Qity Clinical Privacy Policy

This Privacy Policy explains how Qity Clinical collects, processes, stores, shares, and protects personal data, including special category data, in the context of clinical trials, research activities, and related processing operations. It applies to all data collected from individuals who submit personal information to Qity Clinical by any means, including through websites, online forms, research surveys, email, telephone, mobile applications, physician referrals, and any other channel through which Qity receives personal or special category data.

Qity Clinical may act as a data controller, a data processor, or a joint controller depending on the nature of the processing. Regardless of Qity Clinical’s role, data processing activities are conducted in full compliance with the General Data Protection Regulation and with appropriate safeguards to protect the rights and freedoms of data subjects, namely data protection and privacy processes and mindful transparent management of consent.

Qity Clinical collects personal data only when it is relevant and necessary for the purpose for which it was submitted. Individuals may provide data to Qity Clinical directly, for example, by completing registration forms, responding to surveys, contacting us via email, or speaking with a Qity representative, or indirectly, such as when a healthcare professional submits information on their behalf.

Personal data collected may include identification details such as name, date of birth, gender, and contact information; information submitted via questionnaires, consent forms, or online platforms; medical history, diagnostic data, and other information relevant to determining eligibility for participation in clinical trials or supporting other research activities; and lifestyle, demographic, and behavioural information where relevant to the processing purpose.

Data collected by Qity Clinical is dutifully accompanied by the consent record provided by the data subject or, where applicable, their legally authorised representative. Qity Clinical ensures that consent is obtained in a manner consistent with GDPR requirements, meaning it is freely given, specific, informed, and unambiguous. Consent is documented in a durable and verifiable form, capturing the scope, purpose, and lawful basis of the processing activity.

Where Qity Clinical relies on consent as the lawful basis for processing personal or special category data, the associated consent record is securely stored alongside the participant’s data and maintained for as long as required to demonstrate compliance with regulatory and ethical obligations. Data subjects may withdraw consent at any time by contacting Qity Clinical using the details provided in this policy. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal was received.

Qity processes special category data where necessary and in accordance with Article 9 GDPR, which may include health-related data, genetic and biometric identifiers, and other information requiring a heightened level of protection.

Personal data and special category data are processed only when one or more lawful bases under GDPR apply. For personal data, these may include consent where individuals provide clear and informed agreement to the processing of their data, contractual necessity where processing is required to fulfil obligations associated with participation in a clinical trial or related engagement, compliance with legal obligations under EU or Member State law, or legitimate interests pursued by Qity or a third party where these do not override the fundamental rights and freedoms of the data subject.

For special category data, processing is limited to circumstances permitted under Article 9 GDPR, which include explicit consent provided by the data subject, processing required for scientific or research purposes with appropriate safeguards, processing necessary for reasons of public interest in the area of public health, or processing carried out under the responsibility of a healthcare professional subject to professional confidentiality.

Qity Clinical does not knowingly collect personal data from children under the age of 18 without verified parental or guardian consent. Where data from minors is required for clinical or research purposes, Qity ensures that the processing is authorised by a parent or legal guardian, consent mechanisms are adapted to ensure clarity and accessibility for minors and guardians, and additional safeguards are applied to protect the privacy and rights of individuals under 18.

If and when Qity Clinical becomes aware that personal data from a child under 18 has been collected without appropriate consent, the data will be deleted unless retention is legally required.

Qity Clinical processes personal data for specific, explicit, and legitimate purposes. These include identifying and assessing eligibility for clinical trial participation, managing participant recruitment and communications, conducting scientific research and validating study results, complying with regulatory, legal, and ethical obligations, responding to inquiries, surveys, or requests submitted directly by individuals, and improving services, systems, and participant experience based on collected feedback.

Personal data is never processed in a manner incompatible with these purposes.

Qity Clinical may disclose personal and special category data only where necessary and lawful. Data may be shared with sponsors and contract research organisations when required for study operations, clinical investigators and healthcare providers directly involved in trial delivery, regulatory authorities when required for reporting purposes, and technology providers and hosting platforms supporting secure data processing and storage.

All third-party disclosures are governed by appropriate agreements, ensuring compliance with GDPR and the application of equivalent data protection standards.

Qity Clinical applies appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of personal data.

Access to personal data is strictly limited to authorised personnel, secure transmission channels are used for sensitive information, and storage systems are safeguarded against unauthorised access or accidental loss. When engaging external providers, Qity Clinical verifies the maintainance of security measures aligned with GDPR requirements.

Qity Clinical retains personal and special category data only for as long as necessary to achieve the purposes for which it was collected or to comply with legal, regulatory, and contractual obligations, typically fifteen (15) years.

Retention periods are determined by applicable clinical trial regulations, national laws, and ethical guidelines.

After expiry of the retention period, personal data is securely deleted or rendered permanently anonymised to prevent re-identification.

Under GDPR, individuals have the right to request access to their personal data, request corrections where data is inaccurate or incomplete, request deletion of personal data under certain conditions, restrict processing in specific circumstances, request data portability to obtain personal data in a structured, commonly used format, object to processing based on legitimate interests, and withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Requests to exercise these rights can be submitted using the contact details below. Qity responds to all requests within the timeframes defined by GDPR.

For questions about this Privacy Policy or to exercise your rights, contact:

Data Protection Officer

Qity Clinical

Oudenaardsesteenweg 256

9420 Erpe-Mere, Belgium

Email: clinicalprivacy@qity.be

If you believe your data has been processed unlawfully, you may lodge a complaint with the Belgian Data Protection Authority.

Further information and contact details are available at Gegevensbeschermingsautoriteit.

Qity Clinical reviews this Privacy Policy regularly and updates it as necessary to reflect changes in legal, regulatory, or operational requirements.

Significant changes will be communicated directly to affected individuals when appropriate.

For studies conducted in the United States or involving U.S.-based participants, certain data may be classified as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). In these cases, Qity Clinical complies with all HIPAA requirements when working with U.S. clinical sites, investigators, and healthcare providers.

Where HIPAA applies, Qity Clinical will ensure that participants provide a separate, study-specific HIPAA Authorisation before any PHI is accessed, used, or disclosed. This authorisation will explain what data will be collected, for what purposes, who may receive it, and the participant’s rights regarding access, withdrawal, and restrictions.

This means that while GDPR governs the processing of personal and special category data for EU-based participants, HIPAA applies specifically to PHI processed within U.S. healthcare settings. Qity Clinical ensures that all international studies are conducted in full compliance with the relevant legal and regulatory frameworks applicable to each participant’s jurisdiction.