IdentificationTerms Of Service
2020/04/30 version
At Clinfile, we are concerned about the rights of individuals, especially with regard to automated treatments. In a desire for transparency with our users, we have implemented a privacy policy (see Article 5 of these TOS) that defines how we use and protect the information you entrust us with. This privacy policy also summarizes the means of action available to you to exercise your rights.
These TOS apply when you use this website lysosafe.clinfile.com (hereinafter referred to as the “Site”), published by Clinfile (see Article 1 of these TOS), on behalf of the Sponsor of the clinical study in which you participate.
For further information on the protection of personal data, we invite you to consult the European General Data Protection Regulation law (GPDR).
A Data Protection Officer (DPO) is at your disposal for any questions relating to the protection of your personal data at the following address: dpo@multihealthgroup.com.
The continued browsing of this Site constitutes acceptance without reservation of the following terms and conditions of use. The current online version of these terms and conditions of use is the only one enforceable during the entire period of use of the Site and until a new version replaces it. Users of the Site are therefore invited to regularly review these Terms of Service, the date of the update being clearly identified at the top of this page.
Table of Contents
Article 4 Special considerations relating to health data
4.1 Management of Site user rights
4.3 Data transfer to the Promoter
4.3.1 During the course of the study
5.1 Collection, use and protection of data
5.2 Personal or identifying data collected (excluding health data)
5.2.1 Clinical study stakeholders case
5.6 Sharing personal data with third parties
5.7 Rights of the data subject over his data
5.7.3 Right to erasure (right to be forgotten)
5.7.4 Right to restriction of processing
5.7.7 Right to data portability
5.7.8 Exercise of these rights
Article 1 Legal Notice
Clinfile SAS (hereinafter referred to as “we” or “us”), with a capital of €960,000.00, whose head office is located at 13 avenue Morane Saulnier, Bât. Santos-Dumont, 78140 Vélizy-Villacoublay, FRANCE, represented by Dr. Gérard Sorba, in his capacity as Chairman, registered in the Trade and Companies Register (RCS) of Vélizy-Villacoublay under the number 524 637 709, is a publisher of web applications for clinical research management, a subsidiary of the Multihealth group (www.multihealthgroup.com). Telephone: 0033 (0)1 80 13 14 70, e-mail: contact@multihealthgroup.com.
These web applications (or sites), as well as the collected data, are hosted by Cegedim SA, with a capital of €13,336,506.43, whose head office is located at 137 rue d'Aguesseau, 92100 Boulogne-Billancourt, FRANCE, registered in the Trade and Companies Register (RCS) of Nanterre under the number B 350 422 622, telephone: 0033 (0)1 49 09 22 00, e-mail: cnil@cegedim.fr, on servers located in France.
In accordance with Article L.1111-8 of the French Public Health Code (CSP), as amended by Law No. 2016-41 of January 26th, 2016, these servers are HDS certified (Health Data Hosting). This is a certificate issued by the French Ministry of Health that guarantees that the health data we process are hosted in security conditions adapted to their criticality.
Article 2 Access to the Site
Access to and use of the Site are reserved for strictly individual use. You agree not to disclose your login credentials, and not to use this Site and the information or data contained therein for purposes outside the scope of the clinical study in which you participate in.
2.1 Consent
Use of this Site is subject to acceptance of these TOS. As long as the user has not ticked the box indicating that he has read and accepts these TOS, and has not confirmed by clicking on the “Validate” button, use of the Site will not be possible. At any time, the user may withdraw his consent to these TOS. In order to do so, the user must formulate his request by referring to point 5.7.8.
Article 3 Site management
In order to guarantee the best possible quality of service, we can at any time:
- suspend, interrupt or limit access to all or part of the Site, reserve total or partial access to a given category of Internet users;
- delete any information that may disrupt the operation of the Site or contravene national or European laws;
- suspend the Site in order to carry out updates.
Article 4 Special considerations relating to health data
As mentioned in Article 8 of these TOS, the use of Our applications is subject to compliance with the legislation in force. This implies, among other things, compliance with Deliberations Nos. 2018-153, or 2015-256, or 2018-154, or 2018-155, approving the reference methodologies MR-001, MR-002, MR-003 and MR-004, respectively.
In accordance with articles L1121-3 (concerning monitors) and R5121-13 (investigation site, CPP, ANSM, CRO...) of the French public health code, and with point 2.3 of deliberations 2018-153, 2018-154, 2018-155, as well as with article 4 of deliberation 2015-256, any person collaborating in or ensuring the quality control of clinical research is subject to professional secrecy.
In order to demonstrate respect for this secret, the Site has an event log that complies with the requirements of EudraLex Vol. 4, Annex 11 (European equivalence of FDA 21 CFR Part 11). For example, every change in a user's rights or profile is logged. Similarly, any consultation of a source document is recorded to demonstrate that only persons authorized by the Promoter have had access to these documents, as required by the legislation recalled below.
4.1 Management of Site user rights
Any increase in the rights of a user of Our applications must be made in compliance with the legalization mentioned above. This elevation of rights is legally binding on the administrator who has made it. Any breach of the aforementioned professional secrecy is punishable under Articles 226-13 and 226-14 of the French Penal Code.
4.2 Patient access management
Some clinical studies require patients to be assigned identifiers that allow them to log in to the Site. These identifiers are randomly generated by the Site and are completely anonymous. They are transmitted to the patient by the patient's doctor, who remains subject to the aforementioned professional secrecy. In this context, no data directly identifying individuals who are participating in the research is collected by Clinfile.
Patients are not concerned by articles 5.2.1 and 5.3 of these TOS.
If a patient wishes to withdraw his consent as understood by the present TOS, the patient must contact his doctor, and only his doctor, so that medical secrecy is preserved.
4.3 Data transfer to the Promoter
Clinfile cannot be held responsible for any use of the data contrary to the laws made by the Sponsor.
4.3.1 During the course of the study
Throughout the study, data exports can be carried out via the Site interface. These exports are transmitted encrypted in TLS. It is the responsibility of the person carrying out the export to maintain the level of confidentiality security appropriate to the criticality of this data.
4.3.2 At the end of the study
Once the study is completed, the data is transferred in encrypted form to the Promoter. After verifying its integrity, the Promoter confirms that We may proceed with the destruction of the database in accordance with the section 5.5 of these TOS.
Article 5 Privacy Policy
5.1 Collection, use and protection of data
In accordance with the General Regulation on Data Protection (GPDR) adopted by the European Parliament on April 14th, 2016, and in effect in the Member States since May 25th, 2018, as well as the French Data Protection Act of January, 6th 1978 amended, we inform you of the points below.
The GPDR defines different actors such as:
- the data subject: person to whom the data undergoing processing relates;
- the controller: person who determines the purpose and means of the processing;
- the processor: person processing personal data on behalf of the controller.
Within the framework of the clinical research in which you are taking part, the study Sponsor is the treatment manager, Clinfile is the subcontractor.
5.2 Personal or identifying data collected (excluding health data)
5.2.1 Clinical study stakeholders case
As a stakeholder in clinical research (investigating doctor, clinical research associate, datamanager, project manager...), some of your so-called personal data are collected by Clinfile on behalf of the Sponsor of the clinical study in which you participate.
Personal data means any information related to an identified or identifiable natural person. An identifiable person is one who can be identified directly or indirectly by reference, in particular, to a name, an identification number or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.
For the purposes described in point 5.3, the following personal data are collected:
- name;
- first name;
- civility;
- e-mail address;
- professional status;
- postal address or name of employer.
The following data may possibly be collected:
- telephone number ;
- fax number.
This data can be consulted by clicking on the menu “My account”. They can be rectified by simply asking a study administrator.
5.2.2 For all users
The IP address of the machine used to access the Site is stored in the connection logs of our Apache servers. The sole purpose of this collection is to be able to take action against any possible intrusion or malicious use of the Site. The use of the Site being inherent to this collection of data, the continued browsing of this Site constitutes acceptance of this collection by the user.
5.3 Purposes of processing
The above-mentioned data are collected by Clinfile on behalf of the data controller within the framework of the execution of the contract signed by the participants of the clinical study. This contract is sufficient to legitimize this collection under Article 6, paragraph 1. point b) of the GPDR.
The data are collected for the purposes of the following processing operations:
- access and use of the application by the user;
- implementation of user assistance;
- verification, identification and authentication of the data transmitted by the user;
- traceability of the actions carried out;
- various statistics.
5.4 Data protection
As specified in Article 1, the applications and their data are hosted on servers located in France. In accordance with Article L.1111-8 of the French Public Health Code, as amended by Law No. 2016-41 of January 26th, 2016, these servers are HDS (Health Data Hosting) certified. This is a label issued by the French Ministry of Health that certifies that the health data we process or collect is hosted under security conditions adapted to its criticality.
5.5 Data retention policy
We keep the personal data of the users of the Site only for the time corresponding to the purposes of collection as indicated above. At the end of the execution of the subcontracting contract established with the Sponsor, all data of the Site are destroyed from Our servers and a destruction certificate is issued.
5.6 Sharing personal data with third parties
Personal data may be shared with third party companies exclusively within the European Union in the following cases:
- when the user authorizes the website of a third-party to access his/her data;
- if required by law, we may carry out the transmission of data in order to follow up claims made against us and to comply with administrative and legal procedures.
5.7 Rights of the data subject over his data
Pursuant to the regulations applicable to personal data, data subjects do have rights. Some of which are listed below.
5.7.1 Right of access
You may exercise your right of access to your personal data by contacting us in writing via the contact details given in point 5.7.8. In this case, before implementing this right, we may ask you for proof of your identity in order to be able to access your request in accordance with the law.
5.7.2 Right to rectification
If the personal data we hold about you is inaccurate, you may request an update.
5.7.3 Right to erasure (right to be forgotten)
You may request the deletion of your personal data in accordance with the applicable data protection laws.
5.7.4 Right to restriction of processing
You may ask us to limit the processing of personal data in accordance with the assumptions set out in the GPDR.
5.7.5 Right to object
You may object to your data being processed in accordance with the assumptions set out in the GPDR.
5.7.6 Right to be noticed
The GDPR requires the controller to report any breach to the competent supervisory authority (the French Commission nationale de l'informatique et des libertés – CNIL) within 72 hours and to the data subjects as soon as possible. Any breach must also be recorded in a dedicated register kept by the controller.
5.7.7 Right to data portability
You can ask us to hand over your personal data to you for transmission to a new platform.
5.7.8 Exercise of these rights
You may exercise all or part of these rights by contacting us at the following address: DPO – Multihealth, 13 avenue Morane Saulnier, Bât. Santos-Dumont, 78140 Vélizy-Villacoublay, FRANCE, or by e-mail at: dpo@multihealthgroup.com.
All requests must be accompanied by a photocopy of a valid, signed identity document and must indicate the address where we can contact you. A reply will be sent within one month of receiving the request. This one-month period may be extended by two months if the complexity of the application and/or the number of applications so requires.
In addition, and since the French law n°2016-1321 of October 7th, 2016, people who wish to do so have the possibility to organize the fate of their data after their death.
However, we remain entitled, if necessary, to oppose requests that are manifestly abusive (due to their number, repetitive or systematic nature).
Users may also submit a complaint to the French Commission nationale de l'informatique et des libertés – CNIL on the site: www.cnil.fr. However, we recommend that you contact us first before filing a complaint with the CNIL. We are at your entire disposal to solve your problem.
Article 6 Cookies
“Cookies” are small text files of limited size that we store on your machine. It allows us to recognize your computer, tablet or mobile phone, but without being able to identify you personally, in order to personalize the services we offer you.
In accordance with the recommendations of the French Commission nationale de l'informatique et des libertés – CNIL, some cookies are exempted from the prior collection of your consent insofar as they are strictly necessary for the operation of the website or have the exclusive purpose of allowing or facilitating communication by electronic means. These include but are not limited to: session identifier cookies, authentication cookies, load balancing session cookies and cookies for personalizing your interface. These cookies are fully subject to this policy insofar as they are issued and managed by us.
This Site only uses cookies that are strictly necessary for its proper functioning. The creation and use of these cookies are not subject to your consent as explained in the previous paragraph. You may, however, set your browser to prevent the creation of these cookies on your equipment. Nonetheless, since these cookies are essential to the proper functioning of this Site, the use of this Site will not be optimal.
Article 7 Site content
All trademarks, photographs, texts, comments, illustrations, animated or non-animated images, video sequences, sounds, as well as all computer applications that could be used to operate this Site and more generally all elements reproduced or used on the Site are protected by the laws in effect under intellectual property. They are the full and entire property of their author.
Any reproduction, representation, use or adaptation, in any form whatsoever, of all or part of these elements, including computer applications, without the prior written consent of their owner, is strictly prohibited. The fact that the owner does not initiate proceedings as soon as he becomes aware of these unauthorized uses does not constitute acceptance of the said uses, nor a waiver of prosecution.
Article 8 Responsibility
You are solely responsible for the material used to connect to the site. You must take all appropriate measures to protect your equipment and your own data, in particular from virus attacks via the Internet. Third-party software such as the operating system of your machine or the web browser you use to connect to the Site must not be outdated. Moreover, you are solely responsible for the sites and data that you consult. Any file uploaded to our servers through the Site must be lawful.
We shall not be held liable in the event of legal proceedings against you as a result of your failure to comply with these TOS.
If we were to be the subject of a settlement or legal procedure due to a misuse of the Site by you, we may oppose non-compliance with these TOS to obtain compensation for all damages, sums, convictions and costs that may result from this procedure.
Article 9 Applicable law
These terms and conditions of use of the Site are governed by French laws and subject to the jurisdiction of the courts of our registered office, or subject to a specific allocation of jurisdiction arising from a particular law or regulation.
Article 10 Contact us
For any question, information on the products presented on the Site, or concerning the Site itself, you can send a message to the following address: contact@multihealthgroup.com.