Privacy policy

Version 10. This page was last modified on 10/01/2023.

This Privacy Policy is applicable to the Website and services of C-Lys. C-Lys is a trademark of the Belgian company Pivotal Clinical BV with enterprise number BE0634985259 (hereinafter "Patient Journey" or "PJ"). By using the Website and services of C-Lys, you are deemed to have taken note of this Privacy Policy and as a result to have accepted the collection and processing of your personal data in the manner described herein. C-Lys is not responsible for the privacy policy of other websites and sources. This Privacy Policy describes both your use of the C-Lys Website ("Website") and the operation of the services provided by PJ under the tradename C-Lys ("C-Lys" or "us/ our/we" ). The policy describes how C-Lys collects, uses, protects and shares data. This allows you to understand exactly how we operate.

You can visit our Website without disclosing personal information. We will only obtain personal information and data from you if you: (i) register via a trial-specific application form on the Website, (ii) subscribe to the newsletter,(iii) fill out a contact form, (iv) send us an e-mail, (v) send us information by post, (vi) provide us with information by telephone and/or (vii) complete a survey. We will only use the personal data you provide to us for the services or purposes for which you have given your consent. C-Lys has taken steps to protect your data in accordance with the General Data Protection Regulation ‑ Regulation (EU) 2016/679 (GDPR) and the Belgian Privacy Act (Act of 30 July 2018 on the protection of privacy with regard to the processing of personal data).

A data protection officer (DPO) has been assigned and notified to the Data Protection Authority.

1.1 Personal data

By personal data we mean any information relating to you and provided to C-Lys when registering via a study-specific application form, via the completion of a survey, via the subscription form for the newsletter, via a contact form or by telephone after initial registration on our Website.

C-Lys limits the collection of personal data to those data that are necessary to achieve the objective of their use. The retention period is never longer than the period in which the data are necessary for achieving their objective.

1.1.1 Use of your personal data

• You sign up for a specific study and give your permission to use your personal data in the context of the pre-selection for the study: as standard practice, the data you provide on an application form for a specific clinical study are your name, first name, date of birth, gender, city, zip code, e-mail, telephone number and area of interest. In this case C-Lys acts as ‘data processor’ on behalf of the Sponsor, who is the ‘data controller’. Depending on the type of study, you may also provide additional personal information to C-Lys (such as, for example, your state of health), but C-Lys will limit the collection of personal data to those data that are necessary to achieve the objective of their use. You can provide this additional information via the application forms (study questionnaire) on our Website or during telephone contact with us or with our selected 3rd party call center. You undertake to provide us with data that is accurate, complete and up-to-date. You understand that your registration is equivalent to written consent to process your personal data, including sensitive data such as health, lifestyle and ethnic data.
  • Based on the information you provide through the application form we will determine whether you meet various preselection criteria for the specific study. In case a telephone preselection step is included in the preselection process, your personal data will be passed to our selected 3rd party call center. Only if you meet the preselection criteria after online and, if applicable, telephone preselection , your personal data will be passed to the research center participating in the specific study. The research center may contact you to discuss the study further. C-Lys may also make an appointment for you with the research center. Sharing your personal data with a participating research center does not mean that you are also effectively included in the study. The latter is outside the competence and services of C-Lys and the research center will discuss this with you in detail after further evaluation by them. Before effectively taking part in a clinical study, you must also sign a separate informed consent form. C-Lys is not responsible for the handling of your data by the research center. C-Lys/PJ is in no way responsible for the conduct of the clinical study, for the verification of the (medical) data of the potential candidates and/or for obtaining the informed consent of the candidates to take part in a clinical study. 
  • The online C-lys study questionnaire uses an automated decision-making technology in order to reduce data collection from the candidates that are ineligible for the clinical study advertised and to increase efficiency of the service C-lys provides. Answer to certain questions in the questionnaire will lead to different paths which will determine whether the candidates are illegible for the study. Those candidates that are determined to be illegible by the automated decision-making technology will be additionally assessed by C-lys in order to make sure that these candidates are indeed a match with the study. 
  • This automated decision-making is necessary for entering into a contractual relationship with the study candidate. Hence, if the candidate does not want to be a subject to automated decision-making, the candidate cannot apply for the study using C-lys service. 

 

• You subscribe to the newsletter:
  • Via the subscription form: as standard practice, the contact details that you provide on the subscription form are your name, first name, year of birth, gender, country and city where you live, e-mail, telephone number and area of interest. In this case C-Lys is the ‘data controller’. These contact details will be stored in the C-Lys database so that C-Lys can send you newsletters via e-mail, post or SMS. 
  • You do this by selecting the option "I want to receive the newsletter" during registration for a particular study. If you select this option, only your contact details (name, first name, year of birth, gender, country and city where you live, e-mail, telephone number and area of interest) are stored in the C-Lys database so that C-Lys can send you newsletters via e-mail, post or SMS. 

 

• You complete a survey and give your permission to use your personal data in the context of this survey: as standard practice, the data you provide on a form for a survey can be age, gender and country where you live; other data as your name, first name, date of birth, gender, city, zip code, e-mail, telephone number, area of interest can be asked in certain circumstances and survey specific questions related to your health status. In this case C-Lys acts as ‘data controller’ or as ‘data processor’ on behalf of the Sponsor, who is the ‘data controller’. Depending on the type of survey, you may also provide additional personal information to C-Lys (such as, for example, specific health condition), but C-Lys will limit the collection of personal data to those data that are necessary to achieve the objective of their use. You can provide this additional information via the survey on our Website or during telephone contact with us or with our selected 3rd party call center.. You undertake to provide us with data that is accurate, complete and up-to-date. You understand that completion of the survey is equivalent to written consent to process your personal data, including sensitive data such as health, lifestyle and ethnic data.
  • Based on the information you provide through the survey we will determine whether you meet various preselection criteria for the specific survey. Only if you meet the preselection criteria after online preselection, your personal data will be used for analysis of the survey.
  • The online C-lys survey uses an automated decision-making technology in order to reduce data collection from the candidates that are ineligible for the survey advertised and to increase efficiency of the service C-lys provides. Answer to certain questions in the survey will lead to different paths which will determine whether the candidates are illegible for the survey or, if applicable, for the telephone contact.
  • This automated decision-making is for some surveys necessary for entering into a contractual relationship with the subject. Hence, if the subject does not want to be a subject to automated decision-making, the subject cannot apply for the specific survey using C-lys service.​​

When registering on our Website, completing a survey or subscribing to the newsletter, once you indicate that you have read our Privacy Policy and understand and agree with it, you consent to the processing of such data as described here. The retention period never exceeds the period necessary for the achievement of the objective or for related statutory/regulatory requirements (such as, for example, quality control or inspection by regulatory authorities).

Following retention periods are applicable:

• If you register for the newsletter: By accepting this privacy policy you agree that:
  • C-Lys processes, uses and stores your personal data for the time period for which you remain subscribed to the newsletter: end of calendar year of the registration + 5 years. This is to be able to send you information about future clinical studies, or to keep in touch with you in connection with other C-Lys services.
• If you register for a specific study: By accepting this privacy policy you agree that:
  • C-Lys processes and uses your collected personal data until the end of the C-Lys recruitment period (as mentioned on the study webpage), independent if you are included in the study or not
  • during that period C-Lys will not block or delete your personal data.

After the closure of the C-Lys recruitment period your personal data will be locked and archived for 25 years (unless otherwise specified in the webform) for documentation purposes. After this archiving period your data will be permanently deleted.

• If you complete a specific survey: By accepting this privacy policy you agree that:
  • C-Lys processes and uses your collected personal data during the following period: duration of the survey + 1 month
  • during that period C-Lys will not block or delete your personal data.

After this period (duration survey + 1 month), your personal data will be locked and archived for 25 years (unless otherwise specified in the webform) for documentation purposes. After this archiving period your data will be permanently deleted.

 

1.1.2 Options regarding personal data

We offer a free of charge services in order to make sure you are able to exercise your rights as a data subject. You can view, change and delete all personal data you provide to us as well as object to processing of your personal data (some conditions may apply):

• You have a right to view and change your personal data: If you wish you can request an overview of your personal data and amend this if necessary.
• You have a right to data portability: In case you have registered for a study or for the newsletter and provided us with your personal data, you have a right to receive a copy of your personal data in a structured, commonly used and machine-readable format to transmit this data to another organization.
• You have a right to request deletion of your personal data: You can decide at any time to delete your personal data from our database for any future use. This right might be limited by our legal obligations or need for keeping the data for archiving purposes in the scientific research.
• You have the right to withdraw your consent for any future use of your personal data for a specific study. This right might be limited by our legal obligations or need for keeping the data for archiving purposes in the scientific research. After validation of this request your personal data will be deleted for future use from the C-Lys database
• You have a right to unsubscribe from C-Lys newsletters to no longer be contacted by us
• You have a right to demand restriction of processing of your data: After having received your request we will evaluate if the right is applicable. If applicable, your personal data will be deleted for future use from the C-Lys database
• You also have a right to object to processing of your personal data: After having received your request we will evaluate if the right is applicable. If applicable, your personal data will be deleted for future use from the C-Lys database.

The above mentioned rights can be exercised by contacting us via the online contact form on our Website. After verifying your identity, we will do everything reasonably possible to comply with your request unless it will require completely unreasonable measures (e.g. would be technically or organizationally virtually impossible or extremely costly). We may refuse to process requests that are unreasonably repetitive or systematic.

Apart from the right mentioned in this section, you can also lodge a complaint about the processing of your personal data by C-Lys with a local Supervisory Authority.

1.1.3 Transfer of data to third-parties

We will not sell, share or distribute your personal data or disseminate this in any other way to third parties, unless otherwise provided in this Privacy Policy.

C-Lys may hire subcontractors to provide services on behalf of C-Lys. All subcontractors will only receive access to data for the provision of the C-Lys services, if C-Lys has hired the subcontractor in accordance with the objectives for which the data were originally collected. Use of the data for other objectives is prohibited. This is always included in a contract concluded with these subcontractors.

List of subcontractors that C-Lys might use:

• Cloud service providers
• Web hosting service providers
• IT consultancy service
• Quality assurance consultancy service
• End-to-end encryption
• Call center services

As part of the services that C-Lys supplies, it is possible that your data will be viewed by auditors, government inspectors and/or EMA (European Medicines Agency) inspectors, the FDA (Food and Drug Agency) and/or representatives of our customers in order to ensure that both C-Lys and its subcontractors act in accordance with applicable laws, regulations and good clinical practice (GCP).

In the event that C-Lys or PJ (or a part thereof) is sold or transferred at any time, the information that we hold may be a part of the assets to be transferred. In such case, this information will continue to be used in accordance with this Privacy Policy and you will be informed of this in writing or by e-mail.

We may make personal data public if we are legally obliged to do so, or if such action, at our discretion, is reasonably necessary to comply with legal processes, to respond to claims or to protect the rights of C-Lys, its customers, employees and the public.

C-Lys web pages are not intended for the medical reporting of side effects associated with the use of medical products or participation in a clinical study. Should you nevertheless provide us with information about any side effects, then we are compelled to follow up on this and/or to report this to the sponsor of the clinical study. This means that we may possibly contact you to gather more information (such as your medical history) in the context of this side effect. This information is then passed to the sponsor of the clinical study. The sponsor may also contact you directly in the context of the follow-up of the report on the medical side effects.

C-Lys is a Belgian company. Nevertheless, the data processing and/or transfer may take place to countries within or outside the European Union. Under Article 21 of the Belgian Privacy Act and the Articles 44-47 of the General Data Protection Regulation ‑ Regulation (EU) 2016/679 (GDPR) , personal data may only be transferred to countries that ensure the same adequate level of protection and where the same or similar provisions of the GDPR are complied with. The country, duration of the transfer, storage, type of data and precise objectives are criteria which must be examined on a case by case basis. C-Lys guarantees that no transfer takes place to third countries for data processing or storage without the necessary steps being taken to comply with the protection requirements of the GDPR.

Transfer mechanism that C-lys might use for your personal data transfers:

• Adequacy decision by the European Commission
• Privacy Shield certification
• Standard Contractual Clauses provided by the European Commission
• Your explicit consent for transfer

1.1.4 The security of your data

C-Lys will, to the extent possible, take technical, physical and organizational security measures which comply with applicable laws in the field of privacy and data security in order to guarantee a secure processing of your personal data. The risks of accidental or unauthorized destruction, accidental loss, alteration of or access by unauthorized persons, and any other unauthorized processing of your personal data are therefore reduced to a minimum. The safety and management procedures are reviewed on a regular basis in accordance with the latest technological developments. This includes recourse to an external security consultant. C-Lys stores your personal data in its database on specially protected servers in the Netherlands, which are ISO27001, ISO9001 and NEN7510 certified. ISO270001 and NEN7510 are internationally recognized standards for Information Security. ISO9001 is the international standard for quality management systems. The access to the database is only possible by special authorized persons who are engaged in the processing of the data. Appropriate procedures and security measures are taken for sharing the personal data with research centers.

We would like to also point out that you are personally responsible for the security of the computer, smartphone or tablet that you use to visit the C-Lys Website and to communicate certain details to C-Lys. Therefore it is important that you guarantee that the device you are using is properly secured and protected against malicious software (such as computer viruses) using appropriate security measures (such as up-to-date anti-virus software). If you have any reason to believe that your communication to us is no longer safe (for example, if you believe the security of your personal data that you may share with us is not reliable), we insist that you immediately notify us of this by e-mail or telephone.

1.2 Non-personal data

In general, you can visit our Website on the Internet without telling us who you are or revealing any personal information about yourself. In some cases, our web servers automatically collect certain non-personal data about you when you connect or follow a link to the Website. Examples of these non-personal data are: domain names, the type of Internet provider, the type of browser, the type of operating system you use, etc. The information collected relates to the number of visits, average time spent on the Website, pages viewed and other similar information. We use this information to analyze the use of the Website and improve its content.

1.2.1 Cookies and similar technologies

Our Website uses "cookie" technology (small text files that are placed by a web service on the hard drive of a device) or  similar technologies such as web analytics. This allows us to adapt our Website to suit your needs. For more information about how cookies and similar technologies can be managed, we recommend that you consult the documentation regarding your Internet browser. The message on the home page allows you to consent to our cookies policy. If you do not consent, you will be able to access the public pages of the Website but certain functions will be restricted or impossible.

For detailed information, please refer to our ‘cookie policy’.

 

1.3  Children

Our Website is oriented towards adults (such as anyone who is interested in clinical studies, healthcare providers and individuals seeking information related to C-Lys and the services we offer). We do not knowingly collect any information from or about children and request you not to use this Website if you are under 18 years old.

 

1.4 Providing third-person data

You are solely responsible for the information you provide on the C-Lys Website or by telephone to C-Lys personnel. By using the Website you agree only to provide data relating to yourself.

It is only possible to provide data relating to a third person on the C-Lys Website or by telephone to C-Lys personnel in the following exceptional cases:

• If you are the legal representative of a third person (a minor or an incompetent person)
• If you are a physician providing data of one of your patients

In both the above cases, C-Lys is not responsible for the registration of third-person data. If you provide data of a third person to C-Lys, you take full responsibility for any authorization required for the provision and transfer of data concerning a third person. In addition, you undertake to conscientiously respect the rights of this third person, including those described herein.

 

1.5 Changes

This Privacy Policy is in line with the use and capabilities of our Website. It is possible that we may change our Privacy Policy based on feedback from customers or potential study subjects and changes in our services. When we publish changes to our policy, we will change the date of the "last update" of our Privacy Policy. We will report significant changes on our homepage. Nevertheless, we encourage you to read our Privacy Policy periodically.

 

1.6 Questions and feedback

We regularly review our compliance with this Privacy Policy. If you have questions about this Privacy Policy, please contact us via the contact form of via the contact details below:

Our address: Drukpersstraat 4, 1000 Brussels, Belgium

Our telephone number: +34 917 081 250

Additionally, you can also contact our Data Protection Officer via GDPR.PatientJourney [at] pivotalcr.com