This Privacy Policy (this “Policy”) applies to the Personal Data (as defined below) and other information collected by Greenphire, LLC and its affiliates (the “Company”, “we“, “us“, or “our“) while: (1) using our websites, including www.greenphire.com (the “Websites”) and/or (2) using our products and services, including, without limitation the services known as ClinCard, ConneX, eClinicalGPS, EnvisiX and GreenSpace (the “Services”). The Services are typically accessed by you through a proprietary platform (each a “Platform”, collectively, the “Platforms”) available for you to access on a personal computer, smartphone, tablet or other electronic device. To the extent applicable, this Policy also applies to our general online and offline collection of information.
This Policy generally applies regardless of whether you are: (1) a participant in a clinical trial; (2) a payee; (3) a health care provider; (4) a clinical trial site administrator; or (5) a clinical trial sponsor (each a “User”, “you” or “your”). However, certain aspects of the Policy may not apply to each type of User in all circumstances.
By accessing or using the Websites or the Platforms, you agree that you have read, understand, and are bound by this Policy and our Terms of Use [greenphire.com/terms-of-use] (the “Terms of Use”). IF YOU ARE UNDER 18, PLEASE DO NOT USE OR ACCESS THE WEBSITES OR THE PLATFORMS. If you do not agree to be bound by this Privacy Policy or our Terms of Use, please do not use the Websites or the Platforms.
1. Collection of Personal Data
a. Personal Data is information that identifies you, or could be used to identify or contact you. Personal Data includes, without limitation, information such as your name, email address, mailing address, phone number, date of birth, or internet protocol (“IP”) address. We may need to collect and process Personal Data in order: to (i) provide requested information; (ii) provide Services to you; (iii) allow you to access the Website or the Platforms; and/or (iv) because we are legally required to do so. Personal Data may be collected directly from you, from your employer and/or from third parties.
b. Generally, to use and access the Website, you are not required to provide Personal Data. However, to access certain parts of the Website and to use the Platforms you will be required to create an account (each an “Account”). Personal Data will be requested from you as part of the Account registration process. The registration process for an individual User, such as a clinical trial participant, typically requests that you provide your name, email address, mailing address, date of birth and phone number. For Users who are accessing the Website or the Platforms on behalf of their employer, registration typically requires that you supply your name, your job title, your business email address and your business phone number.
c. We also may collect Personal Data when you respond to a survey, inquire about our Services and/or contact us for customer service or technical support.
d. If you inquire about an employment opportunity at Company, you will need to send us a resume or similar document containing Personal Data, that will be used solely for employment evaluation purposes. Providing this information is completely voluntary.
e. The Company occasionally collects Personal Data through various other means, including participation at conferences, tradeshows and events, and from select third-party business partners. From time to time, we may also acquire from third-parties certain lists containing Personal Data of individuals who may be interested in the Websites or our Services.
f. For those Users who receive payments through the Platforms for your participation in clinical trials, we also collect social security numbers as well as information related to your financial institutions and bank accounts such as payment card information.
g. Certain aspects of the Platform may allow you to upload images and documents, such as receipts, which also may contain Personal Data.
2. Grounds for Use of Personal Data. We use Personal Data for legitimate business purposes, including, without limitation, the following:
a. Consent. Personal Data may be used by collecting your consent, such as when you sign a consent in connection with a clinical trial. To withdraw your consent, please contact us at privacy@greenphire.com. Note that if you withdraw your consent, you may not be able to use or access the Websites or the Services. If your consent is obtained via a clinical trial consent, your Personal Data will only be used in connection with the trial or as otherwise permitted by law.
b. Your Account; Delivery of Services. We may use Personal Data about you to: (a) establish and manage your Account; (b) deliver Services to you; (c) allow you to access the Websites or the Platforms; (d) provide you with customer service or technical support; (e) manage our relationship with you, your employer or a clinical trial site; or (f) comply with a legal obligation.
c. Marketing Communications. From time to time, we may use Personal Data to inform you through targeted advertising of products, programs, services and promotions that we believe may be of interest to you as well as for general marketing purposes. We sometimes use a marketing automation tool to identify individuals who may be interested in receiving information about the Websites or our Services.
d. Other Business Purposes. We may use Personal Data for other business purposes, such as data analysis, editorial and feedback purposes, customizing or improving the content and layout of the Websites or the Platforms, completing business transactions, development of marketing and promotion plans and materials, statistical analysis of User behavior (for example, to understand what parts of the Websites and the Platforms are of most interest to Users), product development, market research, administering individual accounts, and meeting regulatory requirements. As appropriate, we, or our business partners, may use your Personal Data to contact you for the purposes of conducting surveys or market research.
e. Administrative Communications. We may use Personal Data to send you information regarding the Websites, the Platforms, your Account status, changes to this Policy or the Terms of Use, or any other policies, agreements or transactions relevant to your use of the Websites or the Platforms. Because this information may be important to your use of the Websites or the Platforms, you may not opt-out of receiving such administrative communications.
f. Employment. We may use Personal Data to consider you for employment when you apply for a position with us or submit a resume or an employment application to us.
g. Compliance with Legal Obligations. We may use Personal Data as necessary to comply with our legal obligations.
3. Web Analytics, Cookies and Similar Technologies.
a. When you visit or interact with the Websites, we, or our third-party service providers, may also use cookies and other types of web technologies to collect technical and usage information such as browsing history, domain name, IP address, browser type, date and time of each visit, and pages that your web browser has visited. As it relates to clinical trial participants, cookies and other types of web technologies will only be used as necessary to perform the requested services. We use cookies to understand and save your preferences for future visits and to compile aggregate data about the Websites’ traffic and your interaction with the Websites so that we can offer better experiences and tools in the future. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your web browser (if you allow) that enables the sites or service provider’s systems to recognize your browser and capture the above information.
b. Most web browsers permit you to set your web browser to block or delete all cookies, including cookies associated with our Websites, or to indicate when a cookie is being set by us. However, it is important to remember that the Websites may not function properly for you if you set your browser to reject our cookies.
c. We may also use other third-party service providers to track visitors to the Websites. Most browsers also allow you to turn on a feature commonly referred to as “Do Not Track” indicating your preference to not have your behavior tracked over time and across websites.
4. How We Share Information.
a. We do not sell Personal Data for monetary consideration or share your Personal Data for advertising purposes. However, we will provide Personal Data to our business partners such as third parties who: (i) assist us in operating the Websites or the Platforms, including information technology partners; (ii) conduct surveys or market research; (iii) manage or operate a clinical trial site; (iv) provide customer support or technical support services; and/or (v) provide general business services (e.g., marketing or analytics). If your use of the Platforms necessitates payments to you, such as if you are a clinical trial participant, we would also then provide Personal Data to financial institutions and related parties in order to provide these payments to you.
b. We may also share your Personal Data when we believe the disclosure is appropriate to comply with the law or legal process, enforce our policies, or protect ours or other’s rights, property, or safety.
c. We may share your Personal Data with our parents, subsidiaries and affiliates. We may also transfer your Personal Data to any successor company through a corporate transaction such as a merger, sale of assets, statutory consolidation and/or joint venture.
d. If you are a clinical trial participant, we will share your Personal Data with: (i) the site staff members (ii) the trial sponsor and those working on the sponsor’s behalf; and/or (iii) contract research organizations.
5. Choices, Rights and Disclosures.
a. We are committed to facilitate the exercise of the rights granted to you by the laws of your jurisdiction. We will do our best to honor your requests, subject to any legal and contractual obligations. If you no longer want to receive marketing-related emails from us on a going-forward basis, you may stop receiving these marketing-related emails by sending an e-mail to privacy@greenphire.com or by clicking the “unsubscribe” link in any email communication. Please note that administrative communications related to the Websites or the Platforms are not subject to a general opt-out or unsubscribe option.
b. We will try to comply with your request(s) as soon as reasonably practicable. Please note: (i) we may not be able to remove your Personal Data from the databases of third parties with which we have already shared your Personal Data (i.e., to which we have already provided your Personal Data as of the date that we implement your request); (ii) that requesting us not to share your Personal Data with unaffiliated third parties may result in you no longer receiving any marketing emails from us; and (iii) that if you choose not to receive marketing-related messages from us, we may still send you administrative communications, and you cannot elect to stop receiving such communications, unless you choose to stop using the Websites and the Platforms. Notwithstanding the foregoing, with respect to clinical trial participant Personal Data, we will be able to remove your Personal Data from the databases of third parties.
6. Retention and Security of Personal Data.
a. We retain the Personal Data for so long as reasonably necessary to fulfill the purposes for which the Personal Data was collected and to perform our contractual and legal obligations.
b. We believe that we have established reasonable organizational and technical measures designed to protect Personal Data from loss, misuse, or unauthorized access, disclosure, alteration or destruction. However, no electronic transmission, storage or processing of information can be entirely secure and you assume all risk of loss, unauthorized access to or misuse of your information. Please note that one of the most effective security measures is protecting your password. Do not use any common passwords (such as “password”, “1234” or your child’s name) for your Account. Do not share your Account password with others.
c. Most Personal Data is stored electronically on third-party servers located in either the USA or the European Union.
7. California Disclosures
a. California “Shine the Light” Information-Sharing Disclosure: California residents may request a list of all third parties with respect to which we have disclosed any of your Personal Data for direct marketing purposes and the categories of information disclosed. If you are a California resident and want such a list, please send us an email request by email to privacy@greenphire.com with “California Shine the Light Rights” in the subject line.
b. California Do Not Track Disclosure: At this time, there is no worldwide uniform or consistent industry standard or definition for responding to, processing, or communicating Do Not Track signals. Thus, our services are unable to respond to Do Not Track Signals.
c. California Consumer Privacy Act Disclosures: The California Consumer Privacy Act, as amended by the California Privacy Rights Act effective January 1, 2023 (“CCPA”), gives California residents the right to request: (i) the categories of Personal Data (including sensitive Personal Date if applicable) we have collected about you; (ii) the categories of sources from which the Personal Data is collected; (iii) the business or commercial purpose of collecting, selling or sharing Personal Data; (iv) the categories of third parties with whom we share or sell Personal Data; (v) the categories of Personal Data about you that we have disclosed; and (vi) the specific pieces of personal information we have collected about you.
Additionally, you have the right: (i) to know the length of time we retain your Personal Data; (ii) to request deletion of your Personal Data; (iii) to request the correction of any inaccurate Personal Data; (iv) to opt out of the sale or sharing of your Personal Data (as applicable); (v) to limit the use of sensitive Personal Data (if applicable); and (vi) to not be discriminated against for exercising any of your CCPA rights.
We will do our best to honor your requests subject to any legal, ethical, and contractual obligations.
d. Exercise of Rights. To exercise the rights described above, it may be necessary for us to verify your identity or authority to make the request and confirm the Personal Data relates to you. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Data. We will not discriminate against you for exercising any of your privacy rights under CCPA or other applicable law.
Please see the chart below regarding the categories of data we may have collected or received in the 12 months preceding the effective date of this Policy from California residents and to whom we may have disclosed the information for business purposes.
We do not sell, and in the last 12 months have not sold, Personal Data for monetary consideration under CCPA. Personal Data may be provided to our service providers and to third parties under Section 1798.140(t)(2)(A) of the CCPA. In the event that the use of third party cookies constitutes a “sale” under CCPA, you may opt out of the use of such cookies using your browser settings.
8. Disclosures for Individual USA States.
a. If you are a resident of Colorado, Connecticut, Virginia or Utah, each of those states provides their residents with rights to: (i) confirm whether we process your Personal Data; (ii) access and delete certain Personal Data; (iii) Personal Data portability; and (iv) opt-out of Personal Data processing for targeted advertising and sales. However, please note that we do not conduct targeted advertising and sales.
b. Colorado, Connecticut and Virginia also provide their state residents with rights to: (i) correct inaccuracies in Personal Data, taking into account the information’s nature and processing purpose; and (ii) opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.
c. Nevada provides its residents with a limited right to opt-out of certain Personal Data sales. However, please know we do not currently sell data triggering that statute’s opt-out requirements.
d. To exercise any of these rights please send a request to privacy@greenphire.com.
9. European Union and United Kingdom Privacy Rights and Choices. If you are located in the European Union (“EU”), the United Kingdom or another jurisdiction that has adopted laws substantially similar to the EU’s General Data Protection Regulations (“GDPR”), your privacy rights include the following:
a. Transparency and the right to information. Through this Policy we explain how we use and share your information. However, if you have questions or need additional information you can contact us any time.
b. Right of access, restriction of processing, and erasure. You may contact us to request information about the Personal Data we have collected from you and to request the correction, modification or deletion of such Personal Data, which requests we will do our best to honor subject to any legal and contractual obligations. To make a request or to ask us a question about our data practices, please contact us via email at privacy@greenphire.com.
c. Right to withdraw your consent at any time. When we process your Personal Data based on your consent, you have the right to withdraw it at any time.
d. Right to object at any time. You have the right to object at any time to receiving marketing or promotional materials from us by either following the opt-out instructions in our e-mails or by contacting us, as well as the right to object to any processing of your Personal Data based on your specific situation. In the latter case, we will assess your request and provide a reply in a timely manner, according to our legal and contractual obligations. Some non-marketing communications are not subject to a general opt-out, such as communications about transactions and disclosures to comply with legal requirements or administrative communications.
e. Right to data portability. You have the right to data portability of your own Personal Data by contacting us.
f. Right not to be subject to an automated decision, including profiling. We do not make automated decisions using your Personal Data that may negatively impact you.
g. Right to lodge a complaint with a supervisory authority. If you consider that the processing of your Personal Data infringes your privacy rights under the GDPR, you have the right to lodge a complaint with a supervisory authority, in the member state of your habitual residence, place of work, or place of the alleged infringement.
h. If you are a clinical trial participant wishing to exercise any of the rights set forth in subsections (b) through (f) above, contact the clinical study site as described in your informed consent form.
10. Changes to our Privacy Policy. We reserve the right to change this Policy from time to time. You are encouraged to regularly review this Policy. If we decide to materially change this Policy, we will post a notice on the Websites and the Platforms.
11. Third-Party Websites. The Websites or the Platforms may contain links to other, unaffiliated websites (“Third-Party Sites”) for your convenience or information. We are not responsible for the content or privacy practices of Third-Party Sites. Third-Party Sites will have their own terms of use and privacy policies, and we encourage you to review those policies as appropriate.
12. Users Outside the United States. Although some Personal Data is stored in the EU, the Websites and the Platforms are controlled and operated from the United States. If you are an individual from the EU, Canada or any other jurisdiction with laws or regulations governing personal data collection, use, and disclosure that differ from United States laws, please be advised that the United States is not deemed an “adequate jurisdiction” by the EU regulatory authorities. Personal Data may also be transferred from the country of your residence to other countries, including the United States, using permitted transfer mechanisms, such as within the framework of the standard contractual clauses.
13. Our commitment to the Data Privacy Framework Program.
Greenphire, LLC complies with the EU-US Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce, with regard to the processing of personal data received from the EU, the UK and Switzerland respectively.
If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Under the DPF program, we commit to subject all personal data received from the EU, UK and Switzerland to the DPF principles, in reliance on the EU-U.S. DPF, its UK extension, and the Swiss-U.S. DPF.
The Federal Trade Commission has jurisdiction over Greenphire LLC’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).
Your choices and rights under the DPF
If your Personal Data is to be used for a new purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized, or transferred to a non-agent third party, you will be provided, where appropriate, with an opportunity to decline to have your Personal Data so used or transferred. Where the information in question is Sensitive Personal Data, your affirmative express consent will be obtained prior to the intended processing.
Additionally, as detailed in section 9 of this Policy, you may seek confirmation regarding whether we are processing your personal data, request access to it, and ask that we correct, amend or delete that information, where it is inaccurate or has been Processed in violation of the DPF Principles.
Accountability for Onward Transfers
When we receive personal information under the DPF principle, we remain liable for any subsequent transfer of it to a third party (“Onward Transfer”).
Where the third party is another controller, we commit to notify you beforehand and give you the choices specified in section 10.2. Furthermore, we commit to enter into a contract with the third-party controller that provides that such data may only be processed for limited and specified purposes consistent with the choice you expressed and that the recipient will provide the same level of protection as the DPF Principles.
Where the third party is acting as our agent, we commit to only transfer Personal Data where such Agent has given assurances that it provides at least the same level of privacy protection as is required by the DPF Principles and will notify us if it determines it can no longer meet this obligation. Furthermore, should we learn that an agent is failing to meet this obligation, we will take reasonable steps to prevent such Processing. Finally, the DPF requires that, to the extent we are responsible for the event, we shall remain liable should our agents process Personal data in a manner inconsistent with the DPF principles.
How to exercise your rights, ask for more information or lodge a complaint?
Your first step should be to contact us directly. To make a request to exercise your rights, issue a complaint about our handling of your personal information, or simply ask for more information, please contact our Data Protection Officer directly at privacy@greenphire.com
Greenphire, LLC
1018 W 9th Ave #200
King of Prussia, PA 19406
Alternatively, you may also contact our local representative:
- In the EU at: eurepresentative@mydposolution.com
- In the UK at: privacy@greenphire.com
OPTION 1: INDEPENDENT DISPUTE RESOLUTION BODY
Your second step, if you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/submit/ for more information or to file a complaint. The services of JAMS are provided at no cost to you.
Indeed, in compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and, the Swiss-U.S. DPF, Greenphire, LLC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS an alternative dispute resolution provider based in the United States, the European Union, the United Kingdom, and/or Switzerland (as applicable).
OPTION 2: PANEL OF EU DATA PROTECTION AUTHORITIES
Your second step, if you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please contact your local European Data Protection Authority.
Indeed, in compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Greenphire, LLC commits to cooperate and comply {respectively} with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Your third step, if any request remains unresolved, should be to exercise your right to invoke binding arbitration under the DPF. To learn more about the arbitration mechanism, please visit https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf.
For inquiries related to Human Resources Data
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Greenphire LLC commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Greenphire LLC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS an alternative dispute resolution provider based in United States, the European Union, the United Kingdom, and/or Switzerland (as applicable). If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.
14. Contact Information. If there are any questions regarding this Policy or how we collect, use, store or handle Personal Data, you may contact us by sending an email to privacy@greenphire.com or by sending registered mail to:
Greenphire, LLC
1018 West 9th Ave., Suite 200
King of Prussia, PA 19406
USA
Attn: Privacy Department
Policy Last Updated: February 22, 2024
