Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

MediOra Health
Owner and operator: André Salm
Sole proprietorship (Einzelunternehmen)
Fliederstraße 9
66578 Schiffweiler
Germany
Email: business@mediorahealth.com
Website: https://mediorahealth.com

André Salm is the controller within the meaning of Art. 4(7) GDPR.

2. Scope of This Privacy Policy

This Privacy Policy explains how personal data is processed when users visit the main MediOra Health website at mediorahealth.com or contact MediOra Health through this website.

The main website is intended primarily for professional and business audiences, including:

• pharmaceutical companies;
• biotechnology companies;
• contract research organizations;
• clinical research sites;
• clinical trial matching platforms;
• research partners; and
• service providers.

The main website is not intended for patient recruitment, medical screening or the submission of patient health data.

Patient recruitment landing pages, study questionnaires, PatientOrbit and other patient-facing or study-specific systems are subject to separate privacy information appropriate to the respective service, study and processing arrangement.

3. General Legal Bases

MediOra Health processes personal data only where a lawful basis exists.

Depending on the context, processing may be based on:

• Art. 6(1)(a) GDPR, where the data subject has given consent;
• Art. 6(1)(b) GDPR, where processing is necessary to perform a contract or take steps at the request of the data subject before entering into a contract;
• Art. 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation; or
• Art. 6(1)(f) GDPR, where processing is necessary for the legitimate interests of MediOra Health or a third party and those interests are not overridden by the rights and freedoms of the data subject.

Where cookies or similar technologies require consent, they are used only on the basis of the applicable consent requirements. Technologies that are strictly necessary for providing the website or a service expressly requested by the user may be used without consent where permitted by law.

4. Website Hosting

When the website is accessed, the hosting infrastructure may process technical connection and server data, including:

• IP address;
• date and time of access;
• requested URL and files;
• referring URL;
• browser type and version;
• operating system;
• device information;
• server response status; and
• transmitted data volume.

The processing is necessary to deliver the website, maintain system stability, detect technical errors, prevent misuse and protect the website against attacks.

The legal basis is Art. 6(1)(f) GDPR. MediOra Health has a legitimate interest in the secure, stable and efficient operation of its website.

5. Server Log Files

The hosting infrastructure automatically generates server log files when the website is accessed.

Server log files may contain:

• IP address;
• date and time of access;
• requested page or file;
• browser and operating-system information;
• referring URL;
• server response code; and
• technical error information.

Server log data is processed to provide the website, analyze technical problems, identify security incidents and prevent misuse.

The legal basis is Art. 6(1)(f) GDPR.

6. Contact by Email and Other Business Communication

When a person contacts MediOra Health by email, telephone or another professional communication channel, MediOra Health processes the information provided in order to respond to the inquiry and manage the related communication.

The processed data may include:

• name;
• company or organization;
• professional role;
• email address;
• telephone number;
• message content;
• study or project information; and
• other information voluntarily provided.

Where the inquiry concerns a possible contract or business relationship, the legal basis is Art. 6(1)(b) GDPR.

For other professional inquiries, the legal basis is Art. 6(1)(f) GDPR. MediOra Health has a legitimate interest in responding to business communications and maintaining professional relationships.

Where processing is expressly based on consent, the legal basis is Art. 6(1)(a) GDPR.

7. Contact Form

The contact page provides a form through which professional users can submit recruitment and business inquiries.

Depending on the information entered, the following data may be processed:

• organization or company name;
• first and last name;
• business email address;
• organization type;
• recruitment type;
• therapeutic area or indication;
• description of recruitment requirements;
• information about how the user first heard about MediOra Health;
• additional information concerning the stated lead source;
• consent or acknowledgment information;
• date and time of submission; and
• technical information required to transmit and protect the form.

The information is used to review and respond to the inquiry, assess whether MediOra Health may be able to provide relevant services and manage subsequent professional communication.

The legal bases are Art. 6(1)(b) GDPR for pre-contractual inquiries and Art. 6(1)(f) GDPR for other business communications. Where the processing is expressly based on consent, the legal basis is Art. 6(1)(a) GDPR.

Form submissions are retained only for as long as necessary to process and follow up on the inquiry. Information may be retained for a longer period where this is necessary to establish, exercise or defend legal claims, manage an ongoing business relationship or comply with statutory retention obligations.

Users should not submit patient health data, medical records or information about identifiable patients through the general business contact form.

Where a provider processes personal data on behalf of MediOra Health, an agreement pursuant to Art. 28 GDPR is concluded where required.

Personal data collected through the website is not sold.

Some service providers or their affiliated companies may process personal data outside the European Union or European Economic Area.

Where personal data is transferred to a country for which the European Commission has adopted an adequacy decision, the transfer may be based on that decision.

Where no adequacy decision applies, appropriate safeguards may include:

• the European Commission’s Standard Contractual Clauses;
• supplementary contractual, technical or organizational safeguards; or
• another transfer mechanism permitted under Chapter V GDPR.

For transfers to participating organizations in the United States, processing may also be based on the EU-U.S. Data Privacy Framework where the relevant recipient is certified.

MediOra Health retains personal data only for as long as necessary for the purpose for which it was collected.

The applicable retention period depends on the nature of the data and processing. In particular:

• contact and inquiry data is retained while the inquiry is being processed and for an appropriate follow-up period;
• information concerning an ongoing business relationship is retained for the duration of that relationship;
• contract, accounting and tax-related information is retained in accordance with applicable statutory retention obligations;

Data may be retained for a longer period where necessary to comply with legal obligations or establish, exercise or defend legal claims.

Once the relevant purpose and applicable retention obligations cease to apply, personal data is deleted or anonymized.

Subject to the applicable legal requirements, data subjects have the following rights:

• right of access under Art. 15 GDPR;
• right to rectification under Art. 16 GDPR;
• right to erasure under Art. 17 GDPR;
• right to restriction of processing under Art. 18 GDPR;
• right to data portability under Art. 20 GDPR;
• right to object under Art. 21 GDPR; and
• right to withdraw consent at any time with effect for the future under Art. 7(3) GDPR.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, the data subject may object to the processing on grounds relating to their particular situation. Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time.

To exercise these rights, contact: business@mediorahealth.com

Data subjects have the right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR.

The supervisory authority responsible for MediOra Health is:

Independent Data Protection Centre Saarland (Unabhängiges Datenschutzzentrum Saarland)
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Website: https://www.datenschutz.saarland.de

Data subjects may also contact another competent supervisory authority, particularly in the EU Member State of their habitual residence, place of work or the place of the alleged infringement.

MediOra Health implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access.

Measures may include:

• encrypted transmission through HTTPS;
• access controls;
• secure account credentials;
• software and security updates;
• backups;
• restriction of access according to operational requirements; and
• technical monitoring and protection against misuse.

No internet-based transmission or storage system can guarantee absolute security.

The main MediOra Health website does not use automated decision-making that produces legal effects or similarly significantly affects users within the meaning of Art. 22 GDPR.

The website does not perform patient eligibility decisions, medical screening or automated clinical decision-making.

This website may contain links to external websites and services. MediOra Health does not control the data processing performed by the operators of those external websites.

When users follow an external link, the privacy policy of the respective provider applies.

MediOra Health may update this Privacy Policy where legal requirements, website functionality, service providers or processing activities change.

The version published on this website at the time of use is the current version.