Privacy notice for the EASi-KIDNEY trial staff

The Chancellor, Masters and Scholars of the University of Oxford (hereinafter 'Oxford') and Boehringer Ingelheim International GmbH (hereinafter "Boehringer Ingelheim"), (collectively 'we', 'our', 'us') take the protection of your personal data seriously. Oxford and Boehringer Ingelheim are joint data controllers with respect to our processing of your personal data for the purposes of the EASi-KIDNEY^TM Trial. We will only process your personal data in accordance with applicable data protection and privacy laws. 

With this Privacy Notice (Version 1.0, 12 April 2023) we inform you how we will use, store and disclose (together 'process') personal data collected about you in the context of your involvement in the EASi-KIDNEY^TM Trial.

1. Types of personal data

In connection with the EASi-KIDNEY^TM Trial, we are processing the following categories of personal data: name, date of birth, work experience and professional qualifications, specialisations, board certification, publications, resumes (also known as curriculum vitae or CVs) and educational background, contact information (e.g. phone, fax, email, business address), your participation in the EASi-KIDNEY^TM Trial and your role (e.g. Principal Investigator, pharmacist, research co-ordinator etc.), and associated clinical site(s)/centre(s).

2. Purposes for which we process your personal data

We will process your personal data for the following purposes ^1,2. 

a) Administering and conducting the EASi-KIDNEY^TM Trial pursuant to the respective protocol including data entered onto the EASi-KIDNEY^TM Trial web-based systems, monitoring, source data/document verification, audits, pharmacovigilance and related risk management according to applicable laws and Good Clinical Practice as provided by the International Conference on Harmonisation (ICH).

b) Sharing with ethics committees/institutional review boards and governmental or regulatory authorities, such as the United States Food and Drug Administration (FDA) and the European Medicines Agency (EMA) or reimbursement authorities where necessary to fulfil legal and regulatory requirements, namely when required:

• in an application, approval, inspection or other regulatory procedure,
• in a Health Technology Assessment (HTA) / reimbursement procedure,
• to ensure transparency about financial arrangements with investigators (especially as required by the FDA), or
• for pharmacovigilance purposes.

c) Selection of investigators for future studies (personal data shared may include: name and CV etc.) and routine controls with international sanction lists.

d) Providing transparency about the EASi-KIDNEY^TM Trial by:

• Registering the EASi-KIDNEY^TM Trial on www.clinicaltrials.gov (disclosure of data is limited to name or title, telephone number, and email address of the principal investigator for each site) and on www.encepp.eu (disclosure of data is limited to name, address, and email address of the primary (lead) investigator), and
• Sharing of EASi-KIDNEY^TM Trial data, reports and other related documents with third parties in accordance with the principles for responsible data clinical trial data sharing.

e) Processing of personal data arising from your use of the EASi-KIDNEY^TM Trial web-based systems, for example IP addresses and information gathered through cookies (described further below), to ensure that we understand who uses our site and how our site is used, and to improve our system and ensure it is secure.

We may share your personal data for the purposes mentioned above with service providers (including 3rd party electronic Trial Master File providers) and affiliates of Oxford and Boehringer Ingelheim. We may also process your data when you participate in trial-related online meetings using third party tools (such as Zoom, Teams, Voov or others).

Most of the data will be processed in the UK, but some recipients will be based in countries other than the UK and your own, and these may not provide an equivalent level of privacy protection. In compliance with applicable law, we have taken steps to ensure that your data remains secure. For example, we put in place contractual protections that have been approved by competent bodies in the UK. Should you wish to receive more information about these transfers or a copy of the agreements, please contact us using the address information below.

3. Retention of Personal Data

As we are obliged to demonstrate that the EASi-KIDNEY^TM Trial has been conducted in accordance with legal and regulatory requirements, we will store your personal data for at least the period required by regulation (currently twenty five [25] years from trial completion for trials conducted in Europe).

4. Cookies

In the context of your involvement in the EASi-KIDNEY^TM Trial you may be asked to submit data via the EASi-KIDNEY^TM web-based systems used by Oxford. Whilst using the web-based system for data entry, “cookie” technology is used. Cookies are small text files that are placed on your computer by websites that you visit. For more information about cookies you can visit http://www.allaboutcookies.org. The cookie technology we use is limited to that which is required for the functionality of the web-based system; all optional cookies, including for marketing and advertising purposes, are automatically disabled. If your role includes the use of the web-based system Cantata, you will be asked to agree to their Terms of Use on your first log-in to the system, details of the required cookies for Cantata™, built on the Salesforce™ platform, can be viewed on the Salesforce website.

5. Data Protection Rights

You have certain rights with respect to your personal data. These include being able to request access to it, correction of any mistakes in it, deletion of it, restriction of its use, as well as being able to object to any processing of it (i.e. any use of it), or request that it be transferred elsewhere.

However, depending on the circumstances and the nature of your request, it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop, or if on balance our interests in processing your data prevail (for instance, where deleting your information would seriously harm the research).

Please send your request or any question you have in relation to our processing of your personal data to either or both of the following:

In case you still have concerns, you can also contact the supervisory authority for privacy/data protection in your country or in the countries where Oxford and Boehringer Ingelheim are established. For Oxford, this is the Information Commissioner's Office (ICO).

_{1 Boehringer Ingelheim’s legal basis for 2. a), c), d) and e) is Art. 6 (1) e) EU General Data Protection Regulation ("GDPR"). Boehringer Ingelheim’s legal basis for 2. b) is Art. 6 (1) c), f) and Art. 49 (1) e) GDPR.
2 Oxford’s legal basis for 2. a), b), c), d), e) is Art. 6(1) e) GDPR, processing being necessary for research carried out in the public interest.}