This Notice applies solely to residents of the State of California, and to information that is defined by California law as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with California consumers or households (“California Personal Information”).
KCR provides this Notice to comply with our obligations in our capacity as a Business under the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this notice.
This Notice does not apply to information KCR collects, maintains, or discloses in our capacity as a Service Provider under the CCPA on behalf of our clients, including clinical and medical information that we collect, host, and analyze as part of the clinical research associated services that we perform under contracts with our clients. If your information has been submitted to us as part of our performance of those services and you would like to learn more about the handling of that information or exercise any rights you may have under the CCPA, please inquire with the client directly.
Moreover, California Personal Information does not include, and this Notice does not apply to:
- information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration;
- publicly available information lawfully made available from federal, state, or local government records;
- deidentified or aggregated consumer information; or
- other information excluded from the CCPA’s scope, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), and
- personal information covered by other sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Driver’s Privacy Protection Act of 1994, and the federal Gramm-Leach-Bliley Act, and implementing regulations, or the California Financial Information Privacy Act.
Categories of California Personal Information We Collect or May Collect:
- Identifiers such as name, email address, telephone number, mailing address, Social Security number, driver’s license identifiers, online identifiers, or other similar identifiers.
- Internet or other electronic network activity information, such as information concerning individuals’ interactions with our websites, applications, or advertisements.
- Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), including signature, financial information, medical information, education and employment history, medical information, or health insurance information.
- Characteristics of protected classifications under California or federal law, such as age, medical condition, physical or mental disability, gender, information relating to pregnancy or childbirth, sexual orientation, or veteran or military status.
- In respect of our employees and job applicants as well as health care professionals: professional or employment-related information, including current or past job history; professional specialties, affiliations, licenses, and certifications; financial compensation information, and performance evaluations, personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as signature, education and employment history, medical information, or health insurance information, characteristics of protected classifications under California of federal law, such as age, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions). Inferences drawn from any of the above information to create a profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Sources of California Personal Information
We collect the categories of California Personal Information listed above from among the following categories of sources:
- Directly from you, including when you provide information to us online, in-person at health screening events or over the phone;
- Indirectly from you, such as when we automatically collect technical and usage information when you use our websites;
- Public sources and data resellers;
- Third-party websites and other online services, such as online advertisements
- and solely with respect to job applicants, information provided via the BambooHR human resources online resource.
Purposes for which We Collect and Use California Personal Information
We may use the California Personal Information listed above for the following business and commercial purposes:
- To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to apply for a loan or ask a question about our products or services, we will use that personal information to respond to your inquiry.
- To respond to your inquiries;
- To contact you regarding changes or updates to our service offerings;
- To conduct recruiting and candidate evaluation activities and to inform our employment decisions;
- To provide, support, personalize, and develop our websites, applications, and product or service offerings;
- To audit our interactions with you, such as counting impressions or verifying the quality and effectiveness of content including ads;
- To prevent malicious, deceptive, fraudulent, or illegal activity, and participating in any prosecution or enforcement of laws or agreements meant to prevent or punish such activity;
- To maintain the safety, security, and integrity of our websites, applications, other technology assets, and our business, including the detection of security incidents.
- To debug, identify, or repair errors or effectuate similar functional enhancements in connection with our websites and other applications.
- To develop, improve, and deliver marketing and advertising.
- For internal operational uses such as research, analytics, development, audits, and security.
- For legal and operational compliance purposes, such as monitoring whether our operations are effectively implementing this policy.
-
To engage in or enable internal uses consistent with our relationship with you, or compatible with
the context in which you provided the information, such as internal research and development; and
For any other purpose described to you when collecting your California Personal Information before or at the time of collection.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Sharing of California Personal Information
We may share California Personal Information with the following categories of third parties:
- Our affiliated companies;
- Our service providers;
- Our clients;
- Other third parties to protect our legal rights or comply with legal requirements;
- Other third parties as required by law, such as to comply with a subpoena or other legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- Other third parties involved in a merger, sale, joint venture or other transaction involving a transfer of our business or assets; and
- Other third parties with your prior consent.
Sales of California Personal Information
KCR did not sell California Personal Information within last 12 months.
Your Rights and Choices with Respect to California Personal Information
The CCPA provides California residents with specific rights regarding California Personal Information. This section describes your CCPA rights and explains how to exercise those rights.
Right to Know Request - Access and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your California Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request (see the section below on Exercising Access, Data Portability, and Deletion Rights), we will disclose to you:
- The categories of California Personal Information we collected about you.
- The categories of sources for the California Personal Information we collected about you
- Our business or commercial purpose for collecting or selling that California Personal Information.
- The categories of third parties with whom we share that California Personal Information
- The specific pieces of California Personal Information we collected about you (also called a data portability request).
- If we sold or disclosed your California Personal Information for a business purpose, two separate lists disclosing disclosures for a business purpose, identifying the California Personal Information categories disclosed; and sales, identifying the California Personal Information categories sold and that each category of recipient purchased.
Deletion Request Rights
You have the right to request that KCR delete any of your California Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your California Personal Information from our records, unless an exception under CCPA applies.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
-
Comply with a legal obligation.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Exercising Access, Data Portability, and Deletion Rights
To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:
- sending request via postal e-mail or calling using data indicated on this website in section contact us
- emailing us at: gdpr@kcrcro.com
Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your California Personal Information. You may also make a verifiable consumer request on behalf of your minor child.
You may only make a request for access or data portability twice within a 12-month period. The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected California Personal Information, or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with your California Personal Information if we cannot verify your identity or authority to make the request and confirm the California Personal Information relates to you. We will verify your identity by matching the identifying information provided by you to the personal information already maintained by us, or, in cases where your request requires a higher degree of certainty, we may use a third-party identity verification service or ask for a photo ID or for more information. Any information you provide us that is not already in our system will be deleted after your request has been fulfilled.
Making a verifiable consumer request does not require you to create an account with us.
We will only use California Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Any disclosures we provide in response to a request will only cover the 12-month period preceding the request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your California Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
Response Timing
We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.
Fee
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision, and we reserve the right to either refuse to act on your request or charge you a reasonable fee to complete your request if it is excessive, repetitive, or manifestly unfounded.
Non-Discrimination
You have a right to not receive discriminatory treatment for exercising your CCPA rights, and we will not discriminate against you for exercising any of your CCPA rights.Changes to this Notice.
We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated notice to our websites and update the notice’s date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.