Privacy Notice for Clinical Trials – EU


Xenon Pharmaceuticals Inc., and its wholly owned subsidiaries (together referred to as “Xenon”) are committed to protecting the Personal Data we process for the purpose of conducting clinical trials. This Privacy Notice sets forth the privacy principles and procedures and the technical security measures we follow to keep Clinical Trial Data private and secure.

Xenon is subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”), Canada’s federal privacy legislation for private bodies, where personal information crosses provincial boundaries and international borders. Xenon is subject to the General Data Protection Regulation (“GDPR”) where we process Personal Data or monitor the behaviour of data subjects who are in the European Union (“EU”).

In the EU, clinical trials are also subject to the Clinical Trials Directive 2001/20/EC and the Clinical Trials Regulation 536/2014/EU, which have specific requirements regarding informed consent for participating in clinical trials (more on consent below). Xenon will also comply with applicable EU member state legislation.

This privacy notice is for data subjects participating in trials in the EU. Data subjects participating in trials in Canada or the United States should refer to the privacy notice for North American trials.

If you are a Clinical Trial Participant and would like more information about your trial or to review your Informed Consent Form, please contact the physician or hospital that enrolled you in the trial.

Xenon and Clinical Trial Data

Xenon does not collect Clinical Trial Data directly from individuals during the course of our clinical trials. Instead, we receive Pseudonymised Data from the Contract Research Organisations (“CRO”) and service providers that we engage to carry out the study. 

Investigators enrolling Clinical Trial Participants in the study will provide information about the trial, how Personal Data will be managed and protected, and a link to this Privacy Notice at the time of enrollment.

Data Subjects in the EU

If you are a Clinical Trial Participant in the EU and would like more information about the specific trial in which you are enrolled or have questions about the processing of your personal data, please contact the physician or the hospital that enrolled you in the trial. Xenon will not be in a position to identify you personally as a data subject, given we only collect Pseudonymised Data.

Data Protection Officer

Xenon has assigned a Data Protection Officer responsible for overseeing our compliance with the EU data protection law.

Karen McParland, DPO
200 – 3650 Gilmore Way
Burnaby, British Columbia
Canada, V5G 4W8
E: dpo@xenon-pharma.com
T: (+1) 604-484-3326

Member Representative in the EU

DPR Group
72 rue de Lessard
Rouen, 76100
France
E: datainquiry@dpr.eu.com with a copy to dpo@xenon-pharma.com

Controller Information

Xenon Pharmaceuticals Inc.
200 – 3650 Gilmore Way
Burnaby, British Columbia
Canada, V5G 4W8
T: (+1) 604-484-3300
https://www.xenon-pharma.com

Scope

This Privacy Notice applies to Personal Data of data subjects in the EU that are received by Xenon in any format, including electronic and paper, and processed by Xenon and/or by partners and service providers (“third parties”) on behalf of Xenon. Categories of third party organisations and data recipients are described below.

Definitions

“Clinical Trial Participant” means an individual participating in a clinical trial in the EU and providing personal information to third parties Xenon has contracted with to conduct the study. Clinical Trial Participant has the same meaning as “Data Subject” under Article 4 of the GDPR.

“Personal Data” means any information relating to an identified or identifiable natural person (‘data subject’) in the EU; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Pseudonymised Data” means Personal Data that can no longer be attributed to a specific individual in the EU without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data are not attributed to an individual. Xenon will protect Pseudonymised Data subject to the GDPR with the same care and high standards as Personal Data.

“Anonymous Data” is information which does not relate to an identified or identifiable natural person or personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. The GDPR does not concern the processing of Anonymous Data.

“Clinical Trial Data” is the data collected and processed by Xenon for clinical trial purposes. It includes Pseudonymised Data received from third parties as well as new data generated by Xenon and third parties based on data collected for the clinical trial. These new data may not relate to an identified or identifiable natural person.

“Processing” means any operations or set of operations performed on Personal Data. It includes the collection, use and disclosure of Personal Data as defined in Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”).

Purposes for Processing Personal Information

When individuals in the EU become Clinical Trial Participants, Personal Data will be processed for the purpose of scientific research into the effects of medical treatment.

Categories of Information Processed

Common personal details 

  • Participant identifier (unique ID#)
  • Location data – country, investigative site
  • Personal details – year of birth, age in years, sex

Special categories of data

  • Health data
    • Physical details – height, weight, Body Mass Index (BMI)
    • Childbearing status
    • Physical health data
    • Psychological details – quality of life rating
    • Mental health data  
    • Genetic data related to genetic research
  • Data revealing racial or ethnic origin

Legal Basis for Processing Personal Information

Clinical Trial Data for research purposes

All processing operations purely related to research activities in the context of the clinical trial will be carried out on the basis of legitimate interests for common personal data (Article 6(1)(f)) and scientific purposes for special categories of data (Article 9(2)(j)). Xenon has a legitimate interest in processing the common personal data for scientific and statistical purposes related to the clinical trial, and will ensure the appropriate protections are in place.

Clinical Trial Data for reliability and safety purposes

Processing operations expressly provided by the EU clinical trial law and by relevant national provisions and which are related to the protection of health while setting standards of quality and safety for medicinal products by generating reliable and robust data will be based on Xenon’s legal obligation (Article 6(1)(c)) and on a public interest in the area of public health (Article 9(2)(i)). This includes processing records respecting adverse events.

Genetic data for research purposes

Genetic data for the purpose of genotype/biomarker assessment will be processed based on scientific purposes (Article 9(2)(j)). Participation in this assessment is entirely voluntary. The decision not to participate in the assessment will not stop the data subject from participating in the rest of the study. Consent to participate in the genotype/biomarker assessment is collected and recorded during the enrollment process using an Informed Consent Form. 

Automated Processing

During the course of the Clinical Trial, Xenon will not make decisions regarding data subjects based solely on automated processing.

Categories of Third Parties and Data Recipients

Xenon contracts with a Contract Research Organisation (CRO) to run trials based on the protocols, or “instructions”, we have developed. The CRO selects investigators and study sites, processes Clinical Trial Data based on the protocol, and monitors the trial activities. CROs and third parties engaged by Xenon for the purposes of conducting a clinical trial are required by law and contractual undertakings to:

  • Keep your Personal Data confidential and secure; and
  • To use and disclose it for purposes that a reasonable person would consider appropriate in the circumstances, in compliance with all applicable legislation.

Categories of third parties that Xenon engages for clinical trials include:

  • Wholly owned subsidiaries of Xenon  
  • Contract Research Organisations
  • Statistical Research Analysts
  • Clinical advisors
  • Technical providers for hosting and software services
  • Safety board

Clinical Trial Data Transmitted to Third Countries

Xenon Pharmaceuticals Inc. is located in Canada. Clinical Trial Data from data subjects in the EU are processed in the EU, Canada, and the United States.

The European Commission has decided that PIPEDA ensures an adequate level of protection (Article 45), which means that transfers of Personal Data between Canada and the EU do not require any specific authorisation. Xenon Pharmaceuticals Inc. is compliant with PIPEDA.

  • We will obtain your consent to process data outside of the EU.
  • Clinical Trial Data will be pseudonymised prior to processing outside of the EU.
  • We will ensure that there are adequate measures and specific guarantees in place to protect Personal Data. For example, data recipients in the US participate in the Privacy Shield program.
  • Xenon Pharmaceuticals USA Inc., a wholly owned subsidiary of Xenon Pharmaceuticals Inc., may process Clinical Trial Data upon instructions by Xenon Pharmaceuticals Inc.  Xenon Pharmaceuticals USA Inc. is contractually bound to protect any Personal Data to the same standards as Xenon Pharmaceuticals Inc.

The list of processors Xenon uses for a specific trial is available upon request.

Retention

Xenon will retain Clinical Trial Data and will instruct third parties to retain Personal Data or Clinical Trial Data, depending on their role in the study, subject to applicable legislation. In Canada the retention period for clinical trial data is 25 years under Canadian Food and Drug Regulations. The EU requires that data be retained for at least 15 years after the trial is completed or discontinued.

Your Rights

Where data subjects in the EU seek to exercise their rights related to their Personal Data, Xenon will provide support to exercise those rights. Xenon may not be able to comply with a direct request where Xenon is not in a position to identify you. This would occur where Xenon has received Pseudonymised Data or where Personal Data have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.

Your rights related to the trial, including the right to withdraw consent, are described in the clinical trial Informed Consent Form.

Depending on the legal basis for processing the Clinical Trial Data under the GDPR, rights related to the Personal Data of Clinical Trial Participants in the EU may include:

  • Access to your Personal Data
  • Right to rectification where Personal Data are incorrect or incomplete
  • Right to restrict/suspend further processing of Personal Data
  • Right to data portability
  • Right to withdraw consent
  • Right to complain to a supervisory authority

The right to erasure will not apply to processing that is necessary for Xenon to comply with a legal obligation, for a task carried out in the area of public health, or for scientific research purposes.

Please contact the physician or hospital that enrolled you in the clinical trial if you would like to exercise your rights related to your Personal Data collected for clinical trial purposes.

Security Measures

We have taken appropriate technical and organisational security measures to protect Clinical Trial Data against unintentional or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and any other unlawful or unauthorized forms of processing under applicable law. 

Such measures include in particular, ensuring confidentiality, integrity and availability of data by controlling physical access to the data, as well as the relevant access, input, disclosure, security of availability and its separation. In addition, we take into account the protection of Clinical Trial Data when developing or selecting the hardware, software and procedures in line with the principle of data protection through technology and privacy by design.

Complaints

When contacting Xenon regarding any issue, please do not include any personal information (other than your contact information) or health information in the subject line or in the content of your message.

Clinical Trial Participants in the EU may contact our Data Protection Officer with complaints regarding this Privacy Notice and Xenon’s processing of Clinical Trial Data:

Karen McParland, DPO
200 – 3650 Gilmore Way
Burnaby, British Columbia
Canada V5G 4W8
E: dpo@xenon-pharma.com
T: (+1) 604-484-3326

Xenon will reply to complaints within 30 calendar days of their receipt and will attempt resolution in accordance with this Privacy Notice.

You may lodge a complaint with the corresponding EU data protection supervisory authority in your country of residence. The relevant EU supervisory authority name and contact details can be found here:

https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080

Last updated: June 30, 2019