At NHTA, we take the protection of personal data seriously. Protecting your privacy when processing personal data is an important priority for us, and we are committed to handling such data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).
This Privacy Policy describes the types of personal data we collect, how we use it, and the circumstances under which it may be disclosed.
Please note that NHTA may update this Privacy Policy from time to time. We encourage you to review this page regularly to stay informed of any changes.
Introduction
At NHTA ApS (“NHTA”, “we”, “our”, or “us”), we take the protection of personal data seriously. Protecting privacy when processing personal data is an important priority for us, and we are committed to processing personal data responsibly and in accordance with the EU General Data Protection Regulation (“GDPR”), applicable national data protection legislation, and recognised information security standards.
This Data Protection Policy explains how NHTA collects, uses, stores, protects and otherwise processes personal data in connection with our business activities, including our website, client engagements, consultancy services, technology solutions, scientific research, health-economic evaluations, epidemiological and outcomes research, registry-based studies, and real-world evidence (“RWE”) projects.
The nature and purpose of processing depends on the relationship with the individual and the specific processing activity.
NHTA does not sell personal data to third parties or share personal data with third parties for marketing purposes.
Data Controller and Data Processor
Depending on the nature of the processing activity and the specific project or contractual arrangement, NHTA ApS (“NHTA”) may act as a data controller, joint controller or data processor.
Where NHTA determines the purposes and means of processing personal data, NHTA acts as a data controller. Where NHTA processes personal data on behalf of a client or another organisation, NHTA may act as a data processor and process the data in accordance with the applicable contractual arrangements and documented instructions of the controller.
For research activities, NHTA may therefore process personal data either as a data controller, joint controller or data processor on behalf of clients or other organisations.
Where applicable, the specific project documentation, contractual arrangements or privacy information provided for a particular processing activity may contain additional information about the relevant controller, processor or joint-controller roles.
If you have questions regarding our processing of personal data or wish to exercise your rights under the GDPR, please contact: gdpr@nhta.com.
NHTA has appointed a GDPR Manager who is responsible for coordinating NHTA’s data protection and privacy matters. Questions regarding NHTA’s processing of personal data or the exercise of your rights may be directed to the GDPR Manager at gdpr@nhta.com.
Categories of Personal Data
Depending on the nature of our activities, NHTA may process personal data including:
- Contact information, such as name, email address, organisation and telephone number
- Professional information relating to clients, collaborators, suppliers and other business contacts, including workplace and job title
- Recruitment and employment information, including qualifications, previous employment history, references, assessment results, interview notes and other information provided during the recruitment process
- Financial, billing and contractual information necessary to provide our services and manage contractual relationships
- Information relating to access to technology solutions and support services
- Website usage information collected through cookies and similar technologies
- Scientific and research data
- Health-related and other special-category personal data where necessary for scientific research or other lawful purposes
- Demographic, clinical, laboratory, prescription, healthcare utilisation, mortality and socioeconomic information obtained from authorised data sources
We apply the principles of data minimisation and process only personal data that are adequate, relevant and necessary for the specific purpose.
Sources of Personal Data
Personal data may be collected:
- Directly from individuals
- Through our website
- During business relationships with clients, collaborators and suppliers
- During recruitment and employment
- From clients and other organisations with which we have a contractual relationship
- From publicly available sources where appropriate
- From healthcare providers, research institutions, public authorities, national health registers, disease registries and other organisations legally authorised to disclose data for scientific research, statistical or other lawful purposes
Where personal data are obtained from sources other than the individual, the source and the applicable information provided to individuals will depend on the specific processing activity and the requirements of the GDPR and applicable national legislation.
Purposes of Processing
NHTA processes personal data for purposes including:
- Delivering consultancy and other professional services
- Conducting health-economic evaluations
- Performing epidemiological and outcomes research
- Conducting clinical, observational, registry-based and RWE studies
- Conducting statistical analyses and scientific research
- Supporting healthcare decision-making, regulatory activities and market access
- Managing client, supplier and other business relationships
- Providing and supporting technology solutions
- Entering into and performing contracts
- Recruiting and employing personnel
- Processing payroll and managing employment-related matters
- Operating, maintaining and improving our website and services
- Complying with legal and regulatory obligations
- Protecting our legitimate business interests where appropriate
- Other purposes compatible with the purpose for which the personal data were collected and permitted by applicable law
NHTA does not use personal data for unsolicited marketing communications.
Legal Basis for Processing
NHTA processes personal data only where a lawful basis exists under the GDPR and applicable national data protection legislation.
Depending on the circumstances, NHTA may rely on Article 6(1)(a)–(f) GDPR, including consent, contractual necessity, compliance with a legal obligation, legitimate interests, or performance of a task in the public interest.
Where NHTA processes special categories of personal data, including health data, processing will only take place where an applicable legal basis under Article 6 GDPR and an applicable condition under Article 9 GDPR are satisfied, together with any additional requirements under applicable national legislation.
For scientific research, epidemiological studies, health-economic analyses, registry-based studies and real-world evidence activities, NHTA applies appropriate safeguards required under applicable law, including where relevant the safeguards provided for under Article 89 GDPR.
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Scientific Research, Epidemiological Studies and RWE
NHTA conducts scientific research, epidemiological studies, health-economic analyses, observational studies, registry-based studies and RWE projects for public authorities, academic institutions, healthcare organisations and life-science companies.
Research projects may involve personal data obtained from authorised data providers, including national health registers, disease registries, healthcare providers, research institutions and public authorities.
Depending on the project, NHTA may act as a data controller, joint controller or data processor.
Research data may include pseudonymised or de-identified information. Where appropriate and legally permitted, personal data are pseudonymised, anonymised or otherwise protected before or during analysis.
Access to research data is restricted to authorised personnel and is subject to applicable security measures, study protocols, contractual requirements and relevant regulatory or ethical approvals.
Where personal data are not obtained directly from the individual, NHTA provides information about the relevant processing through appropriate privacy information, including this Privacy Notice where appropriate, in accordance with Articles 13 and 14 GDPR and applicable national legislation.
In certain circumstances, applicable law may permit an exception or limitation to the obligation to provide information directly to individuals, including where providing the information would involve disproportionate effort or where the processing is subject to specific research-related provisions. Any such exception or limitation will only be relied upon where permitted by applicable law.
Research findings are reported externally in aggregated or otherwise appropriately protected form and are not intended to identify individual persons.
NHTA does not attempt to re-identify individuals from pseudonymised or de-identified datasets.
Disclosure and Recipients of Personal Data
Personal data may be disclosed or made available, where appropriate and legally permitted, to:
- Employees and other authorised personnel who require access for legitimate work purposes
- Clients and other contracting organisations
- Research collaborators and project partners
- Public authorities and regulatory bodies
- Healthcare providers, research institutions and authorised data providers
- Secure data processing and research environments
- IT, hosting and other service providers acting on NHTA’s behalf
- Providers supporting payment processing, payroll administration, expense management and other business functions
- Other organisations where disclosure is required or permitted by law
Where third-party service providers process personal data on NHTA’s behalf, they are authorised to process personal data only for specified purposes and in accordance with applicable contractual arrangements and instructions.
Such providers are required to implement appropriate technical and organisational measures to protect personal data and, where applicable, are not permitted to use the personal data for their own independent purposes.
NHTA does not sell personal data to third parties and does not share personal data with third parties for marketing purposes.
International Transfers
Where personal data are transferred outside the European Economic Area (“EEA”), NHTA ensures that the transfer is carried out in accordance with applicable requirements under Chapter V of the GDPR.
Depending on the circumstances, this may include transfers based on an adequacy decision or the use of appropriate safeguards recognised under the GDPR.
Where required, further information regarding applicable transfer safeguards may be obtained by contacting NHTA using the contact details provided in this Privacy Notice.
Retention of Personal Data
NHTA retains personal data only for as long as necessary to fulfil the purposes for which they were collected and to comply with applicable legal, regulatory and contractual obligations.
Retention periods depend on the nature of the personal data and the purpose of processing.
For research projects, retention periods may additionally be determined by study protocols, ethics committee or other regulatory approvals, data access authorities, contractual requirements, applicable research legislation or requirements imposed by the relevant data provider.
When personal data are no longer required, they are securely deleted, anonymised or otherwise disposed of in accordance with applicable policies and legal requirements.
Information Security
NHTA implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include appropriate access controls, confidentiality requirements, data minimisation and other safeguards appropriate to the nature and risk of the processing.
Access to personal data is restricted to authorised personnel who require access for legitimate business or project purposes.
Where required, research involving sensitive personal data is conducted within secure research environments approved or recognised by the relevant authorities.
NHTA also takes reasonable steps to ensure that personal data are accurate and kept up to date where necessary for the purposes for which they are processed.
Your Rights
Subject to applicable legislation and the circumstances of the processing, individuals may have the right to:
- Request access to their personal data
- Request correction of inaccurate or incomplete personal data
- Request deletion of personal data
- Request restriction of processing
- Object to processing
- Receive personal data in a portable format where the right to data portability applies
- Withdraw consent where processing is based on consent
Individuals may exercise applicable rights by contacting NHTA at gdpr@nhta.com.
Certain rights may be subject to limitations or restrictions where permitted by applicable law. This may include specific provisions concerning processing for scientific research or statistical purposes. Any such limitation will only be applied where the relevant legal requirements and safeguards are satisfied.
Cookies and Similar Technologies
Further information about our use of cookies and similar technologies is available in our Cookie Policy.
Complaints
If you have concerns about NHTA’s processing of your personal data, we encourage you to contact us at gdpr@nhta.com so that we can investigate and address your concerns.
You also have the right to lodge a complaint with the competent data protection supervisory authority in accordance with Article 77 GDPR.