Healthcare Professional Privacy Notice
1.Introduction
This Privacy Notice (this “Notice”) is made available by AvenCell Therapeutics (also referred to as AvenCell) and its affiliated entities to all Healthcare Professionals (HCP) we engage with (“you”, “your” or “user”). This Notice is intended to assist (i) HCPs and (ii) HCPs acting as a representative or contact person for a healthcare organisation (HCOs) in understanding how we collect, process, secure, and transfer your Personal Data. We also describe how you can contact us to learn more information about our privacy practices.
2. Link with other Privacy Notices
Other individuals interacting with AvenCell (job applicants/ candidates, vendors and business partners) are provided with separate information about how we handle their personal information. For example, AvenCell maintains a website Privacy Notice, available at: https://avencell.com/privacy-policy/
It is important that you read this Notice together with any other privacy notice that we may provide you with so that you are fully aware of how and why we are using your data. This Notice supplements any other privacy notices and privacy policies that we may provide to you and is not intended to supersede them.
3. Definitions
For the purposes of this AvenCell HCP Privacy Notice:
Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
Aggregated Data means summarised data derived from your Personal Data. Examples are statistical or demographic data. It is not considered Personal Data in law as this data will not directly or indirectly reveal your identity.
AvenCell Therapeutics (referred to as either “AvenCell”, “the Company”, “We”, “Us” or “Our” in this Agreement) refers to AvenCell Therapeutics, Inc. 500 Forge Road Watertown, MA 02472 USA
Data Controller, for the purposes of EU GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data. For the purpose of EU GDPR, the Company is the Data Controller.
Data Processor, for the purposes of EU GDPR, refers to the Company’s Service Providers.
Data Protection Legislation, if the processed data belongs to people in the European Union, this means the General Data Protection Regulation (Regulation (EU) 2016/679) (‘EU GDPR’) as well as any local data protection implementation laws. This includes any replacement legislation coming into effect from time to time.
Personal Data is any information that relates to an identified or identifiable individual.
For the purposes of EU GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.
Process (or “Processing”) means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether by automated means, such as collection, use, and erasure.
4. Who we are
AvenCell is the Data Controller and is responsible for the processing of your Personal Data.
5. The data we collect about you
Clinical trial regulations such as those associated with the ICH/GCP Guidelines and those adopted by local jurisdictions oblige the Sponsor and those acting on the Sponsor’s behalf to collect personal data from individuals who participate in the conduct of a clinical trial to prove their qualifications.
The personal information you provide will become part of the clinical trial databases and paper files as needed for the implementation, performance and record-keeping (archiving) of the study.
AvenCell will collect and may utilize your Personal Data for the purposes described below:
Category of Data | Purpose for Data Processing |
Contact details (example: your name, nationality, postal address, telephone number, e-mail address) |
|
Compensation Information (example: bank account details, financial information, salary and expenses details) |
|
Employment history (example: job titles, location of employment/workplace, employment history, working hours) |
|
Professional Credentials (example: training records, qualifications and professional memberships) |
|
Research-Related Data (example: research interests and output) |
|
We also collect, use and share Aggregated Data for various purposes. For example, your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Notice.
We may receive information about you from other sources including business partners, third parties, affiliates, and publicly available information.
6. Legal basis for processing your Personal Data
We process your Personal Data using the follow lawful bases:
- Processing necessary for the purpose of the legitimate interests pursued by AvenCell to conduct its business (including for research and development of new medicines creating value for people living with diseases in AvenCell’s therapeutic areas of interest), to manage our human and financial resources efficiently and for internal reporting purposes.
- To comply with legal and regulatory obligations, including assessment of your potential participation in the study and/or the participation of the investigative site by reviewing your eligibility and qualifications and conducting screening measures or to support applications for approval of the product under investigation.
- To establish, exercise or defend our legal rights and/or for the purpose of (or in connection with) legal proceedings (including for the prevention of fraud).
- With your consent (for example, collecting your ethnicity information for DEI reporting purposes, where required). Where we do rely on your consent, you have the right to withdraw it at any time in the manner indicated when your consent was provided.
- Processing necessary for performance of a contract with you, including maintaining a professional relationship with you, payment of salary and expenses, managing your participation in the clinical trial, and/or in order to take steps at your request prior to entering into a contract.
Providing your Personal Data to AvenCell is voluntary but it is necessary if you are to take part in any of our clinical trial activities. Should you choose not to provide your Personal Data to us, your interaction with us may be adversely impacted, you cannot take part in any of our clinical trial activities, and we will not be in a position to perform a contract with you.
7. Disclosures of your Personal Data
Where necessary to fulfil the purposes described in this Notice, AvenCell may disclose your Personal Data to third-parties. Not all of these parties are located in the country where the clinical trial is conducted. AvenCell may therefore transfer your Personal Data to locations outside of your country of residence for the purposes described in this Notice.
Whenever AvenCell shares your Personal Data with third parties, such as companies acting as our authorised agents and service providers, these companies agree to use your Personal Data only for specified purposes and upon our instructions. Furthermore, the recipient will implement and maintain reasonable security procedures and practices appropriate to the nature of your information to protect your Personal Data from unauthorised access, destruction, use, modification or disclosure.
We will transfer and disclose your Personal Data to the following categories of recipients where it is lawful to do so, and subject to the implementation of appropriate safeguards:
Category of Third-Party | Purpose for Disclosure |
Our Subsidiaries and affiliated entities |
|
Service Providers who work for, or provide services to us (including their employees, sub-contractors, officers, such as IT systems providers and IT contractors, payroll and HR system providers, employee expense management providers, pension administration / providers, benefits providers). |
|
Cloud storage solutions |
|
Law enforcement, government, courts, regulators, governmental or quasi- governmental organisations, tribunals and arbitrators. |
|
Professional Advisors, such as insurers, accountants, auditors or lawyers |
|
Other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents. |
|
Any prospective or new AvenCell companies (e.g. if we restructure, or acquire or merge with other companies) or any businesses that buy part of or all of AvenCell (including the rights to the study drug and all related data) to other AvenCell |
If this occurs the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice. |
Potential or future employers |
|
Other researchers, research institutions, collaborators, licensees, and strategic partners |
|
8. International cross-border data transfers
Because AvenCell operates globally, your data may be transferred outside of the country in which you interact with AvenCell, including to countries whose data protection laws substantially differ from the country in which you work or reside and may not provide the same level of data protection as in your country of residence. To accomplish the purposes described in this Notice, we may also disclose and transfer Personal Data to personnel and other departments throughout AvenCell, or to service providers and/or collaborators, licensees and strategic partners based overseas, to the extent that your Personal Data is shared with service providers, AvenCell affiliates or other third parties processing Personal Data on our behalf, which are located outside your country of residence.
For example, your Personal Data may be transferred or accessed by AvenCell and its affiliate entities in the United States of America.
AvenCell shall seek to maintain confidentiality as required within the limits of local laws in these countries.
Whenever we are required to transfer your Personal Data out of EEA, we ensure that at least one of the following safeguards is implemented:
- transferring your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission.
- using specific contracts approved which give Personal Data the same protection it has in Europe including standard data protection clauses approved by the European Commission.
Please contact us on Dataprotection.eu@avencell.com if you want further information on the specific mechanism used by us when transferring your Personal Data out of the EEA.
9. Data security
AvenCell will implement appropriate technical and organizational security measures necessary to adequately safeguard your Personal Data. These safeguards will include, for example:
Security Measures
- Access to Personal Data is restricted and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need-to-know.
- All employees handling Personal Data receive security and data protection awareness training, will only process your Personal Data on our instructions and are subject to a duty of confidentiality.
- Employees with access to Personal Data are given the least privilege required.
- We have robust procedures in place to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
- A disciplinary policy is enforced to prevent unauthorised access.
- Where technically feasible, data is encrypted in transit and at rest.
10. Data retention
We will only retain your Personal Data for as long as required under applicable local, state, national and/or international laws, rules and/or regulations, which may be for a period of up to 25 years (or longer if required by law) after completion of the clinical trial and to fulfil the purposes we collected it for, including for the purposes any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event where we receive a complaint and we reasonably believe there is a prospect of litigation in respect to our relationship with you, or there is an investigation and proceedings.
To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Where we do not have a reason or legal obligation to retain your Personal Data, it will be deleted in accordance with the relevant section of our Data Protection Policy.
In some circumstances you can ask us to delete your data: see your legal rights below for further information.
In some circumstances we will anonymise your Personal Data (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use and retain this information indefinitely without further notice to you.
11. Your legal rights
Subject to certain limitations and exclusions under applicable laws, you may be entitled to contact us and request to exercise your rights in respect of your personal data. You may have the right to request confirmation as to whether AvenCell is processing your Personal Data, and if so:
- To request information relating to the categories of data involved, purposes of processing, recipients of your data, retention periods/criteria, and your rights as a Data Subject.
- To request access to your Personal Data that AvenCell is processing.
- To request AvenCell rectifies any inaccurate or incomplete Personal Data that AvenCell is processing about you.
- To request erasure or restriction of processing of any Personal Data that AvenCell is processing about you, subject to certain exceptions.
- To obtain a copy of your Personal Data in a commonly-used and machine-readable format and have it ported to another data controller.
- To object to the processing of, your Personal Data in certain circumstances.
- To request your information not be sold or otherwise disclosed to a third-party.
- To lodge a complaint with your local Data Protection Authority or Supervisory Authority.
To exercise any of the rights described above, please email Dataprotection.eu@avencell.com with a description of your request.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.
12. Changes to the Notice
We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact AvenCell for more information.
13. Your duty to inform us of changes
It is important that the Personal Data we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.
14. Providing Company with other people’s data
If you give us any Personal Data that does not relate to you (e.g., information about your next of kin/dependants), you must ensure that you have the required legal basis to collect and share their Personal Data. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this Notice. You must also tell them how they can see what information we have about them, correct any mistakes or request copies of their information.
15. Questions
If you have any questions about this Notice, the use of your data, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.
By email: Dataprotection.eu@avencell.com
By telephone: +49 351 4466-45046
By post: AvenCell Europe GmbH, Tatzberg 47, 01307 Dresden, Germany
You have the right to make a complaint at any time to the Supervisory Authority in the EU member state where you reside. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority so please contact us in the first instance.