P1vital is the data controller for the information you provide during a study where P1vital is acting as the Sponsor, and P1vital is the data processor for the information you provide during a study where P1vital is acting as the CRO.
Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.
We use personally-identifiable information to conduct research to improve health and care. As a provider of products and services to healthcare organisations we have a legitimate interest in using information relating to your health and care for research studies, when you agree to take part in a research study. This means that we will use your data, collected in the course of a research study, in the ways needed to conduct and analyse the research study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.
The Participant Information Sheet for the research study will provide more detailed information on what information is collected and why.
If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner's Office (ICO).
You can contact our Data Protection Officer at firstname.lastname@example.org.
Data processors are third parties who provide elements of our clinical research study service for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us without our consent and only then on the basis that we are satisfied that the sub-processors they use are subject to equivalent obligations relating to the security of your data and subject to a GDPR compliant Data Processing Agreement. They will hold it securely and retain it for the period we instruct.