ThM3 Wake Research Supplementary Privacy Notice

California Residents Only

Effective Date:  January 1, 2020

Last Revised:  February 11, 2021

This notice supplements the information contained in the main M3 Wake Research Privacy Policy (the “Main Privacy Policy“)[1] set forth above, and applies solely to residents of the State of California (“California Privacy Policy“).  We have adopted our California Privacy Policy in order to comply with the California Consumer Privacy Act of 2018 (“CCPA“)[2].

Our California Privacy Policy is intended to fulfill CCPA’s objectives of providing California consumers with a comprehensive disclosure of the collection, sharing, disclosure, and sale of their personal information by particular businesses (as CCPA defines those terms), and of the rights that California consumers have regarding their personal information (“California Privacy Rights“).

  1. California Privacy Rights Under CCPA
  2. Right to Know About Personal Information Collected, Disclosed or Sold (“Right to Know”)
  3. Scope of Applicable Personal Information

CCPA provides you the right to request that we disclose to you any or all of the following about your personal information for the 12-month period preceding your request:

  1. the specific pieces of personal information that we have collected about you;
  2. the categories of personal information we have collected about you;
  3. the categories of sources from which we have collected your personal information;
  4. the categories of personal information that we have sold or disclosed for a business purpose about you;
  5. the categories of third parties to whom your personal information was sold or disclosed for a business purpose; and
  6. the business purpose for collecting or selling your personal information.

CCPA also provides you the right to receive information about any financial incentives (i.e., compensation payments) that we may offer in connection with use of your personal information for participating in our clinical research opportunities,

For detailed information about the personal information that we collect and the purposes for which we collect it, please see Part II (“Information We Collect and What We May Do With It”) below.

If you exercise your Right To Know, after we confirm your identity, as explained more fully in Part III (“Exercising Your California Privacy Rights”), we will:  (a) disclose to you the information we have collected about you during the preceding 12 months that correspond to your request; and (b) deliver, free of charge to you, by mail, or electronically, the personal information that you have requested, in the manner required by CCPA and as further described below in Part III (“Exercising Your California Privacy Rights”).

  1. Exclusions from Scope of Personal Information.

CCPA excludes the following from its definition of “personal information”:

  1. Publicly available information from government records
  2. De-identified or aggregated consumer information
  3. Information excluded from CCPA’s scope, such as
  4. Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
  5. Personal information regulated by other sector-specific laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994
  1. Right to Have Personal Information Deleted (“Right to Delete”)

You have the right to request the deletion of your personal information that we collect or maintain.

If you exercise your Right to Delete, after we confirm your identity, as explained more fully below in Part III (“Exercising Your California Privacy Rights”), we will, in the manner specified by CCPA, permanently delete your personal information from our records, unless one of the CCPA exceptions applies to your deletion request applies.

Also, to the extent required by CCPA, we will direct the deletion of your personal information by third parties with whom we have shared the personal information that you have requested that we delete.

Exceptions to your Right To Delete include, but are not limited to, instances when the personal information is necessary to complete a transaction or provide the service requested by you for which the subject personal information was collected or provided (such as to participate in our clinical trials), detect security incidents or protect against deceptive, fraudulent, or illegal activity, or to comply with a legal obligation under CCPA, the California Electronic Communications Privacy Act, or other California or US federal law.

  1. Right to Opt-Out of the Sale of Personal Information (“Right to Opt-Out”)

Under CCPA, you have the right to opt-out of the “sale” (as defined by CCPA) by a CCPA-subject business of your personal information to third parties.  CCPA defines a “sale” of personal information as occurring when a business exchanges personal information of California residents to the third party for monetary or other valuable consideration.

Wake Research does not “sell” your personal information, in either the CCPA sense nor any other sense.

Personal information that is voluntarily entered into one of our Sites will only be used by M3 Wake Research solely for the purposes identified in the chart below.  Our policy is to maintain all personal information as confidential and to use it only for the purpose for which is was submitted.

M3 Wake Research never shares or sells your personally identifiable information with any company or organization. From the time of your entrance into a clinical trial, you will only be identified by initials and a unique number to parties outside of M3 Wake Research that are participating in the conduct of the study.  Only non-identifiable medical information will be given only to the sponsor of the trial and their employees or contractors, and will only be used for study purposes.

Except as otherwise described below, all data that we share with our Healthcare Industry Affiliates, including sponsors of our clinical trials, will be deidentified information (meaning, data that has been carefully encrypted so it no longer identifies you or is linkable to you) or aggregate information (which means data from a group of individuals from which all individual identities have been carefully removed so no particular person may be identified).  All such deidentified or aggregate information will be given only to the sponsors of our clinical trials.  Neither deidentified information nor aggregate consumer information are considered personal information as defined in CCPA.

To the extent we collect personal information of minor children under the age of 18, it will only used by M3 Wake Research solely for the business purposes identified below, or use deidentified or aggregate information about them.  We do not sell the personal information of minor children.

Personal information will never be shared in any way, or for any purpose, other than for what has been specifically consented for us to do with it.

  1. Right to Not Be Discriminated Against for Exercising Your California Privacy Rights

    (“Right to Non-Discrimination”)

You have the right to not receive discriminatory treatment if and when you exercise any of your California Privacy Rights under CCPA.  This would include, as examples, imposing a penalty fee or denying services to you because you exercised a CCPA right.

We will never penalize or otherwise subject you to discriminatory treatment for exercising any of your California Privacy Rights.

Please note that exercising your right to delete some or all of your personal information may mean that you are not able to participate in certain clinical trial opportunities that we offer.

For example, if we do not have enough information to determine whether you meet the criteria for a clinical trial, you will not receive invitations to participate in certain trials.

Financial incentives, such as per-trial compensation payments, are made for certain of our clinical trials.  Clinical trials and survey compensation payment amounts are set at levels determined by taking into account many variables such as (by way of examples only):

the number of qualified volunteers both needed and available, the length and number of visits required of volunteers, and the type of  procedures requested.

If you have questions about your Right to Non-Discrimination, please contact us as described in Part III (“Exercising Your California Privacy Rights”) below.

  1. Information We Collect and What We May Do With It

M3 Wake Research, our subsidiaries, and our affiliates, as well as our third-party business partners with whom we conduct our regular business operations, may collect, share, or disclose personal information solely for business purposes as described in the following sections:

  1. Categories of Third Parties refers to the following persons or entities with whom we may share personal information for business purposes:
  2. Business Support Consultants (examples include our consultants, advisors, and/or vendors who help us by (as examples only): (a) preventing fraud or violations of our Terms of Service; (b) analyzing user data and behavior on our Sites, and tracking page performance; (c) identifying issues and repair errors that impair intended functionality of our Sites; (d) providing assistance to users of our Sites, such as moderators and translators; (e) providing customer service to our users of our Sites users; (f) providing CCPA-required and other verifications of consumers or consumer consent; and/or (g) providing data storage, data processing and payment processing services.

All of our Business Support Consultants have written agreements with us which:

  1. require them to comply with all legal privacy requirements to which we are subject, including those provided in CCPA;
  2. limit their access to personal information to the minimum necessary in order to perform their services for us; and
  • restrict them from making any use of personal information beyond fulfilling the specific services to us for which they are engaged;
  1. Healthcare Industry Affiliates: (examples include clinical research sponsors such as hospitals, healthcare systems, and large multi-specialty medical practice groups, our clients and prospective clients, and their representatives (such as their employees or contractors) who may engage us to conduct clinical research or provide other services for CCPA-permitted business purposes); and
  2. Public Authorities (examples include the U.S. Food and Drug Administration, to which clinical trial information gathered by us is submitted for approval by our sponsors on an anonymized, non-personally identifiable basis, other governmental agencies and authorities, as required by law or reasonably necessary to protect the rights, property, and safety of others or ourselves), and law enforcement agencies.
  3. Business Purposes for Collecting Personal Information: M3 Wake Research will only collect and use your personal information for the following business purposes listed below:
  4. Creating, managing and updating our patient network database system of potential, active, and former research participants;
  5. Improving the efficiency and smooth-functioning operation of our Sites, including (as examples), monitoring and analyzing usage and trends to improve user experience with our Sites;
  • Communicating with you about (as examples): your initial qualification questionnaire, scheduling and conducting screening interviews and in-person visits, providing you with necessary research study documents and materials, scheduling clinical research studies and follow-up activities, establishing your account and validating payments and other transactions, providing instructions for study participation and follow-up matters, apprising of potential future clinical trial needs, including via newsletters, e-mails, and texts, and/or responding to your support questions and comments;
  1. Administering and improving our Sites, our services, and all of our operations;
  2. Ensuring compliance with our policies, legal and regulatory requirements governing our Sites, and/or with other requirements or procedures we believe are necessary or prudent to protect, enforce or defend the legal rights, privacy, safety or property of M3 Wake Research, our medical and administrative staff, our study sponsors, other study participants, and others, as may be applicable;
  3. Complying with all our legal and regulatory requirements in recruiting research participants, conducting clinical trials, reporting clinical data, and all other aspects of our operation, including all FDA Regulations and other clinical protocols; and

VII.        Helping us better search for and validate prospective research participants for clinical trials, using our systems in order to match participants with particular study sponsors’ needs, and to ensure that each clinical trial is completed consistently and accurately, with measurable, reliable data.

These business purposes are indicated by numeral, as applicable, in the third and fourth columns (respectively) of the charts in the next two sections.

We will never use your personal information differently than what we have disclosed to you in this notice, unless we first notify you and obtain your consent to a different use.

  1. Notice at Collection (Personal Information Collected By Us Upon Your Visiting Our Sites)
CATEGORY OF PERSONAL INFORMATION from CCPA §1798.140(o)(1)(A-K)PERSONAL INFORMATION COLLECTED BY US UPON YOUR VISITING OUR SITESBUSINESS PURPOSEFOR WHICH PERSONAL INFORMATION WILL BE USED
A. Internet or Other Electronic Network Activity InformationBrowsing history and information about interaction with M3 Wake Research Sites and services (such as visit frequency).Cookies are collected by and then used as for attribution to track campaign success, and for purposes of auto-populating data fields at subsequent visits.I, II, III, IV, V, VI, VII
B. Geolocation DataGeneral physical and work locationI, III, IV, V, VI, VII
  1. Personal Information We Have Collected Over the Past Twelve Months.
CATEGORY OF PERSONAL INFORMATION FROM CCPA §1798.140(o)(1)(A-K)EXAMPLES OF PERSONAL INFORMATION COLLECTED BY US OVER THE PAST 12 MONTHSCATEGORY OF SOURCES FROM WHICH COLLECTEDBUSINESS PURPOSE FOR WHICH COLLECTEDCATEGORY OF THIRD PARTIES TO WHICH DISCLOSED 
A. Identifiers Name, postal address, e-mail address, telephone numbers, registration details for healthcare professionals, Internet protocol address, records of clinical trials, research and other survey/study opportunities undertaken by users of our Sites (such as forms indicating which clinical trials users sought qualification for,  whether completed or partially completed)Directly from You Business Support Consultants HealthcareIndustryAffiliates Public Authorities   I, II, III, IV,V, VI, VII Business Support Consultants Healthcare Industry Affiliates Public Authorities 
B. Categories of Personal Information from California’s Customer Records statute(Cal. Civ. Code §1798.80(e). Names, addresses, Signatures (electronic and/or physical), medical information, and telephone numbersDirectly from You Business Support Consultants Healthcare Industry Affiliates Public AuthoritiesI, III, IV, V,VI, VIIBusiness Support Consultants Healthcare Industry Affiliates Public Authorities
C. Protected Classifications Under US or California LawNationality, age, race, marital status, medical condition, physical or mental disability, gender, and banking details for compensation paymentsDirectly from You Business Support Consultants Healthcare Industry Affiliates Public Authorities I, II, III, IV V, VIBusiness Support Consultants Healthcare Industry Affiliates Public Authorities
D. Commercial InformationParticipation in clinical trials and surveys and any associated compensation for time.Directly from You  Business Support Consultants Healthcare Industry Affiliates Public Authorities  I, II, III, IV,V, VI, VIIBusiness Support Consultants  Healthcare Industry Affiliates Public Authorities
E. Internet or Other Electronic Network Activity Information Browsing history information about interaction with Wake Research Sites and services.Cookies, web beacons and device fingerprinting/watermarking are used as Google ReCAPTCHA to determine whether the user is human and not a bot.Directly from You Business Support Consultants Healthcare Industry Affiliates I, II, III, IV,V, VI, VI, VIIBusiness Support Consultants Public Authorities
F. Geolocation DataGeneral physical and work locationBusiness Support Consultants I, III, IV, V, VI, VI Business Support ConsultantsPublic Authorities
G. Sensory InformationAudio, electronic, visual, recordings made during clinical trial participation Directly from You Business Support Consultants Healthcare Industry AffiliatesI, II, III, IV,V, VI, VIIBusiness Support Consultants Public Authorities
H. Professional or Employment-RelatedInformationSpecialty and seniority of healthcare professionals, their medical experience and types of patients treated; and occupation of volunteers as relevant for particular research or studiesDirectly from You Business Support Consultants HealthcareIndustry Affiliates Public Authorities  I, III, IV, V,VI, VII Business Support Consultants  Public Authorities
I. Inferences DrawnFrom Other Personal InformationProfile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudesBusiness Support Consultants III, IV, V, VI, VIIBusiness Support Consultants Public Authorities 
  1. Sales of Personal Information During Past 12 Months

M3 Wake Research does not ever “sell” personal information, as described in more detail above in Part I.C (“Right to Opt-Out of the Sale of Personal Information”). 

III.   Exercising Your California Privacy Rights

Exercising Rights to Opt-Out of Sale of Personal Information:  As M3 Wake Research does not “sell” any personal information, as that term is defined in CCPA, we have not provided consumers with a means to “opt-out” of such sales.  However, we will be glad to answer any questions you may have about this or any of your California Privacy Rights.  Please use one of the contact methods described below to reach us for any questions.

In order to exercise your Right to KnowRight to Delete, or Right To Non-Discrimination, please submit your request to us in any one of the ways listed below.

By Webform:  please click here [add hyperlink to form] and you will be directed to a form that you may either submit electronically, or print out and mail to us at our address below:

By Telephone:  (919) 781-2514 (Monday through Friday from 8:00 a.m. to 5:00 p.m. ET)

By E-mail:  [email protected] (please put “M3 Wake Research California Privacy Request” in the  subject line)

By Mail or Courier: 

M3 Wake Research

Attn: California Privacy Requests

3100 Duraleigh Rd, Suite 304

Raleigh, NC 27612

Only you, or a person (or a business entity registered with the California Secretary of State) whom you have authorized to act on your behalf may make a consumer request about your personal information.  Consistent with CCPA’s provisions, we may require either (or both) that you provide your authorized agent with written permission to act for you and verify your own identity to us (or provide a power of attorney signed by you stating your authorized agent’s power to act for you).[3]

If you have questions or concerns about your rights under our California Privacy Policy, or any of the provisions or practices described in either our California Privacy Policy or our Main Privacy Policy, please contact us via the telephone number, e-mail address, or mail/courier address provided above.

  1. Responding to Right to Know and Right to Delete Requests

Within ten (10) business days of receipt of your Right to Know or Right to Delete request, we will confirm our receipt, provide you details about the process we will follow to respond to your request, and/or ask questions, or for additional information, that may be required.

We plan to fulfill these requests within 45 calendar days of receiving the request. If we need more time to respond to your request, we will let you know the reason and, within the first 45 calendar days following receipt of your request, estimate how much additional time we will need (in any event, we will complete your request within 90 calendar days in total from receipt of the request).

If we deny your Right to Know or Right to Delete request, in whole or in part, we will provide you with the reason for this, and if our denial is partial, we will disclose to you, or delete (as applicable), the other information you have requested.

  1. Verification Process: To assert your Right to Know or your Right to Delete, you will be asked to verify your identity before fulfilling your request. This verification process may require you to provide pieces of personal information that we already hold on you, or, in certain circumstances, a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

2. Procedure; Frequency of Submitting Right to Know Requests: You may make requests regarding your Right to Know only twice within any 12-month period.

We do not charge a fee to process or respond to your Right to Know requests, unless a particular request is excessive, repetitive, or manifestly unfounded.  If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

  1. Procedure; Frequency of Submitting Right to Delete Requests: You may make a Right to Delete request to us at any time.  Following verification of your request, we will immediately and permanently delete the personal information requested by you, unless one of CCPA’s exception to this right applies to your request.

If we cannot verify the identity of the consumer requesting deletion of personal information, we may deny the Right to Delete request, and will inform the requestor of this.

Once we verify the identity of the consumer making the Right to Delete request, we will respond to their request by either:

  1. permanently and completing erasing the personal information from our systems and records, in the manner specific by CCPA;
  2. de-identifying the personal information (meaning, carefully encrypting the personal information so it no longer identifiable or linkable to a particular consumer);
  3. aggregating the personal information individual (meaning, we will carefully remove any consumer-identifiers from it, and group it together with other similarly-stripped data from which the resulting data group contains no particular consumer’s personal information in an identifiable fashion).

We will inform you of the manner in which we have deleted your personal information following a Right to Delete request.

  1. Updates to this Supplementary Privacy Notice

We may reserve the right to periodically update our California Privacy Policy.  Please reference

the “LAST UPDATED” legend above for the effective date of the most recent updates.  Your

continued use of our Sites following these changes means that you accept the revised California

Privacy Policy.

[1] Capitalized terms in this California Privacy Policy shall have the meanings ascribed to them in our Main Privacy Policy, unless defined otherwise.

[2] California’s full CCPA statute, 1798 Cal. Civ. Code §§ 1978.100 – 1798.199, may be found here: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.5.&part=4.&chapter=&article=.

[3] For information on preparing a Power of Attorney, see Cal. Probate Code §§ 4000-4465 (“Powers of Attorney”), here:  http://leginfo.legislature.ca.gov/faces/codes_displayexpandedbranch.xhtml?tocCode=PROB&division=4.5.&title=&part=&chapter=&article=ed on one of our Sites, please email us at: [email protected].