PPD Interactive Voice/Web Response Systems Privacy Policy

This notice is effective as of August 20, 2004. PPD is committed to respecting the privacy of individuals. We recognize that when personal information is provided to us, you trust PPD to act in a responsible manner. PPD has enacted internal procedures, which are reviewed and monitored from time to time to ensure this information is used responsibly and complies with internationally recognized standards of privacy protection, including, but not limited to, the European Union Data Protection Directive [EC/95/46] and the U.S. Department of Commerce Safe Harbor Agreement. Internationally recognized standards require that the processing of personal data, both automated and manual, meet with the following Data Protection Principles:
1. Be processed fairly and lawfully
2. Be obtained only for specified and lawful purposes and not be processed in any incompatible manner
3. Be adequate, relevant and not excessive
4. Be accurate and, where necessary, kept up to date
5. Not be kept for longer than is necessary
6. Be processed in accordance with the rights of Data Subjects
7. Be protected by appropriate security measures
8. Not be transferred to third parties unless adequate level of data protection exist

Purposes of Data Processing

PPD processes personal data for specific and limited purposes which you are informed about when information is collected.
For example:
1. Patient data processed for participation in specific clinical, registry and post- market studies for biopharmaceuticals and medical devices.
2. Useridentifying information processed to verify if the user is an authorized user of the site.
3. Phone, fax, email information to be able to contact users in case we need to send them any information or device notification.
4. Phone, fax, email information to communicate with users about features or updates to the site.
Prior to processing personal data, notice will be provided to data subjects in a clear and conspicuous language. Dependent on the type of data processing, notice may be given in person, by e-mail, post, telephone, or by posting on our website.

Data Collection

Users may be required to give certain personally identifiable information, including their name, email address, country, city, hospital name, phone number and fax number. PPD automatically collects certain non-personally identifiable information, including your most recently visited URL. This information, which is collected and maintained in anonymous, non-personal, aggregate form, allows PPD to improve the content of the site and facilitate internal market research. This information may be shared with third parties, only in anonymous form. Every effort is made to ensure that the information is accurate and up-to-date and all communications with individuals provide easy means of validating, correcting errors and updating information.

Data Processing

All processing of personal data is, by consent, for the purposes listed above and under the control of the Data Controller. Individuals have the right to:
1. copies of their data
2. correct their data
3. prevent processing for direct marketing
4. withdraw consent to processing with its consequential effects
5. prevent non-core purpose disclosures
6. prevent trans-border disclosures to third parties where there are inadequate data protection arrangements
To access personal information held and request corrections, amendments, and/or delete that information where it is inaccurate, please refer to the Inquiries, Complaints and Subject Access Requests section of this policy.

Data Security

PPD maintains a high level of security, particularly in relation to data. Computer equipment, networks, programs, data and documentation is maintained to a high standard, and access to data and equipment is at all times restricted to appropriate staff. The handling of medical information obtained in clinical research is governed by national and international data protection regulations and medical confidentiality. Any medical information collected will be maintained under these regulations. If the computer you are using is not for your sole use, you should close your browser when you have finished accessing the site. If you are inactive for minutes, you will automatically be logged out of any PPD web application and all unsaved data will be lost. These actions prevent others from accessing your information. When you want to access the site at another time, you will need to sign in and type in your password. You will have the option of having your password sent to your strictly personal electronic mailbox, for initial registration and later again, if you have forgotten what it is. If you receive a user id and initial personal identification number (PIN) information for access to any phone-based system, you will need to treat that information as personal and confidential. Any sharing of that information puts system and data security at risk. Any authorized user who, for whatever reason, has not yet received a user id and PIN can easily obtain one from PPD once verification is provided from the study sponsor.

Release, Sharing, or Transferring of Data

The personal information provided to us will be available to PPD, Inc., its subsidiaries, and companies working as agents of PPD. Access to data and equipment is at all times restricted to appropriate staff. PPD will not trade, sell, release, share, or transfer personal information for use by any business outside the PPD organization without the subject's consent, or in a form other than what was disclosed to you at the time the information is collected, unless permitted or required by law. Under some circumstances, PPD may be required by law enforcement or judicial authorities to provide personal information as required by law to the appropriate government authorities. Companies working as agents of PPD or clinical trial sponsors (such as pharmaceutical companies) are required to sign confidentiality agreements or provide assurance agreeing to handle all confidential information containing personal data in accordance with applicable law, including but not limited to, the European Data Protection Directive [EC/95/46]. Likewise, physicians or investigators are required to sign site agreements agreeing to follow study guidelines and protect personal data according to law. PPD is a global company and has information databases in different offices throughout the world. PPD may transfer personal data to one of its databases outside the individual's country of domicile. If the level of privacy protection in a country does not comply with recognized international standards, PPD will ensure that data transfers to PPD databases in that country are adequately protected.

Links to Third Party Web Sites

Some of our web pages may contain links to websites outside of the PPD, Inc. organization. Linked web sites are not under the control of or endorsed by PPD. This policy does not apply to linked web sites outside the PPD organization. It is recommended that individuals review the privacy policy of each individually linked website that you choose to visit.

Cookies

A cookie is a piece of data stored on the hard drive of your computer. PPD enables temporary cookies to allow site visitors to easily move from one interactive feature to another; offering visitors a better experience while navigating PPD's Corporate Internet site. However, if an individual is not using any part of the PPD web site that requires "signing in", there will be no cookies activated during that individual's visit. Usage of a cookie is in no way linked to any personally identifiable information while on our site, unless you explicitly provide that information to us. Cookies can also enable us to track and target your interests to enhance the experience on our site. They are used to create a profile and can be used for such purposes as notifying you of relevant trade shows or symposia, but only if you opt-in to this feature. Visitors will always be given the choice and the information will not be sold to other organizations. We receive IP addresses in the normal course of the operation of our Web site. An IP address is a number assigned to you by your Internet service provider so you can access the Internet. We do not use them to personally identify you or disclose them to others.

Log Files

PPD may use your Internet Protocol (IP) address to analyze trends, administer the site, track user movement, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.

Communications

Established web users will occasionally receive communications about database updates to the site ("Ongoing Communications"). Any user who does not want to receive these communications can choose to opt-out of the PPD distribution list. Please see the Choice/Opt-out section below. PPD may send users site and service announcement updates. Users are not able to unsubscribe from service announcements, which contain important information about the service. In the event we are unable to communicate the service announcements via email, we may communicate with the user to provide such announcements via fax or phone.

Training

PPD has provided its employees with appropriate training to ensure that all those who process personal data are fully aware of their individual responsibilities and of management's objectives with respect to data protection.

Choice/Opt-out

Web users have the opportunity to opt-out of the site either for:
1. Receiving ongoing communications.
2. Be a participating user of the site and record clinical data information through e-registration.
Users who do not wish to receive communications or participate to the e-registration, may opt-out of receiving these or participate by sending an email to
iwrssupport@rtp.ppdi.com.

Correction/Updating Personal Information

If a user's personally identifiable information changes, or if a user no longer desires to use the database, PPD provides an easy mechanism to correct, update or remove that user's personal data. The user can submit this information via the User Information Account of the site, as available per study, or otherwise may be asked to update this information through their study monitor. The user can also email ivrssupport@rtp.ppdi.com at any time for assistance.

Inquiries, Complaints, and Subject Access Requests

All communications, queries and Subject Access Requests related to Data Protection issues, should be addressed to PPD, Inc. Attention: Data Privacy Officer, 929 North Front Street, Wilmington, NC 28401-3331, USA, or e-mailed to ppdprivacy@wilm.ppdi.com, for action or response on behalf of PPD. Using reasonable efforts, PPD will promptly respond to any communications regarding our use of personal information. For unresolved disputes between PPD and complainants, PPD has agreed to co-operate with the European Data Protection Authorities (DPAs) dispute resolution procedures.

Privacy Policy Changes

PPD reserves the right to modify or amend this privacy policy. For instance, this privacy policy may need to change as new legislation is introduced or as it is amended. Changes to PPD's privacy policy will be posted on this web site. We recommend that from time to time you review this policy again.
PPD is committed to respecting the privacy of individuals' personal and medical information. By accessing this site and providing patient information, you are acknowledging your sites adherence to applicable privacy laws, rules and regulations. This includes providing notice to patients where necessary and obtaining consent to process and transfer their information to PPD.
PPD has enacted internal procedures, which are reviewed and monitored from time to time to ensure that all information containing personal data is used responsibly and in accordance with applicable law.
I understand that the data provided will be used for the purpose of conducting this registry study and may be transferred to study sponsor, FDA or other regulatory bodies.

Children's Online Privacy Protection

PPD does not collect or maintain information from our website from individuals we actually know are under the age of 13, and no part of our website is structured to attract anyone under 13 years. The only exception to this may occur if data is to be collected directly from study patients under the age of 13 years, and access to users under the age of 13 would only be granted upon confirmed receipt of parental or guardian consent.

Your Acceptance of Our Privacy Practices

By using PPD systems via phone, website, or other user interface, you signify your acceptance of our Privacy Statement, and you adhere to the terms and conditions posted on the website or in the written form of this document received with your user access information. You will be asked to indicate acceptance of the terms of this document the first time you log into a new PPD system, through any available interface. That acknowledgement will apply throughout the continued access to any PPD system using that same user information, or any self-alterations performed off of that same initial user information.