1. Introduction

Center d’Études Cliniques Ltée (“we”, “us” or “our”) are concerned about the protection of your personal data. This privacy policy applies to, but is not limited to, the following stakeholders: prospective clients, customers and volunteers. We are committed to protecting all your personal information and this is our top priority. In this respect, we undertake to process all data in accordance with:

Article 21, of the “Data Protection Act 2017” (for which an annual fee is allocated), on the protection of individuals with regard to the processing of their personal data and on the free movement of such data,

General Data Protection Regulation “GDPR” ((EU) 2016/679) (hereinafter referred to as the “Regulation”).

Procedures have also been put in place to review and monitor the use of personal information to ensure that data processing practices comply with local data protection, “The Data Protection Act 2017” (Mauritius).

http://dataprotection.govmu.org/English/Legislation/Pages/Data-Protection-Act-2017-.aspx

  1. Purpose of the privacy policy

The general purpose of this policy is to inform you about how we collect and process your personal information, which includes data you provide via the website or by other means. We may process your personal data for our legitimate business interest, namely clinical trials.

We respect your right to privacy and the following statement sets out how we collect and process your personal information. The policy applies to www.centredetudescliniques.com and Centre d’Études Cliniques Ltée (CEC).

By using the CEC website, you consent to the collection and use of information in accordance with this policy. Unless otherwise specified in the Privacy Policy, terms used in this Privacy Policy have the same meaning as in our Terms and Conditions and Cookie Policy, available at www.centredetudescliniques.com.

  1. Personal data storage site

Your personal data is collected by CEC, registered with the “Registrar of Companies” under registration number C17149694, whose registered office is located at 6, Lancaster Court, Rue Lavoquer, Port Louis 11328, Mauritius.

CEC has put in place appropriate security measures to prevent your personal information from being lost, used, altered, disclosed or used unintentionally/illegally. In the same line, access to your personal data is limited only to those persons who have signed a confidentiality agreement for the non-disclosure of personal data.

  1. Communication delegate

The CEC has appointed a member of staff to act as a correspondent on behalf of Mrs Sadiyah Joomun. If you have any questions, require clarification or wish to make use of your rights, you can contact the delegated person, who is available at all times at the following e-mail address: [email protected]

If you have a complaint about this privacy policy or if you believe that your rights have been violated, please contact us and we will take the necessary measures as soon as possible. However, nothing prevents you from contacting the supervisory authority in charge of data protection in Mauritius, which is the Data Protection Office (5th floor, Tour SICOM, Rue Wall, Ebène Cyber City, Republic of Mauritius).

  1. Personal information we collect

a. Personal data

Personal data or information is information about an individual from which that individual can be identified.

(https://ico.org.uk/media/fororganisations/documents/1554/determining-what-is-personal-data.pdf)

We may require your personal information in connection with services managed by CEC as an independent contract research organization (CRO). This may include, but is not limited to, your first and last name, telephone number, address, state, province, postal code, city, e-mail address, etc. Study volunteer data is treated with the utmost discretion and is provided in a non-identified format (a format in which a person’s identity cannot reasonably be identified) in order to preserve the volunteer’s right to confidentiality.

Your personal data is of the utmost importance to us and if you do not provide the correct and appropriate personal data, you will be considered unethical and this information will be processed incorrectly. Consequently, any misleading information will result in the cancellation / rejection of bona fide registrations of our operations / acts.

Therefore, it is your duty to inform us as soon as possible of any changes concerning your personal data.

b. Use of personal data

Your personal data is collected by the CEC in accordance with its operations, and the data is processed in accordance with customer requirements and within the framework of our services, which include the selection and inclusion of volunteers, the collection of medical data, statistical analyses and results, among others.

c. Recipients of your personal data

Your personal data disclosed to us is strictly confidential and intended exclusively for CEC operations. Under no circumstances will data be transferred or leased to unauthorized third parties, unless authorized by CEC management. Data is restricted to CEC personnel and may not be used for commercial or non-clinical purposes.

d. How long we keep your personal data

CEC is responsible for retaining your personal data for a period strictly necessary for the performance of its operations, which includes the purpose of satisfying legal requirements, accounting or reporting procedures.

In order to determine the necessary retention time of your personal information, the nature, amount and sensitivity of your personal information, the risk of harm resulting from manipulation or unlawful disclosure of your personal information, are primarily taken into account and are in accordance with CEC’s established procedures.

Basic information on our customers, suppliers/partners, employees (including contact details, identity and transaction information) is kept for at least 10 years after their termination of contract with us for tax and legal purposes. Volunteers’ personal data is kept for at least 5 years if they have not participated in any study, or 10 years from the date of the last participation.

Under certain conditions, you can exercise your rights under the Data Protection Act 2017 (Part VII) and the GDPR (art. 12-23) relating to your personal data.

e. Inquiry into your personal data

If you request access to your personal data (or the need to exercise other rights), you may do so free of charge. However, a reasonable fee may be charged or we may refuse to take the action requested if your request is deemed unjustified, repetitive or excessive. If your identity is deemed questionable, we may ask you to provide additional information to confirm your identity before granting you access to your personal data. However, if we refuse your request, we will inform you in writing of the reason for the refusal. We will try to respond to all reasonable requests within one month. However, it may be possible to take longer than one month to respond to your request, depending on the complexity and number of requests made. (Section 37, Data Protection Act 2017).

f. Rights to your personal data

In accordance with the “Data Protection Act 2017” and the “RGDP”, you have certain rights that you can exercise in relation to your personal data.

Right of access

You have the right to request access to your personal data. This allows you to have a copy of your personal information that we hold and information about the purpose of the data processing. You may also request the correction and erasure of your personal data or object to such processing. You also have the right to lodge a complaint with a supervisory authority regarding unauthorized processing.

Right of rectification

You have the right to rectify any incomplete or inaccurate information relating to your personal data in our database. However, certain procedures will be applied to ensure the accuracy of the new data provided.

Right to erasure

You are entitled to request the erasure of your personal information if the data becomes obsolete for processing or if you no longer wish your personal information to be processed. You may also exercise this right if you object to the data being processed or if the data has been processed unlawfully. However, in some cases we may not be able to comply with your erasure request for specific legal reasons, which will be communicated to you as appropriate.

Right to restrict processing

  • You have the right to ask us to restrict the processing of your personal data if,
  • You dispute the accuracy of your personal data,
  • You want us to delete your personal data in the event of unlawful processing,
  • You wish us to retain your personal data, even when not requested to do so, for your need to establish, exercise or defend legal claims,
  • We are obliged to check whether we have the legal basis in force to use it, even if you object.

Right to object

You may object, for legitimate reasons, to the processing of your personal data. You are also entitled to object to the processing of your personal data if we process it for direct marketing purposes. We will no longer process your personal data unless we present legal purposes revoking your interests, rights and freedom.

Right to data portability

You have the right to request that we transfer your personal data to you or to another data controller (third party) in a commonly used machine-readable format. However, this request will be processed lawfully and will only relate to automated information initially provided as part of our consent to use or contract with you.

You can exercise your rights by contacting our data manager by e-mail at the following address: [email protected]

g. Transfer of your personal data

Your information, including personal data, may be transferred to and stored on systems located outside your state, province, country or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction. If you are a foreign resident and choose to provide us with information, please note that we transfer data, including personal data, to Mauritius and process it there. Your consent to this Privacy Policy, followed by your submission of such information, represents your agreement to this transfer. We have taken all necessary and reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy. No transfer of your personal data will be made to any organization or country unless we are satisfied that there are adequate controls in place at those locations, including the security of your data and other personal information.

h. Disclosure of your personal data

Some of your personal data may be shared with third parties, primarily with our customers, in accordance with our legitimate business interests. However, the personal information shared will be in a format devoid of identity, so that your shared personal data will remain anonymous.

CEC may also disclose your personal information in good faith that such action is necessary:

  • To comply with a legal obligation.
  • To protect and defend the rights or property of CEC.
  • To prevent or investigate possible misconduct related to the Service.
  • To protect the personal safety of Service users or the public.
  • To protect against legal liability.
  1. Adjustment of purpose

Your personal data will be used for the sole purpose of our business framework, unless, for another justified reason compatible with its original purposes, we can logically consider using it otherwise. Should you require any further explanation regarding this new adjustment and its processing, you may contact our data controller.

In the event that we need to use your personal information for unrelated purposes, we will inform you and explain the legal framework that allows us to do so.

  1. Automated interaction technologies

We may collect information such as usage and activity on our website using cookies and other similar tracking technologies. Please see our cookie policy for more information.

  1. Children’s privacy

Our service is not directed at persons under the age of 16 (“children”) in accordance with the Data Protection Act 2017 (section 30), without the consent of their respective parents or guardians. We do not knowingly collect personally identifiable data from anyone under the age of 16. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we will take steps to delete this information from our system.

  1. Service providers

We may subcontract a third party (companies and/or individuals) to perform “part” or “all” of our core business (“Service Providers”). Accordingly, contracted third parties will have access to your personal data only to perform the specified tasks on our behalf and are required not to disclose or use it for any purpose in accordance with our legally binding confidentiality agreement.

  1. Changes to data protection policy

We may update our privacy policy from time to time and any changes made will be communicated to you by posting the new privacy policy on this page. We will notify you by e-mail and/or visible notice on our service prior to the change taking effect and will update the “Effective Date” at the top of this Privacy Policy. We encourage you to periodically review this Privacy Policy to stay informed of any changes. Changes to this Privacy Policy are effective when posted on this page.

  1. Contact us

The CEC will respond to all your questions and comments regarding clarification or explanation of this privacy policy. We remain at your disposal:

By e-mail: [email protected]

By post: Centre d’Etudes Cliniques Ltée,

6 Lancaster Court, Lavoquer Street,

Port Louis 11328, Mauritius

By telephone: (230) 214 14 05