Privacy Notice

Introduction

Lindus Health and its affiliates, subsidiaries, and related entities (“Lindus Health,” “we'', “our”) is committed to protecting the privacy and security of the personal information we collect about end customers and users of our services (“you/your”).

We are further committed to ensuring we meet our legal obligations when processing your personal information under the relevant Data protection Laws, which include but are not limited to:

●      the California Consumer Privacy Act (“CCPA”).
●      the Canadian Personal Information Protection and Electronic Documents Act(“PIPEDA”).
●      the Colorado Privacy Act ("CPA").
●      the Connecticut Data Privacy Act ("CTDPA").
●      the Utah Consumer Privacy Act ("UCPA").
●      the Virginia Consumer Data Protection Act ("VCDPA").

The purpose of this privacy notice is to explain what. personal information we collect about you and how we use it.

Please read this privacy notice carefully as it provides important information about how we handle your personal information and your rights. If you have any questions about any aspect of this privacy notice you can contact us using the information provided below, or by emailing us at: data@lindushealth.com.    

What is personal information and what do we collect?

Personal information means information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, photographs, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.

We may also collect, store, and use sensitive personal information which is a specific subset of personal information. This subset of personal information can include certain government identifiers (such as social security numbers), financial account details, contents of mail, email and text messages, biometrics and information concerning an individual’s health or sexual orientation, or information about racial or ethnic origin, religious or philosophical beliefs, or union membership.

However, we will only collect the personal information outlined in the Informed Consent Form and/or Participant Information Sheet and/or HIPAA Authorization Form. This documentation will have been provided to you by the study team, please refer to it for more information on the types of information we may collect as part of this study.

How we collect your personal information

We collect most of the personal information directly from you in person, by telephone, text, or email and/or via our website.
For example, we may have collected your personal information directly from you aspart of the recruitment process, via our online contact/registration form, or from our email correspondence with you.

We will continue to collect personal information about you for the duration of the study trial.

Purposes for processing

Most commonly, we will use your personal information in the following circumstances:

  • Where it is necessary for the purposes of facilitating your participation in the study/trial
  • To respond to correspondence from you
  • In the provision of our services to a study sponsor
  • Improving our internal systems and/or website 
  • Where we need to comply with a legal obligation
  • When processing is necessary for a business purpose pursuant to this notice or the reason for collection
  • To carry out post study surveys
  • We may also use your data in the following situations:
  • Where it is needed for the establishment, exercise, or defence of legal claims.
  • With your consent

Where we need to use medical protected health information, this will only be done where the participant or their Legally Authorized Representative has signed and/or agreed to the study-specific HIPAA Authorization Form (note this may form part of the Informed Consent Form), or in the instance where an Institutional Review Board (IRB) has approved the use of a waiver to HIPAA Authorization. 

Sharing your information

By signing the informed consent form, or in the case of a waiver of informed consent approved by the IRB by participating in the trial, you consent to your personal information being shared with the trial site and Sponsor and/or the contracted provider working on the trial. 

We may also disclose your information to third parties in connection with other purposes set out in this privacy notice. These third parties may include:

  • Business partners, suppliers and sub-contractors who may process information on our behalf.
  • IT service providers

We will only share (‘share’ includes making available remotely) personal information with third parties where we have a contract in place that contains the required provisions to facilitate such transfers.

We do not sell or share personal information to another business or third party for monetary or other valuable consideration.

International transfers

We may disclose your personal information to  third-party service providers and/or business partners located outside the  U.S. for the purposes indicated in this privacy notice. Some of these  third-party service providers may include cloud-based storage providers who  may store and process personal information in the cloud.

Where we make such disclosures, we have taken reasonable steps to  ensure that any overseas recipients do not breach the relevant state  legislation in relation to any personal information. We have carried out a  thorough due diligence process and have imposed relevant contractual  obligations on any offshore recipients to ensure compliance.

By participating in the study, you accept that Lindus Health may transfer your personal information outside of the US where necessary.

How long we keep your information

We will retain your personal information for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims. 

At the end of the retention period, your personal information will be securely deleted or anonymised, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis, business planning and/or product development.

How we protect your information

We  implement appropriate technical and organisational measures to protect data  against unauthorised or unlawful processing and against accidental loss, destruction or damage.

In addition  to the technical and organisational measures we have put in place, there are simple things you can do to in order to further protect your personal  information, such as:  

1. Never share One Time Passcodes (OTPs).
2. Never enter your details after clicking on a link in an email or text message.
3. Always send confidential information by encrypted email to reduce risk of interception.  
4. If you’re logged into any online service do not leave your computer unattended.
5. Close down your internet browser once you’ve logged off.
6. Never download software or let anyone log on to your computer or devices remotely, during or after a cold call.
7. You can  easily identify secure websites by looking at the address in the top of your  browser which will begin https:// rather than http://.

Your rights and options

We will always ensure, no matter where you are located in the world, that we adhere to and fully respect your data protection rights. In the US, you have the following rights:

  • Right  to know - You  can request that we disclose to you: (1) the categories and/or specific  pieces of personal information we have collected about you, (2) the  categories of sources for that personal information, (3) the purposes for  which we use that information, (4) the categories of third parties with whom  we disclose the information, and (5) the categories of information that we  sell or discloses to third parties. You can make a request to know up to  twice a year, free of charge.
  • Right to delete  - You can request that we delete personal information we have collected from  you and tell our service providers to do the same, subject to certain  exceptions (such as if  we are legally required to keep the information).
  • Right  to opt-out of sale or sharing  - You  may request that we stop selling or sharing your personal information (“opt-out”),  including via a user-enabled global privacy control. We cannot sell or share  your personal information after we receive your opt-out request unless you  later authorize us to do so again. Thisis covered under the ‘sharing your information’ section.
  • Right  to correct - You may ask us to  correct inaccurate information that we have about you.
  • Right to limit use and disclosure of sensitive personal information - You can direct us to  only use your sensitive personal information (for example, your social  security number, financial account information, your precise geolocation  data, or your genetic data) for limited purposes, such as providing you with  the services you requested.

We do not make significant decisions based solely on automated processing nor do we disclose sensitive personal information for purposes which would require us to offer you the right to limit.

If you  exercise one of the above rights, we may need to request some additional  information from you to help us confirm your identity and/or that you are  entitled to make such a request. This confirmation is required to avoid  personal information about one individual being sent to another, either  accidentally or because of deception.

Once we are satisfied with the above, in most cases, we will process any rights requests received straight away. However, in certain circumstances there may be a  legal requirement or administrative reason to deny your request. In these  circumstances, we will ensure that we advise you fully and explain our  reason(s) for the refusal.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. If you wish to exercise your rights, please contact us at data@lindushealth.com.

Children's privacy

Lindus is  committed to complying with the Children’s Online Privacy Protection Act  (COPPA) and to protecting the online privacy of children under the age of 13.  

In certain circumstances, during the provision of our services, we may process the personal information of children under the age of 13. However, we do not knowingly collect personal information of children without parental consent, unless permitted by law. If you are a child under the age of 13, you must have your parents’ permission before providing us with your information. If you learn that a child has provided us with their personal information without parental consent, you may contact us as described below. If appropriate, we will securely and permanently delete the information from our systems.

Contact us

If you have any questions, or wish to exercise any of your rights, then you can contact:

Lindus Health
2nd Floor, 90 Union Street
London
SE1 0NW
United Kingdom

Alternatively, you can email us at data@lindushealth.com

We have also appointed an external Data protection Officer (“DPO”). Our DPO is Evalian Limited and they can be contacted by using the above email or postal address. Please send your communication clearly indicating ‘FAO the ‘Data Protection Officer’, and your message will be passed to Evalian Limited for attention.

How to complain

You have the right to lodge a complaint with your State Supervisory Authority if you are concerned about the way in which we are handling your personal information, or if you feel that we are infringing data protection law.

Changes to this privacy notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify you of the changes where required by applicable law to do so.