Notice
Participation
Foundry Health's participation in the privacy shield can be found in this list of registered parties - https://www.privacyshield.gov/list.
Types of Personal Data
Foundry Health may collect names, email addresses, telephone numbers and other contact information of its customers, partners, suppliers
and other entities that it interacts with in order to conduct its normal business activities.
When conducting clinical trials using Foundry Health's software, our customers may collect extensive personal, private information about
clinical trial participants including detailed medical information. This may include, but not be limited to:
- address and contact details
- next of kin
- family doctor
- medical and surgical histories
- gender
- sexual orientation
- reproductive histories
- substance and medication usage
- laboratory results including e.g. HIV or Hepatitis status
- vital signs information (blood pressure, heat rate, respirations, temperature etc.)
- diagnostic results - scans, ECGs, X-rays etc
- dietary preferences
- past clinical trial participation
- behavioural observations and other notes collected by healthcare professionals and their support staff
The scope, nature and content of this information is entirely at the discretion, and under the control of, the customer using the
software.
Commitment
Foundry Health commits to submitting all personal data received from the EU and Switzerland to the following Privacy Shield principles as
detailed below:
- Notice
- Choice
- Accountability for Onward Transfer
- Security
- Data Integrity and Purpose Limitation
- Access
- Recourse, Enforcement, and Liability
Purposes
Foundry Health may use personal information (email addresses, telephone numbers etc.) of its customers, partners and suppliers to send
them
(or correspond with them on) invoices, marketing information, newsletters and surveys and to interact with them in the course of normal
day-to-day business activities as agreed between the parties.
Customers may request that we host personal information about their clinical trial participants for them using third-party hosting
services. Typically such hosting will be in the customer's region. Customers in the EU and Switzerland can specify that their data should
be
hosted in the EU. Thus, data of clinical trial participants need not normally reside in the US, but may be accessed by authorised
Foundry Health for support purposes.
Personal data of clinical trial participants may be temporarily located in the US for the purposes of processing for migration from
legacy
systems and services to Foundry Health's systems and services. Once migrated, residual and redundant personal data will be securely
destroyed, leaving the only copies of the data within the EU.
Inquiries and Complaints
Any inquiries or complaints falling under the scope of this policy should be emailed to privacy@foundryhealth.com.
Inquiries or complaints will be responded to within 45 days.
Third Parties
Foundry Health uses a number of hosted services to support its business needs. These include, but are not limited to services for
performing financial accounting, marketing, surveying, meeting organisation, project management and similar business processes. These
services may hold or use a customer's personal information.
Foundry Health may use hosting providers to manage a customer's instance of it's software and to host clinical trial participant personal
information.
Each such service or provider is required to comply with the EU-US Privacy Shield principles.
Access to Personal Data
Customers, who are individuals from the European Union or Switzerland may contact Foundry Health via privacy@foundryhealth.com to access their personal
data.
Clinical trial participants from the European Union or Switzerland whose personal data may be held by a Foundry Health customer, in one
of
Foundry Health's hosted systems, will be referred to that customer if they wish to access their personal data.
Foundry Health will not directly grant access to personal data of clinical trial participants from the European Union or Switzerland.
This
must be requested of, and provided by, the customer in compliance with any applicable local laws, requirements and best practices.
Foundry Health will use reasonable efforts to support clinical trial participants from the European Union or Switzerland in
contacting
it's customer, so that they may access their personal data.
Limiting the use of Personal Data
Customers, who are individuals from the European Union or Switzerland may contact Foundry Health via privacy@foundryhealth.com to request that the use
of
their personal data be constrained or restricted.
Clinical trial participants from the European Union or Switzerland whose personal data may be held by a Foundry Health customer, in one
of
Foundry Health's hosted systems, will be referred to that customer if they wish to limit the use of their personal data.
Foundry Health will use reasonable efforts to support clinical trial participants from the European Union or Switzerland in
contacting
it's customer, so that they may limit the use of their personal data.
Dispute Resolution
In compliance with the EU-US and Swiss-US Privacy Shield Principles, Foundry Health commits to resolve complaints about your privacy and
our collection or use of your personal information at no cost to the individual.
European Union and/or Swiss individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Foundry
Health at 1350 14th Ave, Suite 1, Grafton WI 53024, USA, telephone (+1) 855.834.8563, email privacy@foundryhealth.com.
Foundry Health has further committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution
provider
located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not resolved your
complaint, please contact or visit https://www.jamsadr.com/eu-us-privacy-shield for
more information or to file a complaint. The services of JAMS are provided at no cost to you.
Enforcement
While joining the Privacy Shield is voluntary, Foundry Health has made the public commitment to comply with the Framework’s requirements,
and that commitment is enforceable under US law.
The Federal Trade Commission (FTC) has jurisdiction over Foundry Health’s compliance with the Privacy Shield.
Arbitration
Please note that if your complaint is not resolved through the Dispute Resolution process described above, under limited circumstances, a
binding arbitration option may be available before a Privacy Shield Panel. For more information, and to file a claim, please see the International
Centre for Dispute Resolution, the international division of the American Arbitration Association (ICDR-AAA) at http://go.adr.org/privacyshield.html.
Disclosure
Foundry Health may be required to disclose personal information in response to lawful requests by public authorities, including to meet
national security or law enforcement requirements.
Liability for Onward Transfers
Foundry Health acknowledges that it has a responsibility to protect personal information, in the event that it is passed on to a third
party.
Availability
This privacy policy shall be obviously and readily available to individuals on Foundry Health's website - http://www.foundryhealth.com
Choice
Individuals may choose (opt out) whether their information is:
- to be disclosed to a third party or
- to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently
authorized by the individuals.
See 'Limiting the use of Personal Data' above.
Foundry Health may disclose personal information to a third party, when that party is acting as an agent to perform task(s) on behalf of
and under the instructions of Foundry Health. Foundry Health shall enter into a contract with the agent.
Sensitive information (EU) would include personal information specifying medical or health conditions, racial or ethnic origin, political
opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual.
Additionally
in Switzerland it would include ideological views or activities, information on social security measures or administrative or
criminal
proceedings and sanctions, which are treated outside pending proceedings.
Foundry Health will not collect, store or process sensitive information about it's customers in the EU or Switzerland. It will not
disclose
such information to a third party, nor will it use such information for any purpose.
Where Foundry Health customers collect sensitive information from individuals in the EU or Switzerland using it's systems, those
customers must obtain affirmative express consent (opt in) from individuals for such information is to be (i) disclosed to a third party
or
(ii) used for a purpose other than those for which it was originally collected or subsequently authorized by the individuals through the
exercise of opt-in choice.
In addition, Foundry Health will treat as sensitive any personal information received from another party where the other party identifies
and treats it as sensitive.
Accountability for Onward Transfer
Controller
Foundry Health may utilise third parties acting as a controller. Foundry Health will comply with the Notice and Choice
Principles.
Foundry Health will enter into a contract with such a third-party controller. The contract may take the form of a formal Business
Associate Agreement (BAA) signed by both parties or an implicit contract comprising formal terms and conditions as published by the
third-party controller.
Controllers are required only to process personal information in accordance with the purposes specified in the contract, to provide
the same level of protection as the Principles and to notify Foundry Health if it can no longer meet these requirements.
Should this, be the case, the third-party will either remediate the situation or cease processing personal information for Foundry
Health.
Agent
Foundry Health may utilise third parties acting as an agent.
Agents are required only to process personal information for limited and specified purposes and to provide the same level of protection
as
the Principles.
Foundry Health will take reasonable and appropriate steps to:
- ensure that the agent effectively processes the personal information transferred in a manner consistent with Foundry Health’s obligations under the Principles
- require the agent to notify Foundry Health if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Principles
- upon notice, take reasonable and appropriate steps to stop and remediate unauthorized processing
- provide a summary or a representative copy of the relevant privacy provisions of its contract with that agent to the Department upon request.
Security
Foundry Health will take reasonable and appropriate measures to protect personal information from loss, misuse and unauthorized
access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the
personal
data.
While Foundry Health strives to use commercially acceptable means to protect personal information, Foundry Health does not guarantee the
confidentiality of any communication or material transmitted by the internet or other global computer networks or transmitted by
electronic
mail or facsimile transmission among customers, licensees, users and/or individuals in the EU or Switzerland and Foundry Health.
Data Integrity and Purpose Limitation
Personal information will be limited to the information that is relevant for the purposes of processing. Foundry Health will not process
personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the
individual. To the extent necessary for those purposes, Foundry Health will take reasonable steps to ensure that personal data is
reliable for its intended use, accurate, complete, and current. Foundry Health will adhere to the Principles for as long as it
retains
such information.
Information may be retained in a form identifying or making identifiable the individual only for as long as it serves a purpose of
processing as described above. This obligation does not prevent Foundry Health from processing personal information for longer
periods
for the time and to the extent such processing reasonably serves the purposes of archiving in the public interest, journalism, literature
and art, scientific or historical research, and statistical analysis. In these cases, such processing shall be subject to the other
Principles and provisions of the Framework. Foundry Health will take reasonable and appropriate measures in complying with this
provision.
Access
Foundry Health will provide individuals with access to personal information about them that it holds and allow them to correct, amend, or
delete that information where it is inaccurate, or has been processed in violation of the Principles, except where the burden or expense
of
providing access would be disproportionate to the risks to the individual’s privacy in the case in question, or where the rights of
persons
other than the individual would be violated.
Recourse, Enforcement, and Liability
Foundry Health commits to:
- the provison of readily available independent recourse mechanisms by which each individual’s complaints and disputes are
investigated and expeditiously resolved at no cost to the individual and by reference to the Principles, and damages awarded where the
applicable law or private-sector initiatives so provide;
- follow-up procedures for verifying that the attestations and assertions we make about our privacy practices are true and that privacy
practices have been implemented as presented and, in particular, with regard to cases of non-compliance; and
- obligations to remedy problems arising out of failure to comply with the Principles.
Foundry Health and its selected independent recourse mechanisms will respond promptly to inquiries and requests by the Department of
Commerce (DoC) for information relating to the Privacy Shield. Foundry Health will respond expeditiously to complaints regarding
compliance with the Principles referred by EU Member State authorities through DoC.
Foundry Health commits to arbitrate claims and follow the terms as set forth in Privacy Shield Annex I,
provided that an individual has invoked binding arbitration by delivering notice to us at issue and following the procedures and subject
to
conditions set forth in Annex I.
In the context of an onward transfer, Foundry Health has responsibility for the processing of personal information it receives under
the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf.
Foundry Health shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent
with
the Principles, unless we prove that it is not responsible for the event giving rise to the damage.
Should Foundry Health become subject to an FTC or court order based on non-compliance, we shall make public any relevant Privacy
Shield-related sections of any compliance or assessment report submitted to the FTC, to the extent consistent with confidentiality
requirements.
Definitions
- “Personal data” and “personal information” are data about an identified or identifiable individual that are within the scope of the
Directive (EU Directive 95/46/EC), received by an organization in the United States from the European Union, and recorded in any
form.
- “Processing” of personal data means any operation or set of operations which is performed upon personal data, whether or not by
automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use,
disclosure
or dissemination, and erasure or destruction.
- “Controller” means a person or organization which, alone or jointly with others, determines the purposes and means of the processing
of
personal data.
