This Privacy Policy describes the overall processing activities of the IDERHA Consortium. It should be read alongside IDERHA’s Transparency Statement available here, our Code of Practice and Data Protection Policy here, and any other materials that have been shared as outlined below. IDERHA uses personal information for a number of activities, including use of our website. For details around of how your privacy and personal data are protected when using our website and information about Cookies, please see here.
The IDERHA consortium has drafted this notice because we understand that the privacy and security of your personal data is an important concern, and we take it very seriously. As a result, we would like you to understand how we collect and further process personal data, which is any information about an individual which that person can be identified from. It does not include data where any link to the identity has been removed (anonymous data).
Special Notice - if you are under 18 years old
IDERHA is not aimed at children under 18 years old and we do not wish to collect, use, provide or process in any other form any personal data of children under the age of 18.
We therefore ask you if you are under 18 years old not to send us your personal data (for example, your name, address and email address). If you are under 18 years old you may not participate in IDERHA, but if you wish to ask a question about IDERHA or use this website in any way, please ask your parent or guardian to do so on your behalf.
Who is the IDERHA Consortium?
The IDERHA Consortium is a pan-European collaboration consisting of a number of public sector, industrial and not-for-profit institutions as outlined online here. We are all part of a binding consortium agreement and data sharing agreement frameworks that outline our joint and individual responsibilities for processing personal data. These frameworks ensure that we are able to achieve our goals and meet our responsibilities to the consortium so that the project can succeed.
Please refer to the list of partners at https://www.iderha.org/partners which provides a link to each of our partner’s websites where you can find their privacy policies and any notices around our work on IDERHA. Please also see Partner VTT’s notice around their work with IDERHA at https://cris.vtt.fi/en/projects/integration-of-heterogeneous-data-and-evidence-towards-regulatory.
Note that for all the other activities outlined here, the Consortium partners are Joint Controllers of the Personal Data that is processed. The only exception is where you may participate in one of our research studies, where the controllership of data and responsibilities are specified in your participant information leaflets which you will be provided with if you have been invited to participate in any of the studies.
What activities require the processing of personal data?
This privacy notice covers the times we will collect and process your data to support the activities outlined as follows:
- When you attend our public meetings and webinars;
- If you participate in one of our studies;
- When you participate in our Advisory Boards.
If you take part in the research studies that are part of IDERHA Project. We kindly ask you to refer, in such cases, to the information you will be provided when you enrol any of the studies.
What data do we collect and process? Details on how we use your personal data
We may collect, use, store and transfer different kinds of personal data, including sensitive information about you, including health information.
Below we summarise in a table how we use your personal data for each of the purposes.
One of the purposes of our website is to inform you of who we are and what we do. We have set out below a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.
Please note that we may process your data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one basis has been set out in the table below.
If at any time you wish us to stop using your personal data for any or all of the purposes set out in the table, please contact us (details below). Unless otherwise restricted by any applicable law, we will stop the use of your personal data for such purposes as soon as it is reasonably possible to do so.
Please note that in addition to the instances set out below we may need to process your personal data without your knowledge or consent where this is required or permitted by law.
We summarize the reasons for processing, the data we handle and the Lawful Basis for processing in the table below where we have also identified our legitimate interest, where appropriate:
| Activity and Purpose | Description | Lawful Basis |
|---|---|---|
| Attendance at our public meetings and webinars to support our pubic engagement, openness and transparency agenda | Our Webinars or Public Meetings (both online and in person) use Microsoft Teams. If We choose a different platform, we will inform attendees in advance of the Webinar. For Webinars and Public Meetings attendance, IDERHA may wish to share the results of our Webinars and Public Meetings, as well as any questionnaires we may ask you to complete for our work and in its deliverables and reports. We may also promote the Webinar and Public Meetings before and after the event on LinkedIn via our Project pages. Please note also that Webinars and Public Meetings will be recorded and that an analysis of the Webinars and the questionnaire responses will be used to inform the IDERHA consortium and its work. We may publish excerpts from the recording and transcripts via social media and other publications. In processing any personal data for our Webinars and Public Meetings, the Joint Controllers are using the Lawful Basis of Legitimate Interest / Consent under Article 6.1(a/f) of the General Data Protection Regulation. If you do not wish us to use your data for social media, please inform us using the contact details outlined below. | Consent / Legitimate interest |
| Participation in our Advisory Boards to support our commitment to seeking and using independent expertise for critiquing and improving our work and approach | If you are an independent member of our Clinical, Patient or Ethics Advisory Boards, you will be provided with the details of how we use your data in the contract of engagement for the relevant Board. Please refer to this for more details and how to raise any questions or make any comments. | Consent |
| Participation in Research Studies | If you are participating in any of IDERHA’s research studies, please refer to the details of your Data Protection rights and our responsibilities in your Participant Information Leaflet for full details of Personal Data Processing, who to contact if you have any questions and more details about your involvement in the relevant study Among others, name, surname, organization, family status, location, health conditions and related sensitive information and all others specific to the study. | Consent |
*Except for participation in our Research Studies* We do not collect any Special Categories of Data which includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientations, political opinions, trade union membership, information about your health and genetic and biometric data for any of our purposes.
Our commitment to high standards of Data and Privacy Protection
In all cases, the IDERHA consortium complies with the applicable laws and regulations. This means that:
- We will process your personal data in accordance with the purpose they were collected for;
- We will only process the personal data which IDERHA will require for any given purposes (principle of minimization);
- We have taken appropriate technical and organisational measures to safeguard the security of your personal data;
- Please see below to understand how to exercise your rights;
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
Disclosure of your Personal Data
Except as set out in this Privacy Policy, we will not disclose any personally identifiable data without your permission unless we are legally entitled or required to do so (for example, if required to do so by legal process or for the purposes of prevention of fraud or other crime) or if we believe that such action is necessary to protect and/or defend our rights, property or personal safety and those of our users/customers or other individuals.
IDERHA’s partners all use Third Party Tooling for their routine activities, including for example Microsoft Office 0365 and occasionally Google’s suite of tools as outlined in their privacy policies. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for the purposes that we have agreed with you and in accordance with our instructions. We request those third parties to implement adequate levels of protection in order to safeguard your personal data.
International Transfers
Some of the third parties identified in the section above are located outside of the European Economic Area (EEA) so the processing of your data will involve a transfer of data outside of the EEA. Whenever we transfer your data out of the EEA we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission
- Where we use certain service providers we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
- Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data as in Europe.
We respect your personal data and therefore, we will take steps to ensure that your privacy rights continue to be protected if we transfer your personal data outside of the EEA in this way. In addition, if you use our services while you are outside the EEA, your personal data may be transferred outside the EEA in order to provide you with those services.
Keeping our records accurate
We aim to keep your personal data as accurate as possible. If you would like to review, change or delete the details you have supplied us with, please contact us as set out below.
Security of your personal data
We have implemented appropriate security measures and policies with the objective of protecting your personal data from unauthorized access and improper use and will update these measures as new technology becomes available, as appropriate. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.
Data retention
We only retain personal data for as long as is reasonably necessary to fulfil the purposes we collected it for, including the purpose of satisfying any legal, regulatory or reporting requirements. We may retain your personal data for a longer period in the event of complaint or if we reasonably believe there is a prospect of litigation. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data and the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory or other requirements. Please refer to the Participant Information Leaflets for details on Retention for IDERHA Studies participation.
Changes to our Privacy and Other Statements and Policies
From time to time we may make changes to this Privacy Policies, Transparency Statement and Data Protection Policy. Please check our Privacy Policy on a regular basis. This Privacy Policy was last updated on the date presented at the top of this page. Historic versions of our Privacy Policy are available on request.
Your Rights
Please find below the rights that assist you in respect to the processing of your personal data:
- The right to access: this enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it;
- The right to rectification: this enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide us;
- The right to erasure: this enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of the request;
- The right to object to processing: this enables you to object to our processing of your data if you feel it impacts your fundamental rights or freedoms. You also have the right to object to processing where we are using data for direct marketing purposes. Note, however, that in some cases we may demonstrate we have a compelling legitimate ground to process your information that overrides your fundamental rights or freedoms;
- The right to restrict processing: this enables you to ask us to suspend the processing of your data if you want us to establish the data’s accuracy, where processing us unlawful but you oppose erasure, we no longer need the personal data for processing but you require us to hold it for the establishment, exercise or defence of legal claims and you have objected to the grounds of processing but we need to verify if we have overriding legitimate grounds to use it;
- The right to data portability: this enables you to ask us to transfer the personal data to you or a third party chosen by you. Note this right only applies to automated information you initially provided consent for is to use or where we use this information to perform a contract with your data;
- The right to complain to a supervisory authority;
If you wish to exercise any of the rights set out above, please contact us as outlined below. We may need to request specific information from you in order to help us confirm your identify and ensure your rights to access your personal data (or exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
How you can contact us
If you would like to contact us about this Privacy Notice or our privacy practices, please contact the IDERHA Partner related to your questions as outlined at https://www.iderha.org/partners. They will also help you find the appropriate Supervisory Authority if you wish to contact them.
If you are not sure whom to contact, please contact Fraunhofer and they will be able to direct your query as approporiate. Please note that we may refer you to the Data Controller as outlined in the IDERHA Partner’s list available at https://www.iderha.org/partners.