collect/Process”.

It is important that you read this Privacy Statement together with any other privacy or fair Processing notice, or consent form (where applicable), that may be provided to you in specific circumstances, so you are fully aware of how and why we use your Personal Data. This Privacy Statement supplements such other notices/forms and does not override them.

Who this Privacy Statement applies to

This Privacy Statement is intended to apply to individuals whose Personal Data may be processed by Evestia Clinical, including website and app users, healthcare professionals and clinical trial investigators, potential clinical trial participants, Client and Vendor contacts, business partners and other individuals who communicate with us.

In respect of our Processing of Personal Data resulting from healthcare, such as Personal Data of Clinical trial participants and patients whose data is processed in connection with pharmacovigilance or Real World Data Services, a more specific privacy notice, informed consent form, participant information sheet, contract term or regional notice applies.  This more specific document will supplement this Privacy Statement and, where appropriate, prevail in relation to the relevant Processing.

How does Evestia Clinical collect Personal Data?

Evestia Clinical collects Personal Data (or Personal Data is collected on behalf of Evestia Clinical) in several different ways and from several different sources, to enable us to provide the Evestia Clinical Services, as follows:

• Directly from individuals (for example, by individuals using our website or our mobile apps to make enquiries, and supplying contact details)
• From healthcare professionals (who may inform us about themselves, other healthcare professionals, patients and others), particularly in the performance of Clinical Trial Services, Pharmacovigilance and Real World Data Services
• From Clients, in connection with our performance of Evestia Clinical Services for them
• From other CRO’s we are working with, from clinical trial investigators, from Vendors, and from other third parties engaged by our Client who we interact with in the provision of an Evestia Clinical Service
• From or about individuals applying to be, or who have been, enrolled onto clinical trials, as part of our Clinical Trials Services
• From other business partners
• From government agencies or public records
• From industry and patient groups and  associations

From time to time, we may also use or augment the Personal Data we have about individuals with information obtained from other sources, such as public databases, social media platforms and other third parties. For example, we may use such third party information to confirm or verify healthcare professionals’ licences or to better understand individuals’ requirements by associating demographic information with the information an individual has provided.

Evestia Clinical may also share your Personal Data with some or all of the parties or entities mentioned in the above list, as part of its legitimate Data Activities. Further information on the sharing of Personal Data is set out below.

What type of Personal Data might we Collect/Process?

We may collect, use, store and/or transfer (together referred to in this Privacy Statement as Processing) different kinds of Personal Data about you.

You should note that in relation to certain aspects of our Data Activities, we are likely to collect and Process what in the UK is called sensitive Personal Data. Sensitive Personal Data includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning a person’s sex life or sexual orientation, and health-related data (together referred to in this Privacy Statement as Sensitive Personal Data). In our case, we are most likely to collect health-related Sensitive Personal Data, potentially including genetic and biometric data, in relation to the Evestia Clinical Services. We will only Process such Sensitive Personal Data if we need to do so to provide the applicable Evestia Clinical Service to an individual or to discharge our obligations to our applicable Client or to comply with applicable law.

We have grouped together the types of Personal Data we collect (dependent on the applicable Evestia Clinical Service), some of which is Sensitive Personal Data, as follows:

• Contact information and contact preferences (such as name or initials, email address, mailing address, phone number, and emergency contact information)
• Biographical and demographic information (such as date of birth/age, marital status, professional/employment status and type, gender, ethnicity and sexual orientation)
• Health and medical information (such as information about physical and mental health conditions and diagnoses, weight, treatments for medical conditions, genetic information, family medical history, medications an individual may take, including the dosage, timing, and frequency, medical scans/images and test results, and Adverse Events suffered), which we Process where necessary in connection with the Evestia Clinical Services, including the Clinical Trials Services, Pharmacovigilance and Real World Data Services
• Information regarding any parents or legal guardians of applicable individuals
• Financial information, for example to make payments, or to complete a transaction or determine eligibility for patient assistance programs
• Username and password that are selected in connection with establishing an account on our websites or mobile apps
• Photograph, social media handle or digital or electronic signature
• Publicly available information
• Internet activity, such as browsing history, your search history, and information on your interaction with an Evestia Clinical website or Evestia Clinical Services
• We may use the Personal Data we collect with information obtained from other sources, such as public databases, social media platforms and other third parties

For healthcare professionals, Evestia Clinical may also collect or share, in accordance with this Privacy Statement:

• Professional credentials, educational and professional history, institutional and government affiliations, and information included on a resume or curriculum vitae (such as work experience, education, and languages spoken)
• Information about the Evestia Clinical Services with which the healthcare professional has engaged
• Details about our interactions with the healthcare professional, their use of Client products via the Evestia Clinical Services and the agreements they have executed with us
• Publicly-available information related to their practice, such as licence information, disciplinary history, prior litigation and regulatory proceedings, and other due diligence related information.

How and why Evestia Clinical uses Personal Data

Evestia Clinical uses Personal Data for the purposes described in this Privacy Statement and, where applicable, in any project-specific notice, informed consent form, participant information sheet or Client instruction. These purposes may include:

• providing, managing, supporting and improving Evestia Clinical Services, including Clinical Trial Services, Pharmacovigilance, Real World Data Services and consulting projects;
• communicating with individuals, Clients, Vendors, healthcare professionals, investigators, sites and other business partners;
• assessing site, investigator, healthcare professional, Vendor or business partner suitability, credentials, qualifications, licences, experience and compliance status;
• responding to website, app, assessment, questionnaire, scorecard, event, webinar, campaign and other enquiries;
• undertaking business development, account management, relationship management and, where permitted by applicable law, business-to-business marketing and lead-generation activities;
• meeting legal, regulatory, contractual, quality, safety, audit, inspection, record-keeping and reporting obligations;
• detecting, preventing and responding to fraud, security incidents, service misuse, legal claims and other risks; and
• maintaining, analysing, developing and securing our websites, apps, systems, records and services.

Marketing assessments and lead generation

We may collect information submitted through online forms, questionnaires, assessments, scorecards, event or webinar registrations and campaign landing pages operated by Evestia Clinical or by service providers acting on our behalf. This information may include name, business contact details, organisation, role, assessment responses, interests, preferences and resulting score, profile or categorization. We may use this information to provide requested content or results, respond to enquiries, assess potential interest in our services, manage business relationships and, where permitted by applicable law, undertake relevant business-to-business marketing and follow-up communications. We do not use lead-generation scoring or profiling to make decisions that produce legal or similarly significant effects about individuals. You may opt out of marketing communications at any time by using the unsubscribe mechanism included in the relevant communication or by contacting us using the details in the Contacts section below.

Legal bases for Processing your Personal Data

Evestia Clinical Processes Personal Data only where it has a legal basis for doing so in the applicable jurisdiction. Depending on the context, the relevant legal basis may include the following:

• The Processing being in Evestia Clinical’s legitimate interest in provision of access to the applicable Evestia Clinical Services
• The Processing being necessary for the performance of a contract between an individual or entity and an Evestia Clinical company
• The Processing being necessary for the performance of a contract, concluded in your interest, between an Evestia Clinical company and a third party, such as a Client
• The Processing is necessary, or legally required, on important public interest grounds, for the establishment, exercise, or defence of legal claims, or to protect  your vital interests
• Where the Processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• The Processing is required by applicable law
• With your consent (where such consent is required and given) as described in specific terms, privacy notices and/or informed consent forms. Where Evestia Clinical relies on consent, the opportunity to give that consent will be provided prior to the Personal Data in question being collected. The consent is valid only if given by you or through your authorised representative such as a legal guardian, agent, or holder of a power of attorney. Where Evestia Clinical relies on consent, you may be entitled to withdraw that consent (in relation to future Processing only).

For individuals in the UK or EEA, the legal basis will depend on the purpose of the Processing. For example, we may rely on: legitimate interests for ordinary business communications, website administration, service improvement, fraud prevention, relationship management and certain business-to-business marketing; contract necessity where Processing is needed to enter into or perform a contract with you or with a relevant third party; legal obligation where Processing is required for regulatory, safety, pharmacovigilance, tax, accounting or compliance purposes; public interest, scientific research, healthcare or legal-claims grounds where applicable to clinical research, safety reporting or related activities; and consent where we specifically request consent or where consent is required by applicable law. Where we Process Sensitive Personal Data, we will also identify and rely on an applicable condition for processing that category of data under applicable law.

How Evestia Clinical shares Personal Data

You should note that we may share your Personal Data with a limited number of other parties. For example, we may report the information to our appropriate Client, and we may share the information with appropriate Vendors, in order to perform the applicable Evestia Clinical Services. Examples follow:

Within the Evestia Clinical Group

In the normal course of performing the Evestia Clinical Services, Personal Data may be shared within the Evestia Clinical Group for research and statistical purposes, drug safety and efficacy purposes, disease management, system administration and crime prevention or detection, or any purpose otherwise identified in this Privacy Statement.

With our Clients

We may share Personal Data with our applicable Client, in order for such Personal Data to be used for the benefit of the applicable project (for example, a clinical trial), and for research and statistical purposes, drug safety (for example, pharmacovigilance projects) and efficacy purposes, disease management, system administration and crime prevention or detection, or any purpose otherwise identified in this Privacy Statement.

With our Vendors and other third parties

As mentioned elsewhere in this Privacy Statement, we may retain Vendors to perform elements of the Evestia Clinical Services on our behalf and we may collaborate with other companies, regulatory authorities (or similar) and individuals with respect to the Evestia Clinical Services.  Examples of our Vendors include data capture providers, data analysis businesses, consultants working with us to provide Evestia Clinical Services, companies providing services related to the provision of Clinical Trial Services (including but not limited to homecare services in respect of remote clinical trials), credit card processing companies, customer service and support providers, email and SMS vendors, lead generation and marketing platform providers, web hosting and development companies, and fulfilment companies. Some Vendors may collect Personal Data on our (or our Clients’) behalf. We endeavour to ensure all Vendors and other third parties respect the security of such Personal Data and treat it in accordance with law. We do not allow our Vendors to use such Personal Data for their own purposes and only permit them to Process such Personal Data for specified purposes and in accordance with our (or our applicable Client’s) instructions.

Through our websites or apps, we may provide links to other websites, services, and applications that are not operated or controlled by us. This Privacy Statement does not apply to the websites or other platforms of such third parties. Whilst we attempt to facilitate access only to those third party service providers who share our respect for  privacy, we cannot take responsibility for the content, privacy policies, or practices of those third parties. We encourage you to review and understand the privacy practices of any third party before providing any information to or through them. Interactions with these third parties are governed by the privacy policy of the third party.

In connection with business transactions

As we continue to develop our business, we might sell or buy assets. In such transactions, user information, including Personal Data, may be one of the transferred business assets. Also, if either the Evestia Clinical Group or a company within the Evestia Clinical Group, or substantially all of the assets of the Evestia Clinical Group (or a company within the Evestia Clinical Group) were to be acquired by another party, your Personal Data may be one of the transferred assets. Therefore, we may disclose and/or transfer your Personal Data to such third party in these circumstances.

To comply with our legal obligations

Evestia Clinical reserves the right to disclose, without your prior permission, any Personal Data about you and your use of the Evestia Clinical Services in circumstances where we have a good faith belief that such action is necessary to: (a) protect and defend the rights, property or safety of Evestia Clinical, our employees, other users of the Evestia Clinical Services, or the public; (b) enforce the terms and conditions that apply to use of the Evestia Clinical Services; (c) as required by a legally valid request from a competent governmental authority and/or to comply with a judicial proceeding, court order, or legal process; or (d) respond to claims that any content violates the rights of third parties. We may also disclose Personal Data as we deem necessary to satisfy any applicable law.

Please be aware that we may also disclose to third parties, for any purpose, aggregated de-identified (anonymised) data that is not personally identifiable.

It should be noted that, except as part of the Evestia Clinical Services described in this Privacy Statement, Evestia Clinical does not sell Personal Data to third parties.

How we collect Personal Data online

Evestia Clinical’s websites and apps may collect information that could contain Personal Data about your visits to them, without you actively submitting such information. We may use cookies, pixels, web beacons, local storage, analytics tools and similar technologies to operate our websites and apps, keep them secure, remember user preferences, understand how they are used, measure and improve performance, support campaigns and, where permitted by applicable law, deliver or measure relevant content and business-to-business communications. Information collected may include device identifiers, IP address, browser type, operating system, referring pages, pages viewed, time spent on pages, interactions with forms or content and approximate location derived from technical information. Where required by applicable law, non-essential cookies and similar technologies will be used only with appropriate consent or choice mechanisms.

Some of Evestia Clinical’s business partners, Clients, Vendors, website providers, analytics providers, marketing platform providers, social media companies and other third parties may place or access cookies or similar technologies on Evestia Clinical websites and apps. These technologies may allow those third parties to collect information about your device, browser and online interactions over time and across different websites or services. Evestia Clinical does not control the privacy practices of those third parties. You should review the privacy notices and preference tools made available by those third parties, and may also be able to manage cookies through your browser or device settings. If we make a dedicated cookie preference tool or cookie notice available, you should use that tool or notice to manage your preferences for the relevant website or app.

Some internet browsers allow users to limit or disable the use of tracking technologies that collect unidentified information, such as a Do Not Track (“DNT”) setting, which can also be used.

Our website may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share Personal Data. We do not control these third party websites and are not responsible for their privacy statements. We encourage all users to read the privacy statement/policy of every website they visit.

International Personal Data and Personal Data transfers

Personal Data may be collected and Processed in any country or jurisdiction in which  our services are accessed. Privacy law varies in different countries, but Evestia Clinical will always comply with the privacy law prevailing and which applies, wherever you may be in the world.

Evestia Clinical maintains servers and other storage facilities in the United States, the EU, and the UK. Evestia Clinical may transfer Personal Data outside of its country of origin for the purposes and in the manner set out in this Privacy Statement, including for Processing by Clients, Vendors, other appropriate third parties and Evestia Clinical companies in connection with such purposes. In all situations, Evestia Clinical takes reasonable steps to ensure that your privacy is protected. Such steps include, but are not limited to, implementing privacy, security, and contractual controls, as well as steps noted in this Privacy Statement, and steps as required by applicable law.

Where Personal Data is sent outside of the individual’s country, it may be subject to the laws of the country in which it is held, and may be subject to disclosure to the governments, courts, or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country.

Evestia Clinical endeavours to obtain assurances from its Vendors that they will safeguard Personal Data consistent with this Privacy Statement. An example of appropriate assurances that may be provided by Vendors includes a contractual obligation that they provide at least the same level of protection as is required by Evestia Clinical’s privacy principles set out in this Privacy Statement. Where Evestia Clinical becomes aware or suspects that a Vendor is using or disclosing Personal Data in a manner contrary to this Privacy Statement, Evestia Clinical will take appropriate steps to prevent or stop the use or disclosure.

If you are in the EEA or the UK, transfers of your Personal Data may be made to entities located outside the EEA or the UK, including entities located in the United States, for Processing consistent with the purposes described in this Privacy Statement. Where required by applicable law, Evestia Clinical will use appropriate transfer mechanisms, which may include adequacy decisions or regulations, the European Commission standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to the European Commission standard contractual clauses, intra-group or vendor contractual controls, and technical and organizational measures designed to protect Personal Data. Where we rely on contractual transfer mechanisms, we will take steps designed to ensure that the recipient provides an appropriate level of protection for Personal Data as required by applicable law.

Security

Evestia Clinical has implemented reasonable physical, technical, organisational and managerial controls and safeguards to keep your Personal Data protected from unauthorised access, disclosure, alteration, and destruction. Such measures may include but are not limited to:

• the encryption of communications via SSL
• encryption of information whilst it is in storage
• firewalls
• access controls
• separation of duties of staff
• pseudonymisation (where appropriate)
• use only of properly validated software systems

Evestia Clinical trains its personnel on the importance of privacy and how to handle and manage Personal Data appropriately and securely. All employees and consultants are subject to a duty of confidentiality. Evestia Clinical maintains physical, electronic and procedural measures to safeguard Personal Data from accidental or unauthorised access, use, disclosure, or deletion. Personal Data handled by Vendors or companies with which Evestia Clinical may conduct joint programs, is governed by this Privacy Statement.

However, it should be noted that the confidentiality of Personal Data transmitted over the internet cannot be guaranteed. Evestia Clinical urges you to exercise caution when transmitting Personal Data over the internet. Evestia Clinical cannot absolutely guarantee that unauthorised third parties will not gain access to your Personal Data. Therefore, when submitting Personal Data to Evestia Clinical online, you must consider both the benefits and the risks of doing so.

Data integrity, purpose limitation and retention periods

We will use Personal Data only in ways that are compatible with the purposes for which they were collected or consented to by the individual (where applicable), unless we reasonably consider that we need to use the information for another reason and that reason is compatible with the original purpose.

Evestia Clinical has appropriate steps in place to ensure that Personal Data is relevant to its intended use, and is accurate, complete, and current.

Evestia Clinical will retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, including to provide Evestia Clinical Services, comply with legal, regulatory, contractual, quality, safety, pharmacovigilance, audit, inspection, tax, accounting and record-keeping obligations, resolve disputes, enforce agreements and establish, exercise or defend legal claims. Retention periods may differ depending on the type of Personal Data, the purpose of Processing, the applicable Evestia Clinical Service, Client instructions and applicable law. Clinical Trial Services, Pharmacovigilance and Real World Data Services may require lengthy retention periods for patient safety, regulatory and scientific reasons. For example, relevant records may need to be retained for the duration of the applicable medical product’s life-cycle and for an additional period after the product has been removed from the market. When Personal Data is no longer required, we will delete it, anonymise it or otherwise handle it in accordance with applicable retention and disposal requirements.

Children

Evestia Clinical does not intend to collect any Personal Data from children on Evestia Clinical websites or apps (children being individuals who have not reached the age of majority in their residential jurisdictions).

Where children are eligible for or otherwise relevant to Evestia Clinical Services (for example, in respect of Clinical Trial Services, Real World Data Services or Pharmacovigilance), their applicable Personal Data may be Processed in accordance with applicable law and any relevant informed consent, assent, participant information or Client instruction requirements. However, Evestia Clinical does not knowingly allow children to communicate directly with Evestia Clinical. Should you suspect that a child of whom you are the parent or legal guardian has provided us with Personal Data directly, please contact Evestia Clinical using one of the methods set out in the Contacts section below, and Evestia Clinical will work with you to address this issue.

Your rights

You have certain rights and choices regarding our (and our applicable Clients’ and Vendors’) Processing of your Personal Data. Depending on your jurisdiction and the purposes for which the Personal Data is Processed, applicable law may entitle you to additional consumer rights, including the right to:

• Know the categories of and/or specific pieces of information regarding the Personal Data collected about you, including whether your Personal Data is sold or disclosed, and with whom your Personal Data is shared
• Access a copy of the Personal Data retained about you
• Request deletion of your Personal Data (but please note that we may not be lawfully permitted to delete Personal Data we have processed, for example for Clinical Trial Services, Real World Data Services or Pharmacovigilance purposes)
• Correct or amend your Personal Data
• Request transfer of your Personal Data to you or another person in a commonly utilisable format
• Object to certain uses of your Personal Data
• Where we are relying on consent to process your Personal Data, you may usually withdraw your consent at any time. However, this will not affect the lawfulness of any Processing carried out before you withdraw your consent.  If you withdraw your consent, we may not be able to provide certain Evestia Clinical Services to you. We will advise you if this is the case at the time you withdraw your consent.
• File a complaint with an appropriate data protection authority. For the UK, this is the Information Commissioner’s Office (ICO) at www.ico.org.uk. We would however always appreciate the chance to deal with your concerns before you make such a complaint, so please do contact us in the first instance at  DISTDPO@evestiaclinical.com.

We reserve the right to verify your identity in connection with any requests regarding Personal Data to help ensure that we provide the Evestia Clinical Services to the individual to whom it pertains and allow only those individuals or their authorised representatives to exercise rights with respect to that information. If you are an authorised agent making a request on behalf of an individual, we may require additional information to verify that you are authorised to make that request. This may include obtaining a written authorisation and proof that you are authorised to make the request.

Evestia Clinical may not be able to comply with a request where Personal Data has been destroyed, erased or made anonymous in accordance with Evestia Clinical’s record retention obligations and practices. In the event that Evestia Clinical cannot provide an individual with access to his/her Personal Data, Evestia Clinical will endeavour to provide the individual with an explanation, subject to any legal or regulatory restrictions.

Additional regional privacy information

Depending on where you are located, you may have additional privacy rights under local law.  For example, residents of certain US states may have rights to know, access, correct, delete, receive a copy of, opt out of certain uses or disclosures of Personal Data, and appeal certain decisions. As described above, Evestia Clinical does not sell Personal Data except as may be specifically described in a separate applicable notice or consent form and does not use or disclose Sensitive Personal Data for purposes that are incompatible with the purposes described in this Privacy Statement or any more specific notice provided to you.

Contacts

Any questions or concerns regarding this Privacy Statement, the Processing of Personal Data by Evestia Clinical, or related to revocation of consent to Process your Personal Data (where applicable), or any other of your data protection rights, should be directed to the contact address set out below. To submit a request to us, please contact us at the following address: DISTDPO@evestiaclinical.com or by mail to the following address:

FAO The Data Protection Officer
Evestia Clinical Limited, Suite 209, The Spirella Building, Bridge Road, Letchworth Garden City, Hertfordshire, United Kingdom SG6 4ET.

EU Representative Contact: evestiaclinical@kdpc.ie (our appointed EU Data Protection Representative)
Legal Contact: legal@evestiaclinical.com

If Evestia Clinical’s Processing of your Personal Data is covered by EU law you may also lodge a complaint with the corresponding data protection supervisory authority in your country of residence. You can find the relevant supervisory authority name and contact details under http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

To help us respond to your request, all communications should include the sender’s name and contact information (such as e-mail address, phone number or mailing address), and a detailed explanation of the request. In addition, communications related to Evestia Clinical websites should include, as applicable, the e-mail address used for registration and the Evestia Clinical website address on which Personal Data was provided. E-mail requests to delete, amend, or correct Personal Data should include “Deletion Request” or “Amendment/Correction Request”, as applicable, in the subject line of the e-mail or header of the letter, as applicable. Evestia Clinical will endeavour to respond to all reasonable requests in a timely manner (generally, one month in the UK), and in any case, within any time limits prescribed by applicable local law. If we cannot meet these timelines, we will notify you and keep you updated.

We will not usually charge a fee to access your Personal Data, or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will endeavour not to restrict or deny you access to the Evestia Clinical Services because of choices and requests you make in connection with your Personal Data. However, please note that certain choices may affect our ability to deliver Evestia Clinical Services to you.

Any requests to opt-out of future communications from Evestia Clinical or to opt-out of a particular Evestia Clinical program should be directed to Evestia Clinical using the contact methods above.

Changes to Evestia Clinical Privacy Statements

Evestia Clinical keeps its data protection/privacy arrangements under review and accordingly reserves the right to amend this Privacy Statement from time to time to reflect technological advancements, legal and regulatory changes and/or changes to Evestia Clinical’s business practices, subject to applicable laws. If Evestia Clinical changes its privacy practices, an updated version of this Privacy Statement will reflect those changes.  Evestia Clinical will provide notice of such changes by updating the effective date listed on this Privacy Statement. It is your responsibility to check this Privacy Statement frequently on our website to view any amendments. Your continued interaction with Evestia Clinical will, in respect of Data Activity, be subject to the then-current Privacy Statement.

It is of course important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us.