“Personal information” means any information that identifies or could be used by or on behalf of PRI to identify an individual. It does not include information that has been encoded or anonymized, or publicly available information that has not been combined with non-public personal information
“Sensitive personal information” means personal information that reveals race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, views or activities, that concerns health or sex life, information about social security benefits, or information on criminal or administrative proceedings and sanctions other than in the context of pending proceedings. PRI will treat as sensitive personal information any personal information received from a third party where that third party treats and identifies the information as sensitive.
PRI is a scientific consulting firm that provides its expertise in clinical pharmacology to pharmaceutical industry companies (its “Clients”) by using population pharmacokinetic and pharmacodynamic models to describe the time course of individual patient exposure and response to new treatments. PRI acts as a data analyzer and does not control or monitor data provided to it by its Clients. PRI’s Clients determine which data elements are included in their data sets. With the exception of performing data imports or as otherwise directed by its Clients, PRI does not collect data directly from individuals.
The Safe Harbor is based on the following seven Principles:
1. Notice. As a consultant to its Clients, PRI does not inform any individuals about the purposes for which their personal information is collected and used. PRI relies on its Clients to provide any required notices to the individual members of their research populations. When PRI receives personal information from its Clients, it uses and discloses such information in accordance with the notices provided by its Clients and the choices made by the individuals to whom such personal information relates.
2. Choice. As a consultant to its Clients, PRI does not offer individual members of any research population a choice regarding the purposes for which their personal information is collected and used by its Clients. PRI relies on its Clients to provide and comply with any required options, and explicitly requires its Clients to give individuals the opportunity to affirmatively and explicitly consent to the disclosure of sensitive personal information to a non-agent third party or the use of the information for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.
3. Onward Transfer. PRI occasionally transfers data containing personal information to third parties that act as agents for its Clients or for PRI. When PRI transfers personal information as described above, PRI either ascertains that the third party subscribes to the Safe Harbor Principles or is subject to the European Union’s Directive on Data Privacy or another adequacy finding, or PRI enters into a written agreement with the third party requiring the third party to provide at least the same level of privacy protection as is required by the relevant Principles.
4. Security. Security is extremely important to PRI and its Clients. Accordingly, PRI takes significant security precautions to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. PRI relies on its Clients to establish for their data appropriate password requirements and user roles and levels of access.
5. Data Integrity. As a consultant to its Clients, PRI does not typically collect any personal information provided by its Clients. PRI relies on its Clients to ensure that any personal information they collect is relevant for the purposes for which it is used, reliable for its intended use, accurate, complete and current.
6. Access. All information may be accessed only by authorized users at PRI and its Clients. PRI takes reasonable precautions to protect personal information in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction. As a consultant to its Clients, PRI believes that individuals should contact the Client to access and review personal information. The burden and expense for PRI to identify individuals and provide access for them to correct, amend or delete information would be disproportionate to the risks to the individuals’ privacy, and would possibly violate PRI’s contractual obligations to its Clients.
PRI notifies and trains appropriate team members regarding its privacy policies and practices and the consequences for failing to comply with them.
PRI’s adherence to these Safe Harbor Principles may be limited (a) to the extent required to respond to a legal or ethical obligation; (b) to the extent necessary to meet national security, public interest or law enforcement obligations; and (c) to the extent expressly permitted by an applicable law, rule or regulation.
PRI reserves the right to change this Policy at any time in accordance with the Safe Harbor Principles. A notice will be posted on the PRI web page (www.pri-home.net) in the event that this Policy is changed in any material way.
Last Updated: October 7, 2010