PRIVACY

Welcome to the Semantics Privacy Notice

We are Semantics MR Ltd, a UK limited company registered in England and Wales at Level 30, The Leadenhall Building, 122 Leadenhall Street, London EC3V 4AB (registration number: 6783214). In this document Semantics will sometimes be referred to as ‘we’, ‘us’, ‘our’ or ‘ourselves’.

This Privacy Notice is designed to providing you with information about:

• What types of personal data we process
• Why we process personal data
• What lawful bases we use for processing personal data
• What security measures we use to protect personal data
• For who long we keep personal data
• Which legal rights you have when we process your personal data

We may revise this Privacy Notice at any time, for any reason, without notice to you, other than the posting of the amended Privacy Notice on our website. Therefore, we recommend that you review this Privacy Notice regularly.

The importance of protecting your privacy

Semantics respects your privacy and is committed to protecting your personal data, in accordance to the General Data Protection Regulation (Reg. EU 2016/679; ‘GDPR’).

Who does this Privacy Notice apply to

This Privacy Notice applies to:

• personal data of healthcare professionals and patients (‘Research Participants’) who take part or may take part in market research, observational studies, non-interventional studies and other surveys (‘Research Studies’) which we carry out on behalf of our clients;
• personal data of members of staff (‘Collaborators’) of our clients, suppliers and other organisations with whom we have or may have business contacts;
• personal data of Job Applicants.

In this Privacy Notice the terms ‘you’ and ‘yours’ refer to Research Participants, Collaborators and/or Job Applicants.

Security of personal data

We have physical and electronical safeguards in place in order to protect the privacy of your personal data. We regularly update and test our security technology. We limit access to your personal data to those members of staff who need to know this information. We train our staff about the importance of data protection and are committed to taking disciplinary actions to enforce our staff’s responsibilities on data protection.

We do not use automated decision making.

We do not sell, rent or trade personal data to anyone.

Processing personal data of Research Participants

We process the following categories of Personal Data of individuals who have taken part in our Research Studies or may qualify to take part in them.

• Publicly available information: Semantics processes publicly available information about healthcare professionals and organisations’ representatives we believe may be suitable to participate in specific Research Studies. This data may include names, telephone numbers, email addresses, work postal addresses, healthcare specialties, hospitals or clinics of practice, curricula.
• Information from Research Studies’ participation: We process records of the Research Studies which Research Participants have been invited to participate in, whether they responded to them, qualified for or participated. We may also invite Research Participants to new Research Studies based upon their participation in previous Research Studies or preferences which they may have indicated to us.
• Information from clients’ lists: Our clients may send us lists of healthcare professionals who they would like us to include or exclude in specific Research Studies. These lists may include names, telephone numbers, email addresses, healthcare specialties, hospitals or clinics of practice.
• Information from incentives payments: If you have participated in one of our Research Studies, you are likely to have been offered an incentive as a thank you for your participation. We process specific personal data related to these payments which may include bank account details.
• Information from travel arrangement: If you have participated in one of our Research Studies which required to travel to a specific location and have requested us to organise your journey, we may need specific personal data (such as passport, ID, date of birth) in order to make such arrangements.
• Information from interviews and surveys: We process answers to our Research Studies in electronical format (written, audio or video). This data may include a recorded audio or video file containing your voice and/or image. When we interview patients, this data may include health data.

Processing personal data of Collaborators

We process the following categories of personal data of individuals with whom we have or may have business contacts.

• Information from collaborations: We process records of Collaborators. This data may include names, work postal addresses, email addresses, fax numbers, telephone numbers, employment information (for example job titles).
• Publicly available information: We also may obtain personal data from public sources in anticipation of a prospective business relationship. This data may include names, work postal addresses, email addresses, fax numbers, telephone numbers, employment information (for example job titles).
• Information from invoices payments: All business transactions with Collaborators are stored by Semantics. We process specific personal data related to these payments which may include bank account details.

Processing personal data of Job Applicants

We process the following information of individuals who have applied to work with Semantics

• Contact details: This data may include names, work postal addresses, email addresses, telephone numbers
• Curricula: This data may include employment and education history.
• Outcome of interviews: this data may include summarised answers and tests outcomes.

What are the purposes and lawful bases of the processing of personal data

In this section you will find information on the purposes and lawful bases we use for processing personal data.

• Research Participants’ contact details: Semantics uses contact details to contact Research Participants when a Research Study in their area of expertise becomes available. We process data in this way so that we can effectively manage our business and ensure a high-quality experience for Research Participants. We process this personal data on the basis of our legitimate interests to conduct our business.
• Collaborators’ contact details: Contact details are also used to manage our relationships with Collaborators, so that, for example, multiple attempts to contact them regarding the same services are eliminated or they are not re-contacted after informing us they are not interested in our services. We process this personal data on the basis of our legitimate interests to conduct our business.
• Information from clients’ lists: When we receive lists of healthcare professionals from our clients, we process this data on behalf of the data controller (our client) so that we can meet their selection criteria. We process this personal data on the basis of our legitimate interests to conduct our business.
• Information from incentives payments: We use personal data related to incentives or honoraria payments in order to process such payments. This data is also retained for financial reporting, audit and tax purposes and to defend ourselves in case of any claims. This information is necessary to perform the contract between the Research Participant and Semantics.
• Information from invoices payments: We use personal data related to invoices in order to process such payments. This data is also retained for financial reporting, audit and tax purposes and to defend ourselves in case of any claims. This information is necessary to perform the contract between the Collaborator and Semantics.
• Information from interviews and surveys: When we process answers to our Research Studies in electronical format (including your voice and/or image), we do so only on the basis of your explicit consent. When we process patients’ health data, we do so only on the basis of your explicit consent.
• Information about Job Applicants: We process this personal data on the basis of our legitimate interests to conduct our business.

How we may share personal data

Your personal data will be processed in the United Kingdom. We are committed to applying appropriate safeguards to protect the privacy and security of your personal data and to use it only in the ways detailed in this Privacy Notice.

If you are a Research Participant:

• Unless otherwise specified, participation to Research Studies is generally anonymous and we provide our client only with anonymised and/or aggregate data without any personal data.
• We would only share your contact data with our clients or suppliers for the sole purpose of carrying out the Research Study, for example in the event that they are conducting an interview or to avoid duplication of Research Participants.
• Where necessary, we may share personal data related to payments with service providers that we use for delivering your honoraria/incentives.
• Where necessary, we may share personal data with law enforcement and other government authorities if required by law or reasonably necessary to protect the rights and safety of others or ourselves.

If you are a Collaborator:

• We may need to share your contact data with our clients, suppliers or Research Participants for the sole purpose of carrying out the Research Study, for example for carrying out Research Studies’ briefings and/or discussions.
• Where necessary, we may share personal data related to invoices with service providers that we use for our financial transactions.
• Where necessary, we may share personal data with law enforcement and other government authorities if required by law or reasonably necessary to protect the rights and safety of others or ourselves.

These operations may involve transferring your personal data to countries outside the European Economic Area (EEA). Semantics collaborate with clients and suppliers from countries within and outside the EEA who must adhere to at least one of our industry’s codes of conduct such as BHBIA, EphMRA, Intellus Worldwide, MRS and ESOMAR. These codes of conduct include appropriate safeguards to protect the privacy and security of your personal data.

For how long we hold personal data

We retain personal data for as long as we retain a legal obligation to do so, or until the purposes for which the data was originally gathered are irrelevant.

If it is requested that personal data be deleted, we may retain the minimum amount necessary to ensure that the individual is not contacted in the future.

Your Rights

At Semantics we take your rights seriously and will always conduct ourselves in a way that is considerate of our responsibility to serve your legal rights.

Further information about your rights under the GDPR is available on the website of the Information Commissioner’s Office (www.ico.org.uk).

You may exercise any of the following rights in relation to your personal data:

• Right to withdraw consent
• Right to rectification
• Right to erasure (Right to be forgotten)
• Right to restrict processing
• Right to object to processing
• Right to complain to a supervisory authority

To exercise any of the above rights, please contact us in writing with your request:

• via email at privacy@semantics-mr.com
• via post at Semantics MR Ltd, Level 30, The Leadenhall Building, 122 Leadenhall Street, London EC3V 4AB.

Right of access

If you submit a subject access request (SAR) to Semantics, you are entitled to be told whether we hold any data about you. If we do, you also have the right:

• To be given a description of the data, the purposes for which the data are being processed, and those to whom the data may have been disclosed.
• To be given a copy of the data in an intelligible form, with any unintelligible terms explained.
• Upon request, Semantics will provide an individual access to their personal data without undue delay and within a time frame of 30 days except where exceptional circumstances may require additional time.

Your right to access your personal data may be restricted in exceptional circumstances, including, but not limited to:

• when the burden or expense of providing this access would be disproportionate to the risks to your privacy in the case in question
• where the rights of persons other than you would be violated by the provision of such access.

If we determine that your access should be restricted in an instance, we will provide you with an explanation of why this would be the case.

Right to withdraw consent

If we are processing your personal data on the basis of consent, you have the right to withdraw your consent at any time.

Right to rectification

You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

Right to erasure (Right to be forgotten)

You may have the right to the erasure of your personal data when:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• you withdraw consent to consent-based processing;
• you object to the processing under certain rules of applicable data protection law;
• or if you believe that the personal data has been unlawfully processed.

However, you cannot exercise this right where processing is necessary for:

• exercising the right of freedom of expression and information;
• compliance with a legal obligation;
• the establishment, exercise or defence of legal claims.

Right to restrict processing

You may have the right to restrict the processing of your personal data when:

• you contest the accuracy of the personal data;
• processing is unlawful but you oppose erasure;
• we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims;
• you have objected to processing, pending the verification of that objection.

Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it:

• with your consent;
• for the establishment, exercise or defence of legal claims;
• for the protection of the rights of another natural or legal person;
• or for reasons of important public interest.

Right to object to processing

You may have the right to object to our processing of your personal data on grounds relating to your particular situation.

If you make such an objection, we will cease to process the personal data unless:

• we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms;
• or the processing is for the establishment, exercise or defence of legal claims.

Right to complain to a supervisory authority

If you consider that our processing of your personal data infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.

How to contact us

If you have questions about this Privacy Notice, requests on your personal data, concerns or complaints please contact us by email at privacy@semantics-mr.com. You can also contact us by post at Level 30, The Leadenhall Building, 122 Leadenhall Street, London EC3V 4AB, United Kingdom.