PRIVACY POLICY

INTRODUCTION

Cognitive Research Corporation (‘CRC’) is a privately held, full-service contract research organization that specializes in Neuroscience product development for pharmaceutical, nutraceutical, biotechnology, psychedelic, and medical device companies. CRC and its affiliates take the protection of personal data (“Personal Data”) very seriously. When you interact with us, our website, mobile or web applications or points of access, and other services, we collect Personal Data and other information about and from you. This Privacy Policy (the “Policy”) describes what we are doing with your Personal Data, how we protect it, and what privacy rights you may have under applicable data protection and privacy laws, such as the European Union General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act of 2018 (“CCPA”). For Personal Data processed within the scope of this Privacy Policy, CRC acts as a data controller.

It is important to remember when reviewing this Policy, that some of the information contained in the Policy may not apply to you due to your location, or the type(s) of information we collect about you.

WHAT IS COVERED BY THIS POLICY?

This Policy addresses data subjects (which includes both individuals and households) whose Personal Data we receive and process:

  • which is provided to us though communications from the data subject, or which is provided by or on behalf of the data subject, or which is otherwise received;
  • based on their relationship with us and our affiliates and/or subsidiaries in connection with the conduct of clinical trials, such as personnel at a clinical trial site, including without limitation Principal Investigators and other investigative clinical trial site staff (“Trial Personnel”);
  • on our website and its contact forms (the “Website”);
  • on our official social media accounts, including, without limitation, LinkedIn, Twitter, Facebook, Instagram, and/or YouTube (the “Social Media Platforms”); and
  • in various third-party commercial tools for the purpose of marketing, advertising, and selling our services to potential customers (collectively, with the Website and the Social Media Platforms, the “Sales and Marketing Activities”);

WHAT IS NOT COVERED BY THIS POLICY?

  • Information Which Does Not Constitute Personal Data

If we do not maintain information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household, such information is not considered Personal Data and this Policy will not apply to our processing of that information.

  • Human Resources Personal Data

This Policy does not apply to the Personal Data of our employees, job applicants, contractors, business owners, directors, officers, or medical staff.

  • Personal Data Processed on Behalf of Our Customers

This Policy does not apply to the Personal Data we process on behalf of our customers when providing our Contract Research Organization (“CRO”) services (the “Services”), including but not limited to Personal Data of participants in clinical trials or other research.

Adherence to this Privacy Policy may be limited to the extent required by law, regulations or other governmental obligations, and CRC reserves the right to share Personal Data as required or authorized by law or regulation or requested by governmental authorities. In accordance with applicable privacy laws, this Privacy Policy may not apply or may be limited with respect to data processing activities necessary for the performance of a contract between you and CRC.

WHAT IS IN THIS POLICY?

This Policy tells you, among other things:

  1. What Personal Data we collect about you and how we collect it;
  2. The legal bases for processing your Personal Data;
  3. For what purposes we use that Personal Data;
  4. How long we keep your Personal Data;
  5. How do we share your Personal Data;
  6. How do we share Anonymous Data;
  7. Your choices and your rights about the Personal Data we collect about you and how you can exercise those rights;
  8. Children’s Privacy Protections;
  9. How we protect your Personal Data; and
  10. How to contact us.

1. What Personal Data we collect about you and how we collect it

The types of information that we may collect and receive from you while you use the Services are described in this section and include both information that you provide to us, information that we collect automatically when you use the Services, and information that we may collect from third party sources.

Personal Data: information from which an individual may be identified directly or indirectly. Personal Data may include one or more factors specific to an individual such as your first and last name, postal address, zip or postal code, phone number, email address, date of birth, online identifiers such as your IP address, or other device, network and browsing information, and health, financial, employment-related and professional information, or inferences which may be drawn from other Personal Data. Personal Data may also include certain other identifiers.

Cookies and other similar technologies: information relating to your usage or visits to our website(s), web portals, mobile applications, and your devices, and IP address(es), including cookies, Google Analytics, and other similar technologies.

2. The legal bases for processing your Personal Data

To process your Personal Data, we must have a valid reason to do so. Some of these lawful bases for processing include, without limitation, your consent; legitimate interests, such as business interests in marketing our Services; and/or any other ground permitted or required by applicable law. If your Personal Data is processed on the basis of legitimate interests, you have a right to ask us more about the choice of that legitimate basis. CRC will not process your Personal Data in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by you.

3. What are the purposes for which we use your Personal Data?

  • Regulatory reporting and/or other compliance purposes;
  • Contacting you about the Services that CRC has to offer and which we think may interest you, including general information about our products and services;
  • Conducting our Sales and Marketing Activities;
  • Responding to your requests or inquiries you send us for information about our products or services;
  • Contacting you regarding potential opportunities for employment, or other engagement in our research, development and/or collaboration efforts;
  • General business purposes; and
  • Maintaining the functionality and security of our website(s).

4. How long do we keep your Personal Data?

We retain your information for as long as it is necessary for the purposes set out in this Privacy Policy, including the purposes for which we collected your Personal Data or any other permitted purposes, unless required by law to retain it for a longer period of time.

5. How do we share your Personal Data?

  • We may share information about you including individual identifiers, Internet or similar network activity, professional or employment-related information, or other inferences drawn from other Personal Data.
  • We may share this information with our affiliates and business partners, as well as third party providers and social media platforms. These recipients will be required to use your Personal Data only for appropriate purposes, and will be required to take appropriate measures to protect your Personal Data.
  • Some of these recipients may be located outside of the European Economic Area (EEA) or the European Union (EU). Where applicable, certain recipients may be located in countries determined by the European Commission to have data protection laws providing a level of protection equivalent to applicable EU laws. For recipients located in countries that have not yet been recognized as providing an adequate level of protection to personal data, we will only transfer your Personal Data when the required safeguards are in place. Such safeguards may include the Standard Contractual Clauses as approved by the European Commission.
  • Your Personal Data may also be disclosed to the extent required by applicable law, or where we have a good-faith belief that such disclosure is necessary to comply with a legal obligation; official investigations or legal proceedings, or with requests from a regulatory agency. We may also disclose information if we believe it is necessary to protect the legitimate rights, privacy, property, interests, or safety of CRC, our patients, business partners, personnel, or the general public; to pursue available remedies or limit damages; to enforce our terms and conditions on our products or services; or to respond to an emergency. Where a disclosure is made to law enforcement or governmental officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.
  • We may transfer your information in the event we sell or transfer some or all of CRC’s business interests, assets, or both, or in the event of a corporate restructuring.
  • We may also share your information or information about you with third parties with your consent or at your request.

6. How do we share anonymous data?

Anonymous data does not include any Personal Data. We reserve the right to transfer, use, sell or share aggregated, anonymous data for any legal purpose. Such purposes may include, without limitation, analysis or usage trends, or in an effort to identify or collaborate with advertisers, sponsors and/or customers.

7. Your choices and your rights about the Personal Data we collect about you and how you can exercise those rights;

You may have certain rights with respect to your Personal Data under certain laws. Some of those rights may include:

    • The Right to be Informed.
      This Policy informs you of how we process your Personal Data. Where the Personal Data is not collected directly from you, under GDPR and/or other applicable laws, there may be certain exemptions from our obligation to inform you.
    • The Right to Access.
      You have the right to ask for transparent information on how we process your Personal Data, and if we process your Personal Data, you also have the right to access that Personal Data, or access a copy of the same. This right may be subject to certain exemptions.
    • The Right to Object.
      In the event you have the right to object to processing, CRC will no longer process your Personal Data unless we can demonstrate compelling and legitimate grounds for such processing which override your interests, rights or freedoms; or where necessary to establish, exercise or defend a legal claim.
    • The Right to Rectify.
      You have the right to request correction without delay of anything that you believe is wrong with the Personal Data we have for you, or to complete any otherwise incomplete Personal Data.
    • The Right to be Forgotten.
      Also known as the right to erasure, this right entitles you to request the deletion of your Personal Data. If for some reason this request cannot be fulfilled, we will consider limiting our use of your Personal Data where practicable.
    • The Right to Data Portability.
      You have the right to request that we provide you with a portable copy of your Personal Data that you have given to us or that is otherwise generated through your use of our website. You may keep that copy for yourself, or move it elsewhere or to another organization.
    • The Right to Withdraw Your Consent.
      At any time, where we rely on your consent as the legal bases for processing your Personal Data, you may withdraw that consent. However, withdrawing your consent will not impact or negate the lawfulness of our processing prior to your withdrawal of consent. It will also not affect the validity of Personal Data that is processed on other legal grounds.
    • The Right of Non-Discrimination.
      We will not discriminate against you for exercising any data subject right you have under applicable law.
  • CRC will respond to your requests within the prescribed time period(s) pursuant to appliable laws. Whether you make such requests, or an authorized agent is designated by you to exercise your rights on your behalf, we may require additional specific information about you, your agent, and/or proof of your authorization of such agent, in connection with our efforts to protect and safeguard your Personal Data.
  • We will contact you in the event we complete your request, if there is a fee associated with processing your request, if we have to deny your request, or if we have to deny a request from an agent for any reason.
  • If you believe that CRC has processed information in a manner that is unlawful or breaches your rights, or has infringed applicable laws, you may have the right to complain directly to your local data protection authority. Without limiting any such rights to complain directly to an authority, we are committed to protecting personal information, and complaints may be made directly to us. Please see our contact information below.

8. Children’s Privacy Protections;

The rights and protections of children are very important to us, and we take obligations with respect to the protection of the information collected from children very seriously. Our business and Services are not directed at, nor intended for use by children. We request that children do not provide any Personal Data through our Websites or in connection with the Services.

9. How we protect your Personal Data; and

CRC’s technical, administrative, and physical measures are reasonably designed to help protect your Personal Data from unauthorized processing, and from foreseeable risks such as unauthorized disclosure or access. As such, your Personal Data is contained within secured networks with accessibility limited to those with special rights access who are required to maintain the confidentiality of the information stored on those networks. While we have taken great care to create secured and reliable communications, websites and means of data transmission, we cannot make any guarantees. Please keep this in mind as you decide which of your Personal Data you will make available to us through electronic transfer.

10. How to contact us.

To exercise any of the rights referenced in this Policy, please submit a request to us at privacy@cogres.com.

If you prefer to contact us in writing, please send direct your mail to:
Cognitive Research Corporation
ATTN: DATA PRIVACY REQUEST
200 Central Ave.
Suite 1200
St. Petersburg, Florida 33701

This Policy may be reviewed and amended from time to time, without advance notice, consistent with the requirements of applicable privacy laws, to ensure that an appropriate level of protection for Personal Data is maintained. Any changes will be effective immediately upon posting of the revised Privacy Policy, and your continued use of our Websites or our Services will be subject to the then-current Privacy Policy.