ImagingDMD UF is committed to protecting and preserving your privacy. This
personal data we collect from you, that you provide to us, or that we obtain about you in connection with your involvement with the ImagingDMD UF as 1) a subject in a clinical trial, 2) employees, contractors, imaging sites, sponsors, vendors, suppliers, or business partners, or 3) individuals who access ImagingDMD UF websites or engage in email or other electronic communications with ImagingDMD UF for the purposes of commercial interest or personal communications.
• Processed lawfully, fairly and in a transparent manner to you;
• Collected only for specified, explicit, and legitimate purposes, and not further
processed in a manner that is incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary for those purposes;
• Accurate and up-to-date, as necessary;
• Stored for no longer than is necessary for the intended purposes; and
• Secure and protected from accidental or unlawful destruction, loss, alteration,
unauthorized access, or disclosure.
Data Processing on Behalf of Sponsors of Clinical Trials – Subjects
ImagingDMD UF typically serves as a specialized imaging services vendor in clinical
studies involving data subjects, such as patients with rare diseases. In the course of this business activity, it is necessary for us to access, collect, process, use, transmit, disclose, store, and otherwise handle personal data from these data subjects on behalf of clinical trial sponsors, who are usually pharmaceutical, biologics, or medical device researchers that are monitored by regulatory agencies, such as the Food and Drug Administration (FDA) in the U.S. and the European Medicines Agency (EMA) in the EU. When these processing activities are subject to the GDPR we will be acting as “data processors” as directed in a data processing agreement with the sponsor, who is acting as a GDPR “data controller.”
The personal data that we may collect and process about you, if you are a clinical trials data subject, includes medical images that are collected at an imaging site, demographic information about you, and measurements and assessment data from the Proprietary and Confidential Page 2 of 6 images. We typically do not collect your name or other identifying information such as email address, telephone number, or postal address. Clinical trial sponsors determine the means and purposes of such processing activities, including the personal data that will be collected, how that data will be used and by whom
such data is accessed, and how long the data will be retained. The processing of your
personal data in connection with such clinical trials can be found in the information
provided to you by the clinical trial sponsor and/or imaging site, including the Informed Consent Form (ICF) that was reviewed and acknowledged by you prior to your entry into the clinical trial. Please note that you must contact the sponsor if there are any questions or requests regarding your personal data, since they serve as the Data Controller.
Data Processing related to Clinical Trials – Non-Subject
When ImagingDMD UF collects personal data on data subjects that are not in a clinical trial, such as personal data of ImagingDMD UF employees and contractors, imaging sites and sponsor representatives, and ImagingDMD UF vendors, suppliers, and business partners, the relationships between ImagingDMD UF and these data subjects are defined in contractual agreements. The processing and control of this personal data by ImagingDMD UF is intended to establish and manage our contractual relationships with these parties. These contractual agreements specify the limited use and disclosure of your personal data when we access, collect, process, use, transmit, disclose, store, and otherwise handle personal data for these contracted purposes. Please note that ImagingDMD UF may be forced to disclose your personal information when compelled by a lawful request made by a recognized public authority or where required to meet national security and or law enforcement requirements. The personal data that we may collect and process about ImagingDMD UF employees and contractors, imaging sites, and sponsor representatives, and ImagingDMD UF vendors, suppliers, and business partners includes names, positions, email addresses, telephone numbers, and postal addresses. We do not collect health information about these individuals.
Data Processing of Personal Data from ImagingDMD UF Website and Electronic Communication
When individuals access ImagingDMD UF websites or engage in email or other electronic communications for the purposes of commercial interest or personal communications, we automatically and manually collect and process personal data from the website user or the individual who communicates with us. The personal data that we may collect and process includes your name, job title, company name, email address, telephone number, postal address, and details about the use of the website, such as the Proprietary and Confidential Page 3 of 6
Personal Data Protection and Access Rights
In accordance with applicable data protection and privacy laws, and where contractual commitments require, ImagingDMD UF ensures that you can expect all relevant data privacy, protection, and access rights, including, but not limited to, notification of our privacy policies, your rights of choice and consent or to withdraw consent at any time, to request access to specific information, to request personal data correction or deletion, to request a copy of personal data in a common digital format (e.g., PDF), and to be notified about a suspected or actual breach of your personal data.
Data Subject Choice and Consent Rights – If you are a clinical trial data subject, the ICF that was provided to you prior to participation in a sponsored clinical trial provided you with the data privacy notification from the sponsor and documentation of your consent to participate in the clinical trial under the stated conditions, including the purpose, use,
Collection and Access to Specific Information – When ImagingDMD UF serves as a data processor in a sponsored clinical trial, your personal data is typically collected from a third-party, such as an imaging site in a clinical study, and designated ImagingDMD UF will ensure that it will be collected and processed lawfully. You have the right to request that we disclose information to you about our collection and processing of your personal data. If you are a clinical trial data subject or patient, you must contact the imaging site or the clinical trial sponsor to learn how you can access your personal data since ImagingDMD UF does not possess the required information to identify you. If you are not a clinical trial data subject, you can request access to your personal data using a “Data
Subject Access Request Form” that can be requested from the ImagingDMD UF via email to privacy-iDMD@phhp.ufl.edu. Once we receive your written request and confirm your identity, we will disclose to you the information that we possess.
ImagingDMD UF must maintain the accuracy, integrity, confidentiality and relevance of your personal data based on the stated processing purposes. Adequate security mechanisms designed to protect personal data must be used to prevent your personal data from being stolen, misused, or abused, and prevent personal data breaches. If ImagingDMD UF uses a third-party supplier or business partner to process your personal data on its behalf, the third-party data processor will follow established ImagingDMD UF security standards and supplier evaluation requirements to assure that the contracted third-parties adequately safeguard your personal data in a manner that is appropriate to the associated risks.
Deletion and Correction Request Rights – You have the right to request that personal data that ImagingDMD UF possesses about you be deleted or corrected if it is incorrect. Proprietary and Confidential Page 5 of 6 If you are a clinical trial data subject or patient, you must contact the imaging site or the clinical trial sponsor to learn how you can exercise these rights. If you are not a clinical trial data subject, you have the right to request a “Data Subject Access Request Form” via email to privacy iDMD@phhp.ufl.edu to formally request that ImagingDMD UF delete or correct any of your personal data that we collected from you and retained, subject to
certain exceptions or requirements in a contractual agreement. Once we receive your
request and confirm your identity, we will delete or correct your personal data in our
records, unless an exception or other requirement applies. If an exception applies, you will be notified that the data will not be deleted, along with specific information about the basis for the exception. If you submit a request to correct, amend or delete your personal data records, the ImagingDMD UF must ensure that your request is handled within a reasonable time frame. If you are a clinical trial participant, since the information necessary to identify you is not collected or maintained by us, you must first communicate with the clinical trial imaging site and/or sponsor to correct, amend, or delete your records, and the sponsor must then communicate the request to ImagingDMD UF. The ImagingDMD UF must record all of the actions to delete personal data in a “Log of Destroyed Personal Data Records.”
Data Portability Rights – You have the right to receive a copy of your personal data in a structured electronic file format such as Adobe PDF, and/or to transmit those data to a designated recipient at no cost to you. If you are a clinical trial participant, you must first contact the imaging site or the clinical trial sponsor to learn how you can exercise these rights. If you are not a clinical trial data subject, you have the right to request a “Data Subject Access Request Form” via email to privacy-iDMD@phhp.ufl.edu to formally request that ImagingDMD UF provide you or a designated recipient with a copy of all of your personal data in an electronic format. There is no charge for the personal data access and transfer actions, and such requests must be processed within one month. The release of the personal data to you or your designate will be documented on a “Data Subject Disclosure Form.”
Data Breach Notification Rights – You have the right to be notified about a suspected
or actual breach of security of your personal data. If you are a clinical trial data subject located in the EU, the sponsor of the clinical trial is responsible for determining whether there is a likely risk to your rights and freedoms as a data subject and for notifying you and the designated EU authority. If you not a clinical trial data subject and if the ImagingDMD UF identifies a suspected or actual personal data security breach, the ImagingDMD UF must perform an internal investigation, properly report the incident, and take appropriate remedial measures in a timely manner, including notification of you as an affected data subject using the “Data Breach Notification Form – Data Subject.” ImagingDMD UF will record the data breach incident information into the “Register of Data Breaches”, which will be maintained in the ImagingDMD UF records archives and reviewed and updated annually. Proprietary and Confidential Page 6 of 6
Communication with the ImagingDMD UF
To communicate directly with us, please send an email to privacy-iDMD@phhp.ufl.edu
or ImagingDMD UF, 2004 Mowry Road, Gainesville FL 32611.