Version: 2
Effective Date: 11 October 2024
Last Reviewed: 15 August 2024
INTRODUCTION
This privacy notice is provided by MDE Services Group Limited and our affiliates (“We/Us/Our”). We specialise in solutions which support the effective delivery of clinical trials. Services include personalised travel and logistics and expense reimbursement.
This notice describes how we as a data Controller, collect, use, and manage the Personal Data we hold about you, including how the Personal Data may be shared and how the confidentiality of Personal Data is maintained.
We share and process your Personal Data with certain third parties as described in the “Data Sharing and Transfers” section below. Full details of our Affiliates can be found at section 1.13.
The “At a Glance” section contains some very important information that will help explain what Personal Data we process and why. Capitalised terms used in this notice are defined in Personal Data Types (section 1.12) and Affiliates (section 1.13).
AT A GLANCE
1.1 When do we collect Personal Data?
When we refer to Personal Data in this notice, we mean information that can or has the potential to identify someone as an individual user, caregiver or participant or user of the primarius Ecosystem including the primarius Patient Mobile App, Site Portal or Client Portal.
We will collect and process Personal Data about an individual at the following stages:
| Stage | Description |
|---|---|
| User Creation | The purpose of this is for the primarius user administration team to engage with users and to help enrol them into our services by completing and returning the appropriate documentation to us. |
| Service Delivery & Support | We may collect information relating to your access to the system, reimbursement, patient and caregiver support, and also your details when raising support tickets. |
1.2 What Personal Data may we collect from you and why?
Site or Client Portal User:
During this stage, we largely rely on ‘Contractual Necessity’ to process an individual’s Personal Data.
| Stage | Description |
|---|---|
| Personal Identifiers Client/Site Contact Details Client/Site Email | To provide the minimum personal information to create and administer your access to the system. |
| User Creation | The purpose of this is for the primarius user administration team to engage with users and to help enrol them into our services and respective platform by completing and returning the appropriate documentation to us.1.2 What Personal Data may we collect from you and why? |
Patient and Caregiver Service Delivery:
During this stage we will largely rely on ‘Contractual Necessity’ to process your Personal Data apart from Personal Data marked with a (#) below where we will rely on ’Compliance with a Legal Obligation’. The following information is gathered with and without utilisation of the primarius Patient Mobile App.
| Data Category | Reason For Processing |
|---|---|
| Personal Identifiers Contact Details Personal Information User Credentials | To carry out our obligations to you arising from any contract. Responding to queries and everyday needs. |
| Personal Identifiers Contact Details Personal Information User Credentials | To Assess the quality and type of service received and to investigate any concerns or complaints that may raise. |
| Personal Identifiers Contact Details Personal Information User Credentials | For internal record keeping and administration. |
| Personal Identifiers Contact Details Personal Information User Credentials | To administer App and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. To allow individuals to participate in interactive features of our service, when they choose to do so. |
| Personal Identifiers Contact Details Personal Information User Credentials | For the purposes of internal and external audit and accounting purposes together with the preparation and review of management information. |
| Personal Identifiers Contact Details | For the purposes of completing banking transfers for payment of reimbursements and/or stipends. This information is internal only for processing purposes. |
For further details of the Personal Data types contained within each category please refer to the Personal Data Types which can be found in section 1.12.
Any decision to provide any Personal Data described above to us is voluntary. If individuals choose not to provide any of the Personal Data requested or do not consent, we may not be able to provide them with our services and we may be prevented from complying with our legal obligations.
FURTHER DETAILED INFORMATION
1.3 Data sharing and transfers
In the usual course of business, we may disclose Personal Data to (i) our Affiliates, and (ii) certain third-party processors we have retained to perform services on our behalf and pursuant to our instructions. This
may include sharing with:
- Affiliates for the provision and delivery of services, IT application support, internal audits and
investigations, quality control, program monitoring, management reporting and other internal
purposes. - Affiliates to deal with any legal and compliance matters, providing assessment results, for record
keeping, internal audit, reviews, management information, operational, administrative purposes. - Auditors, lawyers, accountants, consultants, and other professional advisors.
- Business partners, suppliers, and sub-contractors for the provision of the contracted services such as
travel companies and airlines. - Organisations providing IT systems support and hosting in relation to the IT systems on which your
Personal Data is stored. - Our card and payment provider, B4B, to allow us to process payments to individuals.
- Third parties in connection with a disposal of assets, restructuring, merger or sale activities.
Where a third-party data processor is used, we ensure that they operate under contractual restrictions regarding confidentiality and security, in addition to their obligations under data protection laws.
We may also disclose your Personal Data (iii) if we are required to do so by law or legal process, or (iv) in response to lawful requests from public authorities, including to meet national security, public interest, or law enforcement requirements. We also reserve the right to transfer Personal Data in the event of an audit or if we or any of our Affiliates sell or transfer all or a portion of their business or assets (including in the event of a merger, acquisition, joint venture, reorganisation, dissolution, or liquidation).
1.4 Third country data transfers
Due to the global nature of our operations, we may transfer the Personal Data we collect about you to recipients in countries other than the country in which your Personal Data originally was collected. For example, we may disclose Personal Data to our Affiliates based in the U.S. or other offices worldwide.
Where we transfer the Personal Data to a country which may not have the same data protection laws as the country in which they were initially provided (such as the U.S.), each such party will protect that Personal Data as described in this Privacy Notice and will comply with applicable local legal requirements providing adequate protection for the transfer of Personal Data to recipients in countries other than the one in which you provided the Personal Data.
Where Personal Data is transferred to a country that does not have adequacy, we have implemented appropriate safeguards to ensure an adequate level of data protection, including by concluding data transfer agreements incorporating the European Commission’s Standard Contractual Clauses under Article 46 of the GDPR.
You may contact the Privacy Office as indicated below to obtain further information on the transfer mechanism.
1.5 Health information collected during the provision of services
Special category data will not be collected by us in order to provide you with our services.
1.6 How we protect Personal Data
We maintain appropriate technical and organisational measures designed to protect Personal Data against loss or accidental, unlawful, or unauthorised, alteration, access, disclosure, or use.
1.7 Retention period
We retain Personal Data for as long as we reasonably require it for legal and business purposes. In determining data retention periods, we also take into consideration local laws, relevant regulations, and the contractual obligations or instructions that are specifically given by the study sponsor.
1.8 Data subject rights
At any point while we are in possession of or processing Personal Data, you have the following rights:
- Right of access – the right to request a copy of the Personal Data that we hold about you. We reserve
the right to charge a reasonable fee based on our administration costs where further copies are
requested. - Right of rectification – the right to correct Personal Data that we hold that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can request the Personal Data we hold about you
to be erased from our records. - Right to restriction of processing – where certain conditions apply you have the right to request that we
restrict the processing. - Right of portability – in certain circumstances you have the right to have the Personal Data we hold
about you transferred to another organisation. - Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right to object to automated processing and profiling – you have the right to object to automated
processing and profiling.
All the above requests will be forwarded on should there be a third party involved in the processing of the Personal Data.
If you would like to exercise any of your data subject rights, please contact us using one of the methods highlighted below.
1.9 Cookies
We may use cookies to distinguish the user from other users of our Website, App, App Site or App store. This helps us to provide a good experience when individuals browse our website, use the Apps, and also allows us to improve our services.
1.10 Contact Information
Any questions about this notice or the processing of Personal Data by us or any of our Affiliates, should be directed to the Privacy Office:
- By email at [email protected] or
- By writing to us at Privacy Office, mdgroup, Building 329, Doncastle Road, Bracknell, Berkshire, RG12 8PE United Kingdom
1.11 Complaints
If you wish to make a complaint about how your Personal Data is being processed by us (or third parties as described in 1.3 & 1.4 above) you should contact the Privacy Office at the address detailed above.
If you are not satisfied with how your complaint has been handled, you have the right to lodge a complaint directly with the relevant supervisory authority.
The UK regulator can be contacted at the Information Commissioners Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Tel 0303 123 1113.
1.12 Personal Data types & items which may be processed
| Data Type | Data Items |
|---|---|
| Personal Identifiers | your name, e-mail address and phone number, the device’s phone number, username, password and other registration information. |
| Contact Information | Name Address Telephone |
| Special Category Data | N/A |
| Third Party Information | Site Details Study Name |
| Other Information | Operating System & Version IP Address & approximate geographical location App Access Dates & Times Date of Time of System access Details of Access logs and events |
1.13 Affiliate
In relation to MDE Services Group Limited or any Affiliate, any subsidiary or holding company of that entity and any subsidiary or holding company of that entity.
| Jurisdiction | Company Name | Company Number |
|---|---|---|
| UK | MDE SERVICES GROUP LIMITED | 09954663 |
| UK | MDE HEALTHCARE SERVICES LIMITED | 05450419 |
| UK | PATIENT PRIMARY LIMITED | 10372696 |
| UK | MDE TRAVEL LIMITED | 09954028 |
| IRELAND | MDE HEALTHCARE SERVICES EUROPE LIMITED | 604758 |
| USA | MDE TRAVEL U.S. LIMITED | 201914174 |
| USA | MDE HEALTHCARE SERVICES, INC | 4109251 |
| SINGAPORE | MDE HEALTHCARE SERVICES PTE. LTD | 201529133k |
| HONG KONG | MDE HEALTHCARE SERVICES HONG KONG LIMITED | 1808783 |
| USA | MDE Horreum, Inc. | 6207778 |
| USA | Seacole Health, Inc | 6042198 |
| UK | Seacole Health, Ltd | 10247381 |
| UK | MDE Horreum Ltd | 13329821 |
| NETHERLANDS | MDE Horreum, BV | 83089098 |
| FRANCE | MD HEALTHCARE SERVICES FRANCE SAS | 897 1 751 |
1.14 Lawful Basis of Processing
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
1.14.1 Consent
N/A
1.14.2 Contractual Necessity
Article 6 of the GDPR states that we can process Personal Data on the basis that such processing is necessary to enter or perform a contract.
The ’Contractual Necessity’ lawful basis permits the processing of Personal Data in two different scenarios:
- Situations in which processing is necessary for the performance of a contract to which you are a party. This may include, for example, processing your financial details for the reimbursement of claims.
- Situations that take place prior to entering a contract such as pre-contractual relations.
1.14.3 Compliance with a Legal Obligation
Article 6 of the GDPR states that we can process Personal Data on the basis that we have a legal obligation to perform such processing. Processing is permitted if it is necessary for compliance with a legal obligation.