SAFE HARBOR PRIVACY POLICY
At Outcome Sciences, Inc. d/b/a Outcome, we value the relationships we have with our customers and respect the privacy of our employees, consumers, business partners and others who may use our services, including individuals participating in clinical research studies.
We have implemented this Safe Harbor Privacy Policy to describe our approach to satisfying the privacy principles with respect to transfers of personal information from the European Union and Switzerland to the United States.
Introduction
The European Union’s (EU) privacy legislation, the Directive on Data Protection (95/46/EC), became effective in October 1998. The privacy legislation of Switzerland (Federal Act on Data Protection) became effective in June 1992. Both privacy legislations require that transfers of personal information take place only to countries that provide an “adequate” level of privacy protection. The U.S. Department of Commerce has made separate agreements with the European Commission (in June 2000) and the Federal Data Protection and Information Commission of Switzerland (in December 2008) for a set of data protection principles and frequently asked questions to enable companies located in the U.S. to satisfy the requirement that adequate protection be given to personal information transferred from the EU or Switzerland to the U.S.
For more information about the Safe Harbor Framework and Outcome’s certification, please visit the U.S. Department of Commerce’s website at http:www.export.gov/safeharbor.
Definitions
“Individual” means any person located in the European Union or Switzerland whose Personal Information is shared with Outcome in the United States.
“Outcome” refers to Outcome Sciences, Inc. d/b/a Outcome, its subsidiaries and affiliates located in the United States.
“Personal Information” means any information or set of information received by Outcome from the EU or Switzerland that identifies or could be used by or on behalf of Outcome to identify an Individual covered by the Safe Harbor Framework. Personal Information does not include information that (i) is anonymized, (ii) consists solely of professional information (e.g., work address, professional email address, etc.) or (iii) is publicly available and which has not been combined with non-public personal information.
“Principles” mean the enumerated principles outlined in the Safe Harbor Framework, which must be followed in order for an organization to be certified under the Safe Harbor Framework.
“Safe Harbor Framework” includes either or both of the U.S. Department of Commerce U.S. – European Union Safe Harbor program and the U.S. Department of Commerce U.S. – Switzerland Safe Harbor program.
“Sensitive Information” is a subset of Personal Information that specifies (i) medical or health conditions, (i) personal sexuality, (iii) racial or ethnic origin, (iv) political opinions, (v) religious, ideological or trade-union related views or activities or (vi) information on social security measures or administrative or criminal proceedings and sanctions, which are treated outside pending proceedings.
Scope
This policy applies to Personal Information, either in electronic or paper form, received by Outcome in the United States from the EU or Switzerland.
This policy does not apply when Personal Information is obtained by Outcome:
1. Pursuant to a written consent from an Individual (e.g., an Individual participating in a research study that signed an informed consent form, an Individual seeking employment with Outcome that signed a job applicant consent form, etc.);
2. Under an agreement that contains the requisite Model Contract Clauses approved by the European Commission with respect to the Personal Information; or
3. When necessary for the performance of a contract (e.g., an employment contract) between the Individual and Outcome.
Safe Harbor Privacy Principles
This policy is based upon the Principles. Outcome has voluntarily self-certified to, is committed to and adheres to the Principles in order to meet the Safe Harbor Framework’s requirements for the protection of Personal Information.
Notice
Below, please find information about the purposes for which Outcome collects and uses Personal Information, how to contact Outcome with any inquiries or complaints, the types of non-agent third parties to which Outcome discloses the Personal Information and the choices and means Outcome offers for limiting the use and disclosure of Personal Information..
Purpose of Collection and Use of Personal Information
For Individuals participating as subjects, clinical investigators or other study personnel in research studies being managed by Outcome, Personal Information may be used in order to carry out the applicable stud(ies) and other study-related services. This may include the transfer of such Personal Information to the applicable study sponsor and business partners performing services related to the study (e.g., study data management, clinical research monitoring services, etc.). We also may use the Personal Information to comply with our legal obligations, policies and procedures and for internal administrative purposes.
For Individuals that are employees or potential employees of Outcome, we will process Personal Information to carry out and support our human resources functions and activities, administer employee participation in benefits, compensation and human resources plans and programs, manage employee performance, implement, investigate and report on compliance and discipline procedures and matters, and comply with our legal obligations, policies and procedures.
For Individuals sharing Personal Information with Outcome in order to inquire about or otherwise make use of our services, we will use such Personal Information in order to provide you with the information, products, and/or services you request. Such uses may include processing requested transactions, improving the quality of our services, sending communications about our products and services, enabling our business partners to perform certain activities on our behalf and complying with our legal obligations, policies and procedures and for other internal administrative purposes.
Choice
By using the manners described in the “How To Contact Us” section below, Individuals will have the opportunity to choose (opt out) whether their Personal Information is to be disclosed to a non-agent third party or to be used for a purpose that is incompatible with the purposes for which it was originally collected.
For Sensitive Information, Outcome will provide Individuals the opportunity to affirmatively or explicitly choose (opt in) whether their Sensitive Information is to be disclosed to a non-agent third party or to be used for a purpose that is incompatible with the purposes for which it was originally collected, except to the extent such opt-in is not required by applicable law or regulation.
In some cases, even if an Individual opts out of disclosures of their Personal Information, we still may disclose such Personal Information if we are required to do so by law, if disclosure is made to law enforcement authorities, if we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity. Outcome also may transfer Personal Information in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, Outcome will direct the transferee to use Personal Information in a manner that is consistent with this Policy.
Onward Transfer (Transfers to Third Parties)
Outcome may use agents (third parties that perform tasks on behalf of and under the instructions of Outcome) to process Personal Information. In these cases, Outcome will only transfer Personal Information to the agent after obtaining assurances from the agent that they will safeguard Personal Information in a manner consistent with applicable laws and regulations and the Safe Harbor Framework. This may include ascertaining that the agent has certified to the Safe Harbor Privacy Framework and the Principles, is subject to the EU Data Protection Directive for the EU or the Federal Act on Data Protection for Switzerland or another adequacy finding, or enters into a written agreement with the agent requiring that the agent provide at least the same level of privacy protection as required by the relevant Principles. Where Outcome has knowledge that an agent is processing Personal Information inconsistent with this policy, Outcome will stop making further disclosures to such agent and will make any breach notifications required by applicable laws, regulations and Outcome internal policies.
Security
Outcome employs reasonable safeguards, including physical, electronic and administrative safeguards, to protect Personal Information in our possession from loss, misuse and unauthorized access, disclosure, alteration and destruction.
Data Integrity
Outcome will use Personal Information only in ways that are relevant and consistent with the purposes for which it was originally collected, and will adopt reasonable safeguards to help ensure that the Personal Information is reliable for its intended use, accurate, complete and current.
Access to Personal Information
If an Individual becomes aware that the Personal Information we maintain about him or her is inaccurate, or if an Individual would like to update or review his or her information, the Individual may contact us in accordance with the “How To Contact Us” section below. We will permit Individuals to correct, amend or delete Personal Information that is demonstrated to be inaccurate; however, we may limit or deny access to Personal Information where the burden or expense of providing such access would be disproportionate to the risks to the Individual’s privacy in the circumstances, or as otherwise permitted by the Safe Harbor Framework. In addition, due to regulatory, ethical, statistical or contractual requirements, we may not be able to provide Individuals, including research study subjects or investigators, with access to Personal Information contained within research data and study databases.
Enforcement and Dispute Resolution
Outcome has established procedures for periodically verifying implementation of and compliance with the Principles. We conduct an annual self-assessment of our practices with respect to Personal Information to verify that representations we make about our Personal Information privacy practices are true and that related privacy policies have been implemented as represented.
Individuals may file a complaint with Outcome in connection with the processing of their Personal Information under the Principles. Outcome will conduct an internal investigation and attempt to resolve any such complaints. In the event a complaint is not resolved to the Individual’s satisfaction, Outcome will also cooperate with the arbitration process under the commercial rules of the American Arbitration Association. For complaints concerning our handling of the Personal Information of employees, we cooperate with the relevant EU data protection authorities or Swiss Federal Data Protection and Information Commissioner, as applicable.
How to Contact Us
If you would like to exercise any of your rights specified above (including those of Choice and Access to Personal Information as described above), or if you have any questions or concerns regarding this policy or our privacy practices concerning Personal Information, please contact Outcome as follows:
Writing to: Outcome Sciences, Inc.
Attention: Legal and Regulatory Affairs Department
201 Broadway
Cambridge, Massachusetts 02139 USA
or
Calling: Outcome Sciences, Inc. Legal and Regulatory Affairs Department
+1 (617) 621-1600
Or toll-free at +1 (888) 526-6700
Changes to This Safe Harbor Privacy Policy
Outcome will regularly review this policy to ensure that it provides an appropriate level of protection for Personal Information in accordance with the Safe Harbor Framework. Outcome may amend or alter this policy without notice from time to time, consistent with the requirements of the Principles. All amendments will be posted on this website. Please check back periodically for updates to this policy.
This policy was last updated on August 12, 2011.
