Policies

1. This Privacy Notice

This Privacy Notice applies to each participant in clinical trials (“you”) which are sponsored or funded by Nxera Pharma UK Limited (“Nxera”, “we”, “us”), or by one of our pharmaceutical company partners or university research partners with whom we have a collaboration. For more information about our group companies please visit our website at https://www.nxera.life/.

If you have any questions about this Privacy Notice or want to exercise your rights set out in this Privacy Notice, you can contact us by email at DPO@nxera.life.

2. Our conduct of clinical trials

We usually act as the sponsor or funder of the clinical trial in which you are participating, although occasionally the clinical trial will be sponsored or funded by a pharmaceutical company partner or university research partner with whom we have a collaboration with, in respect of the study drug (the “Trial”). We are the data controller of your personal data which is provided or generated in the course of the Trial. In this Privacy Notice, we explain more about the personal data about you which we obtain, and why, where, how and for how long we use and keep it. We also provide details of other businesses with whom we share your data. For more specific details about the way your personal data is processed in relation to the Trial, please refer to the Patient Information Leaflet and/or Informed Consent Form, as applicable, which you will be provided with prior to commencing your participation in the trial.

In many cases, we will appoint a type of business known as a clinical research organisation or “CRO”. The CRO will be appointed to carry out the Trial on our behalf. In most respects, the CRO acts on our behalf and as a processor of your personal data. As such, it is only permitted to process your data in accordance with our instructions.

In some circumstances, the applicable pharmaceutical company, university research partner or CRO may also process some of your personal data for its own purposes in relation to the Trial. When it does so, it will act as a separate data controller of your personal data. To find out more about this, you should refer to the privacy notice of the relevant body.

3. What personal data do we obtain about you?

When we refer to ‘personal data’, we mean any information which relates to an identified or identifiable living individual. Individuals might be identified by reference to a name, an identification number or email address. When we refer to ‘special-category personal data’, we mean certain personal data which is deemed sensitive under data protection law, such as health information.

For the purposes of the Trials we may process your personal data, including your special-category personal data, such as:

• your name, postal address, email, telephone number and other contact details;
• your date of birth, gender and other basic biographical data;
• your identification data (such as passport number, country of origin, and National Insurance number);
• your participant ID number;
• medical information, including your medical history and notes of physical examinations and screenings, and data generated from biological samples provided by you; and
• clinical and Trial data, including data relating to: vital signs (such as blood pressure, pulse rate, respiratory rate, body temperature and electrolyte levels); electrocardiograms and cardiac telemetry; haematology and other laboratory testing; monitoring and examinations; adverse events; sample analysis; pre-Trial and Trial notes and reports. 

4. Why do we process your personal data?

We primarily process your personal data in connection with the Trial for the purpose of conducting scientific research. The details of that research differ from Trial to Trial, and the details for your Trial will be set out in detail in your Patient Information Leaflet and/or Informed Consent Form, as applicable. Our legal grounds for processing your personal data in that context are as follows:

• in respect of your personal data (generally), our processing is justified on the basis that it is necessary for our legitimate interest of being a commercial research and development organisation and/or the legitimate interest of the wider public in researching treatments for various medical conditions; and
• in addition, in respect of your special-category personal data, our processing is justified on the basis that it is necessary for scientific research purposes.

We may also be required to process your personal data to comply with our legal obligations, including the performance of safety reporting, archiving of the Trial master file and your medical files, and the disclosure of personal data to any regulatory body in accordance with legal requirements. Our legal basis for processing your personal data in this context is as follows:

• in respect of your personal data (generally), our processing is justified on the basis that it is necessary for compliance with legal obligations to which we are subject, namely our regulatory obligations to monitor, record and archive the outcomes of the Trial, and where necessary report unexpected or adverse events to the relevant authorities; and
• in addition, in respect of special-category personal data, our processing is justified on the basis that it is necessary for reasons of public interest in the area of public health.

5. With whom do we share your personal data?

We may share your personal data with the following third parties who, depending on the circumstances, will either act on our behalf and as a processor of your personal data, or will act as an independent or joint controller:

• our Trial providers (including CROs) who run our Trials for us;
• your GP;
• our other service providers who are engaged by us in connection with the hosting and management of our IT systems (including cloud service providers);
• a pharmaceutical company partner or university research partner with whom we have a collaboration with, in respect of the study drug; and
• regulatory or similar enforcement bodies.

6. International transfers of your personal data

If we need to transfer your personal data from the UK and/or EEA to countries outside of the UK and/or the EEA, we will comply with our legal and regulatory obligations in relation to your personal data, including having a lawful basis for transferring your personal data and putting appropriate safeguards in place to ensure an adequate level of protection for your personal data.

7. Retention of your personal data

How long we retain your personal data will depend on the specific Trial. However, we will not retain your personal data any longer than necessary to fulfil the purposes the personal data was collected for or to fulfil our legal obligations, in line with our data retention policy.

8. Your rights

You have the following rights in relation to the personal data we hold about you. If you would like to exercise any of these rights, please contact us at DPO@nxera.life. Please note that some of these rights are subject to certain exemptions and limitations.

• Your right of access.

If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.

• Your right to rectification.

If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we will let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you with whom we’ve shared your personal data, so that you can contact them directly.

• Your right to erasure.

You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it. If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you whom we have shared your personal data with so that you can contact them directly. Please note that we may need to retain your personal data in accordance with our legal and/or regulatory obligations.

• Your right to restrict processing.

You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we have shared your personal data with others, we will let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we will also tell you whom we have shared your personal data with so that you can contact them directly.

• Your right to data portability.

You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer it to a third party of your choice.

• Your right to object.

You can ask us to stop processing your personal data, and we will do so, if we are relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing.

You also have a right to object to our processing of your personal data for the purposes of direct marketing; we do not, however, undertake direct marketing and so this right is redundant in this context.

• Your right to lodge a complaint with the supervisory authority.

If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, please contact us. You can also report any issues or concerns to a national supervisory authority in the Member State of your residence or the place of the alleged infringement.

You can find a list of contact details for all EU supervisory authorities on the European Commission’s website. The UK supervisory authority is the Information Commissioner.