Patient Advocate Privacy Notice

Who we are and what we do

Lightning Health is a market access consultancy providing market research services to the life sciences sector.

Our Head Office is 8 Devonshire Square, London, EC2M 4PL

Our registered office is 12 Tentercroft Street, Lincolnshire, LN5 7DB

Our UK Companies House Company Registration number is: 11063972

Our ICO Registration Number is: ZA373665

Our website is: https://www.lightning.health

Our email address is: enquiries@lightning.health

Our contact number is: +44(0) 203 488 9438

This privacy notice is set out to ensure that we meet our transparency obligations under General Data Protection Regulation (GDPR) across the EEA, the UK GDPR and US Privacy law in the states of California (Californian Privacy Rights Act), Colorado (The Colorado Privacy Act), Virginia (Consumer Data Protection Act), Connecticut (Act Concerning Personal Data Privacy and Online Marketing), Utah (Consumer Privacy Act) and Iowa (Act Relating to Consumer Data Protection).

Lightning Health is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with Data Protection Legislation.

This privacy notice applies to individuals living with a health condition, or individuals that represent patients through a patient advocacy group – we term these individuals patient advocates. This notice is applicable to patient advocates that we may reach out to, to take part in research for the life sciences sector, and who have agreed to participate in research.

Types of personal information we collect and our Lawful Basis for processing

Recruitment of Patient Advocates to take part in research

We collect information from a variety of sources on the internet, these are known as open data sources. We use the following open data sources: LinkedIn, patient advocacy group websites, other websites. We collect data such as your name and email address from such sources. Lawful Basis: Legitimate Interest

Market Research involving Patient Advocates

Once you have agreed to take part in research for Lightning Health, we will need to process personal information about you and a limited amount of information about your health condition, this is so we can match your condition to the requirements of each research project. We also need to process this information so that we can renumerate you (where applicable) for taking part in the research projects and manage this contractual relationship to comply with legal obligations to which we are subject. This includes:

• Your basic contact information, including your name, telephone numbers (home, mobile, work) and email address, so we can contact you and enrol you in the specific market research projects. Lawful Basis: Contract & Legal Obligation
• Limited information about your health condition, such as the length of time you have experienced your condition for, your symptoms, or medication. This is so we can ensure you meet the requirements to be included as a Patient Advocate for the purposes of the specific market research project. Lawful Basis: Consent & Explicit Consent
• If you take part in a one-to-one interview, we will have an audio and video recording of that interview. The purpose of this is to ensure we have an accurate record of the interview. Lawful Basis: Consent & Explicit Consent
• Your bank details, telephone number, address, date of birth and financial details for renumeration purposes following participation in research projects or advisory boards. Lawful Basis: Contract & Legal Obligation
• Information collected for travel and expenses purposes, such as credit card, bank details, driving licence and insurance details, passport number so we can book flights, booking and itinerary details and travel preferences, if you take part in a face-to-face advisory panel. Lawful Basis: Contract

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your research participation with us.

Your rights

EEA and UK Rights

You have the following rights over your data:

• Request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it
• Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing
• Object to processing of your personal information where we are relying on a legitimate interest and there is something about your situation which makes you want to object to processing on this ground
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you

If you would like to exercise any of these rights and are a UK or EEA based resident; 

• UK Resident please contact our Data Protection Officer at dpo@lightning.health. 

• EEA Residents please contact IT Governance Europe Limited, our EU Representative at eurep@itgovernance.eu. 

US Privacy Rights

If you live in California, Colorado, Connecticut, Iowa, Utah, or Virginia, you have the following rights over your consumer data: (Please note the definition of consumer data varies from state to state and while the personal data of Research Participants resident in California would be considered consumer data other states will be considered on a case-by-case basis)

• Right to Know/ Access. You have the right to request information on the personal information we collected about you in the last 12 months, including the categories of personal information, the categories of sources from which your personal information was collected from, the business or commercial purpose for collecting, selling, or sharing your personal information, the categories of third parties to whom we disclosed your personal information to, and the specific pieces of personal information we have collected about you
• Right to Delete. (Excluding Utah) You have the right to request that we delete Personal Data that we have collected from you, subject to certain exceptions
• Right to Correct. (Excluding Iowa and Utah) You have a right to request that we correct inaccurate Personal Data that we maintain on you
• Right to Opt Out. (Excluding Iowa) You have the right to opt out of the sale of your Personal Data. However please note that we do not sell your Personal Data
• Right to No Discrimination. You have the right to not receive discriminatory treatment by us for the exercise of your privacy rights. This includes employee, applicant, or independent contractor rights to not to be retaliated against for the exercise of your privacy rights. We will not discriminate against you, in any manner prohibited by applicable law, for exercising these rights

In addition, the following states have privacy laws which come into force at various points in 2024 Texas, Florida, Oregon & Montana, Tennessee which comes into force in 2025 and Indiana which comes into force in 2026. When their laws become fully effective many of the above rights may also apply.

If you would like to exercise any of these rights, please contact our Data Protection Officer by email: dpo@lightning.health, or by writing to us at Lightning Health, 8 Devonshire Square, London, EC2M 4PL or by calling on +44(0) 203 488 9438.

Who we share your personal information with

For the most part when you participate in research for Lightning Health it will be in online surveys and one to one interviews. To ensure that the research is blinded and to avoid bias, our client will get basic details on research participants areas of expertise and experience only. This is not directly identifiable data.

If you agree to take part in a face to face or virtual interview then on occasions an anonymised transcript of the interview may be shared with our client commissioning the particular market research.

In some circumstances we will share interview recordings with our client.  We will only do this where we have your explicit consent to do this.

Lightning Health relies on third-party service providers and vendors that provide products and services. These include accountants, law firms and legal service providers, financial professionals, IT providers, payment processors such as Microsoft Azure, Browser, AWS, Wise (International money transfers) and Scoro.

Our third-party service providers may have access to your personal information to perform certain functions or may host your personal information as part of a “cloud based” solution used by employees. Lightning Health only uses third-party service providers that ensure sufficient guarantees for the protection of your Personal Data. All suppliers are to undergo a supplier risk assessment. Lightning Health requires third-party service providers by contract to implement appropriate data security and confidentiality obligations, in accordance with applicable law.

Our third-party providers may change over time, but we will notify you in the event of any change. If you would like further details, or to object to us sharing your data for these purposes, please notify us at dpo@lightning.health and we will provide you with detailed information and respond to your request.

As required by law, in the event of our business being involved in a sale, merger, reorganisation, dissolution or disposal, we would inform you of any such transfer.

We do not sell Research Participant’s data.

Transferring Information outside the UK & EEA

Data Protection Laws prohibits the transfer of Personal Data belonging to European Union (EU) residents outside of the European Economic Area (EEA), unless there are appropriate safeguards in place to guarantee the security of that data.

Where we use third-party service providers outside of the EEA or Switzerland, we will ensure that these organisations provide sufficient guarantees to implement appropriate technical and organisational measures for the protection of Personal Data.

We would seek to use third-party service providers based in a country which has received an adequacy decision from the European Commission or UK equivalent or is a member of the EU/ US Data Privacy Framework.

Or

We require that third-party service providers execute the relevant Standard Contractual Clauses, Binding Corporate rules or adhere to any certification procedures issued by the European Commission or UK equivalent for transfer of personal data to a third country and undertake a transfer impact assessment to identify any supplementary measures required to safeguard your personal data.

If you require further information about these protective measures, you can request it from our DPO. dpo@lightning.health.

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Financial records

We need to keep records of payments made to you for a period of six years to comply with accountancy, audit and tax regulations which apply to us.

Research Records

We keep directly identifiable information gathered during your participation in market research projects for two years, after which time any directly identifiable information will be anonymised.

Video and audio recordings of your interviews will be kept for two years.

Details of retention periods for different aspects of your personal information are available from our DPO dpo@lightning.health.

Complaints or queries

Lightning Health always tries to meet the highest standards when collecting and using personal information and we welcome feedback about this privacy notice or any other data protection issues or concerns. Please in the first instance contact out Data Protection Officer, Melissa Ashdown at dpo@lightning.health with any feedback, comments, concerns, or complaints.

UK Residents: If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office in their capacity as the statutory body which oversees data protection law in the UK, www.ico.org.uk/concerns.

EEA Residents: If you want to make a complaint about the way we have processed your personal information, you can contact the Irish Data Protection Commission Homepage | Data Protection Commission.