About this Privacy Policy
This Global Privacy Policy (“Policy”) describes the main types of personal information QPS Holdings, LLC and its affiliates (together “QPS” or “we”) process within our global organization and how this information is used and disclosed. In addition, this Policy indicates our commitments towards the individuals whose information we handle. The Policy explains in general terms how we seek to comply with data protection laws and regulations, including but not limited to the European Union (“EU”) General Data Protection Regulation (“GDPR”) and national laws implementing the GDPR, the Health Insurance Portability and Accountability Act (HIPAA), state security breach laws and data protection laws in the United States, applicable data protection legislation in other jurisdictions and the privacy and confidentiality requirements of ICH Good Clinical Practice (GCP). The Policy provides information on the purposes for which personal data are being processed by QPS and how individuals can exercise their rights under applicable data protection laws and regulations.
This Policy does not cover the processing of personal data within the context of clinical trials by individual QPS affiliates. For further information on this specific type of processing, we refer you to the websites of the individual QPS affiliates concerned (QPS Missouri with website https://www.417studies.com/, QPS Florida with website https://www.miamiresearch.com/ and QPS Netherlands B.V. with website https://qpsvrijwilliger.nl/).
About QPS
Clinical and medical research is founded upon the collection and analysis of the most confidential information about people. Individuals will only share their sensitive information where there is a culture of trust and where stakeholders implement safe data handling practices. Operating within this environment, QPS recognizes that when we handle information about any individual, we must do so responsibly, with due care to individual privacy, complying with laws on data protection and confidentiality.
Types of Personal Information handled by QPS and to what end
Clinical and Medical Information
As a global contract research organization, we collect, host and analyse significant quantities of health data and bio-medical samples relating to study subjects on behalf of our clients. To enhance privacy, consistent with GCP, subjects’ names and other direct identifiers are not attached to records or samples collected by QPS for research purposes. Instead, subjects are only identified by a code. Only study doctors and authorized personnel, including QPS monitors and QPS auditors, may access named subject records at the source. In cases where local law allows, QPS may also collect full date of birth attached to study records. We maintain that this indirect identifier can on occasion serve to verify subject identity to the benefit of patient safety.
QPS provides additional services that may involve the collection of health information linked to named individuals, for example in our Phase I Clinics, and within operations supporting patient recruitment, post-approval pharmacovigilance and medical information. We appreciate the sensitivity of such information, and the privacy protections we apply in these areas are more rigorous.
Health Professional Information
QPS analyzes the professional profiles of doctors and other health care providers for the purpose of identifying potential investigators to assist in clinical and medical research on specific indications. QPS will use available contact information, including email addresses, for the purpose of inviting potential investigators to apply to participate in research. QPS will source health professional information from its own databases and also indirectly from public sources, data brokers and referrals. For operational purposes, QPS will also collect information relating to the involvement and performance of investigators and supporting study staff.
Industry Professional Information
In the course of conducting our business, QPS will interact with employees, consultants, contractors and other third parties employed or engaged by our clients involved in clinical and medical research. QPS will record and use the names, contact details and other professional information on these individuals for legitimate business related purposes, including project and financial administration. We may use the information we obtain, including email addresses, to provide relevant information on QPS’s services to our clients.
Employee and Human Resource Data
QPS collects personal information from applicants seeking employment with QPS, including private contact details, professional qualifications and previous employment history to inform employment decisions. QPS conducts various background checks on applicants, including where law allows on criminal history and professional disbarment/disqualification. Once employed, QPS collects information on staff for human resource, performance, payroll and tax purposes. QPS will collect and record employee level information in various company systems, consistent with standard business operations. QPS processes similar information relating to consultants, contractors and other third parties engaged by the company to provide products or services to it.
Web Visitors
QPS collects personal information about visitors to QPS websites where this is voluntarily provided to meet a request from those individuals, for example where a client contact requests information on a company service, a health professional is interested in participating in a clinical trial or where someone wants to apply for a vacant position with QPS. Through the use of cookie-based technologies, QPS may collect various data linked to virtual identities allocated to visitors when they access our websites.
A cookie is a data file that is placed by a website operator on the hard drive of a visitor to their site. Cookies with the following functions are enabled to the devices of visitors to QPS websites: to allow the site to deliver the service requested by the visitor; to remember repeat visitors; to improve the user experience of the site and to allow QPS to perform site analytics and to help tailor marketing messages to the visitor based on previous browsing. Your online relationship with QPS may be managed by using settings available on most internet browsers. For example, most browsers will allow a visitor to delete or disable cookies, or to set “Do Not Track” as a function.
Medical Information Contact Centers and Pharmacovigilance
QPS operates contact centers for the purpose of providing medical information to health professionals, patients and other interested parties on specific pharmaceutical products sold by our clients. These contact centers also collect adverse event information and deliver this to relevant pharmacovigilance professionals for processing as required by regulation. Personal data on those who call or email our contact centers are only collected to process requests for information and allow adverse event reporting. Calls may be recorded for quality assurance purposes. Callers (inbound and outbound) are notified if their call is recorded.
Internal and External Disclosures of Personal Information Personal information will be shared within QPS, companies working as agents of QPS and third parties only on a “need to know” basis to meet stated legitimate business purposes, including but not limited to the performance of a contract. Access to databases and folders containing personal information is restricted to appropriate staff. QPS does not trade or sell personal information. Under some circumstances, QPS may be required by law enforcement or judicial authorities to disclose certain personal information as part of investigations or for litigation purposes. QPS may disclose personal information to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of QPS or some or all of its assets.
International Transfers of Personal Information
QPS is a global company serving an industry that is increasingly globalized in its approach to clinical research. Personal information will not be shared across international borders if not required to service (global) projects. QPS hosts personal information in databases in different locations throughout the world. In certain circumstances, personal information will be hosted within vendor platforms located in the Internet cloud. QPS recognizes that many countries globally have regulations restricting the flow of personal information across international borders. QPS has put in place appropriate safeguards and measures to ensure that adequate protection is provided to such data where legally mandated.
General security measures to protect your information
QPS has enacted internal policies, procedures and training programs designed to support compliance with these laws and this Policy. Our policies, procedures and training programs are reviewed on a regular basis, and managed by a team of privacy professionals with senior executive oversight.
Your rights and procedure to perform your rights and contact information
Under the GDPR, individuals have the following rights: the right to access, the right to be forgotten, the right to data portability, the right to rectification, the right to object, the right not to be subject to automated individual decision making and the right to restriction of processing.
For any comments or requests that adheres to one or more of the rights stated above, an email can be sent towards [email protected].
QPS shall process your request within one month after the request has been received, unless circumstances demand a prolongation to a response to a maximum period of three months. In that case, you will be notified beforehand with the reasons of the prolongation. Please note that individuals’ rights under the GDPR are subject to certain restrictions and may not always be granted. A request may be denied in part or in full following these restrictions, such as statutory obligations, the rights of third parties and the legitimate interests of QPS.
Within the EU, EU citizens have the right to lodge a complaint with a supervisory data protection authority. A list of all EU supervisory authorities is available on the European Commission website: https://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm.
Notice and Consent
Where mandated by data protection law and/or where it is a matter of good practice, QPS will seek consent of individuals to collect, use and disclose their data. However, where applicable law allows, particularly where gaining consent will involve a disproportionate effort, where intended processing of the data is in QPS’s or our clients’ legitimate interests or necessary to perform a contract or to comply with statutory obligations, QPS will proceed to process personal information without consent. Also, QPS will use and disclose personal information without consent where required by law and judicial order. Consistent with GCP, laws on confidentiality and data privacy regulations, QPS will collect necessary informed consents of study subjects on behalf of its clients.
Data Quality and Record Retention
Data quality and accuracy are fundamentally important principles to QPS. Crucial to the integrity of clinical research is the accuracy of data relating to study subjects, particularly where attached to bio-medical samples. Consistent with regulatory requirements, QPS employs a professional quality assurance department. In general, our privacy notices provide individuals easy means of validating, correcting errors and updating information. QPS retains personal information in accordance with contractual, legal and regulatory requirements. Generally, personal data retention for study subject is 15 years.
Third party websites
QPS Web pages may contain links to websites outside of QPS. Linked websites are not under the control of or endorsed by QPS. This Policy does not apply to linked websites outside the QPS organization. It is recommended that visitors review the privacy policy of each individually linked website.
Legal Status of Policy and Policy Changes
Our Global Privacy Policy is not a contract, and it does not create any legal rights or obligations. QPS reserves the right to modify or amend this Policy at any time. For instance, the Policy may need to change as new legislation is introduced or as it is amended. The updated Policy will be posted on https://www.QPS.com/.
This Privacy Statement was last updated 01 August 2018.