Effective: May 15, 2023
Supplemental Privacy Notice for US Residents
Purpose
This US Supplemental Privacy Notice (“Supplemental Notice”) applies only to information collected about California, Colorado, Virginia, Utah, Connecticut and Nevada consumers. It provides information required under the following laws, (collectively, “US State Privacy Laws”):
- California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively, the “CPRA”)
- Colorado Privacy Act of 2021 (the “CPA”)
- Connecticut Data Privacy Act (“CTDPA”)
- Utah Consumer Privacy Act of 2022 (the “UCPA”)
- Virginia Consumer Data Protection Act of 2021 (the “VCDPA”)
- Chapter 603A of the Nevada Revised Statutes (the “NRS”)
Some portions of this Supplemental Notice apply only to consumers of particular states. This Supplemental Notice forms part of and supplements and amends, as applicable, our Privacy Policy.
Personal Information We Collect
In the twelve (12) months prior to the “last reviewed” date of this Notice, we have collected the following categories of Personal Information:
- Identifiers, such as name, initials, patient ID, online identifiers, physical characteristics or description, date of birth, IP address or device ID;
- Contact information, including phone number, address, email address;
- Characteristics of protected classifications under state or federal law, such as age, gender, race, physical or mental health conditions, disability, sex and marital status;
- Biometric information;
- Internet or other electronic network activity information, such as interactions with our websites or advertisements;
- Audio, visual and similar information, such as call and video recordings;
- Professional or employment-related information, such as specialty, education history, professional qualifications, work history and prior employers;
- Sensitive personal information, including Personal Information that reveals:
- Precise geolocation;
- Racial or ethnic origin;
- Personal Information concerning health, sex life or sexual orientation;
- Login credentials and passwords.
Retention of Personal Information. We retain your Personal Information for the period reasonably necessary to provide our services to you and for the period reasonably necessary to support our business operational purposes.
Sources of Personal Information
We collect the categories of Personal Information listed above from the following categories of sources:
- Directly from you, including when you provide information to us;
- Indirectly from you, such as when we automatically collect technical and usage information (e.g. cookies) or when your caregiver, health care professional or our client provides us information per your consent;
- Public sources;
Purposes for which We Collect and Use Personal Information
We may use the Personal Information listed above for the following business and commercial purposes:
- To provide our clinical trial services to our clients, including maintaining and updating information as-needed to ensure accuracy;
- To respond to your inquiries;
- To provide, support, personalize, and develop our website, applications, and product or service offerings;
- To prevent malicious, deceptive, fraudulent, or illegal activity, and participating in any prosecution or enforcement of laws or agreements meant to prevent or punish such activity;
- To debug, identify, or repair errors or effectuate similar functional enhancements in connection with the Services;
- For internal operational uses such as research, analytics, development, audits, and security;
- For legal and operational compliance purposes, such as monitoring whether our operations are effectively implementing this policy;
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding
- To engage in or enable internal uses consistent with our relationship with you, or compatible with the context in which you provided the information, such as internal research and development; and
- For any other purpose described to you when collecting your Personal Information before or at the time of collection.
- We use your Sensitive Personal Information only to provide our Services and we do not use or disclose it for any other purposes.
Sharing of Personal Information
We may share Personal Information with the following categories of third parties:
- Our affiliated companies;
- Our service providers, only to the extent needed for them to perform their services;
- Clinical trial sites and sponsors;
- Other third parties to protect our legal rights or comply with legal requirements;
- Other third parties to update and/or confirm their contact lists;
- Other third parties as required by law, such as to comply with a subpoena or other legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- Other third parties involved in a merger, sale, joint venture or other transaction involving a transfer of our business or assets; and
- Other third parties with your prior consent.
Sales of Personal Information
We do not “sell” or “share” Personal Information for cross-contextual behavioral advertising (as those terms are defined under applicable local law). While we do not sell or share Personal Information with third parties in exchange for money, we may have shared certain Personal Information, such as site and site personnel details, with our customers in exchange for monetary consideration in the preceding 12 months which may be treated as a “sale” under applicable local law.
Your Rights and Choices with Respect to Personal Information
California, Colorado, Virginia Utah, and Connecticut consumers have certain rights with respect to the collection and use of their Personal Information. Those rights vary by state. As required by the CPRA, we provide detailed information below regarding the data subject rights available to California consumers. Colorado, Virginia, Utah, and Connecticut consumers have similar rights and can find more details by referencing the applicable US State Privacy Law.
- Access and Data Portability Rights: You may request, up to twice every 12 months, a copy of the specific pieces of personal data that we have collected, used or disclosed about you in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows you to transmit this information to another entity without hindrance. You have the right to request that we disclose to you the following information in respect of our collection and use of your Personal Information over the past 12 months:
- The categories of Personal Information we collected about you.
- The categories of sources for the Personal Information we collected about you;
- Our business or commercial purpose for collecting or selling your Personal Information;
- The categories of third parties with whom we share your Personal Information;
- The specific pieces of Personal Information we collected about you;
- If we sold or shared your Personal Information for a business purpose, including separate lists for
- disclosures for a business purpose, identifying the Personal Information categories disclosed; and
- sales, identifying the Personal Information categories sold and that each category of recipient purchased.
- Correction: You may request correction of your Personal Information that we have collected about you if it is inaccurate or incomplete.
- Deletion: You may request deletion of your Personal Information that we have collected about you, subject to certain exceptions.
- Right to Opt Out of Sharing, Disclosure, or Sale of Personal Information: You have the right to direct us to not share, disclose, or sell your Personal Information. You may submit such requests via the “Do Not Sell or Share My Personal Information” link on our websites or other ways as described in this Privacy Notice. Once we receive your request, we will ensure that your Personal Information is not sold to or shared with third parties.
- Right to Non-Discrimination: You have the right not to be discriminated against for exercising your data subject rights. We will not discriminate against you for exercising your data subject rights.
- Right to Restrict or Limit the Use of Sensitive Personal Information: You have the right to restrict the use and disclosure of Sensitive Personal Information to certain purposes related to the offering of goods or services as listed in the CPRA.
Exercising Your Rights
To exercise your rights described above, please submit a verifiable consumer request to us by:
- Emailing us at dpo@signanthealth.com
We may ask you to provide information that will enable us to verify your identity in order to comply with your data subject request. In particular, when a California or Connecticut consumer authorizes an agent to make a request on their behalf, we may require the agent to provide proof of signed permission from the consumer to submit the request, or we may require the consumer to verify their own identity to us or confirm with us that they provided the agent with permission to submit the request. You may also make a verifiable consumer request on behalf of your minor child. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.
The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Personal Information.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with your Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us.
We will only use the Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision, and we reserve the right to either refuse to act on your request or charge you a reasonable fee to complete your request if it is excessive, repetitive, or manifestly unfounded.
You may have a right to appeal a decision we make relating to requests to exercise your rights under applicable local law. If your request is denied or if we do not take action on your request, we will inform you in writing of the reasons for not taking action, as well as provide an explanation of any rights you have to appeal the decision.
Changes to this Supplemental Notice
We reserve the right to amend this Supplemental Notice at our discretion at any time. When we make changes to this Supplemental Notice, we will post the updated Notice on our website.