City Therapeutics Healthcare Professional Privacy Notice
1. Introduction
City Therapeutics (referred to as “City Therapeutics”, “We, “Our” or “Us”) is committed to protecting the privacy and security of your personal information.
This Privacy Notice (this “Notice”) is intended for Healthcare Professionals, medical professionals, personnel and staff of healthcare institutions (altogether HCPs) with whom we engage where you are located within the United Kingdom (UK) or the European Economic Area. This Notice describes how we handle information that identifies or relates to you as an individual.
It is important that you read this Notice, together with any other notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
You have been directed to or otherwise sent a copy of this Notice because you are an HCP with whom we engage, or you are acting as a representative or contact person for a healthcare organisation (HCO). This Notice makes you aware of how and why your personal information will be used, and how long it will usually be retained for. It provides you with certain information that must be provided under European data protection laws, such as the EU General Data Protection Regulation (EU GDPR) and the EU GDPR in such form as incorporated into the laws of the United Kingdom.
2. Our role as controller
City Therapeutics is the controller of your personal information. We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. We have also designated a UK representative. To locate the relevant contact details, please see the Contact Us section below.
3. The personal information we collect about you
The following table lists the types of personal information we may collect during the recruitment process:
| Personal Information Category | Purpose for Data Processing |
|---|---|
| Contact details (example: your name, nationality, postal address, telephone number, e-mail address) |
|
| Identity Information (example: your name, DOB, photographs, driving licence, passport, professional licence number, or government ID number) |
|
| Financial Information (example: bank account details, financial information, salary and expenses details) |
|
| Employment history (example: job titles, location of employment/workplace, employment history, working hours) |
|
| Financial Disclose Information (example: any financial interests that you or your spouse and dependent children may have in the Sponsor or technologies adjacent to the clinical trial, the identities of your spouse and dependent children) |
|
| Professional Credentials (example: training records, qualifications and professional memberships) |
|
| Research-Related Data (example: research interests and output) |
|
| Details for Adverse Event Reporting |
|
We also collect, use and share Aggregated Data for various purposes. For example, your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Notice.
4. How we use your personal information
| Personal Information Category | Lawful Basis | Purpose |
|---|---|---|
|
Our Legitimate Interest in contacting you to explore clinical research collaboration opportunities GDPR, Article 6(1)(f) |
Clinical Research Outreach
Where you are an HCP involved in scientific fields relevant to City Therapeutics ’s clinical research, to contact you to explore the possibility of engaging and collaborating with you further through City Therapeutics’s clinical research. |
|
Our Legitimate Interest in conducting clinical research GDPR, Article 6(1)(f) |
Clinical Research
Where you are an HCP involved in the planning, delivery, or oversight of City Therapeutics clinical trials, to collect information from you and process your information, including through the use of artificial intelligence technologies, in order to conduct a clinical trial. |
|
Legal Obligation GDPR, Article 6(1)(c) |
Adverse Event Reporting
Where you are an HCP involved in the delivery, or oversight of City Therapeutics clinical trials, to collect information from you and process your information in relation to any Adverse Events that you report relating during the conduct of the clinical trial. |
|
Our Legitimate Interest in seeking marketing authorisation for our products GDPR, Article 6(1)(f) |
Marketing Approval
Where you are an HCP involved in the delivery of and have oversight of the clinical trial to support applications for and to comply with the conditions of any marketing approval granted in respect of any study drug and to assist with any term variations of marketing approvals. |
|
Contractual Obligation GDPR, Article 6(1)(b) |
Communication
Communicating with you and facilitating your communication with others. |
|
Legal Obligation GDPR, Article 6(1)(c) |
Legal Obligations
For the purposes of complying with legal, regulatory and other requirements, including, but not limited to: completing financial disclosures where required, complying with local employment, social security and occupational health laws and regulations; record-keeping and reporting obligations; and, complying with government inspections and other requests from government or other public authorities. |
|
Vital Interest GDPR, Article 6(1)(d) |
Vital Interest
Monitor your health in order to safeguard and protect you, or to act in your vital interest, or the vital interest of a third party. |
|
Our Legitimate Interest in contacting you to explore clinical research collaboration opportunities GDPR, Article 6(1)(f) |
Event Attendance
Where are an HCP and you attend an event attended or hosted by City Therapeutics as a specialist or expert to discuss the clinical trial at an event or where you may participate in interviews, panel discussions, to act as an ambassador or as speaker on a specialist topic of a study we Sponsor. |
|
Our Legitimate Interest in contacting you to explore clinical research collaboration opportunities GDPR, Article 6(1)(f) |
Identifying HCP from Public Sources
We may collect personal information about you from publicly accessible sources, both public or private registries, and third-party databases. This may include your professional contact details, employment details, and other relevant background information. We may use this personal information to categorise you by area of specialisation, assess whether you and / or your institution is eligible to participate in clinical studies, and personalise our communications with you. |
5. Automated Technologies and AI Use
As part of our ongoing efforts to improve the efficiency, quality of our research and clinical trial activities, we may use artificial intelligence (AI) tools to support data analysis, communication, and system functionality. Some of these third-party software platforms, systems may process your personal information, such as Microsoft o365 suite of applications including Connected Experiences and Microsoft Copilot, an AI tool. Other systems, such as ChatGPT, utilised by us may also include AI features and functionalities that may process your personal information.
Throughout our professional relationship, your personal information may be processed within the Microsoft office 365 suite of applications. This may include processing by Microsoft Copilot AI as part of Microsoft Connected Experiences, in accordance with Microsoft’s privacy and security standards. For more information about how Microsoft may process your personal information, see the Microsoft privacy statement which can be accessed here: https://www.microsoft.com/en-gb/privacy/privacystatement. If you have any questions or concerns about this processing, please contact our Data Protection Officer on the contact email address set out in the ‘Contact us’ section.
Our use of AI tools for processing your personal information is carried out on the basis of our Legitimate Interests to conduct clinical research. We balance our interests against your data protection rights and apply appropriate safeguards to protect your personal information.
6. How we collect your personal information
We collect your personal information when you, as a Healthcare Professional:
Engage with City Therapeutics or our Service Providers;
Interact directly with City Therapeutics through our communication channels; or,
Otherwise provide it to us.
We may also receive information about you from other sources including business partners, third parties, affiliates, and publicly available information about you from publicly accessible sources, both public or private registries, and third-party databases. This may include your professional contact details, employment details, and other relevant background information.
Providing your personal information to City Therapeutics is voluntary but it is necessary if you are to take part in any of our clinical trial activities. Should you choose not to provide your personal information to us, your interaction with us may be adversely impacted, you cannot take part in any of our clinical trial activities, and we will not be in a position to perform a contract with you.
7. Disclosures of your personal information
We may share your personal information with the following parties and as otherwise described in this Notice or at the time of collection.
Affiliates. Our affiliates, for purposes consistent with this Notice.
Service providers. Third parties (such as companies and individuals) that provide services on our behalf or help us operate our business (such as hosting, information technology, email delivery, marketing, and website analytics).
Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for compliance and protection purposes.
Business transferees. Acquirers and other relevant participants in business transactions (or negotiations and due diligence for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganisation, sale or other disposition of all or any portion of the business or assets of, or equity interests in, City Therapeutics or our affiliates (including, in connection with a bankruptcy or similar proceedings).
8. International cross-border data transfers
Some of the third parties we contract with to operate our business are based outside the United Kingdom, European Economic Area and Switzerland. Please note these third countries (such as the United States) may not provide the same protections as the data protection laws where you are based. We will ensure that relevant safeguards are in place to afford adequate protection for your personal information (for example, if you reside in the European Economic Area or the UK, we may rely on an EU Commission or UK government adequacy decision or contractual protections for the transfer of your personal information). For more information about how we transfer personal information internationally, please contact us as set out in the “Contact Us” section below.
9. Data security
City Therapeutics will implement appropriate technical and organisational security measures necessary to adequately safeguard your personal information. These safeguards will include, for example:
Security Measures
Access to personal information is restricted and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need-to-know.
All employees handling personal information receive security and data protection awareness training, will only process your personal information on our instructions and are subject to a duty of confidentiality.
Employees with access to personal information are given the least privilege required.
We have robust procedures in place to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
A disciplinary policy is enforced to prevent unauthorised access.
Where technically feasible, data is encrypted in transit and at rest.
10. Data retention
We will only retain your personal information for as long as required under applicable local, state, national and/or international laws, rules and/or regulations, which may be for a period of up to 25 years after completion of the clinical trial and to fulfil the purposes we collected it for, including for the purposes any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event where we receive a complaint and we reasonably believe there is a prospect of litigation in respect to our relationship with you, or there is an investigation and proceedings.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we will anonymise your personal information (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use and retain this information indefinitely without further notice to you.
11. Your legal rights
Subject to certain limitations and exclusions under applicable laws, you may be entitled to contact us and request to exercise your rights in respect of your personal information. You may have the right to request confirmation as to whether City Therapeutics is processing your personal information, and if so:
To request access to your personal information that City Therapeutics is processing and details about how we process your personal information.
To request City Therapeutics rectifies any inaccurate or incomplete personal information that City Therapeutics is processing about you.
To request erasure of any personal information that City Therapeutics is processing about you, subject to certain exceptions.
To request restriction of processing of any personal information that City Therapeutics is processing about you, subject to certain exceptions.
To obtain a copy of your personal information in a commonly-used and machine-readable format and have it ported to another controller.
To object to the processing of your personal information in certain circumstances.
If applicable, to withdraw your consent for processing your personal information at any time.
To lodge a complaint with us.
To lodge a complaint with your local data protection authority.
To exercise any of the rights described above, please email us using the details in the “Contact Us” section below with a description of your request.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.
12. Changes to the Notice
We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact City Therapeutics for more information.
13. Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.
14. Providing us with other people’s data
If you give us any personal information that does not relate to you (e.g., information about your next of kin/dependants), you must ensure that you have the required legal basis to collect and share their personal information. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this Notice. You must also tell them how they can see what information we have about them, correct any mistakes or request copies of their information.
15. Change of Ownership
In the event that the ownership of our business, assets, or drug development rights is transferred to another entity, whether through merger, acquisition, sale, or licensing, we may share your personal information with the acquiring or licensing entity. This is to ensure continuity of research, regulatory obligations, and product development.
The receiving entity will be required to process your personal information in accordance with applicable data protection laws and the purposes outlined in this Notice, or as otherwise communicated to you at the time of transfer.
Where necessary, we will update this Notice and notify you of any material changes in how your personal information is handled.
16. Contact Us
If you have any questions about this Notice, the use of your personal information, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.
City Therapeutics’ Data Protection Officer (DPO):
The DPO Centre
Katarzyna Wieckowska
Email: dpo@citytx.com
Our UK Representative:
The DPO Centre
Email: ukrep@citytx.com
Thank you for taking time to read this Notice.