Western Region Website Privacy Notice

Introduction

This Privacy Notice (“Notice”) explains how Linical Europe GmbH, and its affiliates, subsidiaries and branch offices, collect, use and disclose personal data online and offline in connection with the services We provide to Our clients. This Notice applies to the individuals whose Personal Data (as described below) We process, i.e. a natural person who works for or is otherwise engaged by, or interacts with Us. This includes; 

•    Linical employees, officers, and contractors. 
•    Our Service Providers’ and Agents’ employees, officers, and contractors,  
•    Our clients (including clients’ employees, officers, agents, and contractors), their affiliates or other third parties in connection with the Services.
•    A service user of this Website.

Please note that a separate Healthcare Professional Privacy Notice is available for Healthcare Professionals, available here.

Please note that clinical trial or study participants seeking transparency information should reach out directly to their investigator at the study site or the relevant study sponsor. Linical only acts as a Data Processor for the processing of clinical trial or study participant Personal Data.

Definitions

For the purposes of this Notice: 

Cookies are small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website. 

Data Controller, for the purposes of both UK GDPR and EU GDPR, refers to Linical as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data. For both UK GDPR and EU GDPR, Linical is the Data Controller. The terminology may vary depending on your jurisdiction and applicable Data Protection or Privacy laws, this may be referred as “Organizations”, “Business” or other equivalent.

Data Processor, for the purposes of both UK GDPR and EU GDPR, refers to Linical’s Service Providers.  The terminology may vary depending on your jurisdiction and applicable Data Protection or Privacy laws, this may be referred as “Vendor”, “Third-party”, “Service Provider” or other equivalent.

Data Protection or Privacy Legislation, as defined in the Data Protection Legislation section below. 
Device means any device that can access the Service such as a computer, a mobile phone, or a digital tablet. 

Linical (referred to as either “Linical”, “We”, “Us” or “Our” in this Agreement) refers to Linical Europe GmbH, inclusive of its affiliates, subsidiaries and branch offices, at Hahnstrasse 40, 60528 Frankfurt am Main, Hessen, Germany, respectively. 

Personal Data is any information that relates to an identified or identifiable individual. For both UK GDPR and EU GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.  The terminology may vary depending on your jurisdiction, this may be referred as “Personal Information”.

Service refers to the Website, unless otherwise stated. 

Service Provider means any natural or legal person who processes the data on behalf of Linical. It refers to third-party companies or individuals employed by Linical to facilitate the Service, to provide the Service on behalf of Linical, to perform services related to the Service or to assist Linical in analyzing how the Service is used. For the purpose of both UK GDPR and EU GDPR, Service Providers are considered Data Processors. 

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit). 

Website refers to the Linical website, accessible from https://www.linical.com. 

You means the individual accessing or using the Service, or the organization, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under both UK and EU GDPR, You can be referred to as the Data Subject or as the User as you are the individual using the Service.

Data Protection Legislation

Throughout this document we refer to Data Protection Legislation.  

European Union (EU) and European Economic Area (EEA)

In the EU and EEA, Data Protection Legislation means the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”) and the ePrivacy Directive (Directive 2002/58/EC), as well as any local data protection implementation laws, including any replacement legislation coming into effect from time to time.

United Kingdom (UK)

In the UK, Data Protection Legislation means the Data Protection Act 2018 (“DPA 2018”), United Kingdom General Data Protection Regulation (“UK GDPR”), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), the Data (Use and Access) Act 2025, and any legislation implemented in connection with the aforementioned legislation, including any replacement legislation coming into effect from time to time.

United States of America (US)

In the US, Data Protection Legislation refers to any federal, state, sectoral, or case laws and regulations governing the privacy and security of personal data, including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 (HIPAA); the Genetic Information Non-discrimination Act 2008 (GINA), the Federal Food, Drug, and Cosmetic Act 1938 (FDCA), and all applicable state privacy legislation, including, but not limited to, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); the Confidentiality of Medical Information Act  (CMIA) 1981; New York’s Shield Act; and Delaware’s Online Privacy and Protection Act (DOPPA), and all other relevant state and federal regulations. This definition also encompasses any legislation implemented under these laws and any replacement or additional legislation enacted from time to time.

Other Jurisdictions

Depending on your jurisdiction, additional Data Protection Legislation may apply. If you have any questions, you can contact Us using the details in the Contact Us section below.

Data Controllership

In our capacity as a Contract Research Organisation (CRO), Linical acts as a Data Processor for the clinical trial Sponsor, processing Personal Data collected during the clinical trial on behalf of the Sponsor, and in accordance with the Sponsor’s instructions. Linical is the Data Controller for all other Personal Data we process, unless otherwise stated, as described in this Notice.

Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. For further details on how you can contact our DPO, please see the Contact Us section below.

Your Personal Data

We only collect Personal Data that We know we will genuinely use and in accordance with the Data Protection Legislation. The type of Personal Data that we will collect on You will depend on whether You are; 

•    A Linical employee, officer, or contractor, 
•    A Linical Service Provider or Agent employee, officer, or contractor, 
•    A Linical client, e.g., a clinical trial Sponsor (including client employees, officers, agents, and contractors), their affiliates or other third parties in connection with the Services,
•    Or a service user of this Website.

We are a Controller of the personal data You (data subject) provide us. We may collect the following types of personal data from you:

Employees, Officers, or Contractors of Linical, Linical’s Service Providers or Linical’s Clients:

•    Your name 
•    Your date of birth 
•    Your contact information (telephone number, fax number, email address, or mailing address) 
•    Your employment details 
•    Where relevant, your pseudonymized unique identification number(s) (e.g., payroll number) 
•    Where relevant, your financial information (e.g., bank information) 
•    Where relevant, your Right to Work information (e.g., nationality) 
•    Where relevant, your health data (e.g., sick leave information)

Website User*

•    Your name 
•    Your contact information (email address) 
•    Your Contact Us form responses 
•    Your Usage Data (e.g., your IP address) 
•    Cookies and Tracking Technologies‡ 

*You are under no statutory or contractual requirement or obligation to provide us with your Personal Data; however, we require at least the information above for us to deal with you as a Service User in an efficient and effective manner.

*For more information on Linical’s use of Cookies and other Tracking Technologies, please see our Cookie Notice.

Your Sensitive Personal Data

Where Linical acts as a Data Controller, within the scope of this Notice, We do not typically collect sensitive Personal Data. Please do not share any Personal Data with Us which would be categorized as special data under Data Protection Legislation  (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership).

Children and Our Services

Where Linical acts as a Data Controller, Our services are not directed to individuals under the age of thirteen (13), We do not seek, or knowingly collect Personal Data from individuals under 13. If We become aware that We have unknowingly collected Personal Data from a child under the age of 13, we will make commercially reasonable efforts to delete such information.  If You are the parent or guardian of a child under the age of 13 who has provided us with Personal Data, You may contact our DPO using the information in the Contact Us section below to request that it be deleted.
Where Linical acts as a Data Processor on behalf of the Data Controller (the clinical trial Sponsor) collecting Personal Data in the context of clinical trials, Linical may collect the Personal Data of Minors (under the age of eighteen) where such Minors are participants in the clinical trial.  In such circumstances, Minors’ Personal Data will be processed by Linical in accordance with the instructions and legal basis provided by the Data Controller (the clinical trial Sponsor), and always in compliance with applicable Data Protection Legislation.  This Processing is subject to the informed consent or authorisation obtained from the Minors’ parent or legal guardian, as required by relevant regulations and guidelines. 

Our Processing Purposes

 Under Data Protection Legislation, the available lawful bases we rely on for processing your information are:
 
•    GDPR Article 6(1)(a) – your consent;*  
•    GDPR Article 6(1)(b) – We have a contractual obligation; 
•    GDPR Article 6(1)(c) – We have a legal obligation;  
•    GDPR, Article 6(1)(d) – In order to protect the vital interests of You or a third party; 
•    GDPR, Article 6(1)(e) – We have a public interest; or, 
•    GDPR, Article 6(1)(f) – We have a legitimate interest. 

* Where the lawful basis for processing is Consent, you can remove your consent at any time. You can do this by contacting our DPO using the contact details provided in the Contact Us section below. 

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.  If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may use Personal Data for the following purposes:

Recipients of Your Personal Data

We may share your personal data with other organizations in the following circumstances:

•    From time to time, we may need to share your Personal Data with our strategic partners;
•    To affiliates and subsidiaries of Linical; 
•    If the law or a public authority says we must share the Personal Data;
•   If we need to share Personal Data to establish, exercise, or defend our legal rights—this includes providing Personal Data to others for the purposes of detecting and preventing fraud;
•    From time to time, employ the services of other parties for dealing with certain processes necessary for the operation of our services; or
•    For purposes otherwise permitted under the Data Protection Legislation

Your Personal Data is processed by us in each corresponding location.
 
We use Service Providers (“Data Processors”) who are third parties that provide elements of services for us. We have Data Processor Agreements in place with our data processors to help protect your Personal Data.

Retention Periods

We will retain Personal Data to provide You with a high quality and consistent service. We will retain Personal Data for as long as needed or permitted in light of the purposes for which it was obtained. We will always retain Your Personal Data in accordance with the Data Protection Legislation, and never for longer than is necessary. 
Linical follows a Retention Schedule which outlines how long We will retain your Personal Data. We consider the retention period to begin from the point at which We last contact You, or otherwise reviewed Your record to determine whether it was still active, unless otherwise required by law.  As such, unless otherwise required by law, Your data will be retained for the period specified in the summarised table below, and then securely deleted in accordance with Our internal policies and procedures. 

Communicating With You

Where you are an employee of Linical, we will contact you through existing Linical communication channels, including email, where it is appropriate to do so. 

Where you are an employee of Linical’s Service Providers or clients, a user of this website who has provided us with your contact information, a Healthcare Professional, or any other business contact, we will send you relevant news about our services in a number of ways including by email, but only if we have a Legitimate Interest to do so. Where we do not have a Legitimate Interest, we will not send you marketing communications unless we have asked for, and gained, your Consent. We make every effort to ensure that we only send such communications to those acting in a business capacity and do not send such materials to consumers via personal email addresses if it is clear they are not acting in such a capacity or have not otherwise provided their consent. 

All email communications will have an option to unsubscribe where relevant. If you wish to amend your marketing preferences You can do so by following the link in the email and updating your preferences. Alternatively, you can contact our DPO using the contact details provided in the Contact Us section below.

Sharing Your Thoughts

When using Our Website and other Services, You may be able to share information through social networks like Facebook, LinkedIn and X. For example, when You ‘like’, ‘share’ or review Our Services. When doing this, Your Personal Data may be visible to the providers of those social networks and/or their other users. Please remember it is Your responsibility to set appropriate privacy settings on Your social network accounts so that You are comfortable with how Your information is used and shared on them.  

Third Party Links

Our Website may contain links to other sites operated by third parties. Linical does not control such other sites and is not responsible for their content, their privacy policies, or their use of personal information. Linical’s inclusion of such links does not imply any endorsement of the content on such sites or of their owners or operators except as disclosed through the Services. Any information submitted by You directly to these third parties is subject to that third party’s privacy policy. We expressly disclaim any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of personal information by third parties.

Business Changes

We may, from time to time, expand or reduce Our business and this may involve the sale and/or the transfer of control of all or part of Our business. Any personal data that You have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Notice, be permitted to use that data only for the purposes for which it was originally collected by Us.  

Security

We have put in place appropriate organizational, technical and administrative measures to protect Personal Data, and prevent it from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed.
 
We take security measures to protect your information, including; 

•    Limiting access to Our buildings and resources to only those that we have determined are entitled to be there (by use of passes, key card access and other related technologies); 
•    Managing a data security breach reporting and notification system which allows Us to monitor and communicate information on data breaches with You or with the applicable regulator when required to do so by law; 
•    Implementing access controls to Our information technology; and, 
•   Deploying appropriate procedures and technical security measures (including strict encryption, anonymization and archiving techniques) to safeguard Your information across all Our computer systems, networks, websites, mobile apps, offices, and stores.

International Transfers

Your Personal Data is processed at the Linical’s operating offices and in any other places where the parties involved in the processing are located, including the United States, and Japan. This means that this information may be transferred to Devices located outside of Your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. Where this occurs, Linical will ensure that: 

•    The security and confidentiality of Your Personal Data is always secure; 
•    Any transfers are undertaken to countries that the European Commission or UK Government, as applicable, has deemed to provide an adequate level of data protection, or where appropriate safeguards are in place (see below).  
•    Any Data Controller receiving Your Personal Data has entered into an agreement with Linical which contains standard data protection clauses as required by UK and/or EU GDPR or there is an alternative appropriate safeguard in place governing the transfer; and, 
•    Any Data Processor receiving Your Personal Data has entered into an agreement with Linical which contains the required Data Processor clauses as well as standard data protection clauses as required by UK and/or EU GDPR or there is an alternative appropriate safeguard in place governing the transfer. 
Where You are based in the UK or EU and we are required to transfer your Personal Data out of the UK or EU to countries not deemed by the ICO or European Commission (as relevant) to provide an adequate level of Personal Data protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the Data Protection Legislation, such as the specific contracts containing standard data protection clauses approved by the European Commission or UK government (as relevant) providing adequate protection of Personal Data. You can obtain a copy of this documentation by contacting our DPO as identified in the Contact Us section below.

Your Rights

Depending on your jurisdiction, your rights under applicable Data Protection and Privacy laws may differ from the below.

European Union, European Economic Area, and the United Kingdom

Where EU GDPR and UK GDPR apply, you have the following rights over your Personal Data. If You would like to exercise these rights, please Contact Us as set out below.

•    The Right to Be Informed About Our Collection and Use of Personal Data
o    You have the right to be informed about the collection and use of Your personal data. We ensure We do this with our internal and external Privacy Notices (including this document). These are regularly reviewed and updated to ensure these are accurate and reflect Our data processing activities.
•    Right to Access Your Personal Data
o    You have the right to access the Personal Data that We hold about You in many circumstances, by making a request. This is sometimes termed a “Data Subject Access Request.” If We agree that We are obliged to provide Personal Data to You (or someone else on your behalf), We will provide it to You or them free of charge and aim to do so within 1 month from when Your identity has been confirmed. We would ask for proof of identity and sufficient information about Your interactions with Us that We can locate Your Personal Data. 
•    Right to Rectify Your Personal Data
o    If any of the Personal Data We hold about You is inaccurate, incomplete, or out of date, You may ask us to correct it.
•    Right to Erasure
o    You have the right to have personal data erased. This is also known as the “right to be forgotten.” The right is not absolute and only applies in certain circumstances. For instance, the right to erasure does not apply where We have a legal obligation to retain Your Personal Data. 
•    Right to Restrict Processing
o    You have the right to ask Us to restrict the processing of Your personal data. For example, this may be because You have issues with the accuracy of the data We hold or the way We have processed Your data. The right is not absolute and only applies in certain circumstances. 
•    Right to Portability
o    The right to portability gives You the right to receive personal data You have provided to a controller in a structured, commonly used, and machine-readable format. It also gives You the right to request that a controller transmits this data directly to another controller.
•    Right to Object
o    You have the right to object to Our processing of some or all of the personal data that We hold about You. This is an absolute right when We use your data for direct marketing but may not apply in other circumstances where We have a compelling reason to do so, e.g., a legal obligation. 
•    Rights Related to Automated Decision-Making
o    You have the right to object to Our processing where a decision is made about You solely based upon automated processed and that has significant or legal effects upon You. Linical does not intend to conduct any automated decision-making using Your Personal Data. 

In the EU/EEA, You can find Your country’s regulatory body here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. If You have any questions about which supervisory authority applies in Your jurisdiction, please Contact Us as set out below. 

In the UK, the Information Commissioner's Office (ICO) regulates data protection and privacy matters. They make a lot of information accessible to consumers on their website, which You can access here: https://ico.org.uk/for-the-public. 

You can make a complaint to any supervisory authority at any time about the way We use Your information. However, We hope that You would consider raising any issue or complaint You have with Us first. Your satisfaction is extremely important to Us, and We will always do Our very best to solve any problems You may have. In the UK, you have a right to make a complaint directly to Linical.

United States - California
California Data Protection Legislation

If You are a California resident, the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”) requires that We provide You with a privacy policy of Our online and offline information practices and Your rights under this law regarding Your personal information. We currently collect, share, disclose, and use Your personal information. In the 12 months prior to the last updated date of this Notice, We have collected, shared, disclosed the personal information set out in the ‘What Information We Collect’ section above. We may collect personal information directly from California and other US state residents, credit reporting agencies, and/or our third-party service providers. We do not collect all categories of personal information from each source.

California Resident Rights

California residents are afforded the following rights:
•    to delete Your personal information, unless We:
o    can prove this to be impossible;
o    it involves disproportionate effort; or
o    it is reasonably necessary for Us to maintain records to fulfil the transaction(s) for which the personal information was collected;
•    to correct inaccurate personal information held about You;
•    to know what personal information is sold or shared and to whom (this right is fulfilled with the information provided within this Notice);
•    to request specific pieces of information from Us;
•    to opt out of the sale or sharing of Your personal information;
•    to limit use and disclosure of sensitive personal data; and,
•    to no retaliation following opt-out or exercise of other rights.
If You would like to contact our DPO regarding these rights, please Contact Us as set out below. Please note that We may need to verify Your identity before processing Your request. Rights requests shall be reviewed to see if an exemption allows Us to retain the information. We may deny Your deletion request if an exemption applies and/or if retaining the information is necessary for Us or Our Service Provider(s), for example to detect fraudulent activity or comply with a legal obligation. We will delete, de-identify, or limit the scope of personal information not subject to an exemption from Our records and will direct Our Service Providers to take similar action.

United States – Other Data Protection Legislation
Other US Data Protection Legislation

If You are a US resident, We process Your personal data in accordance with applicable US state data privacy laws, including the CCPA/CPRA described above. This section of Our Notice contains information required by other US state data privacy laws and supplements the above section on CCPA/CPRA. Several US states have enacted comprehensive privacy statutes, including, but not limited to: Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. These laws include provisions aimed at safeguarding consumer rights and outlining business obligations. If You have relevant rights under these laws, You can exercise them by contacting our DPO using the details provided in the Contact Us section as set out below.
Our practices are designed to adhere to the highest standards set forth by these laws, ensuring that We respect the privacy rights of all individuals. As the US privacy laws continue to evolve, We will monitor these changes, adjust Our privacy practices, and update Our Notice(s) accordingly.

We Do Not Sell Your Personal Information

You have the right to know whether Your personal information is being sold. Your personal information is “sold” when it is provided to a third party for monetary or other valuable consideration for a purpose that is not a “business purpose” as set forth in the CCPA or other US state data privacy laws. We do not sell your personal information. Please note a “sale” does not include when We disclose Your personal information at Your direction, or when otherwise permitted under law.

We May Share Your Personal Information

We may “share” Your personal data, as defined under California and other applicable US state laws, for personalised advertising purposes and/or for any other purposes outlined in this Notice.

Do Not Track

Due to varying practices among browser providers and the lack of a market standard, We do not respond to Do Not Track signals currently.

Non-Discrimination

US state privacy laws prohibit businesses from discriminating against You for exercising Your rights under the law. Such discrimination may include denying goods or services, providing a different level or quality of service, or charging different prices. The CCPA permits businesses to provide differing levels or quality or different prices where the business can demonstrate that the difference is reasonably related to the value to the business of the consumer’s personal information.

Contact Us

If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this Notice or the way your Personal Data is processed, please contact our Data Protection Officer (DPO): 

FAO Linical DPO
Dr. Lawrence Carter
The DPO Centre Limited
50 Liverpool Street
London
UK
EC2M 7PY
+442037971289
dpo@linical.com

Updates to This Notice

We may change this Notice from time to time (for example, if the law changes).  We recommend you check this Notice regularly to keep up-to-date. Any changes will become effective when We post the revised Notice.