Market Research Privacy Policy

Data controller
A data controller is a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the means and purpose of processing personal data (e.g. Inpharmation).

Data processor
A data processor is a person, company, or other body which processes personal data on the data controller’s behalf (e.g. the admin and finance team, HR, or directors).

Data subject
A data subject is an identified or identifiable “natural” person to whom personal data relates (e.g. Inpharmation employees).

Personal data
Any information relating to an identified or identifiable “natural” person (e.g. your name, address, identification numbers, performance reviews, etc.).

Special category data
These are certain types of personal data which are considered to be particularly sensitive and require special protection, including race, ethnic origin, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, and sexual orientation.

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to them and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told them about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told them about.
• Kept securely.

We may collect, store, or use the following categories of personal information about you:

• Personal details such as name, title, gender, address, email, and telephone number.
• Business contact information for health care professionals, such as job title, department, address, email, and telephone number.
• Demographic data, such as educational background, income bracket, and country.
• Voice captured through audio recording.
• For online surveys, we use digital fingerprinting that records your IP address, browser software, and device specifications.

We may also collect, store or use the following “special categories” of more sensitive personal information:

• Health information about the respondent, respondent’s relatives, or respondent’s patients.

Much of the personal information processed for our market research projects is neither collected nor stored by Inpharmation. It is often our fieldwork vendors that provide temporary access to your data in order to make contact for market research. In almost all cases, we do not see or collect this data, but they will process it temporarily on our behalf.

Where we do collect your personal information, we obtain it from you directly when you provide responses in an online survey or indirectly when you respond to a screening questionnaire administered on our behalf. We also collect a “digital fingerprint” when you complete the screening questions to an online survey – but only if you fulfil the screening criteria and there is an available slot in the online survey.

Our end client, the pharmaceutical company that has commissioned the research, may provide a database that contains your personal information, referred to as “target lists”. If this is the case, you will be informed in the online survey or before scheduling an interview, where you will have the opportunity to contact us to opt out of the target list.

In order to contact you for participation in market research, we employ fieldwork and recruitment agencies to send invitations on our behalf. These agencies collect and store your data in order to do so. Where you have been contacted prior to engaging in our market research, the agency’s privacy policy applies.

If you are invited to take part in market research, it will be because of one of the following reasons:

• You have given permission for a company to supply your details to a third party for research purposes.
• You have given permission to be on a market research panel.

If you have been contacted and you do not believe you have given your permission or just wish your name to be removed from the database, please let us know and we will inform the relevant organisation who supplied your details.

Inpharmation collect and process your data for a number of purposes and where we have a legal basis to do so. We will not use your data for any purpose other than for the market research study you have elected to participate in. Crucially, we will not sell any of your personal data.

Processing is based on our legitimate interest
Inpharmation has a legitimate interest in processing your personal data during online surveys in order to maintain security of the survey site.

Processing is based on consent
We will only process data for our market research where you have consented to allow us to do so. You will be provided an opportunity to opt out during pre-screening. If you do opt out, then you will not be able to continue with the study, because it would be impossible to run the research without collecting some personal data.

Where you have provided consent to third parties, such as fieldwork agencies, they or we will use this information to contact you and invite you to participate in a market research study.

Where you have consented during the pre-screening process, we will use your data:

• combined with the responses/views/opinions of others who have participated in the same research and report the results anonymously to the client that commissioned the study (research sponsor).
• to conduct a telephone interview or online survey as part of a market research study.
• to contact you regarding any Product Complaints or Adverse Events reports you may have made during the study.
• to verify the answers you recently provided in a market research study.
• to verify that you are a legitimate respondent and have not attempted to complete the study more than once.

Processing is necessary to fulfil legal obligations
In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, where we are obliged to share your personal information with regulatory bodies which govern our work and services.

In a market research study, different parties come together to form the ‘research chain’. It begins with the research sponsor, the company that decides they want to run a market research project (our client).

Next comes the research agency that designs the survey and will report its findings back to the research sponsor (which is where Inpharmation comes in).

Then comes the fieldwork agency that implements the survey online or over the phone and speaks to respondents all the over the world to collect the opinions and insights that are needed to write the reports.

We may disclose some of your data to the fieldwork agency or agencies in order to fulfil the purposes described above.

We may also disclose your data to our technical service providers, such as web hosting platforms and data storage providers (e.g. Microsoft SharePoint) in order to fulfil the purposes described above.

Generally, the research sponsor will not receive your personal data unless you choose to identify yourself in an interview setting. The research sponsor may observe a live interview and may, consequently, receive some of your data. But they will only be allowed to observe if you have given your explicit consent. You do not have to give your consent to be identified or observed to continue participating in the research.

However, we may have to disclose some of your data to the research sponsor for the purpose of Product Complaint and Adverse Event reporting, as it is a legal requirement.

Fieldwork agencies will typically process your data in the country they are based in. Their privacy notice will be provided at the beginning of the market research study, if you need further details.

The data we collect during the market research study are transferred from your country of origin and stored electronically in the United Kingdom, where we and our data storage facilities are based.

We will sometimes need to transfer your data outside of the UK and European Economic Area (‘EEA’) in order to fulfil our purposes, because our fieldwork service providers or clients are not based in the UK or EEA.

When we do this, we will tell you at the start of the market research study, before processing your data, and get your explicit consent to do so – and any transfer of data will be done securely. The data will only be used in the same way it would be used in the UK or EEA, with the same concern for your rights and your privacy. This will be safeguarded by at least one of these measures:

• the country receiving the data is considered by the UK and EU to provide an adequate level of data protection; this includes countries in the European Economic Area.
• the organisation receiving the data is covered by an arrangement recognised by the UK and EU as providing an adequate standard of data protection.
• the transfer is governed by approved contractual clauses.
• the transfer has your consent.
• the transfer is necessary for the exercise of legal obligations.
• the transfer is necessary for important reasons of public interest.

We only store personal data for as long as necessary to fulfil the purpose for which it was collected. We review the data we hold on a regular basis. If we find the purpose for which we collected it is no longer relevant – we delete it or make it completely anonymised so that it is impossible to identify you as an individual. We also strive to collect only the data we need.

The specific timeframe will vary depending on country-specific requirements, but we typically do not store your data for more than one (1) month after the market research study has concluded. If we have no business or legal need to keep it, we will either delete it securely or anonymise it to ensure no one can ever link you to it.

Any special category data (e.g. health data) is deleted or anonymised as soon as possible and no later than one (1) month after the market research study has concluded.

If you are a healthcare professional, we may need to keep reports of Product Complaints and Adverse Events you mentioned about patients, and your contact details if you consented to provide them, until we are satisfied it was followed-up on properly. Once satisfied, your data will be deleted or anonymised.

You, the Data Subject, have several rights that you can exercise over you data, such as the right to access, correct, and request to delete your personal information, data portability, restricting the processing or objecting to it if it was done under legitimate interests.

You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence (e.g. the Information Commissioner’s Office in the UK), if you consider the processing of your personal information infringes applicable law.

For questions or more information or guidance about your rights please contact dataprivacy@inpharmation.com. Read more information about Data Subject rights below.

Access to your data
You can request access to the information we hold about you, with some limited exceptions, and we will also tell you;

• why we are processing it;
• who are we sharing it with and if any information is transferred to a country not deemed to have adequate protections in place for personal data;
• how long will we be keeping your data;
• the source of the information if it was not collected directly from you;
• if we are using your data for automated decision making or profiling.

If you make a request for a copy of the personal information that we are processing, please be as specific as possible as this will both help us to identify the information more quickly and provide you with a copy without any undue delay.

Rectifying inaccuracies
If you feel the information we hold on you is inaccurate, you can ask us to correct or update it.

Right to be forgotten
You can also request that we erase your information, although that might not always be possible if doing so means we cannot perform our contract with you, or we have a legal obligation or legitimate interest to keep the information. We will explain the consequences of erasing your information.

Restrict the processing
If you feel we are processing your information unlawfully or with inaccurate information, you can ask us to restrict processing. Where Personal Information is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise or defence of legal claims unless we have your consent. If the processing is restricted, we will continue to store the information.

Object to the processing
If you disagree with any legitimate interest or public interest we have relied upon to process your information, you can object to the processing. We will then stop processing the information unless we can demonstrate a compelling legitimate ground that overrides your rights, or the processing is required to establish, exercise, or defend a legal claim.

Data Portability
Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal information is processed by automatic means, you have the right to receive all such personal information which you have provided to Inpharmation in a structured, commonly used and machine‑readable format, and also to require us to transmit it to another controller where this is technically feasible.

Make a complaint
We are committed to safeguarding your data and upholding your rights, but if you feel we have not done that, please contact dataprivacy@inpharmation.com. Additionally you have the right to complain to the relevant supervisory authority, which in the UK is the Information Commissioner’s Office (ICO) at https://ico.org.uk/.

Right to know
You have the right to know what personal information we collect, use, disclose or sell
about you, both at the point of collection and after the fact, including:

• specific pieces of personal information that we have collected about you;
• categories of personal information we have collected about you;
• categories of sources from which we have collected your personal information;
• categories of personal information that we have sold or disclosed for a business
• purpose about you;
• categories of third parties to whom your personal information was sold or disclosed for a business purpose; and
• the business purpose for collecting or selling your personal information.

Right to delete
You have the right to request that we delete certain personal information we hold about
you. This is subject to certain exemptions permitted by applicable law.

Exceptions to your right to delete include, but are not limited to:

• To complete the transaction for which the personal information was collected, provide a service requested by you or that you could reasonably anticipate in the context of our ongoing business relationship with you;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
• Debug to identify and repair errors that impair existing intended functionality;
• To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business; and
• To comply with our legal obligations under the CCPA or other legal obligations.

Right to opt-out
You have the right to opt-out from us selling your personal information. (Note: We do not sell your personal information and have no interest in doing so.)

Right to non-discrimination
You have the right not to receive discriminatory treatment as a result of choosing to
exercise any of your rights under the CCPA as a California Resident.

Exercising your rights
If you have any questions about your exercising your rights, please contact us at dataprivacy@inpharmation.com