Business Professionals

ICON plc. (“ICON”, “we”, “us”, “our”) is committed to protecting your privacy.

This privacy notice tells you what personal information we collect and how we collect it. It explains what we use your personal information for, why we use it, and how we protect your personal information. This notice also describes certain rights you have in respect of your personal information.

This notice is intended for healthcare professionals and business professionals.

In some cases, this notice will not apply to your circumstances, and we will provide you with a separate privacy notice instead. For example, this privacy notice does not apply to you:

(a) if you are a research participant, potential research participant or general user of our website (not acting in a professional capacity). Please see the General Privacy Notice instead.

(b) if you are a job applicant. Please see the Job Applicant Privacy Notice instead.

(c) if you are a user of the ICON Digital Platform app. The IDP Privacy Notice is available to you in the IDP Digital Platform instead.

(d) if you are a subscriber to, or an author of publications made available via, Mapi Research Trust services. Please see the MRT Privacy Notice instead.

(e) if you choose to participate in a medical research study that is taking place at one of ICON's clinics (also called a "study site"). If this is the case, we will provide you with a separate privacy notice as part of the Informed Consent Form, prior to you agreeing to take part in the study.

ICON is the "data controller" of your personal information for the purposes set out in this notice. This means we determine how your personal information is used and processed for the purposes described in "How do we use your personal information? section.

In circumstances where ICON acts on a third party's instructions (this means ICON is acting as a "data processor"), that third party is the data controller of your personal information, and their privacy notice will apply to you instead of this one.

Contact information and your privacy point of contact

You can submit questions or comments to our Global Data Protection Officer at Data_Privacy_Officer@iconplc.com.

You may also contact our Data Protection Officer by writing to us at: Global Data Protection Officer, ICON plc South County Business Park, Leopardstown, Dublin 18, D18 X5R3, Ireland.

To exercise your rights as outlined in the "What are your rights regarding your personal information?", please follow this link and complete the Data Subject Rights form.

Back to top

“Personal information” is any information relating to you which allows you to be identified directly or indirectly. Personal information can include a name, an email address, an identification number or any other details that are specific to you.

Depending on the purpose for using your personal information, we collect and process information from you, including:

(a) Basic information – your name, surname (including prefix or title), country or location, as well as your preferred language;

(b) Contact information – information that enables us to contact you, e.g. your email, mailing address, and telephone number;

(c) Professional information and experience – your employer name and occupation, your CV/resume, information related to your qualifications and academic achievements, areas of expertise, place of practice, professional registration number, photograph, and your interests (such as any specific topics about which you request information from ICON and our partners);

(d) Financial information – your bank account number, credit or debit card numbers and other financial and compensation details;

(e) Conflicts – circumstances which may create a conflict of interest – including whether you or a close family member are an officer or employee of a political party, candidate for public office or hold a position in government;

(f) Travel-related and other identification information – including your national ID number, passport number, driving licence number, tax identification number and travel preferences;

(g) Interactions and services – data related to your user accounts, your involvement and performance in connection with services you may provide to us, your use of our services, your interactions with us, and your preferred method of communications with us; and

(h) Technical and network activity information – information about your device and your usage of our websites, apps and systems, including your IP address, browser type, operating system, domain name, access times and referring website addresses.

We collect this information directly from you:

a) when you use our websites, apps and systems.

b) when you get in touch to provide information, for support or to provide feedback.

c) when you register with us to receive information from us, including information on ICON's services, webcasts, and updates.

d) when you register your interest in obtaining services, or in providing clinical trial investigator or related services to us or our clients and partners.

e) when you use our public hotline, EthicsLine, to report any concerns or questions.

f) as part of an interview or telephone call.

g) if you participate in a project that is managed by us on behalf of a client.

h) if you complete a feasibility or prequalification questionnaire for a study, or express your interest in participating in a study by completing an online questionnaire.

i) if you provide a curriculum vitae or other supporting documents for a study.

We collect and process information from third parties, including:

a) from publicly available sources, such as websites, directories and industry networks.

b) from our third party clinical research service providers.

c) from our clients that engage us to provide services.

You can choose not to give us personal information when we ask you for it. If you decide not to give us your personal information, it may restrict our relationship with you. For example, we may not be able to provide you with our services or respond to communications from you via our website.

If you provide any personal information relating to another person, you are responsible for ensuring that:

a) this person is made aware of the information in this notice; and

b) this person has given you their permission to you sharing their personal information with us.

Back to top

We use your personal information:

a) to provide you with information when you request it or when we believe our products and services may be of interest to you, including webcasts, updates and information on specific ICON services. If we intend to share electronic marketing with you, we will ask for your consent where required and you can opt out at any time.

b) to provide the products and services that you, your organisation or a third party have requested. Where ICON is supporting the delivery of a study which you are involved in, this includes to support, report on and manage study activities, including via our web-based tools.

c) to manage and develop our relationship with you, including to provide customer support services, and to manage our provision of products and services.

d) to manage our business, including to develop and plan for future business opportunities, to manage our internal resources, and to record and analyse our business activities.

e) to identify and authenticate your rights to access user accounts which are provide by or via ICON.

f) to store your details in our database of investigators; to assess your suitability to assist in clinical trials and research studies, and to provide services to ICON, our partners or our clients; and to contact you about this where appropriate. If you choose to be added to ICON’s investigator database, we will provide you with an additional, detailed privacy notice when you register.

g) if you are involved in a clinical trial, to monitor clinical operations during a clinical trial.

h) if you or your organisation provide (or may potentially provide) products or services to ICON:

(i) to assess the ability of you or your organisation to provide products and services to ICON.

(ii) to receive such products and services, review the quality of those products and services, and send and receive communications about those products and services.

(iii) to process payments and invoices.

(iv) to carry out projects, activities and services on behalf of ICON and its clients.

(v) to provide support services via our service desk.

(vi) to perform background checks.

(i) to recruit and communicate with you for market research projects and pay incentives for your participation.

(j) to manage our network and information systems security.

(k) to assess quality and compliance as part of ICON's internal quality and compliance programme, including to investigate reports of misconduct and risk.to respond to your queries and requests.

(l) to process, manage and respond to any questions or concerns you raise via ICON's EthicsLine.

(m) to protect the security of our websites and apps.

(n) to comply with our legal obligations. For example, we must comply with applicable laws against improper payments and interactions with third parties, and we may receive requests to disclose certain personal information from regulatory bodies like the US Financial Industry Regulatory Authority.

(o) to analyse trends and gather anonymised geographic statistics.

(p) to improve our products and services.

(q) to exercise or defend ICON against potential, threatened or actual litigation.

r) for the purposes of building/creating artificial intelligence/machine learning models for the purposes/processing listed in this section.

s) for the purpose of using artificial intelligence/machine learning models for the purposes/processing listed in this section.
 

We will not use your personal information for purposes that are incompatible with the above purposes, unless it is required or authorised by law.

Back to top

We may disclose personal information we collect about you to other parties. We will only do this for the purposes set out in "How do we use your personal information?" section. These third parties are:

(a) Third party service providers - We may share your personal information with our third party service providers that provide web hosting services, cloud storage services, clinical trial sites, laboratory services, concierge services, home health clinician services on our behalf, and other vendors involved in projects in which you are involved.

(b) Our business partners - We may share your personal information with our business partners for the purposes described above.

(c) Our clients - We may share your personal information with our clients, which include organisations involved in medical care, pharmaceuticals, medical devices and medical research.

(d) Clinical trial sites - We may share your personal information with the institution, clinic or hospital where a clinical trial is taking place.

(e) Regulatory bodies - We may share your personal information with regulatory and government bodies.

(f) Our affiliates and subsidiaries – We may share your personal information within our group of companies for the purposes described above.

(g) For legal, security and safety purposes - We may have to share your personal information in response to authorised requests of government authorities or where required by law.

(h) In connection with a corporate transaction - As part of any merger, sale, joint venture, transfer, or other disposal of all or any portion of our business (including as part of any bankruptcy or similar proceedings), we may transfer your personal information to other parties involved in these transactions. Under these circumstances, all parties will enter into a confidentiality agreement to protect personal information and must only use personal information for the purpose it was collected for in the first instance.

(i) With your consent - We may share your personal information with other third parties with your consent.

Back to top

We may need to transfer your personal information internationally including to/from the USA and elsewhere. We will only transfer your personal information for the purposes set out in "How do we use your personal information?" section.

We implement appropriate measures to protect your personal information when we transfer your personal information outside of your home country, such as data transfer agreements that incorporate standard data protection clauses. The data privacy laws in the countries we transfer it to may not be the same as the laws in your home country.

We will apply appropriate safeguards to such transfers as required by applicable law. For example, transfers from the European Economic Area ("EEA") to non-EEA countries will usually be governed by EU-approved Standard Contractual Clauses and will be subject to other appropriate security measures. If you are in the EEA, you can obtain a copy of these safeguards by emailing us using our contact details in "Contact information and your privacy point of contact" section.

Back to top

We decide for how long to keep your personal information by considering:

a) the length of our relationship with you, and whether we need to keep your personal information to respond to or process a question or request from you.

b) what is advisable in light of our legal position (due to statutes of limitations).

c) whether there is a requirement to keep your personal information for a period required by law.

d) whether we should keep your personal information in connection with legal action or an investigation involving ICON.

For example, we hold on to records of payments in accordance with the local laws where you are based.

We may collect information that is not personal information or convert personal information into information which can no longer be used to identify you (such as through aggregation or anonymisation). When we do this, we may use and disclose that information for any purpose, as anonymised data is not covered under data protection laws.

Back to top

We use a variety of security measures and technologies to help protect your personal information. We carefully choose our service providers, and check they have security measures and technologies in place to protect your personal information.

However, no physical or electronic security system is entirely secure. We cannot guarantee the complete security of transmissions over the internet, or of our databases. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us using our details at "Contact information and your privacy point of contact" section.

Back to top

Please see our Cookies Notice.

Back to top

Why are we allowed to collect and use your personal information?

We use your personal information only where required for specific purposes. The table below sets out the purposes for which we use your personal information and our legal reason for using your personal information in this way.

What are your rights regarding your personal information?

You have rights in respect of your personal information. The rights available to you depend on our reason for processing your personal information and the local law in your country, and there are exceptions to some rights. Depending on this, you may have:

a) The right to be informed – if we are processing your personal information, we must inform you of various details, including who is processing your personal information, why, how long we will retain it for, and if we are transferring the data to another country.

b) The right to withdraw consent – if we are processing your personal information on the basis of your consent, you can withdraw your consent to that processing at any time. If you withdraw your consent, this will not mean any processing we carried out prior to your withdrawal is invalid.
c) The right of access to your personal information – you can request a copy of the personal information we hold about you.

d) The right to rectification – you have the right to request that we correct any inaccuracies in the personal information we hold about you and complete any personal information where this is incomplete.

e) Right to erase your personal information (right to be forgotten) - you have the right to be forgotten in certain circumstances including, for example, where the personal information is no longer needed for the purpose for which it was collected. However, this right does not apply where, for example, processing is necessary to comply with a legal obligation, or for the establishment, exercise or defence of legal claims.

f) The right to restrict the processing of your personal information - you have the right to ask us to restrict certain processing activities in some circumstances, including, for example, where you challenge the accuracy of the information. Where processing has been restricted, we can only process it for limited purposes such as, for example, the establishment, exercise or defence of legal claims.

g) The right of data portability - you have the right to have your personal information returned to you or to a third party in certain cases.

h) The right to object – you have a right to object to the processing of your personal information in certain cases, for example, when we process your personal information based on our legitimate interest. In such a case we will stop processing your personal information unless we can show there are compelling legitimate grounds which override your interest.

To exercise these rights, please contact us using our contact details in "Contact information and privacy point of contact" section. We may request proof of identity, so we can verify who you are.

If you feel your data protection rights have been infringed by ICON, you may have the right to complain to your local data protection supervisory authority. A good resource for details on data protection authorities from around the world is kept at List of DPAs | pdpEcho.

Back to top

You have rights in respect of your personal information. The rights available to you depend on our reason for processing your personal information and the laws in your state, and there are exceptions to some rights. Depending on this, you may have the right to: 

• Obtain confirmation that we hold certain personal information relating to you and the corresponding processing activities, and to verify its content, origin, and accuracy;
• Access, review, port, delete or anonymize, or to block or withdraw consent to the processing of certain personal information (without affecting the lawfulness of processing based on consent before withdrawal of your consent); 
• Request information about third parties with whom we have shared your personal information; 
• Where relevant, request review of decisions based solely on automated data processing;
• Where relevant, object to our use of personal information for direct marketing and in certain other situations at any time. 

To exercise these rights, please contact us using our contact details in "Contact information and privacy point of contact" section. We may request proof of identity, so we can verify who you are.

Please note that we need to retain certain personal information as required or permitted by applicable law.

If you reside in California, we are required by California law to provide you with additional information about how we use and disclose your personal information, and you may have additional rights with regard to how we use your personal information. We have included this California-specific information below.

• Categories of Personal Information:

Consistent with What personal information do we collect about you? How do we collect it?, we may collect certain categories and specific pieces of information about California residents that are considered "personal information" under California law ("CA Personal Information").

• Sources of Personal Information:

The sources of your CA Personal Information are outlined in What personal information do we collect about you? How do we collect it?

• Uses of Personal Information:

The purposes for which we collect CA Personal Information are detailed in How do we use your personal information? with additional information below.

• Sale of Personal Information:

In the context of our Symphony Health business line, details of which can be found here, this section applies to physicians and other medical practitioners:

If you are a medical practitioner, we may collect your CA Personal Information from one of several sources or business partners. One of these business partners is the American Medical Association (AMA). ICON follows the contract requirements regarding the use of your CA Personal Information that we receive from the AMA. You can tell the AMA if you do not want your personal information to be released. When you tell the AMA to restrict the use of your personal information, and AMA gives this direction to ICON, ICON complies with the AMA’s direction. You can find the AMA’s privacy policy on its website, which is https://www.ama-assn.org/.

We may sell certain categories of your personal information to our clients in connection with our products and services. During the past twelve months, we may have sold the following categories of personal information about you to our clients:

• Identifiers including your name, postal address, telephone number, email address, and other similar identifiers
• Protected Characteristics
• Educational, Professional and Employment-related Information
• Inferences

You have the right to opt out of such sale of your information. Please see the ‘California Consumer Rights’ section below for more details.

• Sharing Personal Information:

The categories of third parties to whom we disclose your CA Personal Information for a business purpose are detailed in How do we share your personal information?[BJ4] 

• Retention of CA Personal Information:

We retain your CA Personal Information as detailed in How long do we keep your personal information?

California Consumer Rights

If you are a California resident, you have rights in respect of your CA Personal Information, and there are exceptions to some rights. Depending on this, if you are a California resident, you may exercise the following rights:

• Right to Know. You have the right to request information about the categories of CA Personal Information we have collected about you, the categories of sources from which we collected the CA Personal Information, the purposes for collecting the CA Personal Information, the categories of third parties with whom we have shared your CA Personal Information, and the purpose for which we shared your CA Personal Information. You may also request information about the specific pieces of CA Personal Information we have collected about you. You also have a right to receive information about the CA Personal Information about you that we have "sold" to or “shared” (as such terms are defined under California law) with third parties within the past 12 months.
• Right to Delete. You have the right to request that we delete CA Personal Information that we have collected from you.
• Right to Correction. You have the right to obtain correction of your CA Personal Information. 
• Right to Transfer. You have the right to request a transfer of your CA Personal Information to another entity to the extent technically feasible, in a structured, commonly used, machine-readable format.
• Limit the Use of Sensitive Personal Information. You have the right to limit the use and disclosure of your sensitive CA Personal Information. 
• Right to Opt Out. You have the right to opt out of the sale and / or sharing of your CA Personal Information. You also have the right to opt-out of being subject to automated decision-making processes, including profiling. 

You may submit a request to exercise your Californian privacy rights by following this link and completing the Data Subject Rights Form or using our contact details in the "Contact information and privacy point of contact" section or by calling our toll-free number (877-202-0559). We will not discriminate against you, in any manner prohibited by applicable law, for exercising these rights.

Verification. In order to exercise your rights, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. When making a request, please provide the following information: first and last name; email address; and type of request you are making.

Authorized Agents. If you choose an authorized agent to make a request on your behalf, they must provide appropriate documentation including written signed permission from you, proof of your identity, and verification of their identity; or a valid, designated power of attorney as defined under the California Probate Code.

Timing. We will respond to requests to delete and requests to know within 45 calendar days, unless we need more time. If this is the case, we will notify you and may take up to 90 calendar days in total to respond to your request.

ICON may make changes to this Privacy Notice. For instance, we may need to amend this Privacy Notice if there are changes to relevant laws.

Where we have your contact details, we will notify you of any significant changes.

Back to top

Revised 06-27-2024