New Zealand Clinical Research Privacy Policy

Purpose

NZCR Group Holding Ltd. is committed to protecting your privacy. We value the trust and confidence you place in us when we collect your personal data. Personal data is seen as taonga (something sacred, precious, or significant). At NZCR we actively care for your taonga in a manner that preserves its integrity and value. This privacy policy explains how we may collect, store, use, disclose, and safeguard the personal information you provide to us, and the rights you have to your personal information.

All NZCR staff and contracted third parties are bound by legal and ethical obligations to safeguard clinical trial participants’ privacy and confidentiality. NZCR abides by the New Zealand Privacy Act 2020, Health Information Privacy Code 2020, and National Ethical Standards for Health and Disability Research (NEAC).

Definitions

‘we’,’us’, and ‘our’: In this privacy policy these terms refer to New Zealand Clinical Research (NZCR)

Personal Identifiable Information/Personal Data: The Privacy Commissioner defines personal information as “any information that tells us something about a specific individual. The information does not need to name the individual, as long as they are identifiable in other ways, like through their home address.

Name
Date of birth
Address
IP idenfifiers
Signature and/or initials
IRD number
Photographic identification
National Health Index
Medical / Clinical notes

Sponsor: Means the company organising or paying for the clinical trial

1. Types of Personal Information Collected

The type of personal information NZCR may collect, and hold will depend on the nature of the individual’s relationship with NZCR. Examples include but are not limited to:

Clinical Trial Participant or Potential Participant

1.1 When you register your interest in a clinical trial by completing our registration form, personal and health information is collected. The completion of the registration form is voluntary. The personal information collected on this form may include:

1.1.1 Your name.

1.1.2 Your date of birth.

1.1.3 Y our biological sex at birth.

1.1.4 Your ethnicity.

1.1.5 Your weight and height.

1.1.6 Your contact details, which may include your email address, phone number, and postal address.

1.1.7 Information about your health and any medical conditions and treatments

1.1.8 Information about your lifestyle, such as smoking, alcohol consumption, use of drugs, and diet.

1.2 If you consent to participate in a clinical trial, further personal information is collected about you. This information is voluntary and if you do not wish to take part in a clinical trial, this information is not required. Depending on the specifics of the trial you are taking part in, the following information may be requested:

1.2.1 Photographic identification.

1.2.2 Your signature.

1.2.3 National Health Index (NHI).

1.2.4 Medical records held by your GP or specialist.

1.2.5 Results of medical tests and assessments.

1.2.6 Your race.

1.2.7 Lifestyle information, such as your sexual orientation, use of contraception, smoking, alcohol and drug history, diet, and exercise information.

1.2.8 Family medical history.

1.3 There may be reimbursement for your time during the trial, travel and/or parking. This includes the collection of:

1.3.1 IRD number.

1.3.2 Bank account number.

Candidates seeking employment / Employees / Contractors

1.4 Personal information about employees, prospective employees or contractors that may be collected:

1.4.1 Name, address, email address, contact details.

1.4.2 Date of birth and emergency contacts.

1.4.3 Resume, qualifications, training records and certificates.

1.4.4 Vaccination records, relevant medical information (that may be applicable to the role).

1.4.5 IRD number, bank account number.

1.4.6 Training, performance, termination, terms, and conditions.

1.4.7 Signatures, initials, and other employment details required to fulfil a position.

Third-party Vendor / Suppliers

1.5 Third-party (vendors, suppliers, contractors) personal information collected may include:

1.5.1 Name, address, email address, contact details.

1.5.2 Business records, professional information, qualifications, certificates.

1.5.3 Billing information.

2. How we Collect Personal Information

2.1 Generally, we collect personal information directly from the individual or the information is completed by the individual on our participant registration pages. All information provided to us is voluntary, however, if you do not provide certain information, you may not be able to participate in a clinical trial.

2.2 There may be occasions when we collect information from other sources such as,

2.2.1 To determine potential eligibility for a trial, information may be collected (with consent from you) from your General Practitioner (GP), or other health care professional.

2.2.2 Publicly maintained record or other publicly available sources of information e.g. social media.

2.2.3 Prospective employees are asked to provide referee names and contact details and we may collect personal information from those referees.

2.2.4 Accessing NZCR website will result in some information being logged including the time of access, IP address, and the pages that have been viewed or accessed.

2.2.5 Metadata related to your personal information may be collected as part of you using our web and cloud services.

3. Use of Your Personal Information

3.1 Your personal information may be used for the purposes of:

3.1.1 Establishing and maintaining a database of potential clinical trial participants willing to participate in clinical trials.

3.1.2 Checking your suitability for a current or future clinical trial.

3.1.3 Contacting you to tell you about those trials.

3.1.4 For the conduct and interpretation of the clinical trial.

3.1.5 Giving you updates from NZCR.

3.1.6 Contacting you for marketing purposes.

3.1.7 Requesting voluntary feedback on our services.

3.1.8 Meeting any legal or regulatory requirements.

3.1.9 Taking required action where we suspect that fraud or unlawful activity has been, is being or may be engaged in.

3.1.10 Other clinical trial-related purposes.

3.1.11 Reimbursing you for your time, parking, or travel due to participation in a trial.

3.1.12 Improving the operation, administration, development, or enhancement of the website or other electronic communication.

3.1.13 Client, vendor, and third-party management.

3.1.14 Business relationship management.

3.1.15 Human resource requirements.

3.1.16 Assessing applicants for employment or engaging contractors, consultants, or third-party vendors.

3.1.17 Meeting legal, financial, and regulatory requirements NZCR is subject to.

3.2 Personal information may also be used in aggregated form for marketing and industry analysis purposes, such aggregated information will not include any personally identifiable information.

4. Disclosure of your Personal Information

4.1 We disclose your personal information for the purposes for which it is collected. Only necessary information is disclosed related to the role or activity being performed. This may include;

4.1.1 To our staff to carry out their functions.

4.1.2 To external health care providers for any ongoing care required outside of the clinical trial.

4.1.3 Clinical trial sponsors, or their representatives, who check the clinical trial procedures are being performed correctly by NZCR.

4.1.4 Third-party suppliers and service vendors who support or process data on our behalf.

4.1.5 Our service providers or any business that supports our services, including any person that hosts or maintains an underlying IT system or data centre that we use to provide the website or other services and products.

4.1.6 Other third parties, in an aggregated and/or anonymised form for statistical purposes.

4.1.7 Other persons, including government agencies or regulatory bodies in New Zealand or overseas, as required or authorised by law.

4.1.8 Third parties you authorise to act on your behalf or that are otherwise connected with you (such as your legal representative or other authorised agent or attorney).

4.1.9 Law enforcement agencies.

4.1.10 Finance and Insurance Providers.

4.2 Some of these third parties may not be located in New Zealand and thus we may supply information to parties who may be overseas, even though data protection laws may not be comparable to those in New Zealand By providing NZCR with your personal information, you consent to the collection, processing, disclosure and transfer of your personal information outside New Zealand but only in the manner permitted under this Privacy Policy.

5. Storage and Security of Your Personal Information

5.1 We take the security of the information we collect seriously. The storage of your personal information may be on paper or in a computer database that is confidential, and access controlled. We may also use third party databases and services where your personal information may be stored, including overseas storage of data, and we will take all reasonable steps to ensure our third-party databases are protected by provisions comparable to the New Zealand Privacy Act 2020.

5.2 We will take all reasonable steps to protect personal information that is held by us from unauthorised access, use, disclosure, alteration, or destruction. However, we cannot guarantee that the measures we maintain will ensure the security of personal information.

6. Use of Social Media and Website

6.1 NZCR uses social media pages that are in the public domain, so to protect your security and privacy, personal information should not be posted on our social media pages.

6.2 NZCR reserves the right to moderate or remove comments, posts, images, links, or other contributions that are, or could reasonably be seen as inappropriate, misleading, breach of privacy, too much information, images that don’t belong to you, or any information that is harmful or does not comply with social media terms of use.

6.3 We may use cookies (an alphanumeric identifier that we transfer to your computer’s hard drive so that we can recognise your browser) to monitor your use of the website for the purposes of providing more customised content to you on our website and conducting business and marketing analysis. All information collected via cookies will be held by us. This information will not be made available to any third party in a manner that enables you to be identified. If you do not wish to allow cookies, you may disable cookies by changing the settings on your browser, although this may mean that you cannot use all the features of the website.

7. Closed Circuit Television (CCTV)

7.1 CCTV cameras are in operation at NZCR. The CCTV Policy explains why we use CCTV cameras and how. If you wish to view this policy, please contact the Privacy Officer.

8. Your Rights to Access, Correct or Delete Your Personal Information

8.1 You have the right to request access to the personal information we hold about you, and seek corrections if you think the information we hold is not accurate.

8.2 NZCR will comply with the request as required under the Privacy Act 2020, Health Information Code of Practice 2020, clinical trial regulations or other relevant legislation.

8.3 To ensure that the information we hold about you is accurate and current, please notify us of any changes to your information as soon as possible.

8.4 To request access to or correction of personal information we hold about you, email the NZCR Privacy Officer.

9. Unsubscribing

9.1 If you no longer wish to receive emails about future trials, please contact info@nzcr.co.nz. Your profile will be unsubscribed from the mailing list, but your details will remain on the database and can only be re-activated at your request or if you register again with us. Please note that this is a manual process and may take up to 5 business days to complete.

9.2 If you have registered your interest in a clinical trial but have not taken part in a trial (i.e., you have not signed a consent form), you have the right to request your personal information to be removed from our database. Please contact info@nzcr.co.nz for removal. Please note that this is a manual process and may take up to 5 business days to complete.

9.3 If you have participated in a clinical trial (i.e., you have signed a consent form), the information you provide to us will be held by us in accordance with clinical trial requirements (as described in the trial-specific Participant Information Sheet and Consent Form (PISCF)) and cannot be removed or deleted upon your request. We may also need to contact you in the future if there is any new information about the trial you participated in. This information that we collect from you must be kept for at least 15 years from the end of the trial or longer (e.g., 25 years) if required by the trial sponsor (the company organising or paying for the trial).

10. Changes to our Privacy Policy

We reserve the right, at our discretion, to alter this privacy policy at any time. Changes to this privacy policy will take effect immediately once they are published on the NZCR website. Please check this privacy policy regularly for modification and updates. If you continue to use this website or if you have provided any personal information after we post changes to this privacy policy, this will indicate your acceptance of any such changes.

11. Privacy Breach

11.1 We will take all reasonable steps to mitigate a personal information data breach and to prevent recurrence if possible.

11.2 Under the Privacy Act 2020, if a privacy breach that either has caused or is likely to cause anyone serious harm, NZCR must notify the Privacy Commissioner and any affected people as soon as practically able. We may be required to report the breach to other regulatory bodies under applicable clinical trial requirements. Privacy Complaints.

11.3 All privacy complaints should be directed to NZCR Privacy Officer. At all times, privacy complaints will:

11.3.1 Be treated seriously.

11.3.2 Be dealt with promptly.

11.3.3 Be dealt with in a confidential manner.

11.3.4 Not affect your existing obligations or affect the relationship between you and NZCR.

11.4 The Privacy Officer will commence an investigation into your complaint and you will be informed of the outcome of your complaint following the investigation.

11.5 In the event you are dissatisfied with the outcome of your complaint, you may refer your complaint to the Office of the Privacy Commissioner, PO Box 10094, Wellington 6143.

12. Contact Us

12.1 If you have any queries, concerns or complaints about this privacy policy, or the way we handle your personal information, or have any recommendations or comments, please contact our Privacy Officer.

12.2 If you would like access to the personal information we hold about you, or request correction of your personal information, please contact the Privacy Officer at quality@nzcr.co.nz.

References

Appendix 1: Revision History

Version 2:

Description of change: Rewrite of the entire policy to add website details and include participant and employee privacy.

Version 1:

Description of change: New document replacing CCST P-12 Privacy Policy

POL-NZCR-14 Privacy Policy

Version: 2 Effective Date: 26/03/2024 Review Date:26/03/2027