Privacy Policy: Clinical Studies
Information regarding your privacy
For personal data processed about data subjects for research purposes
Most recent update: 28 Aug 2022
Introduction
As a company that works with medical devices, Acarix A/S ("Acarix" or "we") collect and process personal data on data subjects who participate in clinical testing of medical devices and research projects. In this regard, Acarix will assume the role as data controller, and we are obligated to provide you with certain information.
In most cases, we are able to inform you directly when we collect and process your data, e.g. when you participate in a clinical trial where Acarix is the sponsor. However, in certain situations we are not able to provide this information to you, e.g. if we have obtained your data through a third party, and in such situations we have no way of contacting you. To ensure transparency to the greatest extent possible, we have made the below information generally available on our website www.acarix.com to cover such situations.
Categories of personal data, purposes and legal bases for processing
Acarix will process personal data as described below:
| Purpose of processing | Categories of personal data | Legal bases for processing |
|---|---|---|
| We will collect and process your per-sonal data for the purpose of the clini-cal testing (i.e. scientific research purposes) you participate in. | Ordinary categories of personal data, e.g. time of testing, gender, age, ID number (rec. ID), demographic data, criteria for participation on study. Special categories of personal data, e.g. health information (e.g. blood pressure, hypertension), test results, adverse events information and medi-cal history. Sensitive data collection may in some cases take place via audio recordings of the heart (i.e. sound recordings indicating e.g. coro-nary artery disease or heart failure). | Ordinary categories of personal data: GDPR art. 6(1)(e), cf. the relevant legislation and regulation on testing of medical devices. Special categories of personal data: GDPR art. 9(2)(j), cf. the relevant legislation and regulation on testing of Medical Devices. |
| We are obligated by law to collect and process personal data in case of any adverse events experienced in relation to our devices for reliability and safe-ty purposes. | Ordinary categories of personal data: GDPR art. 6(1)(c), cf. the relevant legislation and regulation on testing of Medical Devices. Special categories of personal data: GDPR art. 9(2)(i), cf. the relevant legislation and regulation on testing of Medical Devices. | |
| Once the specific clinical testing/study you've participated in is finalized, we will also process the data for future research purposes within the area of heart diseases | Ordinary categories of personal data: GDPR art. 6(1)(e) Special categories of personal data: GDPR art. 9(2)(j), Danish Data Protection Act Section 10 |
Sources
We may collect personal data about individuals in a research context via medical professionals or other parties who have conducted medical trials, which you have participated in, including e.g. regarding the testing of medical devices.
If you have provided personal data to your doctor or other medical professionals, and if you have consented to the personal data being transferred to us, you may contact your doctor or the relevant medical professional if you wish to withdraw the consent prior to the personal data being transferred to us.
If we collect your personal data directly from you, or if we are otherwise able to contact you, we will provide a privacy policy directly to you.
Who will be able to know my identity?
Your name, your personal identification number or other information that allows your direct identification will be replaced by a code meaning that your data is made pseudonymous. The medical professionals conducting the study will be able to identify you by name and the following parties may also be able to identify you when they access your personal data for the purpose of conducting audits or similar: selected Acarix audit employees, health authorities and/or other assisting organisations of Acarix.
Analyse or predict aspects of health
As part of your participation in the clinical testing of the medical device, we will use your personal data to analyse or predict aspects concerning your health, in particular whether there are any indications that you may have a certain diagnosis. However, there will always be a medical professional evaluating the test results and the test results will never stand alone in any diagnosing or similar.
Disclosure of personal data
Your personal data will be disclosed if this is required by health authorities, e.g. for the purpose of audits, marketing permissions, change in CE marking or similar. The legal basis for such disclosure will be considered for each case but may be based on Article 6 (1) (c) and/or GDPR art. 9(2)(i), cf. the legislation and/or regulation governing the testing of medical devices.
Transfer of personal data to data processors
We may use data processors to process your personal data collected for clinical testing of medical devices and/or research projects to any third parties. Such data processors may be the providers of the IT systems which we use or it may be consultants who we ask to provide assistance and/or expertise as regards further analyzation of the collected data. All data processors will act on our behalf and will be bound by a data processor agreement.
Transfer of personal data to recipients in third countries
Personal data may be transferred to third countries, if necessary, i.e. countries (for example the US) which may not provide the same level of data protection as is the case within the EU/EEA. In such situations, we will ensure that the transfer is performed in accordance with Chapter V of the GDPR, e.g. by. ensuring that Standard Contractual Clauses (see them here) are entered into and that adequate supplementary measures are established to protect your personal data.
In exceptional cases, personal data may be transferred (always in a pseudonymized form) if authorities in third countries require information about e.g. adverse events. Such transfers can, depending on the specific case, be based on a derogation, e.g. GDPR Article 49 (1) (d).
Storage period
We will only store your personal data for as long as it is deemed necessary to fulfil the purposes for the processing of your personal data.
Pursuant to the legislation and/or regulation on medical devices, we will in some instances be subject to rules that require us to store your personal data for at least:
a period of at least 15 years after the clinical investigation with the medical device in question has ended, or
in the event that the device is subsequently placed on the market, at least 10 years after the last device has been placed on the market
We may store your personal data for longer, if continued storage and processing is necessary for ongoing or future research projects.
Your rights
Subject to the applicable restrictions in the Danish Data Protection Act and General Data Protection Regulation, you have the following rights:
- The right of access to personal data
- The right to rectification of inaccurate and inadequate personal data
- The right to erasure of personal data
- The right to restriction of processing of personal data
- The right to object
- The right to data portability
You also have a right to submit a complaint to the competent supervisory authority, including the Danish Data Protection Agency. You will find the contact information of the Danish Data Protection Agency on www.datatilsynet.dk. You can also read more about your rights on www.datatilsynet.dk.
Contact
Please contact us if you have any questions about the processing of your personal data or how to exercise your rights.
Contact details:
Acarix A/S
Ryvangs Allé 81-83
2900 Hellerup
CVR No.: 32648223
Att: Thomas Stig Lundstrøm