Privacy Policy Research and Clinical Trials

Privacy policy applicable to individuals participating in our research and clinical trials (physicians and/or subjects whose data is used for research and/or trial purposes)

This Privacy Policy describes all the data processing that we may carry out within the framework of our research and clinical trial activities. For complete information on the nature of the processing we carry out, and also on your rights and how to exercise them, please also consult the information contained in Volta Medical's General Data Protection Policy.

What categories of personal data are we likely to collect and process in our capacity as Data Controller?

The categories of data we collect depend on the type of research and/or clinical trial we are conducting and your role in the research or clinical trial concerned (patient, professional involved, etc.).
In this context, the data we are likely to collect includes the following:

With regard to natural persons whose data enables us to carry out our research and/and clinical trials

For data relating to persons participating in or concerned by a research project or clinical trial (excluding research conducted on the basis of PMSI data)

Please note: The data collected varies depending on the type of research or clinical trial concerned. You are informed of the specific data collected, as well as all the essential characteristics of the processing carried out, by the doctor in charge of the study or clinical trial through a dedicated information notice.
The data may include the following:

Identification data: age or date of birth (month, year, or, where necessary, day), place of birth, sex, country and department of residence, serial number or alphanumeric code excluding surname(s) and first name(s), body mass index (BMI);
Health data: data strictly necessary for the conduct of the research and/or clinical trial (such as weight, height, medical history, treatments received, examination results, medical imaging, data relating to adverse events occurring during the research or clinical trial, health data relating to a condition likely to influence the results or prevent participation, intervention reports, electrocardiograms, cardiac signals, etc.);
photographs and/or videos and/or voice recordings that do not allow the identification of the data subjects (e.g. through masking of the face, eyes, or distinctive features) and are collected in compliance with applicable regulations on image and voice rights;
dates relating to the conduct of the research (in particular the date of inclusion and dates of visits or data collection);
ethnic origin;
genetic data strictly necessary for the purposes of the research or clinical trial, which may not be used to identify or re-identify individuals;
family situation;
level of education (e.g. primary, secondary, higher education);
socio-professional category (e.g. INSEE classification);
professional life (e.g. current occupation, professional history, unemployment, business travel, occupational exposure);
social security affiliation (excluding the national identification number), supplementary insurance (mutual insurance, private insurance);
participation in other research, studies or clinical trials, in order to verify compliance with inclusion criteria;
travel (e.g. to the place of care or research: mode of transport, duration, distance);
consumption of tobacco, alcohol, or drugs;
lifestyle habits and behaviours (e.g. level of dependency, assistance received, physical activity, dietary habits, leisure activities);
lifestyle (e.g. urban, semi-urban, or rural environment; housing characteristics);
sex life;
vital status, where this information is available in source documents or known to the professional involved in the research;
reimbursement of expenses incurred in connection with participation in the research or clinical trial;
quality of life scales or any other information relating to quality of life.

For data relating to professionals involved in research and/or clinical trials: As part of our research and/or clinical trials, we also collect personal data relating to professionals involved, such as scientific managers, participating physicians, and, where applicable, staff involved in the research.
This may include: surname, first name, title, telephone number,professional contact details (email, postal address, landline and mobilephone), department, entity and address of the entity in which you work,professional identification number (RPPS), URSSAF number where applicable,professional curriculum vitae (CV), contracts entered into with us; datarelating to map annotations.

For university practitioners: institution, identity of the dean and/ordirector, internal manager or head of department, head of committee, position,signature, date of signature, institutional stamp, professional correspondence.
Where applicable: bank details, remuneration, hospitality, dates ofinteractions with us, and technical data relating to the use of medical deviceswe develop.

For clinical research assistants: Surname, first name, title, telephone number, professional contact details (email, postal address, landline and mobile phone), department, entity and address of the entity in which you work.
Where applicable: bank details, remuneration, hospitality, and dates of interaction with us.

With regard specifically to studies conducted on the basis of PMSI data:

The PMSI (Programme de Médicalisation des Systèmes d’Information) is a standardized collection of administrative and medical data gathered from public and private healthcare establishments in France. The data contained in this system are collected by the Agence Technique de l’Information sur l’Hospitalisation (ATIH).

The French State uses this system primarily to organize hospital care and finance healthcare establishments based on their activity.

Under certain conditions, PMSI data may also be made available to entities producing or marketing health products. These conditions are governed by Reference Methodology MR-006 (Deliberation No. 2018-257 of June 7, 2018).

The PMSI data that may be made available to us include data centralized by the ATIH concerning the following activities:
- medicine, surgery, obstetrics, and dentistry (MCO);
- follow-up and rehabilitation care (SSR);
- collection of medical information in psychiatry (RIM-P);
- home hospitalization.

The data relevant to each study is listed in the scientific protocol, the summary of which has been declared to the public directory maintained by the Institut National des Données de Santé [National Institute for Health Data] (INDS). Studies registered with the INDS can be consulted here: https://www.health-data-hub.fr/projets.

With regard to the processing of data relating to the persons responsible for carrying out the study (staff of the research office/laboratory in question), the categories of data that we are likely to process are as follows: first and last name, job title, access profiles, business telephone, postal, and email address where applicable, employer's organization, training, degrees and qualifications, elements required for the assessment of knowledge in order to carry out the study.

What do we use this data for? What are our purposes?

We may process your data for the purpose of fulfilling the purposes set out below:

Purpose no. 1: Data processing carried out as part of our research activities involving or not involving human subjects

The use we make of this data depends on our research/clinical trial objectives.

Volta Medical conducts several types of research and trial involving or not involving the human person as defined by the French Public Health Code. Data is collected in application of a research protocol validated by the study's scientific director as part of a research contract signed with the relevant healthcare facility, a research laboratory, or a research firm.

A specific information notice is distributed to any person likely to be part of research and/or trial. This information notice presents the information required by law, including the specific purposes of the processing.

For data processing carried out as part of studies requiring access to PMSI data, the data subjects of the studies are notified by the notice available here at any time.

If you wish to receive additional information, we encourage you to contact us using the contact information given in the "Contact " tab of Volta Medical's General Data Protection Policy.

In the context of research and clinical trials, we also collect personal data concerning the professionals involved, such as scientific officers, participating physicians, and, where applicable, staff involved in the research.

In the context of these research and clinical trials, we are data controllers, and the healthcare facilities/physicians, research labs, or firms that process data on our behalf are our data processors as defined by the GDPR. In some cases, other entities may also be considered as joint data controllers; in such cases you will be informed in the information notice communicated to you by appropriate means.

Purpose n°2 : Data processing carried out in the context of the fulfilment of our regulatory obligations in terms of transparency and the prevention of conflicts of interest

In strict compliance with applicable regulations, we may compensate, pay, or award hospitality to healthcare professionals. We may also make donations for research or for organizations, or fund training in the field of healthcare. Consequently, we collect information needed for completing procedures required by regulations concerning transparency and the avoidance of conflicts of interest.

What is the legal basis under which we operate?

The legal basis for processing depends on the purpose of the intended processing. Please refer to the section corresponding to your situation.

Purpose no. 1: Processing of data carried out as part of our research activities involving or not involving the human person (including research carried out on the basis of data originating from the PMSI)

With regard to the processing of the personal data of data subjects of research sponsored by Volta Medical, the legal basis is the legitimate interests of Volta Medical, without, however, infringing on the interests or fundamental rights and freedoms of the data subjects. An information notice is communicated to data subjects detailing the applicable legal basis and specifying what legitimate interests we are pursuing.

With regard to the processing of the data of professionals involved in these research and clincial trials, the legal basis is our legitimate interest or the performance of the contract entered into with the professionals concerned, or Volta medical’s compliance with its legal obligations (e.g. With regard to declarations of interest and the management of potential conflicts of interest). A specific information notice is sent to these professionals within statutory timeframes, indicating the legal basis applicable to the intended processing.

Purpose n°2 : Data processing carried out as part of our statutory obligations concerning transparency and the avoidance of conflicts of interest

The legal basis for this processing is compliance with our legal obligations. A GDPR-compliant notice is provided in this regard to the healthcare professionals and data subjects by appropriate means.

How long do we keep your data?

The data retention period depends on the purpose for which it is processed. Please refer to the section corresponding to your situation.

Purpose no. 1: Data processing carried out as part of our research activities involving or not involving the human person

With regard to the data of persons participating in research/clinical trials conducted by Volta Medical: Data are stored throughout the period needed for the research/clinical trial, plus the various periods authorized by regulations. At the end of this data retention period, personal data are either anonymized or destroyed in a securely manner. Exact information on data retention periods is given in the specific information notice for the research or clinical trial concerned.
Exact information on data retention periods is given in the specific information notice for the research concerned.
‍

With regard specifically to research conducted on the basis of data originating from PMSI: Access to data and its storage within the secure solution are strictly limited to the duration of the study. When Volta Medical demonstrates the need, this period may be extended up to a maximum of two years from the last publication of the results. The data of persons in charge of research for PMSI studies is retained for a maximum of 5 years after the end of the research, or for a period in accordance with applicable regulations.

Purpose n°2 : Data processing carried out as part of our statutory obligations concerning transparency and the avoidance of conflicts of interest

Data is kept for the period during which we are in contact with the person for whom the declarations/authorizations are required by law. At the end of this period, the data is securely archived for a period of 5 years so we can protect ourselves against any litigation.

Who are the data recipients?

Data recipients will differ depending on the intended processing. Please refer to the section corresponding to your situation.

Purpose no. 1 : Data processing carried out as part of our research activities and clinical trials involving or not involving human subjects

The recipients of identifying data of persons concerned by research and clinical trials sponsored by Volta Medical may include the following :

the data controller and natural or legal persons acting on the controller's behalf, when they are strictly authorized to access the data and when their participation is necessary for data processing in the context of research or a clinical trial;
the principal investigator;
professionals involved in the research or trial, and personnel acting under their oversight and authority;
persons in charge of data collection, quality control, processing, and analysis of data
persons responsible for regulatory affairs and for registering the research/clinical trial with the competent authorities
personnel of health authorities and public supervisory authorities legally authorized in the context of a specific procedure or mission, or the exercise of a right of communication
authorized personnel acting under the oversight of the insurance organization guaranteeing Volta Medical's civil liability, specifically in application of article L.1121-10 of the French Public Health Code;
independent experts responsible for re-analysis of data to verify research or clinical trial results.

The recipients of directly identifying data of the subjects of research and clinical trials sponsored by Volta Medical may include the following:

the professionals involved in the research and the personnel acting under their oversight or authority, concerning the people for whose care they are responsible in the context of the research or clinical trial (in particular your doctors and their staff)
the persons responsible for quality control and quality assurance during visits to the investigating sites to monitor and assess the quality and authenticity of the data collected, specifically by comparing the data recorded with the content of the source documents (an Agence Régionale de Santé [Regional Health Agency] known as "ARS", and its foreign equivalents). Under Volta Medical's oversight, these individuals also ensure compliance with provisions relating to the privacy and protection of subjects
members of independent supervisory committees, as defined in article L.1123-7 of the French Public Health Code
Volta Medical's DPO, only when contacted directly by the data subject
authorized personnel acting under the oversight of the insurance organization guaranteeing Volta Medical's civil liability, specifically in application of article L.1121-10 of the French Public Health Code
personnel of health authorities and public supervisory authorities legally authorized in the context of a specific procedure or mission, or the exercise of a right of communication

Recipients of the data of the professionals involved in the research and/or clinical trial may include the following:

the data controller and its data processors;
the principal investigator and their collaborators;
the professionals involved in the research or clinical trial, and personnel acting under their oversight
the persons managing regulatory affairs and registration of research/clinical trial with the competent authorities acting on behalf of Volta Medical or belonging to one of the companies in its group
employees of companies in the group to which Volta Medical belongs;
personnel of health authorities and public supervisory authorities legally authorized in the context of a specific procedure or mission, or the exercise of a right of communication;
authorized personnel acting under the oversight of the insurance organization guaranteeing Volta Medical's civil liability, specifically in application of article L.1121-10 of the French Public Health Code.

These categories of persons, who are bound by professional secrecy, may also originate from organizations or structures outside Volta Medical (in particular the ARS [Regional Health Agency], professional bodies such as the French National Board of Physicians ["Conseil de l'ordre des médecins], the French Transparency Register or their international equivalents). You are encouraged to consult the privacy policies of these organizations.
‍

Purpose n°2 : Data processing carried out as part of our statutory obligations concerning transparency and the avoidance of conflicts of interest

The data that is strictly necessary for the fulfilment of our regulatory obligations in terms of transparency and the prevention of conflicts of interest is processed exclusively by our internal staff authorized to access this data in the context of the performance of their tasks for our company. This data may also be communicated to certain authorized third parties (including regulatory bodies, such as the Council of the Order of Physicians, the French Register of Transparency and their foreign equivalents, etc.). We invite you to consult the privacy policies of these organizations.

Is the collection and processing of your data mandatory?

With regard to persons concerned by research and clinical trials sponsored by Volta Medical: Since participation in the research or trial is optional, individuals participating in such research or trial are notified by means of a specific information notice to ensure they understand what it entails and are aware of their rights. They are free to either participate in the research/trial or refrain from doing so without any impact on the healthcare they receive. If the research or trial in question allows it, they are free to withdraw their consent at any time.

In the case of research on data originating from PMSI (i.e. the French program for the medicalization of information systems), healthcare facilities and health insurers notify individuals of the potential re-use of data concerning them, by any means enabling the data subjects to be informed of the re-use of their data.
With regard to data processed as part of PMSI research sponsored by Volta Medical, information is provided to data subjects in accordance with the applicable reference methodology (also known as "MR-006"). Information is available here.
‍

With regard to professional involved in the research or clinical trials : Participation in research/trial is not mandatory, but the collection and processing of data is necessary for the participation of the professional in question.

With regard to the fulfillment of our obligations concerning transparency and the prevention of conflicts of interest: The provision of data by the concerned person or by a third party is mandatory.

How do we collect your data?

With regard to individuals whose data is processed in the course of our research and clinical trials: Direct collection from individuals or indirect collection in the context of retrospective studies or studies conducted on the basis of PMSI data.

With regard to healthcare professionals in the course of their participation in our research or clinical trials: Direct collection from the data subjects or via their employer.

With regard to the fulfillment of our obligations concerning transparency and the prevention of conflicts of interest: Direct collection from individuals or indirect collection from third parties (including the individual's superiors).

Do we transfer your Data outside the EU ?

We may transfer data to a country outside the European Union in the course of our activities. In this case, we take all appropriate measures to ensure compliance with the regulations applicable in the European Union. You can obtain a copy of these guarantees from our Data Protection Officer whose contact details can be found in the "Contact" tab of Volta Medical's General Personal Data Protection Policy.

How do you exercise your rights?

For studies involving PMSI data, rights of access, rectification, and opposition may be exercised with the director of the organization managing the mandatory health insurance scheme with which you are affiliated, in accordance with the provisions of article R. 1461-9 of the French Public Health Code.

For other research and trials, you can exercise your rights through the study physician or through Volta Medical's Data Protection Officer, whose contact details can be found here under the "Contact" tab of Volta Medical's General Data Protection Policy.
‍

However, health data processed by us is pseudonymized. Volta Medical does not know your identity; if you choose to contact our Data Protection Officer, the confidentiality of your identity therefore cannot be maintained.
If you decide to exercise your rights or submit questions about the processing of your personal data through the study physician, your identity can be kept confidential.

As with all other data processing carried out by Volta Medical, if at any time during the study or trial you feel that you have not been sufficiently informed of your rights, or that your rights have not been properly respected, you can contact the supervisory authority at the Commission Nationale de l’Informatique et des Libertés [National Commission on Data Privacy] (Mailing address: 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07).

Can we modify this Policy ?

We may modify the content of this Policy at any time, following the evolution of our activities and/or in order to comply with our legal obligations. In the event of any amendments, these will be made and posted on the relevant pages of this Policy on our website. We recommend that you refer to these pages each time you visit our website. However, if the amendments to this Policy are substantial, we will draw your attention to this by publishing a disclaimer on our website.