Who we are

Exactis Innovation (Exactis) is a pan-Canadian research Network for precision oncology funded by Business-Led Networks Centres of Excellence (BL-NCE). We collect and process patient data through our national registry.

Your Privacy

We take the Privacy of the data we hold very seriously, and have put in place strong policies to ensure the protection of such data. If you ever have any questions on how your data is managed, used, accessed and/or protected, do not hesitate to contact us.

Who we share your data with

All Data collected by Exactis in the course of its affairs is strictly regulated and the use is submitted to ethical, regulatory and legal requirements. No personal identifiable data is ever shared with third parties.

How long we retain your data

We only retain data as long as required for the purpose for which they were collected, and in accordance with applicable laws and regulations.

What rights you have over your data

You can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, and/or security purposes.

Contact us

Kostas Trakas
Privacy Officer
privacy@exactis.ca

Confidentiality Policy

This policy describes how we handle and protect personal information that we collect through technological means (e.g., by email or online). We follow these rules to protect your privacy and comply with our legal obligations.

1. Who is this policy for?

The rules described in this policy apply to you if we collect your personal information by technological means in the course of our business. For example, this policy applies to:

• if you contact us by email;
• if you participate in our PMT Registry, as a participant or healthcare professional.

Our Privacy Policy describes in more detail our personal information management and protection practices.

2. When do we collect your personal information, and how can we limit its collection?

We collect personal information by technological means in the situations listed below. Check them out to find out:

• the types of personal information we collect;
• from whom and why we collect it;
• Steps you can take to limit collection

We consider “personal information” to be any information about you that can be directly or indirectly identified to you (for example, by combining it with other information).

We do our best to keep your personal information accurate, complete and up-to-date when we use it. We rely on you to notify us when this information changes. To do so, you can write to us at privacy@exactis.ca.

2.1. When you participate in a clinical trial with us

We use an electronic platform to collect information about clinical trial participants, as well as investigators, study personnel, consultants, contractors, and affiliated individuals when conducting or managing a clinical trial.

For research participants, we only collect personal non-identifying information, in accordance with the terms of the participants’ signed Informed Consent Form.

For individuals other than participants, we collect the following personal information:

• your name and email address, to enable you to create an account;
• your IP address, the date and time of connection, the actions you take in the system, and the information contained in the documents you file onto the platform.

This information is collected for the following purposes:

• compliance with legal and regulatory requirements;
• verification by governmental or regulatory agencies, the study sponsor, and their agents and affiliates;
• publication on www.clinicaltrials.gov and websites and databases that serve a comparable purpose;
• storage in databases to facilitate the selection of investigators for future clinical researches or other business.

How can we limit the collection of this personal information?  Every participant is free to not participate in a clinical trial. Individuals other than participants are free to decline to participate in clinical research.

2.2. When you browse our website

Our website collects personal information for statistical purposes. The IP addresses of people who visit it are stored. Cookies are generated on each visit.

How can we limit the collection of this personal information?  You can decline the use of cookies when asked upon entering our website.

2.3. When you send us an information request

When you send us an information request through our website, we collect information necessary to respond to your question. We will collect your name and email address, as well as any other personal information you may share with your question. The types of information and the reason for collection depend on the context of our exchanges.

2.4. When you apply for a job with Exactis

When you apply for a job, internship or other position, we collect the personal information necessary to evaluate your application and to contact you as part of the process.

We collect the following personal information:

• your cover letter, resume, email address, phone number, and mailing address.
• Information discussed during a reference check telephone conversation, such as your job performance. We contact the references you provide to us, with your consent.

2.5. When you write to us by email

When you correspond with us by email, we collect your email address and the personal information contained in your emails. The types of information and the reason for collection depend on the context of our exchanges.

Here are the most common situations:

• When you submit a proposal of service.  We collect personal information to open the file and evaluate the service offer. We collect your name, mailing address, email address and telephone number. If you have a legal representative, we collect the same information about them. We also collect the name of the company or public body involved, the name and title of the individuals involved, and their contact information (mailing address, telephone number and email address). Note that some of this information is not personal information (for example, contact information for representatives).
• When you make a request for access to documents or personal information held by us. We collect information from your email, name and email address.
• When you make a complaint about the quality of our services. We collect the personal information contained in your email to process your complaint.
• When you write to us for any other reason. We collect the personal information contained in your e-mail to respond to your questions or requests for information, or to assist you in your access or privacy efforts with us or other organizations.

How can we limit the collection of this personal information?  For most of the situations listed, you can obtain information in person or send them by mail.

3. We respect your consent

When we collect, use and disclose your personal information, we always do so for specific purposes. Your consent is valid for as long as necessary to achieve these purposes. We may then retain your personal information for as long as necessary to fulfill our retention obligations outlined in the law and in our retention schedule.

We always respect the purposes for which we collected your personal information. If we wish to use or disclose your personal information for any other purpose, we will ask for your consent, except as permitted by law.

4. We may share your personal information with other individuals and organizations

4.1. To whom we may share your personal information

We may share your personal information with other individuals or organizations as necessary to fulfill the purposes described in this policy or as permitted by law. The type of information shared depends on your situation.

For example, we may share your personal information with the following individuals and organizations:

• A regulatory authority that is competent over the conduct of a clinical trial conducted or managed by us;
• Other researchers, academic institutions or private entities, in accordance with the clinical trial approved documents (such as the ICF, Protocol or governance framework);
• A service provider retained by us, such as AWS – Amazon Web Services (only used for hosting our data platform)

4.2. We may disclose personal information outside of Quebec

We usually store your personal information in Quebec. However, from time to time, we may share your personal information with another province in Canada:

• when we are working with another federal or provincial regulatory agency on a clinical trial;
• when a backup copy of a file is kept in another province.

In this case, your personal information is also subject to the laws of that province.

Before we disclose your personal information, we take protective measures. We conduct a Privacy Impact Assessment, which is a process where we consider all the factors that may impact your privacy and assess whether the information will be adequately protected. We also enter into a contract or agreement that includes appropriate security measures for the information disclosed.

5. How We Protect Your Personal Information

5.1. We limit access to your personal information

Only staff members who need to process your personal information to perform their duties may access it. These individuals only have access to the information necessary to perform their duties.

We have established the roles and responsibilities of staff members throughout the processing cycle of your personal information, from collection to destruction. These roles and responsibilities are outlined in our Privacy Policy. We review them regularly to keep them up to date.

5.2. We have robust security measures in place

We have implemented several types of measures to protect your personal information from loss, theft and unauthorized access, use or disclosure. They include:

• physical measures, such as locked premises;
• technological measures, such as firewalls;
• organizational measures, e.g. the adoption of an information security policy.

5.3. We destroy your personal information after we have fulfilled our obligations

We retain your information for as long as necessary to fulfill the purposes described in this policy. Even if you are no longer connected to us, we need to retain your personal information for a period of time to comply with our legal obligations. As long as we retain it, we continue to protect your personal information and keep it confidential.

We have a retention schedule in place to clearly establish the retention period for certain types of information. Once this period has passed, we will permanently and securely destroy your personal information.

6. Your rights

6.1. Withdrawing your consent

You may request to withdraw your consent to the use, disclosure and retention of your personal information.

The processing of this request depends on the situation and the purpose sought. As the case may be:

• you can withdraw your consent, but we will no longer be able to provide you with a service that depends on it (for example, if you wish to withdraw an application you have filed);
• You cannot withdraw your consent, as the processing of your personal information is necessary or mandatory (for example, personal information of an investigator for compliance purposes in case of a clinical trial).

In all cases, we may need to retain certain personal information to comply with our legal obligations.

6.2. Accessing and correcting your personal information

You have rights related to your personal information. You can ask us:

• access it;
• correct or update them.

Here are the steps to process an application:

• you must send a written request to the Privacy Officer. You will find their contact information at the end of this policy;
• We will process your request within 20 days of receiving it.
• You will receive our response in writing.

7. Do you have a question, a complaint, or a comment?

We have appointed a Privacy Officer. This person ensures that we comply with the rules outlined in this policy and in the law. You may contact our Privacy Officer at:

Mr. Kostas Trakas

Privacy Officer

5450 Chemin de la Côte-des-Neiges, bureau 522

Montreal (Quebec) H3T 1Y6, Canada

Email: privacy@exactis.ca

Tel: 514 282-4523 ext. 222

This policy is effective September 21, 2023

Updated: December 19, 2023