Disclosure of your personal information

If you have consented to us providing you with your personal information and special categories of information, we will also ask for your consent to share your personal information with the third parties set out below for the purposes set out in the table below [for what we use your personal information].

• Internal third parties listed in the glossary.
• External third parties as described in the glossary.
• Third parties with whom we may elect to sell, transfer or consolidate any portion of our business or our assets. Alternatively, we may attempt to acquire or merge with other businesses of those third parties. In the event of a change in our business, the new owner will be able to use your personal information and special categories of information in the same manner as set out in this Privacy Policy.

 

International Transfers

Many of our external third parties are based outside the EEA, and their processing of your personal information involves the transfer of data outside the EEA.

When we transfer your personal information out of the EEA, we ensure the same level of protection as the EEA by ensuring that at least one of the following safeguards is in place:

• We will only transfer your personal information to countries that have been deemed by the European Commission to provide an adequate level of protection for your personal information. For more information, see European Commission: Adequacy of protection of personal data in non-EU countries.
• When we use certain service providers, we may use specific contracts approved by the European Commission that provide the same protection for personal information as in Europe. For more information, please refer to the European Commission: Model Contract for the Transfer of Personal Data to Third Countries.
• If we use a provider based in the United States, we may transfer data to that provider if they are part of the Privacy Shield, which requires them to provide similar protections for personal information shared between Europe and the United States. For more information, please refer to the European Commission: EU-US Privacy Shield.

If you would like more information about the specific mechanisms we use to transfer your personal information outside the EEA, please contact us.

 

[Data Security]

All information provided by you is stored on our secure servers. Information "at rest" on our secure servers is protected using industry-standard data encryption. If we provide you with a password to access certain parts of our Site (or if you choose to do so), you are responsible for maintaining the confidentiality of this password. Do not share your password with anyone.

After we receive your information, we use strict procedures and security features to prevent your personal information from being accidentally lost, used, or accessed in an unauthorized way. As part of the Service, data transmitted between you (the End User) and Illingworth is protected using industry-standard encryption methods. Data stored on our servers is protected with encryption at rest and state-of-the-art firewalls to prevent unauthorized access.

No personally identifiable data is stored on the end-user's device. To facilitate login, two encrypted tokens are stored on the end-user's device.

We have procedures in place to deal with suspected personal information breaches and will notify you and applicable regulators if legally required to do so.

 

Data Retention

By law, we must retain basic information about you (including contact, identity, financial and transaction information) for 7 years after the conclusion of the clinical trial for financial audit purposes.

In some circumstances, you may ask us to delete your data. For more information, see "Your Legal Rights" below.

In some circumstances, we anonymize your personal information for research or statistical purposes (so that it can no longer be associated with you). In that case, we may use this information indefinitely without notifying you.

 

What are your legal rights?

Under certain circumstances, you have the following rights under data protection laws relating to your personal information:

• Request access to your personal information (commonly referred to as a "Data Subject Access Request")
• Request for correction of your personal information held by us
• Request to delete your personal information
• Object to the processing of your personal information on this basis where we are relying on legitimate interests (or those of a third party) and we believe that in your particular situation it will affect your fundamental rights and freedoms.
• Request restriction of processing of your personal information
• Request the transfer of personal information to you or to a third party
• If we rely on your consent to process your personal information, withdraw your consent at any time

 

You may exercise these rights at any time by contacting us at 1 Pinehurst Road, Farnborough GU14 7BF OR PatientGO@illingworthresearch.com.

 

glossary

 

Lawful Basis

Consent means the processing of personal information for which you have expressed your consent by statement or express opt-in for processing for a specific purpose. Consent is only valid if it is freely given, specific, and fully informed and clearly stated that you wish to do so. You can withdraw your consent at any time by contacting us.

EEA means the European Economic Area.

Legitimate interest means our interest in conducting and managing our business in order to provide you with the best service/product and to be able to provide you with the best and safest experience. Before processing your personal information for our legitimate interests, we will ensure that we consider and balance the potential impact on you (both positive and negative) and your rights. We will not use your personal information for activities where our interests override their impact on you (except with your consent or as required or permitted by law). You can get more information about how we evaluate our legitimate interest in the potential impact on you in relation to certain activities by contacting us.

Performance of a contract means the processing of your data if it is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into such a contract.

Compliance with a legal obligation means processing your personal information where it is necessary to comply with a legal obligation to which we are subject.

 

Third

 

Internal Third Parties

Other companies belonging to the Illingworth Group act as joint controllers or processors and are based in Spain, France, Italy, Australia and the United States, providing IT and systems management services and providing guidance reporting.

 

External Third Parties

 

It is a service provider acting as a processor and provides IT and systems administration services.

Professional advisers acting as processors or joint controllers (e.g. consultants, lawyers, bankers, auditors, insurance companies, etc., providing banking, legal, insurance and accounting services).

Service providers acting as processors who provide you with visits, lodging, and transportation as part of the Services.

UK HM Revenue & Customs, regulators and other authorities acting as UK-based processors or joint controllers who are required to report processing activities under certain circumstances.

 

What are your legal rights?

You have the right to:

• Requests for access to your personal information (commonly referred to as "Data Subject Access Requests"). This allows you to receive a copy of the personal information we hold about you and to ensure that we are lawfully processing it.
• Request correction of the personal information we hold about you. This allows us to correct any incomplete or inaccurate data we hold, but we may need to verify the accuracy of any new data you have provided to us.
• 個人情報の抹消要求。これにより、当社が個人情報の処理を継続する正当な理由がない場合には、当社に個人情報の消去または削除を求めることができます。また、お客様が処理に異議を唱える権利（下記参照）を正常に行使した場合、当社がお客様の情報を違法に処理した可能性がある場合、または現地の法律を遵守するためにお客様の個人情報を消去する必要がある場合にも、お客様は、当社に個人情報の削除または削除を求める権利を有しています。ただし、特定の法律上の理由により、お客様からの抹消要求に応じられない場合があり、その場合は、お客様の要求時に通知されます。
• 当社が正当な利益（または第三者の利益）に依拠しているお客様の個人情報の処理の対象であり、お客様の特定の状況について、お客様の基本的な権利および自由に影響を及ぼすと感じ、異議を唱えたい場合には、お客様の個人情報の処理に異議を唱えることがあります。場合によっては、当社がお客様の権利と自由に優先する、お客様の情報を処理するためのやむを得ない正当な理由があることを証明することができます。
• お客様の個人情報の処理の制限要求。これにより、以下の場合に個人情報の処理を一時停止するように求めることができます。
  • データの正確性を確認することを希望する場合
  • 当社によるデータの使用がづ製であるか、お客様がデータ消去を希望しない場合
  • お客様が法的要求を確立、行使、または弁護するために必要であるため、当社がデータを必要としなくなった場合でも、お客様がデータを保持する必要がある場合。または
  • お客様が当社によるお客様のデータの使用に異議を唱えたが、当社がそれを使用する正当な根拠を無効にしているかどうかを確認する必要がある場合。
• お客様または第三者への個人情報の転送要求。当社は、お客様またはお客様が選択した第三者に対し、お客様の個人情報を、構造化された、一般的に使用された、機械で読み取り可能なフォーマットで提供します。この権利は、お客様が当初、使用に対し同意を提供した自動化された情報、または当社がお客様との契約を履行するために情報を使用した場合にのみ適用されることにご注意ください。
• 当社がお客様の個人情報を処理するために同意に依拠している場合、いつでも同意を撤回することができます。ただし、これはお客様が同意を撤回する前に行われた処理の合法性には影響しません。お客様が同意を撤回された場合、当社はお客様に特定の製品やサービスを提供できない場合があります。その場合は、お客様が同意を撤回した時点でお知らせいたします。

 

個人情報のカテゴリーの説明

• 身元情報：姓、名、旧姓、ユーザー名または類似の識別子、婚姻状況、肩書、生年月日、性別、パスポート情報（番号、名前、発行国、有効期限を含む）。
• 連絡先情報：自宅住所、メールアドレス、電話番号、緊急連絡先の詳細。
• 財務情報：銀行口座および支払カードの詳細。
• 取引情報：お客様への支払いに関する詳細、アプリ内リクエストの詳細など。
• デバイス情報：お客様が使用しているモバイルデバイスの種類、固有のデバイス識別子（デバイスのIMEI番号、デバイスのワイヤレスネットワークインターフェースのMACアドレス、またはデバイスが使用する携帯電話番号など）、モバイルネットワーク情報、モバイルオペレーティングシステム、使用するモバイルブラウザの種類、およびタイムゾーン設定情報が含まれます。
• コンテンツ情報：写真、ビデオ、その他のデジタルコンテンツを含む、お客様のデバイスに保存されている情報が含まれます。
• プロファイル情報：ユーザー名とパスワード、アプリ内リクエストの履歴、お客様の好みやフィードバックが含まれます。
• 使用状況に関する情報：当社アプリの利用状況、または当社サイトへのアクセス状況の詳細を含みます。これには、当社の請求目的に必要かどうかにかかわらず、トラフィックデータおよびその他の通信データ、ならびにお客様がアクセスするリソースが含まれますが、これらに限定されません。

 

特別カテゴリーの情報

これには、お客様がアプリ内で行ったリクエスト（交通機関や宿泊施設のリクエストなど）に関連して当社に提供した情報が含まれます。また、お客様の人種または民族、宗教的または哲学的信念、および健康に関する情報についての詳細が含まれる場合があります。