Privacy policy and GDPR compliance
This Privacy Policy outlines Fondation Force general policy and practices for complying with the applicable EU General Data Protection Regulation 2016/679 (GDPR), including the types of personal data we process, the reasons and the legal basis for that processing, the technical and security measures that we apply and the rights that individuals have under GDPR. This Privacy Policy applies to all personal information (as these are defined under the GDPR) of natural persons received by us, whether in electronic, paper or verbal format.
1. Types of personal data that Fondation Force processes, purposes and legal basis of processing
a) Clinical and Medical Information
As a global CRO, we collect, host and analyze health data relating to clinical trial subjects, on behalf and according to the directions of our clients/sponsors. To enhance privacy and consistent with Good Clinical Practice, subjects’ names and other direct identifiers are not attached to any records collected and archived by Fondation Force ( e.g. at the CRF documents). Instead, subjects are only identified by a code. Only study doctors and authorized Fondation Force personnel (monitors) may access the complete, named, subject records at the investigational sites. All clinical and medical information processed by Fondation Force is done so under contract with our clients/sponsors. The processing occurs based on the explicit consent of the study subjects, obtained by the designated study doctors or investigational sites and acting upon written contracts between us, the sponsor, the doctor and the investigational sites.
b) Health professionals’ information
Fondation Force collects and uses the professional profiles of doctors and other health care providers for the purpose of identifying potential investigators to assist in clinical research and for conducting these clinical trials. Fondation Force may also process financial information of investigators to support payment for their services. We may source health professional information directly from those professionals, from our own databases and also indirectly from public sources and referrals.
c) Industry Professional Information
In the course of conducting our activities, Fondation Force interacts with employees, consultants, contractors and other third parties employed or engaged by the sponsors/clients involved in clinical and medical research. Fondation Force records and uses the names, contact details and other professional information on these individuals for legitimate activities-related purposes, including project and financial administration.
For Individuals participating in research studies being managed by Fondation Force as a CRO, including patients, care givers, and relatives, clinical investigators or other study personnel, and other consultants, contractors, managers, and agents of the study sponsor and its corporate affiliates, business partners and third-party service providers, Personal Information may be used in order to carry out the applicable studies and other study-related services and/or pharmacovigilance. This may include the transfer of such Personal Information to the applicable study sponsor, its corporate affiliates, business partners and third-party service providers performing services related to the study (e.g., study data management, clinical research monitoring services, safety monitoring, etc.).
2. Notice and consent
At the point of data collection, Fondation Force provides notices to individuals in a clear and conspicuous language about how their information will be used, disclosed and transferred; what choices they have in relation to how their data are handled; what informational rights they have under data privacy law or under this Policy; and who to contact with any questions or complaints. These privacy notices are tailored to specific situations of data collection.
3. Security measures
Fondation Force operates in compliance with strict and detailed policies and procedures and employs reasonable and appropriate physical, electronic, managerial and technical procedures to safeguard and secure any personal information from loss, misuse, unauthorized access or disclosure, alteration or destruction taking into due account the risks involved in the processing and the nature of the Personal Information Fondation Force is processing.
4. Data integrity
Fondation Force endeavors to use Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the Individual. Fondation Force will take reasonable steps designed to ensure that only Personal Information that is relevant to its intended use, accurate, complete, current, and otherwise reliable in relation to the purposes for which the information was obtained is used by Fondation Force for as long as Fondation Force retains possession of such information.
5. Individuals’ rights
Individuals have a right to access Personal Information about themselves, and to amend, correct or delete Personal Information that is inaccurate, incomplete or outdated. Fondation Force will, on request, provide an Individual with confirmation regarding whether Fondation Force is processing Personal Information about them, consistent with applicable law.
Fondation Force, when acting as a CRO at the conduct of clinical trials, has no direct relationship with medical research subjects participating in them and any such Individuals who seek access, or who seek to correct, amend, or delete their Personal Information should direct his or her query to the relevant study sponsor or investigator, which has only transferred such Personal Information to Fondation Force for processing according to their agreement.
Individuals, moreover, have the right to address to the French Data Protection Authority, if they believe that any of their rights thereof are being violated.
6. Data retention
Fondation Force will not retain data longer than necessary to fulfil the purposes for which it was collected, according to our contractual arrangements, or as required by applicable laws and regulations.
7. Contact information
Questions, comments or complaints regarding Fondation Force’s Privacy Policy or data collection and processing practices can be sent by email to: dpo [at] fondation-force.fr