Effective On:December 22, 2021
Last Modified On:December 22, 2021
SymBio Pharmaceuticals Limited. ("SymBio", "we", "us", "our") takes the protection of your personal information ("Personal Data") very seriously. Personal Data is any information about you that can be used to identify you as a person. This Privacy Notice (this "Notice") describes how we use your Personal Data when we conduct clinical trials (a "Trial" or the "Trials").
SymBio as Sponsor of the Trial listed below, is the "data controller" for your Personal Data. This Notice is meant to help you understand what information we collect when you agree to be part of one of our Trials, why we collect it, and your rights. We are required to give you this information in order to comply with the privacy law, including Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR) and the GDPR in such form as incorporated into the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018 and any regulations thereunder, and the UK Data Protection Act 2018 (the "UK GDPR").
This Notice does not apply to Personal Data we collect by other means, like Personal Data that we receive directly through our public website (https://www.symbiopharma.com/). This Notice also does not apply to Personal Data of our employees, job applicants and contractors.
2. Current Scope
SymBio Pharmaceuticals Limited has begun a study of an investigational drug (also known as the "study drug") called brincidofovir as a possible treatment for adenovirus (a common type of virus) infection. If you have consented to be a part of this Trial, or you are an investigator or other site personnel involved in this trial, we will use and protect your Personal Data as described below.
The current Trial is called "A Phase IIa, Open-label, Multiple Ascending Dose Confirmation Study of the Safety and Tolerability of Intravenous Brincidofovir in Subjects with Adenovirus Infection"
The Informed Consent Form ("ICF") you or your parent signed in order to be a participant in this Trial also contains information about your privacy rights. Each ICF may have slightly different terms to account for different rules in the jurisdictions in which we conduct Trials. If there is a conflict between a part of this Notice and what is in the ICF you signed, the terms in the ICF will control (meaning they are the terms that will apply to the processing of your data).
Within the scope of this Notice, SymBio acts as a data controller for the Personal Data we collect, use and process ("process"). This means that we determine the purposes and the means of the processing of Personal Data.
However, we do not have direct access to Trial patients' identifiable Personal Data, meaning that we are typically unable to directly identify Trial patients pursuant to Good Clinical Practice Guidelines. Your Personal Data is collected by the clinical research organization (CRO) assisting us with the Trial, the Trial site (the doctor's office, clinic, hospital, or other healthcare facility where the Trial is being conducted), or other third parties, such as your primary care doctors. When any information relating to Trial patients is shared with us, it will be key-coded (also known as "pseudonymized") so that you will not be identified by any direct personal identifier.
4. Basis of Processing
Before, during, and after each Trial, we will process your Personal Data for various purposes. In each case, we will rely on an appropriate lawful basis for processing your Personal Data. We will only process your sensitive Personal Data (like health and genetic data) when allowed by law.
5. How We Receive Personal Data
In the context of this Notice, we collect your Personal Data only from the following sources:
6. Categories of Personal Data
SymBio or its service providers, including the CRO, may have access to and process the following types of Personal Data about Trial participants (in pseudonymized or key coded-form, meaning it will not be associated with your or your child's name):
Your or your child's name may be viewed by one of our service providers, like the CRO, when they are acting to ensure or verify the accuracy of records involved in the trial, but that information will never be copied into any system that we have access to and will not be made available to us.
SymBio may collect and process the following types of Personal Data about Trial personnel:
7. Purpose of Processing
We will process Trial patients Personal Data for the purposes of:
We also process your Personal Data for the specific purposes described in the ICF provided to you by Trial personnel.
We will process Trial personnel Personal Data for the purposes of:
8. Data Retention
SymBio will keep your Personal Data until we fulfill the purposes listed above, or for as long as required by applicable law.
Our Trials are long-term. We use them to track the effects of test medications using information collected from Trial participants like you. This means we will need to keep your Personal Data for a long time. However, in order to protect your privacy, the information of every Trial participant is "key-coded" before we enter it into the studies and reports. This means that we replace identifying information like your name and contact information with a code number.
To the maximum extent permitted by law, once your data has been key-coded and recorded in official Trial documents, we cannot remove it without affecting the accuracy of the studies and test results. For example, European law requires us to keep Personal Data that is part of the clinical trial master file for at least twenty-five years after the conclusion of the applicable Trial. Other laws may require different retention periods.
9. Sharing Personal Data with Third Parties
We will share your Personal Data with service providers who process Personal Data on our behalf and who agree to use your Personal Data only to assist us in conducting our Trials or as required by applicable law.
We may share your Personal Data with the contracted research organization for Trial operations, with the laboratories involved in analysing the medical data involved in the Trial, with service providers involved in evaluating drug safety and efficacy, and with cloud-based software providers, providers of medical software, hosting, data analytics, and other service providers who host the platforms used to facilitate the Trial.
We require that all of these service providers protect your Personal Data, including through the adoption of adequate security measures, and use the data solely to provide the services to us.
We will also share your Personal Data with other third parties involved in the Trials. Some of these third parties are data controllers in their own right, meaning they also may determine the purpose or means of collecting or using your data for their own purposes. They will have their own privacy notices to govern their collection, use, and protection of your data. These third parties include clinical sites like hospitals and medical offices, and public government agencies.
We may share your Personal Data with certain regulatory agencies who oversee the conduct of clinical trials, including the United States Food and Drug Administration ("FDA"), the European Medicines Agency ("EMA") and the Medicines and Healthcare products Regulatory Agency ("MHRA"), and the Japanese Pharmaceuticals and Medical Devices Agency ("PMDA") as required to comply with certain reporting and regulatory obligations or in the context of future research. If we have to disclose your Personal Data to a government or law enforcement authority, we may not be able to ensure that those officials will protect your Personal Data to the same standard as we require in our contracts with our service providers.
10. Data Transfers
Some of these service providers and other third parties are located outside of the UK and European Union, for example, in the United States and Japan. Therefore, your Personal Data may be processed outside your jurisdiction and in countries not subject to an adequacy decision by the European Commission or your local legislature and/or regulator, and that may not provide for the same level of data protection as your jurisdiction.
We ensure that the recipient of your Personal Data offers an adequate level of protection, for instance, by entering into appropriate data protection agreements and where required, the European Commission-approved standard contractual data protection clauses.
11. Other Disclosure of your Personal Data
We may disclose your Personal Data:
12. Data Integrity & Security
We have put in place, and have required our service providers to put in place, technical, administrative, and physical measures that are designed to help protect your Personal Data from being accessed, disclosed, altered, or destroyed by unauthorized people. These measures include the use of measures like key-coding and encryption, where appropriate. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know and are subject to confidentiality obligations.
13. Your Privacy Rights
You have specific rights regarding your Personal Data that we collect and process.
For Trial Participants: to exercise the rights we explain below, please first speak with your study doctor instead of contacting us directly.
If we process your or your child's Personal Data, you will have the right to request access to (or to update or correct) that Personal Data. You may also have the right to ask that we limit our processing of your Personal Data, as well as the right to object to our processing of your Personal Data. You may also have the right to data portability, which means that you may have the right to ask us to provide you with a copy of your Personal Data that another company like SymBio can process.
To submit these requests or raise any other questions, please contact us by using the information in the "Contact Us" section below. You may also have the right to lodge a complaint with a data protection regulator in your applicable jurisdiction
14. Data About Children
We obtain parental or legal guardian consent before processing Personal Data about children.
15. Changes To This Notice
If we change this Notice, we will provide you with a copy of the revised Notice or update the web page you read it on. We will also update the "Last Modified" date.
16. Contact Us
If you have any questions about this Notice or our processing of your Personal Data, please first speak with your study doctor. You may also contact our Data Protection Officer (DPO) at firstname.lastname@example.org or at the contact information provided below. Upon receipt of your request, please allow up to one month for us to reply.
17. Data Protection Officer
We have appointed VeraSafe as our Data Protection Officer (DPO). Please contact VeraSafe on matters related to our use of your Personal Data. VeraSafe's contact details are:
100 M Street S.E., Suite 600
Washington, D.C. 20003
18. United Kingdom Representative
We have also appointed VeraSafe as our representative in the United Kingdom ("UK"). While you may also contact us, please contact VeraSafe on matters related to the processing of Personal Data. To contact VeraSafe, please use this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at :+44 (20) 45322003.
VeraSafe can also be contacted by mail at:
VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL