Eureka Trials, Inc. ("Eureka," "we," "us," or "our") collects personal data in order to operate a technology platform through which individuals may identify and connect with clinical research studies that may be relevant to them. This Privacy Policy describes the personal data we collect, the purposes for which we use and disclose it, and the rights and choices available to you.
This Policy applies to eurekatrials.com, to our applications, and to our related services (the "Services"). It does not apply to any clinical research study in which you enroll, such study being conducted by the research site, its investigators, and the sponsor, each of which handles information in accordance with its own privacy notices and with that study's informed consent and authorization documents; to any health platform through which you may have reached us, each of which is governed by its own privacy policy; to your health care providers, which are subject to the Health Insurance Portability and Accountability Act; or to third-party websites to which we may link.
Our Consumer Health Data Privacy Policy provides additional information and applies to particular categories of information and to residents of particular states.
We process personal data on the basis of your consent, our legitimate interests in operating and improving the Services, the performance of a contract with you, compliance with our legal obligations, and the facilitation of clinical research.
Information you provide. Contact information, including your name, electronic mail address, mobile telephone number, postal address, and postal code; demographic information, including your date of birth, age, sex, gender, height, and weight, and, where a study's inclusion or exclusion criteria so require, racial or ethnic origin; health information, including conditions and diagnoses, symptoms, medications, treatment and procedure history, allergies, pregnancy and lactation status, substance use, reproductive and sexual health information where study criteria so require, and your responses to screening questions; your preferences, including willingness to travel, availability, interest in particular studies or study types, and communications preferences; your communications with us, including messages, support requests, survey responses, and call recordings to the extent permitted by law; and records of the consents and authorizations you provide.
Information obtained from your medical records. In the event you elect to connect your electronic medical records through a third-party health records connectivity service, we may receive from your health care providers information including conditions and diagnoses, medications, allergies, laboratory and diagnostic test results, vital signs, procedures, immunizations, and encounter history. This feature is optional and is not a condition of using the Services or of being matched or referred to any study. We neither receive nor store your patient portal credentials.
Information collected automatically. Log data, including internet protocol address and browser and device information; device identifiers; usage data, including pages and studies viewed, features used, and session information; and such cookies as are strictly necessary in order to operate the Services. We derive general city- or region-level location from internet protocol address, and we do not collect precise geolocation data.
Information obtained from other sources. Health platform partners, in the event you were introduced to us through such a platform and consented to that platform sharing information with us; sponsors and research sites, which report the status of a referral you have requested, including whether you were contacted, scheduled, screened, determined ineligible, declined, or enrolled; public clinical trial registries, including ClinicalTrials.gov, with respect to study information; and service providers, including fraud prevention and analytics providers.
Identity verification. In order to confirm your identity and prevent fraud, we and our identity verification providers may collect and process information reasonably necessary for that purpose. We limit such information to what is necessary to verify your identity and do not use it for any unrelated purpose.
Sensitive personal data. We treat health and medical information, and, where provided, information concerning racial or ethnic origin, sexual orientation, and reproductive or sexual health, as sensitive personal data. We collect and process sensitive personal data only with your consent and only for the purposes described in this Policy. Eureka limits the collection and processing of personal data and medical information to what is necessary to fulfill the purposes for which it is to be used.
Information we do not collect. We do not collect genetic data, and we do not purchase health data from data brokers. We do not collect payment information from individuals using the Services, individuals not being charged by Eureka.
We use personal data in order to identify and present clinical research studies that may be relevant to you and to rank such studies by relevance; to transmit a referral to the sponsor or research site conducting a study to which you have requested a referral; to communicate with you concerning studies that may be relevant to you, concerning any referral you have requested, and concerning your account; to operate, maintain, secure, improve, and develop the Services, including for purposes of debugging, authentication, fraud and abuse prevention, and analytics; to improve the accuracy of our matching, using de-identified or aggregated data; to create de-identified and aggregated data and statistics, which we may use and share and which we neither attempt nor permit others to re-identify; and to comply with our legal obligations, enforce our Terms of Use, protect the rights and safety of individuals, and respond to lawful requests.
We do not use health information for purposes of targeted advertising.
Sponsors and research sites. Where you request a referral to a particular study, your personal data may be shared with the sponsor of that study and with any partners involved in delivering that study's services, including approved research sites, laboratory screening and testing services, transportation services, and language interpretation providers. A request with respect to one study is not a request with respect to any other study, and in the event you are subsequently matched to a different study we will request your consent again. Information transmitted typically includes your contact information, the study identifier, your relevant condition and screening responses, and, where you have connected your medical records, relevant clinical information supporting the match. We require third parties to protect personal data using standards substantially similar to our own and not to use such data for any purpose other than execution of the applicable study or as otherwise authorized by Eureka. Information transmitted to a sponsor or research site is thereafter held by such recipient in accordance with its own policies and legal obligations, including applicable clinical research recordkeeping requirements, and inquiries concerning such information should be directed to that recipient.
Health platform partners. Where you reached us through a partner platform, we may share the fact and status of a referral you have requested in order that such partner may coordinate your ongoing care.
Service providers. We engage service providers within the following categories, each of which may access personal data only as necessary in order to perform services on our behalf and each of which is bound by written agreement to maintain confidentiality and appropriate safeguards and not to use such data for its own purposes: cloud hosting, database, and storage infrastructure providers; identity, authentication, and account management providers; health records connectivity providers; data processing and matching infrastructure providers, including providers of computational services used in order to compare your information against study criteria; electronic mail, short message service, and other communications delivery providers; customer support and service desk tooling providers; security, monitoring, fraud prevention, and identity verification providers; first-party analytics and product measurement providers acting on our behalf; backup, archival, and disaster recovery providers; and professional advisors, including legal, accounting, and compliance advisors.
Adverse event reporting. Where you report a suspected adverse event, side effect, product complaint, or other safety concern, we may be obligated to report such information to the applicable sponsor, manufacturer, or regulatory authority for purposes of regulatory compliance, and the sponsor or manufacturer may contact you or your health care provider for further information. Information forwarded to health authorities is de-identified where permitted.
Governmental and public health authorities, where required by law.
Legal and safety. Where we reasonably believe disclosure is required or permitted by law, including in response to a subpoena, court order, or other lawful request; in order to enforce our Terms of Use; in order to detect or address fraud or security issues; or in order to protect the rights, property, or safety of any person.
Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy, divestiture, or sale of assets, subject to the recipient's continued adherence to this Policy.
At your direction.
Eureka does not sell your personal data or your sensitive personal data and does not share such data for purposes of cross-context behavioral advertising.
Eureka is compensated by clinical trial sponsors, research sites, and their agents in connection with services provided to them, including the referral services you request. Disclosure of your personal data to a sponsor or research site is made solely for purposes of providing a service you have affirmatively requested, namely a referral to a specific study you have selected, and does not constitute a sale of your personal data.
You may opt out of marketing electronic mail by following the instructions contained in any such message, and out of text messages as described in our Terms of Use. We do not engage in targeted advertising and do not sell or share personal data. You may nonetheless record a preference by means of the "Do Not Sell or Share My Personal Information" link available at eurekatrials.com/privacy-preferences or by electronic mail to privacy@eurekatrials.com. We honor Global Privacy Control and other recognized opt-out preference signals to the extent required by applicable law.
We use only such cookies as are strictly necessary in order to operate the Services, including for purposes of authentication, session management, security, and load balancing. Such cookies may be managed through your browser settings, provided that the Services may not function properly in the event they are disabled.
We do not use cookies or similar technologies for advertising or for cross-context behavioral tracking, and we do not permit third parties to track users across the Services for advertising purposes. Any analytics or product measurement we perform is conducted on a first-party basis and is not used for advertising. We do not use health information provided by you, or information obtained from your connected medical records, for advertising purposes, and we do not disclose personal data to advertising networks.
There being no common industry standard governing response to browser "Do Not Track" signals, we do not respond to such signals. We do honor Global Privacy Control as described above.
Your relationship with any third-party website, application, or platform accessed through the Services is governed solely by your agreement with such third party.
We maintain reasonable and appropriate administrative, physical, and technical safeguards designed to protect personal data, including encryption in transit and at rest, access controls and least-privilege permissions, multi-factor authentication for administrative access, access logging, vendor security review, workforce confidentiality obligations and training, and a documented incident response process.
No organization can guarantee the absolute security of personal data. Any breach of security involving your unsecured identifiable health information shall be reported to you and to applicable regulators without undue delay and as required by law, including the Federal Trade Commission's Health Breach Notification Rule and applicable state breach notification laws.
We retain personal data only for so long as is necessary in order to provide the Services and to fulfill the purposes described in this Policy, following which it is deleted or de-identified in accordance with our records management practices. We retain certain records for longer periods where required by law, including records of referrals and of the consents and authorizations you have provided, and records subject to legal hold. De-identified and aggregated data may be retained indefinitely.
The Services are not intended for children. You must be 18 years of age or older in order to use the Services. We do not knowingly collect personal data from any person under the age of 18 and will delete such information promptly upon learning that it has been collected. Requests may be directed to privacy@eurekatrials.com.
We extend the following rights to all individuals using the Services, without regard to state of residence:
Limitations upon deletion. We are unable to retrieve or delete information previously transmitted to a sponsor or research site at your request, such recipient potentially being obligated to retain it. We may also retain personal data as necessary in order to comply with legal obligations, resolve disputes, prevent fraud, enforce our agreements, and maintain records of consents and authorizations.
Exercising your rights. Requests may be submitted by electronic mail to privacy@eurekatrials.com, by telephone at (929) 265-0739, or by post to Eureka Trials, Inc., Attention: Privacy, 5 Union Square West FRNT 1, #1442, New York, NY 10003. An authorized agent may submit a request on your behalf upon proof of authorization. We verify identity prior to acting upon any request and will request only such information as is necessary in order to do so.
Requests are provided free of charge. We will respond within forty-five days and may extend once by an additional forty-five days where reasonably necessary, upon notice to you. We may charge a reasonable fee or decline to act upon requests that are manifestly unfounded, excessive, or repetitive.
Appeals. In the event we decline to act upon your request, we will provide the reasons therefor together with instructions for appeal. Appeals may be submitted by electronic mail to privacy@eurekatrials.com bearing the subject line "Appeal." We will respond within forty-five days, and in the event your appeal is denied we will provide a method by which you may submit a complaint to your state attorney general.
California. Pursuant to the California Consumer Privacy Act, California residents possess the rights described above, including the rights to know, access, delete, correct, and port personal information; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and to be free from discrimination in connection with the exercise of such rights.
Eureka does not sell your personal data or your sensitive personal data and does not share personal data for purposes of cross-context behavioral advertising.
We collect the following categories of personal information: identifiers; records described at California Civil Code section 1798.80; characteristics of protected classifications; internet and network activity; coarse geolocation; audio recordings; inferences; and sensitive personal information consisting of health and medical information and, where provided, racial or ethnic origin and sexual orientation. The sources, purposes, and categories of recipients are as described above. We use and disclose sensitive personal information solely in order to provide the Services you have requested and for such other purposes as are permitted under California Civil Code section 1798.121, and not for purposes of inferring characteristics concerning you.
Pursuant to California Civil Code section 1798.83, we do not disclose personal information to third parties for such third parties' own direct marketing purposes.
To the extent Eureka constitutes a provider of health care under California Civil Code section 56.06 by reason of offering software designed to maintain medical information, we maintain the standards of confidentiality required of a provider of health care and do not disclose medical information except as permitted by that statute or as authorized by you. Consistent with California law, we do not disclose medical information relating to a person seeking or obtaining reproductive or sexual health services in response to an out-of-state request unless such request is based upon a violation of California law.
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states having comprehensive privacy legislation. Residents of such states possess the rights described above, including access, correction, deletion, portability, appeal, and the right to opt out of any sale and of targeted advertising. We do not sell or share your personal data. We obtain your consent prior to processing sensitive data, including health data, and you may withdraw such consent at any time. We do not process personal data for purposes of targeted advertising or for profiling in furtherance of decisions producing legal or similarly significant effects. We recognize universal opt-out mechanisms, including Global Privacy Control, to the extent required.
Washington, Nevada, Connecticut, and Texas. With respect to consumer health data, please refer to our Consumer Health Data Privacy Policy.
Nevada. Pursuant to Nevada Revised Statutes section 603A.340, we do not sell covered information for monetary consideration to any person who will license or sell such information to additional persons. Verified opt-out requests may be submitted to privacy@eurekatrials.com.
The Services are intended for use within the United States, and personal data is processed and stored within the United States. We do not offer the Services to residents of the European Economic Area, the United Kingdom, or Switzerland.
We may amend this Policy from time to time. Material changes will be noticed through the Services, by electronic mail, or by other prominent means, and the Last Updated date will be revised accordingly. We will not use or disclose previously collected personal data in a manner materially different from that described at the time of collection without obtaining your consent. Continued use of the Services following the effective date of any revision constitutes acceptance thereof.
Eureka Trials, Inc.
Attention: Privacy
5 Union Square West FRNT 1, #1442
New York, NY 10003
privacy@eurekatrials.com
(929) 265-0739