1       OVERVIEW

Alba Science Ltd. (“we”, “us” or “alba”) is committed to data protection and data privacy. With the General Data Protection Regulation (GDPR) becoming enforceable from 25 May 2018, we have undertaken a GDPR readiness programme to review our entire business, the way we handle data and the way in which we use it to provide our services and manage business operations.

We hold personal data on all our volunteers to allow us to perform the work that we do. This notice details the personal data we may retain, process and share with third parties relating to your involvement with us and our studies. We are committed to ensuring that your information is secure, accurate and relevant. To prevent unauthorised access or disclosure, we have implemented suitable physical, electronic, and managerial procedures to safeguard and secure personal data we hold.

2       INTRODUCTION

We have issued this notice to describe how we handle personal information that we hold about our volunteers (often referred to as “subjects” or collectively referred to as "you").

For clarity, people who apply to be added to our panel of volunteers are referred to as “Volunteers”.  From this panel, some volunteers are selected to take part in individual studies.  At the point a volunteer is included on a specific study, we refer to them as being a “subject” on that study.  For the purposes of this notice, the term “volunteer” applies to all volunteers and the term “subject” applies to those volunteers participating on a study.

We respect the privacy rights of individuals and are committed to handling personal information responsibly and in accordance with applicable law. This notice sets out the personal data that we collect and process about you, the purposes of the processing and the rights that you have in connection with it.

3       TYPES OF PERSONAL DATA WE COLLECT

There are different types of personal data we collect about you.  We need some when you apply in order to match you to suitable studies and to contact you. 

3.1     BASIC PERSONAL DATA FOR ALL VOLUNTEERS

To become a volunteer with us, we need to collect some personal information about you.  This information is used to match you to suitable studies and to contact you.  When you apply to become a volunteer, you will complete an application form for us and we will create a profile for you.

We may collect the following types of personal information when you apply:

  • · Identification Data – such as your name, gender, date of birth.
  • · Contact Details – such as home address, mobile telephone and email address.
  • · Profiling Data – to allow us to match our volunteers to our studies - such as hair colour, skin type, dandruff, sensitive-skin.
  • · Medical History Data – such as history of eczema, hayfever, epilepsy, cancer or skin problems, known allergies.

3.2     ADDITIONAL PERSONAL DATA FOR SOME OF OUR STUDIES

If you are selected and agree to take part on one of our studies, we may need to collect some further personal information about you as part of the conduct of the study.  This information is collectedly solely for the purposes of ensuring eligibility to take part in the study and to ensure your safety throughout it.

We may collect the following types of personal information as part of a study:

  • · Eligibility Information – in order to determine your eligibility for a study.
  • · Medical Conditions – any current medical conditions and associated medications
  • · Adverse Event information – details of any events during the course of a study.

3.3     OTHER DATA WE COLLECT

In addition to the personal data that we collect from you when you apply to become a volunteer or when you take part in one of our studies, we also keep some additional data about you on your profile.

Additional data we keep about you may include:

  • · History of study participation – such as dates you started and finished each study and whether you completed the study or not.
  • · History of Communications – such as email correspondence or SMS text messages between you and us.

4       SENSITIVE PERSONAL DATA

Sensitive personal data (‘special categories of personal data’ under the General Data Protection Regulation) includes any information that reveals your racial or ethnic origin, religious, political or philosophical beliefs, genetic data, biometric data for the purposes of unique identification, or information about your health/sex life.

Generally, we try not to collect or process any sensitive personal information about you.  In some circumstances, we may need to collect some sensitive personal information for legitimate study-related purposes – such as when a study requires participants from a particular ethnic origin.

5       PURPOSES FOR PROCESSING PERSONAL DATA

5.1     REGISTERING AS A VOLUNTEER

When you apply to become a volunteer with us, it is with the intention of taking part on some of our studies.  We need some of your personal information in order to find suitable studies for you and to contact you about these.  We process the data in your application form to build a profile of you on our Volunteer Database system, called Live Clinical.

If you are applying to become a volunteer with us then we collect and use this personal data for study recruitment purposes – in particular, to determine your suitability for a specific study that we are recruiting for. This typically includes assessing your age, gender and location in order to find a good match. 

When you are enrolled as a volunteer, we give you a unique Volunteer Number.  This number if your unique identifier within our Live Clinical system.

5.2     FINDING SUITABLE SUBJECTS FOR OUR STUDIES

When we need to recruit subjects for an upcoming study, our recruitment team are provided with details of the group of subjects needed to take part on the study.  Typically, we may need to recruit subjects based on a combination of age, gender and geographic location (such as being near a test centre).  In addition, we may be looking for volunteers with a particular skin type (such as sensitive skin). 

We use our Live Clinical system to search our database of volunteers to find us those who match the requirements of the study.  This is done by assessing your personal data.

If you are matched to a study, a further assessment of your medical data will be made to confirm suitability.  For example, it may be that volunteers with a history of allergies may not be eligible to take part on a study.

5.3     CONTACTING YOU

We may use your email address or your mobile phone number to contact you to invite you to take part in one of our studies.  For some studies, we send invites out by SMS text messages to those who match the recruitment criteria.

If you are contacted by telephone to discuss your suitability to take part in one of our studies, the member of our recruitment team will have access to your profile in our Live Clinical system.

5.4     TAKING PART ON A HOME USER STUDY

We conduct some of our studies remotely.  In some cases, we can send products to our volunteers in their homes to use.  In return for these, our volunteers are usually asked to complete online surveys relating to their experiences of using the product.  We call these “Home User Studies”. 

For Home User Studies, we use your contact details to send any products or documentation to you.

When participating in a Home User Study, we may provide you links to any online surveys which we ask you to complete.  In some cases these links will be anonymous but in others, we may ask you to confirm your name, address, age or other personal information at the start of the questionnaire.  We do this so that we can match up the responses to the subjects we have enrolled on our system.  Once this is done, all personal information is removed.

5.5     TAKING PART ON A CLINICAL STUDY

We conduct some of our studies at our test centre where our subjects attend one or more times during a study.  We call these “Clinical Studies”.

When you participate on a clinical study, you will first be provided with a Volunteer Information Document to read and will asked to provide consent to participate in the study.

Once you have provided consent, we will perform a “Screening” phase where we will confirm any Personal and Medical information we have in our records with you to ensure that we are aware of any changes and also to reconfirm your eligibility to be included on the study.  We may also need to discuss any ongoing medical conditions or medications.

Once the screening phase is complete and you are accepted onto one of our studies, we assign you a sequential “Subject Number” (Starting 001, 002, 003 etc.).  During study conduct, both your Subject Number and your name are available to the technician to confirm your identification. 

At the end of the study, the names are removed, ensuring the subjects are only identifiable by Subject Number with the exception of your written consent document, since a signature is required on this.

During your involvement on a Clinical Study, we may collect various types of data, such as measurements, readings, assessment scores etc.  This is not personal data and is not personally identifiable. 

In cases where photographs are taken during a study, these will be cropped or masked in order to ensure that they cannot be personally identifiable, other than where a full-face photograph is required.  In these cases, you will be asked to provide additional consent.

5.6     LEGITIMATE BUSINESS PURPOSES

We may also collect and use personal information when it is necessary for other legitimate purposes, such as to help us conduct our business more effectively and efficiently

5.7     LEGAL PURPOSES

We may also use your personal data where we consider it necessary for complying with laws and regulations, including under judicial authorisation, or to exercise or defend our legal rights.

6        LEGAL BASIS FOR PROCESSING PERSONAL DATA

Our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the way we collect it. We will normally collect personal data from you only where we need it to perform a contract with you (i.e. to invite you to participate in one of our studies), where we have your freely given consent to do so, or where the processing is in our legitimate interests and only where this interest is not overridden by your own interests or fundamental rights and freedoms.  In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

Any processing based on consent will be made clear to you at the time of collection or use – consent can be withdrawn at any time by contacting the Alba Science Data Protection Officer.

7       WHO WE SHARE YOUR PERSONAL DATA WITH

We take care to allow access to personal data only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. Whenever we permit a third party to access personal information, we will implement appropriate measures to ensure the data is used in a manner consistent with this notice and that the security and confidentiality of the data is maintained.

7.1         TRANSFERS TO OUR CUSTOMERS

When we provide the results of our studies to our customers we remove all personally identifiable information.  References to individual subjects are done by Subject Number only.  Where images are provided, these will be cropped and masked in order to ensure that they are not personally identifiable.

7.2         TRANSFERS TO THIRD-PARTY SERVICE PROVIDERS

We make certain personal data available to third parties who provide services to us. We do so on a "need to know basis" and in accordance with applicable data protection and data privacy laws.

7.3         TRANSFERS TO OTHER THIRD-PARTIES

We may also disclose personal data to third parties on other lawful grounds, including:

  • · To comply with our legal obligations, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative or judicial process
  • · In response to lawful requests by public authorities (including for national security or law enforcement purposes)
  • · As necessary to establish, exercise or defend against potential, threatened or actual litigation
  • · Where necessary to protect the vital interests of our employees or another person
  • · In connection with the sale, assignment or other transfer of all or part of our business; or
  • · With your freely given and explicit consent

8       WHERE WE KEEP YOUR PERSONAL DATA

All personal data is retained on Alba Science’s own servers based in the United Kingdom.

All paper-based personal data (such as signed consent forms or application forms) are stored at our facilities in the United Kingdom.

Our customers may request that we send them all the original paperwork from a study for them to retain.  Where this is the case, the Consent Forms are also sent to the customer.  These will contain the names and signatures of the individuals enrolled on the study.

9       TRANSFER OF PERSONAL DATA ABROAD

We may need to transfer personal data to countries outside of the United Kingdom. When we export your personal data to a different country, we will take steps to ensure that such data exports comply with applicable laws. For example, if we transfer personal data outside the European Economic Area (EEA), such as to the United States, we will implement an appropriate data export solution such as entering into contracts with the data importer that contain EU model clauses or taking other measures to provide an adequate level of data protection.

10    DATA RETENTION

Personal data will be stored in accordance with applicable laws and kept for as long as needed to carry out the purposes described in this notice or as otherwise required by law.

Generally, this means your personal information will be retained until the end or your involvement with us.  Once you ceased to be a volunteer with us, we will remove your personally identifiable information from our system and retain a non-personally identifiable record containing only your Volunteer Number.  Records of your previous involvement on studies will remain anonymised.  Should you re-apply to become a volunteer again in the future, Your old Volunteer Number would be required in order to link your previous study participation again.

Study Data which has been collected during the course of a study will not be amended upon erasure of your personal data since this data will not be personally identifiable.

11    YOUR RIGHTS

You may exercise the rights available to you under data protection law as follows:

  • · The right to be informed.
  • · The right of access.
  • · The right to rectification.
  • · The right to erasure.
  • · The right to restrict processing.
  • · The right to data portability.
  • · The right to object.
  • · Rights in relation to automated decision making and profiling.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. You can read more about these rights at:

https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

12    ISSUES AND COMPLAINTS

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This notice was drafted with clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed.

If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office in their capacity as the statutory body which oversees data protection law – www.ico.org.uk/concerns.

13    UPDATES TO THIS POLICY

This policy may be updated periodically to reflect any necessary changes in our privacy practices. In such cases, the most recent version will be available on our website.

14    CONTACTING US ABOUT THIS PRIVACY POLICY

If you have any queries regarding this notice, please contact the Data Protection Officer at Alba Science using the details below:

Data Protection Officer

Alba Science Ltd,

24 Broughton Street

Edinburgh

EH1 3RH

Telephone: 0131 297 0000

Email: dataprotection@albascience.com