ARA Privacy Policy

introduction

This Privacy Policy (the “Policy”) applies to www.advanceresearch.com, which is owned and operated by Advance Research Associates, Inc., a California corporation (“ARA”). ARA is committed to respecting your privacy and recognizes your need for appropriate protection and management of any personal information you share with ARA (“Personal Information”). For purposes of this Policy, “Personal Information” means any information that can be used to individually identify a person, and may include, but is not limited to, name, email address, postal or other physical address, IP address, credit or debit card number, and job title. ARA has established this Policy so that you can understand how ARA uses and protects Personal Information.

scope of this policy

This Policy outlines our practices for protecting and managing Personal Information, including implementing the Privacy Shield Principles described below. This Policy applies to all Personal Information received by ARA in providing services as a Clinical Trials Data Management and Biostatistical Reporting Contract Research Organization (“CRO”). This includes Personal Information contained in clinical trial data and data collected from ARA employees, ARA’s clients (each a “Client”), and the ARA web site.

ARA's Role in Processing Personal Information

personal information related to clinical trial participation

ARA, as a CRO, provides data analysis services for our Clients. In the performance of these services, ARA may be the recipient of medical and health information pertaining to test trials, including Personal Information. Some of these Clients may be located within the European Union or Switzerland. Personal Information from research subjects (each a “Subject”) may be transferred to ARA in a pseudonymized form. The data is collected by our Client, as the data controller, in accordance with (a) the notice provided by our Client to the Subject, (b) choices made by the Subject, or (c) to comply with the legal obligations, policies, procedures, and internal administrative purposes of our Client, as solely determined by our Client (not ARA).

Any Personal Information Processed by ARA Would be Solely at Our Client’s Instruction

Any Personal Information of Subjects that ARA might process would have been collected by the data controller, our Client, solely to provide the CRO services that our Client has contracted ARA to provide, or as required by law. In using and processing Personal Information, ARA would act solely (a) as the data processor and (b) as instructed by our Client as the data controller. ARA processes pseudonymized data only and stores it only as long as is needed to fulfill our obligations under our service contract with the Client, comply with applicable law, and maintain records internally in accordance with CRO industry practices.

Our Client (not ARA) is solely responsible for ensuring whether a Subject’s Personal Information is (a) to be disclosed to a third party or (b) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the Subject.

Notice of Certification Under the EU-US and Swiss-US and Privacy Shield Frameworks

Protecting privacy is critical to our business. ARA complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of information transferred between the European Union and Switzerland and the United States. ARA adheres to the Privacy Shield Principles as certified under the Department of Commerce. ARA’s certification can be viewed here: https://www.privacyshield.gov/. ARA also complies with applicable laws as they may be
revised from time to time.

ARA will investigate and attempt to resolve any complaints and disputes regarding use and disclosure of Personal Information in accordance with the Privacy Principles and applicable law (including without limitation the European Union General Data Protection Regulation, or “GDPR”). ARA will respond to a complaint within forty-five (45) days of receipt. For complaints that cannot be resolved, ARA commits to cooperate with the panel established by the European Union data protection authorities (“DPAs”) or the Swiss Federal Data Protection and Information Commissioner, as applicable, and, in accordance with applicable law, comply with the valid legal advice given by the panel or Commissioner with regard to Personal Information transferred from the European Union or Switzerland. ARA commits to cooperate with European DPAs and comply with the advice given by such authorities regarding human resources data transferred from the EU in the context of the employment relationship.

This independent dispute resolution process is provided at no cost to you. Under the Privacy Shield Principles, you may choose to invoke binding arbitration via ARA’s arbitration provider, the International Centre for Dispute Resolution (ICDR/AAA) to resolve any residual complaints not resolved by any other means. Access the ICDR/AAA site here: http://go.adr.org/privacyshield.html.

ARA’s commitments under this Policy are subject to the enforcement powers of the U.S. Federal Trade Commission (“FTC”).

employees

ARA may collect information from their employees and job applicants to perform Human Resource functions. Individuals will be informed of the purposes for which ARA collects and uses the information. ARA will provide the choice and means for limiting the disclosure of Personal Information if requested. ARA will notify employees in advance of using or disclosing the information for a purpose other than for which it was originally collected.

Accountability for Onward Transfers

ARA does not share Personal Information with contracted third parties. Any information requests by third parties are deferred to our Client.

Compelled Disclosure

ARA may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Security

ARA takes precautions through physical, technical, and administrative procedures to safeguard and secure Personal Information in its possession from loss, misuse, unauthorized access or disclosure, alteration and destruction. For example, ARA requires clients to remove any information that would identify a Subject’s name with their data, before ARA will process that data.

Data Integrity & Purpose Limitation

ARA will only use Personal Information in a way that is consistent with and relevant for the purpose for which it was collected or authorized by the Subject. To the extent necessary for those purposes, ARA will take reasonable steps to ensure that Personal Information is accurate, complete, current and reliable for its intended use and for the duration it is held by ARA.

access

ARA, as a CRO, does not have direct relationships with the Subjects and as such, Subjects seeking access to their Personal Information must direct inquiries to their clinical investigator or study sponsor (our Client) which transferred the Personal Information to ARA for processing. On request, ARA will provide ARA employees with access to their Personal Information, and in doing so allowing individuals the opportunity to correct, amend or delete inaccurate information, or has been processed in violation of this Policy or the Principles, except where the burden or expense of providing access would be disproportionate to the risks to the privacy of the individual in the case in question or where the rights of persons other than the individual would be violated.

ARA’s Management of Personal Information of Visitors to this Web Site

If a visitor chooses to contact ARA through this web site, with the visitor’s permission we will collect and/or process personal information such as the visitor’s name, email address and phone number. ARA will follow a similar process if it is necessary to accommodate the visitor’s request to download information from ARA’s web site. We use a visitor’s Personal Information solely to send the visitor requested information or respond to a request.

Individuals in certain jurisdictions, such as the European Union, have certain rights under the GDPR and other laws with respect to their Personal Information, such as rights to access it; correct inaccurate information; object to its collection or use for certain purposes; erase it; restrict its further processing; ask for a copy; withdraw their consent of processing; and file a complaint with the appropriate supervisory authority.

ARA uses cookies or other technologies to monitor visitors to this web site in accordance with the GDPR’s guidelines. The nature of each cookie is disclosed to the visitor and the visitor is free to consent to each cookie separately, withdraw consent separately, and—regardless of whether the visitor consents to the cookies or not—the visitor is allowed to use this web site.

We use a tool called Google Analytics to collect information about use of our site. Google Analytics collects information such as how often users visit this site, what pages they visit when they do so, and what other sites they used prior to coming to this site. We use the information only to improve this site. Although Google Analytics plants a permanent cookie on your web browser to identify you as a unique user the next time you visit this site, the cookie cannot be used by anyone but Google. Google’s ability to use and share information collected by Google Analytics about your visits to this site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy. You can prevent Google Analytics from recognizing you on return visits to this site by disabling cookies on your browser. If you wish, you may Disable Google Analytics while on our website.

Links to Other Web Sites

ARA’s web site includes links to other web sites. Such sites’ privacy practices may differ from those of ARA. If you submit Personal Information to any of those sites, your Personal Information is governed by their privacy policies. ARA encourages you to carefully read the privacy policy of any web site you visit.

Client testimonials

ARA may post clients’ comments and testimonials on our web site which may contain Personal Information. ARA obtains the client’s consent prior to posting the testimonial to post any person’s name and comments. If you wish to update or delete your testimonial, please contact ARA at privacy@advanceresearch.com.

Your Consent

By using this web site, you consent to the terms of this Privacy Policy and to ARA’s processing of Personal Information as described herein.

Changes to this Privacy Policy

ARA may update this Policy to reflect changes to our Personal Information practices. If we make any material changes, we will notify you by means of a notice on this web site prior to the change becoming effective. ARA encourages you to periodically review this page for the latest information on our privacy practices.

Merger/Acquisition

If ARA is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on ARA’s web site of any change in ownership or in uses of your Personal Information, as well as any choices you may have regarding your Personal Information.

Contact Information

Advance Research Associates
2350 Mission College Boulevard, Suite 825
Santa Clara, CA 95054
voice: (650) 810-1190
fax: (650) 810-1195
email: privacy@advanceresearch.com

Effective date: 26Jul22