DSG Inc. Privacy Policy

Updated January 19, 2024

Purpose

DSG, Inc. (“DSG”) is committed to protecting your privacy. We value your trust and make it a high priority to ensure the security and confidentiality of the personal information you provide to us. This Privacy Policy describes the main types of personal information we may have access to and process within the organization, how we collect, use, disclose and otherwise process personal information in connection with our websites, and other services, and explains the rights and choices available to individuals with respect to their information.

This notice applies to all Personal Data of clients, clinical trial participants, health care professionals, vendors, job applicants, employees, contractors, former employees, and visitors to our website (such as cookies and internet tags) which is provided to, or collected and processed by DSG.

If you are a resident of certain states in the United States, this Policy also incorporates our Supplemental Privacy Notice for US Residents, which includes additional information required to be provided under certain state laws.

DSG complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. DSG has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. DPF. DSG has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov.

This notice may occasionally be updated. When material updates are made, the date of the last revision will be reflected at the end of the page.

Data Protection Principles

Processes Personal Data fairly, lawfully, and in a transparent manner.
Collects Personal Data only for specified, explicit and legitimate purposes.
Processes Personal Data only where it is adequate, relevant and limited to what is necessary for the purposes of Processing.
Keeps accurate Personal Data and takes all reasonable steps to ensure that inaccurate Personal Data is rectified or deleted without delay.
Keeps Personal Data only for the period necessary for Processing.
Adopts appropriate measures to make sure that Personal Data is secure, and protected against unauthorized or unlawful Processing, and accidental loss, destruction or damage. DSG takes responsibility for how it acquires, processes, and disposes of Personal Data, and for ensuring compliance with the above principles.

DSG takes responsibility for how it acquires, processes, and disposes of Personal Data, and for ensuring compliance with the above principles.

Information collected

Below is a high-level summary of the types of Personal Data we may collect from you. Following that high-level summary is additional detail and information on how we collect, process and use your Personal Data.

DSG does not knowingly collect, maintain, disclose, or otherwise process Personal Data from minors below the age of 16 without the permission of such minor’s parents or legal guardians.

DSG may process Personal Data as a data controller or as a data processor (or sub-processor). When DSG processes the Personal Data as a data processor (or a sub-processor), DSG (a) will only process the Personal Data in accordance with the applicable laws, rules, regulations, and as specifically directed by the data controller; (b) and will use the Personal Data only to the extent necessary to provide the services.

Visitors to our websites and physical locations, and senders of inquiries

We may process your Personal Data when you (1) visit our websites or our physical locations; (2) submit inquiries to us online or offline; (3) sign up for our newsletters or other informational or marketing materials.

Examples of the types of data we process:

Identity and contact information, such as:	first and last name email address postal address phone number
Visual and audio information, such as:	still images video (including via CCTV) recordings of your calls
Technical Information, such as:	Internet Protocol (IP) address browser type and browser language device type Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving our website activity on our website and referring websites or applications data collected from cookies or other similar technologies
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified, and the information is no longer considered Personal Data under data protection laws.

Where do we get the data?

We may get the Personal Data (1) directly from you; (2) from the devices you use; (3) our security systems (CCTV); (4) third parties.

Why do we process the data?

to provide you with access to our website and to our services
to communicate with you
to send you updates
to customize content for you
to detect security incidents
to protect against malicious or illegal activity
to ensure the appropriate use of our website
to improve our services
for short-term, transient use
for administrative purposes
for marketing, internal research, and development
for quality assurance

DSG’s role in the data processing:

DSG is the entity responsible for the collection and use of your Personal Data (known in some jurisdictions as the “data controller”)

The legal basis of processing:

for the purposes of our legitimate interests
in circumstances where we have requested and received consent
for other purposes that may be required or allowed by law

Who receives the data?

The legal basis of processing:

DSG, our affiliates, subsidiaries, and related companies
vendors that assist us in providing our services or help us improve our marketing or administration

Clinical trial participants and candidates

We may process your Personal Data when you participate or intend to participate in a clinical trial or you are a caregiver of a patient who participates in a clinical trial that is sponsored by one of our customers. DSG provides software and various other services to clinical trial sponsors and CROs (Contract Research Organizations). Under such circumstances, DSG is the data processor, and the clinical trial sponsor is the data controller. If you are a participant in a clinical trial, you receive a separate privacy notice from the data controller, which describes how your Personal Data is processed in the clinical trial.

Examples of the types of data we process:

Depending on the services DSG provides to the data controller, DSG may process the following types of data:

Identity and contact information, such as:	first and last name patient ID email address postal address phone number signature
Other personal information, such as:	age gender initials date of birth username password
Visual and audio information, such as:	still images video or audio recordings
Technical Information, such as:	Internet Protocol (IP) address browser type and browser language device type and/or device ID, if the device is provided by DSG activity on our website or applications data collected form cookies or other similar technologies
Health information	diseases study visit dates medical history and treatment information responses to questionnaires/e-diaries
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified, and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

We may get your Personal Data (1) directly from you; (2) from the devices you use; (3) from your caregiver; (4) from health care professionals.

Why do we process the data?

to send you your login credentials
to provide the software/services to you and to our customers
to send you reminder messages
to determine your eligibility to participate in the clinical trial
to identify and authenticate you
to detect security incidents
to protect against malicious or illegal activity
to ensure the appropriate use of our software
to improve our software and services
for short-term, transient use
for administrative purposes
for quality assurance
for troubleshooting

DSG’s role in the data processing:

DSG processes the Personal Data on behalf of the study sponsor as a data processor. The study sponsor is the data controller of the Personal Data.

The legal basis of processing:

As determined by the data controller.

Who receives the data?

DSG, our affiliates, subsidiaries, and related companies
our customers (the data controller who sponsors the clinical trial)
Health care professionals (members of the study team)
vendors that assist us in providing our Services
The device manufacturers or OS providers have no access to Personal Data.

Health care professionals

We may process your Personal Data if you work at a research site and participate in a clinical trial that is or has been sponsored by one of our customers.

Examples of the types of data we process:

Depending on the services DSG provides to the data controller, DSG may process the following types of data:

Identity and contact information, such as:	first and last name email address postal address phone number
Other personal information, such as:	username password
Visual and audio information, such as:	video or audio recordings
Technical Information, such as:	Internet Protocol (IP) address browser type and browser language device type and/or device ID, if the device is provided by DSG activity on our website or applications data collected from cookies or other similar technologies
Professional and educational information	job title or position employer work skills employment history degrees and certifications clinical trial experience specialized trainings and training records performance metrics
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

We may get the Personal Data (1) directly from you; (2) from the devices you use; (3) from our customers; (4) data may be generated based on your interaction with DSG.

Why do we process the data?

to send you your login credentials
to provide the software/services to you and to our customers
to send you reminder messages
to communicate with you
to provide you training
to identify and authenticate you
to detect security incidents
to protect against malicious or illegal activity
to ensure the appropriate use of our software
to improve our software and services
for short-term, transient use
for administrative purposes
for quality assurance
for marketing, internal research and product development
to assess your eligibility to participate in clinical trials
to recommend you to clinical trial sponsors
for troubleshooting

DSG’s role in the data processing:

When DSG provides services to a sponsor of a clinical trial or Contract Research Organization (CRO), DSG processes the Personal Data on behalf of the study sponsor as a data processor. The study sponsor is the data controller of the Personal Data

The legal basis of processing:

As determined by the data controller
for the purposes of our legitimate interests
for other purposes that may be required or allowed by law
your consent that you provided to the study sponsor/CRO or directly to DSG

Who receives the data?

DSG, our affiliates, subsidiaries, and related companies
our customers
Health care professionals (members of the study team)
vendors that assist us in providing our Services
The device manufacturers or OS providers have no access to Personal Data

Employees, contractors or candidates

We may process your Personal Data if you apply for a position at DSG or if you are an employee or a contractor at DSG. If you are an employee or a contractor, please visit the separate privacy notice that was provided to you for further information on how we process your Personal Data.

Examples of the types of data we process:

Identity and contact information, such as:	first and last name email address postal address phone number
Other personal information, such as:	age gender date of birth marital status, dependents
Visual and audio information, such as:	still images video (including via CCTV) recordings of your calls
Technical Information, such as:	Internet Protocol (IP) address browser type and browser language device type and/or device ID, if the device is provided by DSG activity on our website or applications data collected from cookies or other similar technologies geolocation
Professional and educational information	job title or position employer work skills employment history degrees and certifications clinical trial experience specialized trainings and training records performance metrics
Health information	disability maternity, parental leave sick leave
Commercial and financial information	bank account information tax information salary
Professional and educational information	job title or position employer work skills employment history degrees and certifications training records performance metrics
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified, and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

We may get the Personal Data (1) directly from you; (2) from the devices you use; (3) from third parties (e.g. background checks); (4) data may be generated based on your interaction with DSG.

Why do we process the data?

to communicate with you
to provide you training
to identify and authenticate you
to detect security incidents
to protect against malicious or illegal activity
to ensure the appropriate use and operation of our software and services
to improve our software and services
for short-term, transient use
for administrative purposes
for quality assurance
for marketing, internal research and product development
to assess your eligibility for a position
to evaluate your performance
to perform other employment related tasks

DSG’s role in the data processing:

DSG is the entity responsible for the collection and use of your Personal Data (known in some jurisdictions as the “data controller”).

The legal basis of processing:

for the purposes of our legitimate interests
for other purposes that may be required or allowed by law
to comply with legal obligations
in preparation for or to perform a contract
your consent that you provided to DSG

Who receives the data?

DSG, our affiliates, subsidiaries, and related companies
our customers
vendors that assist us in providing our Services
public and governmental authorities, to the extent required by law

Customers (Sponsors and CROs)

We may process your Personal Data if work at one of our customers (sponsors and CROs) and interact with DSG and/or access our software.

Examples of the types of data we process:

Identity and contact information, such as:	first and last name email address postal address phone number
Other personal information, such as:	username password job title employer
Technical Information, such as:	Internet Protocol (IP) address browser type and browser language device type and/or device ID, if the device is provided by DSG activity on our website or applications data collected from cookies or other similar technologies
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified, and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

We may get the Personal Data (1) directly from you; (2) from the devices you use; (3) from your employer.

Why do we process the data?

to send you your login credentials
to provide the software/services to you or to your employer
to communicate with you
to identify and authenticate you
to detect security incidents
to protect against malicious or illegal activity
to ensure the appropriate use of our software
to improve our software and services
for short-term, transient use
for administrative purposes
for quality assurance
for marketing, internal research and product development
for troubleshooting

DSG’s role in the data processing:

DSG processes the Personal Data as a data controller for the following purposes:

for marketing, internal research and product development
for administrative purposes
for quality assurance

The legal basis of processing:

as determined by the data controller
for the purposes of our legitimate interests
for other purposes that may be required or allowed by law
to comply with a legal requirement
in preparation for or to perform a contract
your consent

Who receives the data?

DSG, our affiliates, subsidiaries, and related companies
vendors that assist us in providing our Services
The device manufacturers or OS providers have no access to Personal Data

Vendors

We may process your Personal Data if you provide any services to DSG.

Examples of the types of data we process:

Depending on the services you provide to DSG, DSG may process the following types of data:

Identity and contact information, such as:	first and last name email address postal address phone number
Technical Information, such as:	Internet Protocol (IP) address browser type and browser language device type and/or device ID, if the device is provided by DSG activity on our website or applications data collected from cookies or other similar technologies
Commercial information	bank account information tax information, including tax number
Professional and educational information	job title or position employer work skills degrees and certifications specialized trainings and training records performance metrics
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified, and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

We may get the Personal Data (1) directly from you; (2) from the devices you use; (3) from third parties; (4) data may be generated based on your interaction with DSG.

Why do we process the data?

to provide the software/services to our customers
to communicate with you
to provide you training
to identify and authenticate you
to detect security incidents
to protect against malicious or illegal activity
to ensure the appropriate use of our software
to improve our software and services
for short-term, transient use
for administrative purposes
for quality assurance
for marketing, internal research and product development
for vendor assessment and qualification

DSG’s role in the data processing:

DSG is the entity responsible for the collection and use of your Personal Data (known in some jurisdictions as the “data controller”).

The legal basis of processing:

for marketing, internal research and product development
for administrative purposes
for quality assurance

The legal basis of processing:

for the purposes of our legitimate interests
for other purposes that may be required or allowed by law
your consent
to comply with a legal requirement
in preparation for or to perform a contract

Who receives the data?

DSG, our affiliates, subsidiaries, and related companies
our customers
other vendors that assist us in providing our Services

Attendees at events

We may process your Personal Data if you attend professional events we sponsor or hold.

Examples of the types of data we process:

Identity and contact information, such as:	first and last name email address postal address phone number
Visual or audio information, such as:	still images video (CCTV)
Professional and educational information	job title employer employment history certifications and education responses to questionnaires
Anonymized / de-identified data	Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified, and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

We may get the Personal Data (1) directly from you; (2) from our business partners; (3) from your employer.

Why do we process the data?

to communicate with you
to identify and authenticate you
to detect security incidents
to protect against malicious or illegal activity
to improve our software and services
for short-term, transient use
for administrative purposes
for quality assurance
for marketing, internal research and product development

DSG’s role in the data processing:

DSG is the entity responsible for the collection and use of your Personal Data (known in some jurisdictions as the “data controller”).

The legal basis of processing:

for the purposes of our legitimate interests
for other purposes that may be required or allowed by law
in preparation for or to perform a contract
to comply with a legal requirement
your consent

Who receives the data?

DSG, our affiliates, subsidiaries, and related companies
Other event attendees
vendors that assist us in providing our Services

How we share Personal Data?

In addition to the third parties described under each category in the above section, we may share Personal Data with the following categories of third parties to accomplish the purposes set out above and for the additional purposes set forth below.

To Protect Our Legal Rights or Comply with Legal Requirements. We may disclose Personal Data (1) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements or in response to subpoenas, court orders, or other legal or regulatory process; (2) to establish or exercise our legal rights; (3) to defend against legal claims; or (4) to protect your safety or the safety of others, or (5) to investigate fraud, or (6) as otherwise required by law.
Sale or Transfer of Corporate Assets. In the event of a merger, sale, joint venture or other transaction involving a transfer of our business or assets, we may transfer your information to other parties involved in the transaction. Any entity acquiring our data assets will do so with the express, written commitment to use the data only for authorized purposes, and to maintain a similar level of privacy and information security protection. You will be notified via email or notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.
With Your Consent. We may disclose your personal information to other third parties with your prior opt-in consent.

Our accountability for personal information that we receive under the DPF Principles and subsequently transferred to a third party is described in the DPF Principles. In the context of an onward transfer, we have responsibility for the processing of personal information we receive under the DPF Principles and subsequently transfer to a third party acting as an agent on our behalf. We remain liable under the principles if a third party that we engage to process personal information on our behalf does so in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Individual Rights

You may have a right under your jurisdiction’s data protection law to the following rights with respect to some or all of your Personal Data:

To request access to your Personal Data (including under GDPR Article 15);
To request that we rectify or erase your Personal Data (including under GDPR Articles 16 and 17);
To request that we restrict or block the processing of your Personal Data (including under GDPR Articles 18, 21 and 22 and to object to the sale or sharing of your Personal Data under other relevant laws);
To provide your Personal Data directly to another organization, i.e., a right to data portability (including under GDPR Article 20);
When we previously obtained your consent, to withdraw consent to processing (including under GDPR Article 21); and
To lodge a complaint with the data protection authority in your area.

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. We may, after receiving your request, require additional information from you to honor the request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.

When we receive your Personal Data from our customers and process your Personal Data on their behalf, we do so in the capacity of a data processor. In such cases DSG may need to contact the data controller and follow the data controller’s instructions.

To exercise these rights, please use DSG’s contact page https://www.dsg-us.com/contact-dsg.html, email to dataprivacy@dsg-us.com or contact a DSG HR representative, as the case may be.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, DSG commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact us at the email address or at DSG’s contact page as described above. DSG commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs), and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

Under certain conditions EU, UK or Swiss individuals may have the possibility to invoke binding arbitration for complaints regarding Data Privacy Framework compliance (EU-U.S. DPF, and the UK Extension to the EU-U.S. DPF and/or Swiss-U.S. DPF) not resolved by any of the other DPF mechanisms - see the following link for additional information - https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2

Data Security

We want you to feel confident about using our website and services, and we are committed to protecting the personal information we collect. As part of this commitment, we have achieved ISO/IEC 27001:2013 –Information security management system certification. ISO/IEC 27001:2013 provides a standard for maintaining an information security management system (ISMS) including appropriate administrative, technical, and physical security procedures to help protect the personal information you provide to us. In addition, we use encryption (as applicable) when transmitting your personal information between your system and ours, and we employ firewalls and intrusion detection systems to help prevent unauthorized persons from gaining access to your information.

DSG has internal policies and controls in place to reasonably protect Personal Data against loss, accidental destruction, misuse or disclosure, and to ensure that data is not accessed by unauthorized users. However, as is the case with all websites, applications, products, and services, we unfortunately are not able to guarantee security for data collected through our products and services. In addition, it is your responsibility to safeguard any passwords, PIN codes, or similar individual information associated with your use of our products and services.

Where DSG engages third parties to process Personal Data on its behalf, such parties do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organizational measures to ensure the security of data.

DSG recognizes potential liability in cases where Personal Data may be transferred to third parties. DSG will not transfer any Personal Data to a third party without first ensuring that the third-party adheres to principles or similar laws providing an adequate and equivalent level of protection.

International Data Transfers

Your Personal Data may be transferred and maintained outside your state, province, country, or other jurisdiction where the privacy laws may not be as protective as those in your location, including the United States. We have put in place lawful transfer mechanisms and adequate safeguards, in accordance with applicable legal requirements, to protect your Personal Data.

We comply with the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF Principles as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, United Kingdom and/or Switzerland to the United States.

The Federal Trade Commission has jurisdiction over DSG’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

How long your personal data will be retained

We generally retain Personal Data for as long as needed for the specific business purpose or purposes for which it was collected. In some cases, we may be required to retain Personal Data for a longer period of time by law or for other necessary business purposes. Whenever possible, we aim to anonymize the information or remove unnecessary identifiers from records that we may need to keep for periods beyond the specified retention period.

When we act as a data processor, the retention period is determined by the data controller.

Cookies and similar technologies

DSG uses cookies which are small data files that are served by our platform and stored on your device. Our site uses cookies dropped by us or third parties for a variety of purposes including to operate and personalize the website to improve users’ experience and for targeted advertising purposes. Cookies may expire at the end of your browsing session, or they may be stored on your computer ready for the next time you visit the website. You can prevent the setting of cookies by adjusting the settings on your browser (see your browser “Help” section for how to do this). Disabling cookies will affect how you experience our website.

We may collect information about your visits to our website, including the pages you view, the links you click, search terms you enter, and other actions you take in connection with our website and services. We may also collect certain information from the browser you used to come to our website, such as your Internet Protocol (IP) address, browser type (such as Firefox or Chrome) and language, device type, geographic location, access times, the Uniform Resource Locator (URL) of the website that referred you to our website and to which URL you browse away from our site if you click on a link on our site. We use third party (Google Analytics) embedded scripts which are bits of programming code included within our web pages. This information is collected to measure how you view or interact with our web pages. We use this information to send marketing emails.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page https://policies.google.com/privacy.

If you have questions or comments about this Notice or about how your Personal Data is processed, please contact us by using DSG’s contact page https://www.dsg-us.com/contact-dsg.html or email to dataprivacy@dsg-us.com.