Institution Staff Privacy Statement

How We Will Use Your Personal Information

We will use your Personal Information for the following purposes:

• Identification and authentication: we use your identification information to verify your identity when you are assisting with the conduct of clinical trials, and to maintain the security of your Personal Information. We use your Personal Information for this purpose so that we can comply with our contractual obligations with your institution, including to confirm that you are able to provide your services.
• Communicating with you: we will use any of the categories of your Personal Information when we communicate with you, for example if we wish to contact you or your institution in relation to your services or other clinical trial opportunities, or if you contact us with questions. It is in our legitimate interests to be able to provide you with appropriate responses.  It is in our legitimate interests to be able to notify your institution of clinical trials for which it may be suitable and this allows us to fulfill our contractual obligations to your institution in this regard.
• Institution database: we may add your Personal Information to our institution database and use it to identify and notify your institution of clinical trial opportunities. In addition, this allows us to fulfill our contractual obligations to your institution so that we can identify and notify your institution of clinical trials for which it may be suitable.
• Future clinical trials: we may collect and use your contact information and information about your performance to help evaluate clinical studies, investigators, and institutions to be considered and contacted for future clinical trials. For these purposes, your Personal Information may be disclosed to Labcorp's affiliates and third parties that conduct clinical research trials.
• Exercising our rights: we will use any of the categories of your Personal Information to exercise our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims or violations of law or the contract. It is in our legitimate interests to use your Personal Information for these purposes.

When we process Personal Information to meet our legitimate interests (including for the purposes of communicating with you and exercising our rights as set out above), we balance these against your fundamental rights and freedoms and put in place safeguards to protect your privacy.

Your Rights Over Your Personal Information

You have certain rights regarding your Personal Information, subject to local law. These include the following rights to:

• access your Personal Information;
• rectify the Personal Information we hold about you;
• erase your Personal Information;
• restrict our use of your Personal Information;
• object to our use of your Personal Information;
• receive your Personal Information in a usable electronic format and transmit it to a third party (right to data portability); and
• lodge a complaint with your local data protection authority.

We encourage you to contact us to update or correct your Personal Information if it changes or if the Personal Information we hold about you is inaccurate. Please note that we will likely require additional information from you in order to honour your requests.

Please note that should you request that your Personal Information be deleted you may continue to receive materials for a short period while we are updating our lists.

Where we have obtained your consent to process your Personal Information, you have the right to withdraw such consent at any time by contacting us using the details under the section "Contact Us" below.

If you would like to discuss or exercise such rights, please contact us at the details below.

Worldwide Transfer of your Personal Information

Your personal information may be transferred to, stored, and processed in a country other than the one in which it was provided, including the U.S. (i.e., a ‘Recipient’ country). When Labcorp does so, it transfers the information in compliance with applicable data protection laws. Where the applicable data protection laws of your jurisdiction do not recognize the Recipient country as providing an adequate level of data protection, Labcorp will use such lawful mechanisms for the transfer as are approved by the applicable data protection authority of your jurisdiction prior to transferring any of your personal data (e.g., the Standard Contractual Clauses for transfers from the European Economic Area (EEA), the United Kingdom’s International Data Transfer Agreement, Switzerland’s Transborder Data Flow Agreement as applicable). If you wish to see a copy of the relevant mechanism that Labcorp uses to transfer your personal information, please contact us using the contact details set out below.

Third Parties

We may share your Personal Information with third parties under the following circumstances:

• Agents, contractors and business partners: we may share your Personal Information with agents, contractors or business partners of Labcorp that are based locally or abroad in connection with services that these individuals or entities perform for, or with, Labcorp. These agents, contractors or business partners are restricted from using this information other than to provide services for Labcorp, or services for the collaboration in which they and Labcorp are engaged. We may, for example, provide your information to agents, contractors or partners for hosting our databases, or for data processing services such as data analytics, or so that they can send you the information that you requested.
• Affiliates and subsidiaries: Labcorp is owned by Laboratory Corporation of America Holdings (LabCorp), and we work closely with other businesses and companies that fall under the Labcorp and LabCorp Group Companies. We will share your Personal Information with LabCorp and our affiliates and subsidiaries for the purpose of identifying skills, facilities and any other information relevant to the performance of services for clinical trials being conducted by Labcorp and/or its affiliates on behalf of its sponsor(s). For more information about our affiliates and subsidiaries, please visit the Labcorp websites.
• Sponsors: we may share your Personal Information with sponsors of clinical trials to identify skills, facilities and any other information relevant to carry out clinical trials, including compliance with contractual obligations.
• Law enforcement agency, court, regulator, government authority, IEC or other third party: we may share your Personal Information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
• Asset purchasers: we may share your Personal Information with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to make sure that the entity to which we transfer your Personal Information uses it in a manner that is consistent with this Privacy Statement. It is in our legitimate interests to share your Personal Information in connection with a corporate transaction involving our assets and business. When we share your Personal Information to meet such legitimate interests, we balance these against your fundamental rights and freedoms and put in place safeguards to protect your privacy.

Information Security and Storage

We implement technical and organizational measures appropriate to the risk to the Personal Information we process. These measures are aimed at protecting the on-going integrity and confidentiality of Personal Information. We evaluate these measures on a regular basis to confirm the security of the processing.

We will keep your Personal Information for as long as we have a relationship with your institution and for any regulatory period associated with the purpose for collecting your Personal Information.  We will keep your Personal Information for a period of 10 years in our institution database for the purposes of assessing whether you and your institution are suitable for future clinical trial opportunities and notifying you and your institution of those opportunities. When deciding how long to keep your Personal Information, we will retain your Personal Information for a period of time that enables us to:

• Maintain business records for analysis and/or audit purposes;
• Comply with record retention requirements under the law;
• Comply with contractual obligations;
• Defend or bring any existing or potential legal claims;
• Respond to any complaints regarding the services provided by you and your institution.

We will delete your Personal Information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from out systems, we will put in place appropriate measures to prevent further processing or use of the data.

Contact Us

Labcorp is based in the USA and is the controller responsible for the Personal Information that it collects and processes.

If you have any questions or concerns regarding the way in which your Personal information has been used, please contact the Company’s Data Protection Officer at Data Protection Officer, Corporate Compliance Department, 531 S. Spring Street, Burlington, NC 27215 U.S.A. or via email at DPO@labcorp.com. The data protection representative of the Company in the European Union is Labcorp Clinical Development SRL, Avenue du Bourget 501130 Brussels, Belgium. The data protection representative in the United Kingdom is Labcorp Clinical Development Limited, 5 Foundation Park, Roxborough Way, Maidenhead, SL6 3UD.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to your local data protection authority.

Updates and Changes

You may request a copy of this Privacy Statement from us using the contact details set out above. We may modify or update this Privacy Statement from time to time.

If we change this Privacy Statement, we will notify you of the changes. Where changes to this Privacy Statement will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).