Futura Medical are committed to protecting your personal privacy and choices. This information notice sets out the basis on which we process your personal data collected for clinical trials and research.

Who we are

We are Futura Medical Developments Limited company number 03456088 of registered address Surrey Technology Centre, 40 Occam Road, Surrey Research Park, Guildford, Surrey, GU2 7YG - this policy is written on behalf of us and our parent company (referred to in this policy as us, our, we and Futura).

If you need to contact us, our details appear below How to contact us.

Purpose of this Policy

The purpose of this policy is to help you understand what types of personal data we collect about you and why we process it. It gives you information about our lawful grounds for processing your personal data, your rights in relation to your personal data and how to make a complaint. It also tells you about when we might share your personal data with others, the steps we take to keep your personal data private, safe and secure and how long we have to keep your information on file.

This policy only relates to personal data collected for clinical trials, related research and Futura's regulatory compliance, and it is one of a number of information documents you will receive, and need to read in detail, to help you understand your role and rights as a clinical trial participant. If you are an employee, potential employee, a customer or a website user of Futura, please refer to our other privacy policies here:

Employee privacy policy and

General website privacy policy

If you have any questions about this policy once you have read it or need more information about Futura and how we handle your personal data, please contact our Privacy Manager How to contact us.

Types of personal data and how we obtain it

The law governing personal data changed across the European Union, including the UK, in May 2018; when the General Data Protection Regulation ("GDPR") and the Data Protection Act 2018 came into force. The new law increases the rights of personal data subjects (see the section entitled Your rights for more information). It also increases the responsibilities of companies collecting and handling personal data.

Personal data is any information which identifies an individual living person. It is data from which a person can be identified directly; but also includes data where the person can only be identified indirectly from that information in combination with other information. Personal data may also be special category personal data, including information about a person's health, sexual health or sexual orientation. Special category data is considered to be more sensitive than other types of personal data and we can only process and collect it in more limited circumstances.

On the basis of Good Clinical Practice (GCP) Futura Medical will collect CV's of Investigators, sub investigators and other applicable site personnel.

On the basis of legitimate interest for assessing candidates' proficiency, Futura Medical will also collect the CV's for third party trial team members and committee members.

As a clinical trial participant you will be providing a lot of personal data, including special category data, to the healthcare professionals you encounter at the Clinical Trial Site (typically the hospital or clinic where you attend appointments related to the clinical trial and Futura's product(s)). You will need to provide the Clinical Trial Site with information including your name, address, date of birth, height, weight and gender. Other types of information which may be gathered about you by the Clinical Trial Site might include access to your medical records, information about any ongoing health conditions, information about your sexual partners and their health, other information on your sex life and factors which may affect it. Some or all of that personal data about you may be shared with us by the Clinical Trial Site, or you may even provide such information to us directly yourself.

In the course of your participation in the trial, additional personal data about you may be generated or collected (including information you report to the Clinical Trial Site, as well as their opinions about you and how you have responded to our medicine(s)). All of the personal data relevant to you as a trial participant may be generated, collected and shared by your healthcare professionals, the Clinical Trial Site, the Clinical Contract Research Organisation (CRO) which oversees the study or by us, Futura (we are known as the Sponsor of the Clinical Trial, being the company responsible for the medicine being tested). Typically in any clinical trial, and to comply with the rules and regulations governing such studies, personal data about the participants (you) will be shared between the healthcare professionals/Clinical Trial Sites (as controllers of your personal data, making decisions about how your personal data is collected and shared), the appointed CRO (usually as processors of your personal data acting under instructions from the Sponsor about what to do with your personal data) and the Sponsor (us/Futura, also as a controller of your personal data as we decide how and why to use your personal data, within the parameters set by the applicable laws and regulations).

Futura will treat all data we receive, generate or collect about you in accordance with the data protection legislation and other confidentiality obligations. We will also keep your personal data to a minimum and relevant for achieving the aims of the study, regulatory approvals of our medicines, medical research or in pursuit of pharmacovigilance and good medicines safety. Wherever possible we, and our study collaborators, will pseudonymise your personal data when sharing and processing that data. Pseudonymised data is where information about a person is identified using a unique identifier (e.g., a study participant number) instead of the person's name, address or date of birth; so the data can only be linked to an identified individual if you have access to additional information (which is held separately from the pseudonymised data). Pseudonymisation can help reduce privacy risks by making it more difficult to identify individuals, but it is still personal data and will be treated by us in accordance with the GDPR and this privacy policy.

Why we process your personal data
- lawful grounds and special conditions

The reason we collect and process your personal data is for the proper conduct of our clinical trials, to monitor the efficacy and safety of our medicines, to conduct other research into our medicines and treatment methods and to support our applications for regulatory approval of our medicines. It is also to satisfy our obligations to monitor and report adverse events and the long term effects of medicines.

The lawful grounds on which we rely in order to collect and process your personal data are that it is necessary to comply with our legal and regulatory obligations (see section entitled Your rights for more detail on some of the legislation we are subject to and rely on to justify our processing). In summary, it is the framework of legislation, regulations and codes of practice, which apply in your country/the country in which you participate in our clinical trial and which govern the conduct of clinical trials, the approval of medicines and the monitoring of medicines safety and efficacy.

Much of the processing we carry out on your personal data is also necessary for achieving our legitimate interests, and we have made appropriate assessments that such processing does not have an adverse effect on your interests or fundamental freedoms and rights as a data subject. Some of the legitimate interests on which we rely in processing your personal data from clinical trials include pursuit of clinical research, development of safe, effective and commercially viable products, opening up and pursuing appropriate lines of communication with medicines regulators, medical researchers, healthcare professionals and our contractors, prevention of fraud and criminal activity, achieving compliance with our approved clinical trial protocols and maintaining secure and effective IT systems and networks (e.g., by storing your personal data in secure cloud environments with adequate back-up and disaster recovery provision to ensure the security and integrity of your personal data).

Your participation in our clinical trial may also be considered as a contract for us to provide you with goods and services. Where this analysis applies, we will have an additional lawful ground to justify our processing of your personal data, being performance of, or preparation to perform, a contract.

As explained above, the clinical trial will result in the collection, generation and processing of a lot of special category data about participants. Where we process special category data about you, in addition to the lawful grounds set out above, we will also be relying on Schedule 1 Part 1 of the Data Protection Act 2018 and GDPR Article 9(i) and (j) for our special conditions for doing so. The specific special conditions we rely on in this respect include that the processing is necessary for conduct of scientific research (Art 9(j)) and in the public interest for ensuring high standards of quality and safety of medicinal products (Art 9(i)). We have complied with the applicable member state laws governing such activities and carry out the processing in a proportionate way with appropriate safeguards in place, taking account of your rights as an individual (as described in more detail elsewhere in this policy - see sections on your rights, and how we protect your personal. We may also, in certain circumstances, rely on additional special conditions such as establishment, exercise or defence of legal claims (Art 9(f)) or for the purposes of preventive medicine, medical diagnosis, and provision of healthcare (Art 9(h)).

In certain limited circumstances we may alter the purpose for which we are processing your personal data from that for which it was collected. We will only do so if that is lawful under GDPR and justified for example on medical research or medicines safety grounds.

Please note that the CRO and Clinical Trial Site/healthcare professional involved with your clinical trial will have their own privacy policy explaining what data they are collecting and how they are using it. Please review those policies for additional information about the handling of your personal data by our collaborators. While we ensure appropriate processing agreements are in place where required for compliance with the GDPR, we are not directly responsible for the actions of third party collaborators where they are acting independently of Futura. See the information below on our current clinical trials if you are unsure of the identity of the CRO or our other collaborators. If you need further assistance in this respect, please contact our Privacy Manager who will be happy to help.

Who we share your personal data with

As explained in the section entitled "What personal data do we collect" your personal data is shared between the healthcare professionals running the study on our behalf, the Clinical Trial Site, the CRO and us (Futura, the study Sponsor). Your personal data, [albeit in psuedonymised form,] may also form part of our medicines marketing authorisation application in different countries, it may be entered into the European and other Adverse Event Reporting databases. It may also be shared with the various healthcare providers, regulators, advisors and insurers we deal with in order to ensure our clinical trials, research and medicines are safe, appropriate and effective and to achieve the general commercial aims of our business (such as investment or sale of the business). Wherever possible, we will share only non-identifiable data with such third parties. But if your personal data is required to be included for legitimate and justifiable reasons, then it will be included in such disclosures of information in accordance with our obligations under the relevant legislation.

Another less direct form of sharing your personal data includes where we use third party service providers to help process your personal data. Wherever that happens, we will enter into written agreements with those service providers to ensure they process your personal data appropriately and in accordance with the data protection legislation and our instructions. Some examples of where others may be involved in processing your personal data on our behalf include our group companies, our IT systems and infrastructure providers, our CROs, and consultants and analysts involved in testing and summarising findings and results from our clinical trials. A list of our current third party contractors involved in processing personal data of clinical trial participants, along with information on what processing they carry out on our behalf is available in the Futura Data Protection Impact Assessment (DPAI) for each new clinical trial and is available on request

Your personal data may also be processed by national or international regulators, enforcement agencies, public authorities, police and courts, but we will only share your personal data with such bodies where it is appropriate and required under legislation, regulation or order of an authorised body.

Where your personal data might be transferred

The data protection legislation requires that we do not transfer your personal data outside the EU unless there are appropriate safeguards in place to protect your data and your rights. A data Protection Impact Assessment (DPIA) document will be generated for each clinical study which will detail the names of companies and brief information on the types of data a processing they carry out in relation to clinical trial participants data. All of the data is pseudonymised before being transferred. All of the companies involved are subject to the appropriate safeguards (either as a member of the EEA and subject to an adequacy decision, as a signatory to an appropriate privacy shield (EU-US or Swiss-EU), or by being bound by us to model clauses/standard contractual clauses approved by the European Commission for the purposes of international transfer of personal data.

How we protect your personal data and retention periods

We have in place a number of cybersecurity and other measures designed to protect your personal data and privacy. A key measure, discussed in more detail elsewhere in this policy, is pseudonymising your data. We generally only process and share your personal data when it is in pseudonymised form. Another measure we take is making sure we only collect and keep your data where it is proportionate to do so. We also minimise our records and we are careful about what information we share about you and how long we keep it. We keep our IT systems up to date, and only use service providers with a proven track record in the clinical trials field and who work to high recognised standards (for example ISO27001). There are very rigorous international standards governing clinical trials work, to ensure confidentiality and regulatory control of human medicines testing. As a result, much of what we and others involved in the clinical trial do accords with the requirements of the GDPR.

As explained elsewhere in this policy, we may have to keep your personal data and information about your involvement in our clinical trial on record for a long time. This is the case even if you withdraw from the trial or ask us to stop processing your personal data. Because of the legislation and regulations governing clinical trials, medicines safety and marketing authorisations, we are required to retain all of your personal data as a clinical trial participant for a period of 25 years after the study has finished pursuant to EMA Guideline on GCP compliance. This is so we can contact you in the unlikely event that a long term effect of the medicine is discovered. For other data it may be two years from the date the marketing authorisation was granted. In any event we will keep our retention periods and our records of your personal data under review to record retention proportionate and to the minimum necessary to achieve the purpose required.

Your rights

A key change brought in by the new data protection legislation is that we will no longer be relying on your consent as the lawful basis for our personal data processing, although we will still need your consent for other things (e.g., your participation in our clinical trial, access to certain medical records and other confidentiality considerations). This means that once you agree to take part in one of our trials, your rights under the GDPR to object to our continued processing of your personal data or to ask us to delete your personal data will be limited. This is because the GDPR sits alongside, and has to be read in conjunction with other legislation, regulations and codes of practice governing what Futura and our collaborators do in relation to clinical trials, research and medicines approvals.

Typically, your data protection rights will be limited where continued retention of records and processing is required for good reasons (e.g., public safety or wider social benefit). Some examples include keeping medicines and research safe, promoting innovation in medicines, achieving good pharmacovigilance and adverse event reporting, maintaining public confidence in the safety and efficacy of clinical trials and approval of medicines and monitoring the long term effects of medicines (keeping you informed if there are any safety concerns).

This doesn't mean your personal data will be shared publicly, but it may mean that we have to keep your information on file for long periods of time (even if you ask us to delete it) or that we may have to share certain of your personal data with regulators, healthcare providers and insurers - but we will always act in accordance with our obligations under the legislation and have appropriate security and confidentiality measures in place to protect your privacy (as to which see the section entitled How we protect your personal data). Other sources of our obligations may include the EU Clinical Trial Directive (2001/20/EC) (and its national implementing or equivalent legislation in the countries in which we conduct trials), from 2019 the new EU Clinical Trial Regulation (No 536/2014) (and equivalent national implementing legislation), the UK Policy Framework for Health and Social Care Research, the EU Directives relating to pharmacovigilance (201/84/EU, 2012/26/EU and 2001/83/EC) and the EU Regulations on authorisation and supervision of medicines (1235/2010, 1027/2012 and 726/2004).

Under the data protection legislation, individuals have the following rights in relation to their personal data:

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling

However, as mentioned above certain of your rights may be limited where we have overriding legal or regulatory obligations. Your rights to request deletion of your data or to restrict or object to processing may not apply. You can always request to exercise your rights, and we will provide you with information of the grounds for our refusal if we are not going to comply with a particular request you have made.

We will always try to reduce the amount of personal data we keep to the minimum necessary to achieve the required purpose, and we use measures such as pseudonymisation and the security measures discussed above to protect your privacy even where your personal rights to insist on restricted processing or deletion are limited.

You can find out more about your rights under the data protection legislation by visiting https://ico.org.uk/your-data-matters/ or contacting the Information Commissioner's Office to discuss your concerns https://ico.org.uk/make-a-complaint/.

How to complain

We hope you will approach Futura in the first instance if you have any concerns or complaints about how we collect or use your personal data. Please contact the Privacy Manager at the contact points listed below How to contact us. You can complain direct to the Information Commissioner's Office at any time - please go to https://ico.org.uk/make-a-complaint/ where you will find details on how to complain and up to date contact details for the ICO. If you are based outside the UK you can contact your local Data Protection Authority.

Recent clinical trials (including CRO and Clinical Site details)

FM57 Clinical Trial CRO's/countries involved
OCT - Bulgaria, Latvia, Russia and Ukraine
  Pharm-olam (POI)
Slovakia, Hungary, Czech Republic, Poland and Georgia

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated in September 2018. This notice is not a contract and is subject to change at any time. Whenever a change occurs, an announcement will be made in the news section of www.futuramedical.com.

How to contact us

Questions, comments and requests regarding this privacy policy are welcomed. If you want to request information about our approach to protecting your personal data or about this privacy policy you can email us or write to us at the address below.

The Data Controller, responsible for keeping your information secure in relation to the above services is:

Futura Medical Ltd
Surrey Technology Centre
40 Occam Road
Guildford
Surrey, GU2 7YG
Email: privacy.manager@futuramedical.com
Telephone: +44 (0) 1483 685670

Futura Medical has nominated a Board level representative for Data Protection and a person responsible to lead on Data Protection matters: this is Futura Medical's Privacy Manager, who can be contacted using the details above.