Privacy Notice for Clinical Trials – EU Participants
Please note, this privacy notice has also been translated into the following languages (countries):
- Bulgarian (BG)
- Czech (CS)
- German (DE)
- Spanish (ES)
- French (FR)
- Croatian (HR)
- Italian (IT)
- Dutch (NL)
- Polish (PL)
- Portuguese (PT)
Xenon Pharmaceuticals Inc., and its wholly owned subsidiaries (together referred to as “Xenon”) are committed to protecting the Personal Data we process for the purpose of conducting clinical trials. This Privacy Notice sets forth the privacy principles and procedures and the technical security measures we follow to keep Clinical Trial Data private and secure.
Xenon is subject to applicable privacy and data protection and clinical legislation where our clinical trials are conducted.
This privacy notice is for data subjects participating in trials in the European Union (EU), Switzerland and the UK. Data subjects participating in trials in other parts of the world should refer to the privacy notice for non-EU trials: PRIVACY NOTICE FOR CLINICAL TRIALS – NON-EU PARTICIPANTS.
If you are a Clinical Trial Participant and would like more information about your trial or to review your Informed Consent Form, please contact the physician or hospital that enrolled you in the trial.
Xenon and Clinical Trial Data
Xenon does not collect Clinical Trial Data directly from individuals during the course of our clinical trials (except in the context of monitoring the study to ensure quality standards are met). Instead, we receive Pseudonymised Data from the Contract Research Organisations (“CRO”) and service providers (“third parties”) that we engage to carry out the study.
Investigators enrolling Clinical Trial Participants in the study will provide information about the trial, how Personal Data will be managed and protected, and a link to this Privacy Notice at the time of enrollment.
Data Subjects in the EU
If you are participating in a clinical trial and would like more information about the specific trial in which you are enrolled or have questions about the processing of your personal data, please contact the physician or the hospital that enrolled you in the trial. Xenon will not be in a position to identify you personally as a data subject, given we only collect Pseudonymised Data.
Data Protection Officer
Xenon has assigned a Data Protection Officer responsible for overseeing our compliance with the EU data protection law.
Data Protection Officer
200 – 3650 Gilmore Way
Burnaby, British Columbia
Canada, V5G 4W8
E: dpo@xenon-pharma.com
T: (+1) 604-484-3326
Member Representative in the EU
Data Protection Representative Limited (trading as DataRep)
72 rue de Lessard, Rouen, 76100, France
E: datarequest@datarep.com with a copy to dpo@xenon-pharma.com
Controller Information
Xenon Pharmaceuticals Inc.
200 – 3650 Gilmore Way
Burnaby, British Columbia
Canada, V5G 4W8
T: (+1) 604-484-3300
https://www.xenon-pharma.com
Scope
This Privacy Notice applies to Personal Data of data subjects in the EU, Switzerland and UK that are received by Xenon in any format, including electronic and paper, and processed by Xenon and/or by partners and service providers (“third parties”) on behalf of Xenon. Categories of third-party organizations and data recipients are described below.
Definitions
“Anonymous Data” is information which does not relate to an identified or identifiable natural person or personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. The GDPR does not concern the processing of Anonymous Data.
“Clinical Trial Data” is the data collected and processed by Xenon for clinical trial purposes. It includes Pseudonymised Data received from third parties as well as new data generated by Xenon and third parties based on data collected for the clinical trial. These new data may not relate to an identified or identifiable natural person.
“Clinical Trial Participant” means an individual participating in a clinical trial in the EU and providing personal information to third parties Xenon has contracted with to conduct the study. Clinical Trial Participant has the same meaning as “Data Subject” under Article 4 of the GDPR.
“Personal Data” means any information relating to an identified or identifiable natural person (‘data subject’) in the EU; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Pseudonymised Data” means Personal Data that can no longer be attributed to a specific individual in the EU without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data are not attributed to an individual. Xenon will protect Pseudonymised Data subject to the GDPR with the same care and high standards as Personal Data.
“Processing” means any operations or set of operations performed on Personal Data.
“Special categories of data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Purposes for Processing Personal Information
When individuals in the EU become Clinical Trial Participants, Personal Data will be processed for the purpose of scientific research into the effects of medical treatment.
Categories of Information Processed
Common personal details
- Participant identifier (unique ID#)
- Location data – country, investigative site
- Personal details – year of birth, age in years, sex
Special categories of data
- Health data
- Physical details – height, weight, Body Mass Index (BMI)
- Childbearing status
- Physical health data
- Psychological details – quality of life rating
- Mental health data
- Genetic data related to genetic research
- Data revealing racial or ethnic origin
Legal Basis for Processing Personal Information
Clinical Trial Data for research purposes
Depending on the country in which the clinical trial is conducted, the processing operations purely related to research activities in the context of the clinical trial may be carried out based on one or more of the following legal justifications:
(i) Need to comply with sponsor’s legal obligations,
(ii) Consent,
(iii) Legitimate interests of the sponsor,
And/or for special categories of data such as health data:
(i) Public interest in the area of public health,
(ii) Necessity of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Genetic data for research purposes
Genetic data for the purpose of genotype/biomarker assessment will be processed based on your consent and the necessity of processing for archiving purposes in public interest, scientific or historical research purposes or statistical purposes. Participation in this assessment is entirely voluntary. The decision not to participate in the assessment will not stop the data subject from participating in the rest of the study. Consent to participate in the genotype/biomarker assessment is collected and recorded during the enrollment process using an Informed Consent Form.
Automated Processing
During the course of the Clinical Trial, Xenon will not make decisions regarding data subjects based solely on automated processing.
Categories of Third Parties and Data Recipients
Xenon contracts with a Contract Research Organisation (CRO) to run trials based on the protocols, or “instructions”, we have developed. The CRO selects investigators and study sites, processes Clinical Trial Data based on the protocol, and monitors the trial activities. CROs and third parties engaged by Xenon for the purposes of conducting a clinical trial are required by law and contractual undertakings to:
- Keep your Personal Data confidential and secure; and
- To use and disclose it for purposes that a reasonable person would consider appropriate in the circumstances, in compliance with all applicable legislation.
Categories of third parties that Xenon engages for clinical trials include:
- Wholly owned subsidiaries of Xenon
- Contract Research Organisations and other third-party vendors
- Statistical Research Analysts
- Clinical advisors
- Technical providers for hosting and software services
- Safety board
Clinical Trial Data Transmitted to Third Countries
Xenon Pharmaceuticals Inc. is located in Canada. Clinical Trial Data from data subjects in the EU, Switzerland and the UK are processed in the EU, Canada, and the United States.
Xenon will only transfer data internationally from the European Union, UK or Switzerland to Canada or the United States on the basis of the appropriate legal mechanism:
- The adequacy decision between the European Commission for the information in the scope of the PIPEDA law, or
- The standard contractual clauses of the European Commission otherwise.
- Clinical Trial Data will be pseudonymised prior to processing outside of the EU.
- We will ensure that there are adequate measures and specific guarantees in place to protect Personal Data.
- Xenon Pharmaceuticals USA Inc., a wholly owned subsidiary of Xenon Pharmaceuticals Inc., may process Clinical Trial Data upon instructions by Xenon Pharmaceuticals Inc. Xenon Pharmaceuticals USA Inc. is contractually bound to protect any Personal Data to the same standards as Xenon Pharmaceuticals Inc.
The list of processors Xenon uses for a specific trial is available upon request.
Retention
Xenon will retain Clinical Trial Data and will instruct third parties to retain Personal Data or Clinical Trial Data, depending on their role in the study, subject to applicable legislation. In Canada and in the European Union the retention period for clinical trial data is 25 years.
Your Rights
Where data subjects in the EU seek to exercise their rights related to their Personal Data, Xenon will provide support to exercise those rights. Xenon may not be able to comply with a direct request where Xenon is not in a position to identify you. This would occur where Xenon has received Pseudonymised Data or where Personal Data have been destroyed, erased, or made anonymous in accordance with our record retention obligations and practices. You can at any time reach out to your study doctor who will know how to help you.
Your rights related to the trial, including the right to withdraw consent, are described in the clinical trial Informed Consent Form.
Depending on the legal basis for processing the Clinical Trial Data, rights related to the Personal Data of Clinical Trial Participants may include:
- Access to your Personal Data
- Right to rectification where Personal Data are incorrect or incomplete
- Right to restrict/suspend further processing of Personal Data
- Right to data portability
- Right to withdraw consent
- Right to complain to a supervisory authority
The right to erasure will not apply to processing that is necessary for Xenon to comply with a legal obligation, for a task carried out in the area of public health, or for scientific research purposes.
Please contact the physician or hospital that enrolled you in the clinical trial if you would like to exercise your rights related to your Personal Data collected for clinical trial purposes.
Security Measures
We have taken appropriate technical and organisational security measures to protect Clinical Trial Data against unintentional or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and any other unlawful or unauthorized forms of processing under applicable law.
Such measures include in particular, ensuring confidentiality, integrity, and availability of data by controlling physical access to the data, as well as the relevant access, input, disclosure, security of availability and its separation. In addition, we take into account the protection of Clinical Trial Data when developing or selecting the hardware, software, and procedures in line with the principle of data protection through technology and privacy by design.
Children Personal Information
Some of Xenon’s clinical trials involve participants that are children. Xenon will only process a child’s personal data with parental consent, or the consent of a legal representative, and in accordance with the laws where the clinical trial is being conducted.
Complaints
When contacting Xenon regarding any issue, please do not include any personal information (other than your contact information) or health information in the subject line or in the content of your message.
Clinical Trial Participants in the EU, Switzerland or the UK may contact our Data Protection Officer with complaints regarding this Privacy Notice and Xenon’s processing of Personal Data:
Data Protection Officer
200 – 3650 Gilmore Way
Burnaby, British Columbia
Canada V5G 4W8
Or our Data Representative in the EU.
Xenon will reply to complaints within 30 calendar days of their receipt and will attempt resolution in accordance with this Privacy Notice.
You may lodge a complaint with the corresponding EU data protection supervisory authority in your country of residence. The relevant EU supervisory authority name and contact details can be found here:
https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-fi
Last updated: April 11, 2023