argenx BV (“argenx”), based in Belgium, is sponsoring an international study (the “study”) of patients living with myasthenia gravis (“MG”). In order to facilitate the study, argenx has appointed Vitaccess Limited (“Vitaccess”, “we” or “us”), in particular to provide a technology platform, and the “MyRealWorld™ MG” application to be used by participants involved in the study (the “app”). The protocol for the study has been approved by a duly constituted body, Salus IRB, in accordance with best practice for ethics reviews.
As at the date of this notice, argenx and Vitaccess are both subject to the European Union General Data Protection Regulation 2016/679 (“GDPR”) in their access and/or use of your personal data. In implementing the study on behalf of argenx, Vitaccess will collect, store and analyze the personal data of participants as a subcontractor of argenx.
Pursuant to the GDPR, as argenx is the sponsor of the study, determining the purposes for which and means by which the personal data are processed, argenx is a data controller of participant data. Vitaccess is acting as the data processor in relation to the services being carried out for argenx. Vitaccess can also act as a data controller in limited circumstances described in sections 3.6 and 5.2.
argenx has sponsored the development and management of the app for the purposes of the study and hopes to publish aggregated data from this study and present it at scientific meetings. Because of the sensitivity of the personal data collected via the app, argenx does not itself receive those data and has asked Vitaccess to determine and implement measures to ensure no personal data are transferred to argenx. In particular, personal data collected by the app are de-identified and aggregated by Vitaccess before any statistical analysis is performed. In addition, a Scientific Advisory Board has been established as an independent body to protect participants’ interests and provide advice on research-related requests to access the data provided by the study database.
This notice provides information to participants (referred to as “you”) about how and why we use your personal data in relation to our services to argenx.
We may update this notice from time to time. It was last updated on .
The following summarizes key points within this notice. For more detail on any particular matter, please refer to the later sections as indicated.
- argenx controls the use of your data for the purposes of the study, and therefore has primary responsibility for use of your data as part of the study, including ensuring that you are aware of how both argenx and Vitaccess use your personal data. Vitaccess processes your personal data on behalf of argenx, and provides this notice to assist argenx with its responsibilities. See section 2.
- Vitaccess has appointed a data protection officer (contact: firstname.lastname@example.org), who is responsible for overseeing use of personal data by us within the study and compliance with applicable laws. See section 2.1.
- We use your personal data in order to operate the study and provide the app on behalf of argenx, to provide you with app features, and to assist argenx in managing its relationship with you. In limited circumstances, we may use your data to protect our own business interests. See section 3.
- The personal data we use include special categories of personal data, including health information relating to your condition (which we need in order for you to participate in the study). See section 3.7.
- Our app's planned features may allow you to upload other information, such as documents and audio recordings. Please inform and obtain consent of other relevant individuals before you upload information relating to them (such as recordings of their voice). See section 3.3.
- Within some planned app features, you may choose to share some of your data with other participants in the study, and should review and set your options for doing this. Similarly, other participants may choose to share some of their data with you. Please respect the privacy of other participants and the confidentiality and sensitivity of their data. See sections 3.3 and 4.8.
- argenx, as the controller of your data, could have access to your personal data for the purposes of the study, and is responsible for determining the purposes for which it may be used. However, argenx is generally relying on Vitaccess to handle your personal data on its behalf, and seeks to use aggregated and de-identified data for its research purposes, and for use in presentations and publications. See sections 2.2, 3.2 and 4.1.
- Salus IRB and other accrediting agencies may inspect any study findings and the procedures we have followed. This may include accessing your personal data. The Scientific Advisory Board and the Study Investigator may also access your personal data for the purposes of the study, though this will usually be in a form from which they cannot identify you personally. See sections 4.2 to 4.4.
- Your data will be aggregated and de-identified before they are shared with researchers or other subscribers to the research portal for the study, or used in presentations or publications. See section 3.2.
- We seek your specific consent (on behalf of argenx) to most of our uses of your personal data in accordance with data protection and ethics requirements. However, some records are kept for other legitimate interests or legal requirements. See section 5.
- As the study is an international project, your data may be transferred to a different country to that in which you are located. This includes transfers to Vitaccess in the United Kingdom (UK), to argenx in Belgium, to Salus IRB in the US, which is outside the European Economic Area, and to the systems of Vitaccess's technology providers (which are located within the US, the UK and the European Union). See section 6.
- You have certain rights in relation to our use of your data, including the right to obtain a copy of the data held by us (on behalf of argenx). Requests to exercise your rights should be made to argenx. See section 9.
The remainder of this notice is set out in the following sections:
- About Vitaccess and argenx
- What data we collect and how we use it
- Sharing your data and relationships with other parties
- Consents and legal basis for use of your data
- International data transfers
- Retaining your information
- Security of your data
- Your legal rights, including your right to access a copy of the data held about you
- Vitaccess and argenx contact details
2. About Vitaccess and argenx
Vitaccess Limited is a company registered in England and Wales with company number 10642948. We act as a processor on behalf of argenx in our collection and use of your personal data for the purposes of the study, meaning that we act on argenx's instructions in our collection and use of your data from our app and technology. In limited circumstances, we may act as a controller and ourselves determine how your personal data are used – see section 3.6.
Vitaccess is located in the UK, and is therefore subject to the GDPR and associated UK data protection laws in relation to its use of your personal data in the context of our activities in providing the app and associated technology for the study.
We have appointed a data protection officer, who is responsible for overseeing use of personal data by Vitaccess. You may contact the data protection officer with queries or concerns about our use of your data (though your primary contact in relation to the study and your data should be with argenx).
Contact details for Vitaccess are set out in section 10.
argenx BV is a company incorporated in Belgium with company number 0818.292.196 and address Industriepark-Zwijnaarde 7, 9052 Zwijnaarde, Belgium. It acts as a controller for the purposes of data protection laws, meaning that it determines how and why your data are to be collected and used by Vitaccess, and instructs Vitaccess accordingly. It is also responsible for determining any additional purposes or ways in which your personal data may be used (outside the scope of Vitaccess's activities) – please contact argenx for further information about this.
argenx is located in Belgium and is therefore subject to the GDPR and associated Belgian data protection laws in its use of your personal data in the context of Vitaccess's activities as described in this notice.
The data protection laws of the country in which you are located may also apply in some circumstances. Please contact argenx for more information about the specific laws which apply to its use of your personal data.
Contact details for argenx are set out in section 10.
2.3. Scope of this notice
Vitaccess is providing this Privacy Notice to assist argenx with its responsibilities to make you aware of how your personal data are used by us for the purposes of the study (using our app and associated technology).
3. What Data We Collect and How We Use It
3.1. Installation of the app, eligibility and registration
You may download the app from Android or iOS app stores in response to an email from a MG patient support group in your country, an invitation or recommendation from a study participant (see section 3.5), after seeing marketing materials about the study (e.g., on social media) or hearing about the study via word of mouth.
When you install the app, you will be asked to register with us and provide us with information to enable us to assess your eligibility for participation in the study, including to check that you are over 18 and a genuine MG patient. The information we collect for these purposes includes the following:
- Your name and contact details, which we use to contact you in relation to the study (by email).
- Date of birth.
- Information about your condition.
Once you have completed this information, if you have entered valid details, you will be able to create a username and password for the app. We will also assign you with a respondent ID, which we will use for the purposes of administering your use of the app and the information you provide. If you have not provided valid details or are not eligible to participate (which we may assess before or after the username and password have been sent), we will let you know, and will remove your details from our systems within a reasonable period – see section 7.
3.2. Profile, tracker, and surveys
We ask you to enter data into your profile and tracker, and complete surveys using the app, to assist with the study, understand participants living with MG, and investigate symptoms and health-related quality of life in the real-world setting.
You will first be asked to answer some background questions about yourself, such as demographics, diagnosis and treatment. The information you provide will be used to create your profile within the app (together with information provided at the eligibility stage – see section 3.1).
You may then complete the surveys and tracker, which collect detailed information about how MG impacts your daily life, for the purposes of the study.
Your data (including profile content, tracker content, and responses to surveys) will be transferred into a database for the purposes of the study, where they will be analyzed by argenx. The data in the database will be de-identified and aggregated by Vitaccess, meaning that identifying information will be removed from that dataset but we will separately have access to a key which allows us to re-identify you if needed. argenx only intends this key to be used in exceptional circumstances, for example if a clinician has identified a health risk for a particular patient arising from the study, and would like to contact them personally to discuss this risk.
The Study Investigator and Salus IRB will also have access to this de-identified data where needed to perform their roles for the purposes of the study. See section 4 for more information about these parties.
Aggregated and de-identified datasets drawn from the database may be shared with other parties for research purposes using a research portal – see section 4.5.
In the event of your death, the data that have been collected continue to be important, and will remain in the central database.
The app may provide you with some patient-centered features ('PCFs'), such as a checklist of questions to ask during medical consultations, and a knowledge base.
If you use these PCFs, we will therefore also collect and store additional information about you, including information that you provide, and information that we create as part of these features. This is used to provide you with the relevant PCFs.
If you decide to provide information or content which identifies another individual (such as audio records or scans that identify your doctor), please inform that individual that you are doing so.
The PCFs may allow you to display or share some of your personal data with other participants in the study or users of the app. We shall seek your consent before data are displayed or shared in this way, and you should regularly review and set your sharing options within these features. Similarly, other participants in the study may choose to display or share with you some of their personal data. To the extent you view or receive information about other participants or users of the app, please respect the privacy of such individuals and the confidentiality and sensitivity of their data.
Note that if you choose to share data or communicate with other participants or users using systems outside of our app and our platform (such as by email), neither argenx nor we have control over such other systems (including their security). See also section 4.8.
We may also use metadata about your use of the PCFs (such as information about which features you use and how you use them) to explore possible trends and patterns which may provide further research opportunities. We seek to aggregate and de-identify such data for these purposes.
3.4. Communications about future studies
Subject to obtaining your consent, we may (on behalf of argenx) send you information about future studies being run by us or other parties.
3.5. Tell a Friend feature
A “Tell a Friend” feature may be included in the app. This will invite you to provide us with another MG patient's name and email address, for us to contact them to let them know about the study and the app. You must confirm to us that you have obtained that person's consent before providing their details to us.
Your personal data may also be used by us on behalf of argenx:
- to monitor your use of the app, in order to check that it is being used appropriately, and for the purposes of administration and maintenance of the app and our systems;
- if instructed by argenx, to analyze your use of the app to improve app functionality, for example by measuring the response rates to the different surveys; and
- to assist argenx in protecting or enforcing its legal rights, or complying with applicable laws (including data protection laws).
argenx, as the controller, is responsible for determining any additional purposes for which your personal data may be used, outside the scope of Vitaccess's activities. You should contact argenx directly for more information about this – see contact details at section 10.
Vitaccess may, in limited circumstances, use your personal data as a controller for our own business purposes. These purposes include protection of our software and intellectual property (and other rights and responsibilities in relation to the app and our technology), administering our technology and our relationship with argenx, and maintaining appropriate records relating to the same.
3.7. Special categories of data
The activities described previously involve collection and use of special categories of data (also known as “sensitive data”), including as follows:
- information about MG and your condition. This is fundamental to the study, so is collected and used by us throughout the course of the study and the features provided to you; and
- information about criminal matters or other sensitive information. Monitoring of our systems and/or other business records may involve or reveal information about criminal matters or other sensitive information.
4. Sharing Your Data and Relationships with Other Parties
argenx has sponsored the development and management of the app for the purposes of the study and hopes to publish aggregated data from this study and present them at scientific meetings. Because of the sensitivity of the personal data collected via the app, argenx does not itself receive those data and has asked Vitaccess to determine and implement measures to ensure no identifying information is transferred to argenx. In particular, personal data collected by the app are de-identified and aggregated by Vitaccess before any statistical analysis is performed. In addition, a Scientific Advisory Board has been established as an independent body to protect participants’ interests and provide advice on research-related requests to access the data in the study database. See further information about its controller status at section 2.
4.2. Scientific Advisory Board
The Scientific Advisory Board is an advisory body established to protect participants’ interests and provide advice on research-related requests to access data in the database. As part of these activities, the Scientific Advisory Board and its members may need to access and use participant data. Where this is needed, the Scientific Advisory Board will generally only access and use the de-identified and aggregated by Vitaccess data from the database, meaning that identifying information will be removed from that dataset. However, we will separately have access to a key which allows us to re-identify you if needed. If the Scientific Advisory Board needs to contact you personally, it would obtain independent ethics approval to do so.
4.3. Salus IRB and other accrediting agencies
Salus IRB is the body which has approved the study for the purposes of ethics requirements. You may contact them at: email@example.com, if you would like to speak with someone unrelated to the study, have questions, concerns, or complaints regarding the study, or have questions about your rights as a research participant. If you do so, Salus IRB will use your personal data to assist you with your query.
In addition, Salus IRB and/or (if authorized by argenx) other accrediting agencies may inspect any study findings and the procedures we have followed, which may contain your personal data (including your name or other identifying information). Accrediting agencies may investigate any issues relating to misconduct, deviations from the protocol, conflicts of interest, safety issues or adverse events.
4.4. Study Investigator
The Study Investigator is Dr Mark Larkin. His role is to ensure the study is conducted properly and completed within the agreed period. The scope of data shared with the Study Investigator will be determined by argenx – please contact argenx for further information. The Study Investigator will generally only access and use de-identified data.
4.5. Users of the research portal, publications and presentations
Aggregated and de-identified information arising from the study will be used to help researchers to understand what treatments works for MG and what does not, which will improve the treatments that are offered to patients in the future. Access to the research portal will be overseen by the Scientific Advisory Board.
These details may also be presented at conferences and published in peer-reviewed journals by argenx – please contact argenx for further information about this.
4.6. Your clinical team
We do not share your personal data with your physician or clinical team, though you may choose to share your personal data with them within the app.
4.7. Our technology service providers
Our technology service providers may handle your data. They act as sub-processors on behalf of argenx (but appointed by us), meaning that argenx remains primarily responsible for how they use your data, and we pass on our responsibilities as a processor to such providers within our agreements and arrangements with them. Our providers (as at the date of this notice) provide platforms on which we store your data, and assist us and argenx to analyze and pseudonymise your data.
4.8. Other participants
As part of some PCFs you may choose, using options within the app, to share some of your information with other participants in the study (see also section 3.3). The app may also make it easier for you to contact other participants by email or otherwise outside the app and Vitaccess's platform.
Please contact argenx or us if you have concerns about the use of your data by other participants. However, note that, while we require other users to respect your privacy and the sensitivity of your data within the terms of our app, we do not control how other participants choose to use your data.
We also do not control use of data by third party systems separate to our app and our platform (such as your email). We do not control the security of such systems, and cannot access or remove any personal data which you share or communicate using them.
4.9. Other parties
We may also share your data, where instructed or authorized by argenx, with legal authorities or regulatory bodies. For example, other accredited agencies investigating matters related to the appropriate conduct of this study.
We may share your data with other parties to the extent that you have consented to argenx or us doing so, or where we or argenx are otherwise required or permitted by law to do so.
argenx, as the controller, is responsible for determining any additional disclosures of your personal data, outside the scope of Vitaccess's involvement. You should contact argenx directly for more information about this – see contact details at section 10.
5. Consents and Legal Basis for Use of Your Data
In accordance with data protection laws, we are informing you of the legal basis for the collection, use and disclosure of your data, as described previously. The following apply to our activities.
We collect, use and disclose your information for the purposes of the study and the features of the app with your consent. The consents we seek (on behalf of argenx) include:
- Consent to argenx and us using your data to confirm your eligibility for the study and to register you for the app and the study – see section 3.1.
- Consent to use specific data types for the purposes of the study, which we obtain by giving you the option whether or not to complete certain fields – see section 3.2.
- Consent to use of your data from your profile, tracker, and surveys for the purposes of the study and for the data to be transferred to the de-identified database. We will also seek to refresh this consent regularly; generally approximately every six months. See section 3.2.
- Consent to use of your data to provide you with PCFs. We will also seek to refresh this consent regularly; generally approximately every six months. See section 3.3.
- Consent to us sending you communications about other studies. See section 3.4.
- Consent to your data being shared with Salus IRB, the Scientific Advisory Board and the Study Investigator, in accordance with section 4.
If you do not consent to your data being used for any specific activity (or withdraw any consent previously given) you may not be able to participate with that activity. So, for example:
- your participation in the study using our app relies on your consent to use of your eligibility and background information for this purpose, and to the sharing of data with other parties involved in the study; and
- your completion of the profile or tracker, or participation in any survey using our app relies on your consent to inclusion of your profile, tracker or survey information in the study database. However, some consents will not impact your ability to participate (though may affect your level of participation), including:
- communications from us about other studies.
5.2. Legitimate interests
We collect, use and retain data (including your name, contact details and communications with you), on behalf of argenx, which is necessary for argenx's legitimate interests in providing the study and the app, for example to manage and administer argenx's relationship with you, to check you are using the app and participating in the study appropriately, to maintain records of communications, and to assist argenx in protecting or enforcing its legal rights and complying with applicable laws.
Where Vitaccess, in limited circumstances, uses your personal data as a controller for our own business purposes (see section 3.6), this is within our legitimate interests in protecting our rights (including intellectual property rights) and managing our responsibilities in relation to the app and our technology, and in administering our technology and our relationship with argenx.
5.3. Legal obligation
We may (on behalf of argenx or directly, where required) collect, use or disclose personal data as is necessary to comply with a legal obligation, such as where law enforcement authorities require us or argenx to do so, or to address rights of individuals under data protection laws.
6. International Data Transfers
As the study is an international project, your data may be transferred to a different country to that in which you are located. This may include:
- transfers to argenx in Belgium;
- transfers to Salus IRB in the US; which is outside the European Economic Area. argenx is responsible for ensuring appropriate safeguards are in place to protect your data in relation to such transfers – please contact argenx for obtaining a copy of those appropriate safeguards;
- transfers to Vitaccess in the UK (which, at the date of this notice, is located within the European Union); and
- transfers to Vitaccess's technology providers, whose data systems may be located either within the US, the UK or the European Union. As at the date of this notice, this includes technology providers within the US who have self-certified with the EU-US Privacy Shield framework. Where other providers are based outside the UK or the European Union, we will check that safeguards are in place to protect your data to a similar standard as under UK and Belgian law.
7. Retaining Your Information
We will retain your personal data for as long as we are instructed by argenx to do so, for the relevant purposes specified previously. Further information about retention periods is available on request (see contact details for argenx and us at section 10).
If you are discontinued or withdraw from the study after we have collected information about you, no new study data about you will be collected by Vitaccess. However, all your data that have been collected to date will remain within the study database. If you prefer that your data be removed from the study database, Vitaccess can be contacted using the contact details at section 10. Note that your information may still form part of aggregated and de-identified datasets which have already been collated and used for research purposes.
We may also continue to maintain records relating to you (such as your name, contact details, communications with you, and information about how you used the app):
- for argenx's or our record-keeping purposes, including to comply with its or our legal obligations and to defend its or our legal rights; and
- where requested by argenx, to assist with app improvement and development.
8. Security of Your Data
You will be able to select a password to access your MyRealWorld MG account. We recommend you use a strong password of at least eight characters, including one upper and one lower case letter, and one number.
You are also advised to enable a password-protected screen lock from your device's Settings menu.
Your data entries within the app are encrypted before being sent to our systems (operated by us and our service providers – see section 4.7). Information within the study database is de-identified (see section 3.2).
If you would like any further information about our information security measures, please contact us or argenx using the contact details at section 10.
9. Your Legal Rights
In accordance with data protection laws, you have a right:
- to obtain a copy of the personal data we hold about you, together with other information about how we and argenx process it;
- to withdraw any consent which you have given relating to our use of your data;
- to request rectification of inaccurate or incomplete data, and, in some circumstances, to request that we erase or restrict our use of your data, or otherwise to object to the processing of your data for direct marketing purposes or for reasons relating to your particular situation;
- to receive a copy (in a machine-readable format) of personal data that you have provided to us) and to transmit those data to another controller without hindrance from argenx or Vitaccess to which the personal data have been provided (otherwise known as the “right to data portability”, to the extent it is processed electronically based on your consent (as described in section 5); and
- not to be subject to a decision based solely on automated processing, which significantly affects you, unless additional legal requirements are met.
Note that there are certain limitations and exemptions to these rights that may be applied depending on the circumstances.
Please contact argenx (see section 10) to make requests to exercise these rights (specifying what you are requesting), or if you would like further information about them.
10. Vitaccess and argenx Contact Details
- For general queries about the study:
- For data protection queries to argenx:
- Jiri Janousek — firstname.lastname@example.org
- For data protection queries to Vitaccess:
Data protection officer
2nd Floor Nucleus House
2 Lower Mortlake Road