This notice applies to individuals based in the EU who are participants in the following clinical trial:
·CS1003-305, A Multi-Center, Double-Blind, Randomized, Phase III Study to Investigate the Efficacy and Safety of CS1003 in Combination with Lenvatinib Compared to Placebo in Combination with Lenvatinib as First-Line Therapy in Subjects with Advanced Hepatocellular Carcinoma (HCC)CStone Pharmaceuticals (“CStone” or “we”) is the Sponsor for this trial, and as such act as a Controller as defined by the EU General Data Protection Regulation (GDPR). We act as a Joint Controller with EQRx, Inc. an American company in the development of this trial.
In most instances, your personal data will be de-identified when transferred outside of the European Economic Area (EEA) and replaced by a subject ID. This means your data such as your name and contact details will not be transferred.
Our lawful basis for each purpose is included.
|Purpose||Types of data||Lawful basis||Retention|
|Screening and Recruitment||Demographic (name, country, contact details etc.) and Health Data||Article 6(1)(f) – legitimate interest and Article 9(2)(j) research purposes||25 years as per the EU Clinical Trials Regulation (536/2014)|
|Operations of the clinical trial||Health Data||Article 6(1)(f) – legitimate interest and Article 9(2)(j) research purposes||25 years as per the EU Clinical Trials Regulation (536/2014)|
|Pharmacovigilance||Health and Trial data||Article 6(1)(c) legal obligation and Article 9(2)(i) necessary for ensuring high standards and quality of medicinal products||25 years as per the EU Clinical Trials Regulation (536/2014)|
Where we rely on our legitimate interest, our legitimate interest is the development of products which can support and treat those living with certain conditions. We are carrying out this clinical trial to explore whether this medical strategy and treatment and is safe and effective for humans.
We also rely on our legal obligation under the EU Clinical Trial Regulation (536/2014) to ensure the safety of our participants.
All individuals have consented to be part of the clinical trial and can withdraw from the study at any time.
The GDPR provides certain rights for Data Subjects which include:
·Right of access
You have the right to access personal data CStone hold about you,
·Right to rectification
You have the right to have inaccurate data about you corrected.
·Right to object
You have the right to object to processing in certain circumstances.
In the majority of cases, it will be free to exercise these rights and CStone will respond within a period of one month.
CStone is based in China, and as such your personal data will be transferred to China, and to our trusted suppliers based in Singapore and the United States of America all of which work under strict contract with CStone. We must inform you that currently China, Singapore, and the United States have a different data protection regime to the regime in the EU, which is not deemed to provide an adequate level of protection for the purposes of EU data protection legislation. To maintain security of this data, personal data is only transferred to CStone and its trusted suppliers when strictly necessary and under the EU’s Standard Contractual Clauses which provide safeguards for these transfers. We have put in place other safeguards to protect your personal data such as encryption and only your subject ID, gender, ethnicity, and research data will be sent outside of the EEA.
CStone has appointed an European Economic Area (EEA) Representative who you can contact directly if you have any questions or concerns about how we use your personal data during and after the clinical trial:
Kaleidoscope Data Privacy Consultants SL (KDPC ES),
David Stone, EEA Representative,
Calle Balmes 173, 4-2, Barcelona 08006, España.
+34 (0) 938 004910
Categories of recipients who will have access to your personal data will be the trial site study team, and CStone’s study team, drug safety team, trial monitoring team and drug management board and also clinical trial and medicinal product regulators.
Personal Data will be retained for 25 years in line with the EU regulatory requirement for clinical trial data (EU Clinical Trials Regulation (536/2014)).
If you have any queries regarding the processing activities, you can contact our European Economic Area (EEA) representative: firstname.lastname@example.org Our Data Protection Officer can be contacted at email@example.com If we are unable to resolve your query, you may contact your local supervisory authority.
Home - Garante Privacy
Agencia Española de Protección de Datos | AEPD
Home Page - UODO