Zelta Privacy Statement

Quick Links

Study Participants, Legally Authorized Representatives, and Caregivers
Zelta Study Designers and Study EDC End Users
Zelta Subprocessors

Zelta My Clinical Diary

This Zelta Application Privacy Notice (“Notice”) applies to study participants, legally authorized representatives, and caregivers that use “My Clinical Diary” to access the eConsent or the electronic patient reported outcomes functionality of the Zelta platform (the “Application”).

The Application is owned and operated by Merative U.S. LP (“Merative”) and is made available to you through a “Participating Organization” (e.g., a clinical trial sponsor or research study site), that has engaged Merative as an authorized third-party vendor.

This Notice applies only when Merative acts as a “controller” of your information for the purpose of providing you authenticated access to the Application. By accessing the Application, you acknowledge that you have read and understand this Notice. Please read carefully. If you do not wish for your information to be processed as set forth in this Notice, do not access the Application.

You acknowledge and understand that a Participating Organization may also process the information that you provide through our Application (e.g., your clinical trial participation information) in order for us to provide certain services on behalf of the Participating Organization. Each Participating Organization is the “controller” of such information, and Merative only processes that information on behalf of the Participating Organization. For information on why/how the Participating Organization is processing your information, including their data retention policies, please refer to their specific privacy policy, or to documentation provided to you when your informed consent to participate in the Participating Organization’s clinical research was collected.

Information Collected: We collect and process the following information to create and maintain End User accounts on, and to maintain functionality of, the Application:

Identity Data (e.g., Your first name, last name, and your email address)
You will select and provide the answers to three secret questions to be used for forgotten username or password retrieval, which may include user content or other personal information
Device/network information, such as: an IP address or device identifier.

Purpose & Legal Basis: We process your information to provide you secured access to the Application for the following purposes and related legal basis.

With your consent so Merative can provide the features and services you request, including creating and maintaining your account, and maintaining the service.
As necessary to perform contractual obligations and perform services for Participating Organizations.
As necessary to fulfill legal obligations or to establish or defend legal claims.
As necessary for our legitimate interest, to answer your queries or to improve the application and its usability

Session cookies can be used to track your progression from page to page so that you are not asked for information that you have already provided during the current session, or information that is needed to be able to complete a transaction. Session cookies are erased when the web browser is closed. Persistent cookies store user preferences for successive visits to a website, such as recording your choice of language and country location. Persistent cookies erase their data within 12 months.

The My Clinical Diary module uses only strictly necessary cookies and similar technologies (which do not directly identify you) to make sure the Application works as intended. Merative does not use any information collected by the Zelta platform or the My Clinical Diary module for marketing activities.

Data Retention: Data will be retained and stored by Merative only for the period necessary to achieve the purposes for which it was collected (i.e., if you no longer have a role within the clinical trial) and as required to comply with any legal and regulatory obligations, including such obligations applicable to Participating Organizations, unless it has been anonymized and no longer contains personally identifiable information. We generally consider the following factors when we determine how long to retain data (without limitation):

Retention periods established under applicable law;
Industry best practices;
Whether the purpose of processing is reasonably likely to justify further processing;
Risks to individual privacy in continued processing;
Applicable data protection impact assessments;
IT systems design considerations/limitations; and
The costs associated continued processing, retention, and deletion.

Your Rights: You have certain rights when it comes to the handling of your personal information. The Merative Privacy Contact Request Form can be used to:

Request access to the personal information about you that we have and process and request a copy of this data,
Require rectification of inaccurate data about you
Request to delete the personal information we hold about you.
Request to obtain your personal information in a usable format and transmit it to another party (also known as data portability).
Restrict processing of your personal information under certain specified circumstances
Object to processing, on grounds relating to your particular situation, at any time to the processing of your data.
Submit an opt-out request of specific personal information types of processing or, where you have given your explicit consent for the processing of your data, withdraw it at any time without justification.

Please note your rights may be subject to limitations and exceptions resulting from applicable laws. For example, there may be situations where we cannot share certain information that you seek if disclosing this means disclosing information about others.

You may also have the right to complain to the competent supervisory authority. Contact details of Data Protection Authorities in the European Economic Area can be found here, and in the UK here.

California Consumer Privacy Act of 2018 (CCPA) Supplement

If you are a California resident, you have certain additional rights under the California Consumer Privacy Act of 2018 (CCPA). This supplement is an overview of the information required by the CCPA and provides instructions on how to exercise the rights granted by the CCPA.

1. Disclosures about Your Personal Information

Collection, Business Purposes and Disclosure of Personal Information. As described in this Notice to support your use of the Zelta Application, we may have collected and disclosed, for a business purpose, information from the following categories:

Information necessary to provide you with access to and use of the Zelta Application
Information necessary to respond to your request for information, order or support
Information about your use of Merative services

This includes Personal Information defined by the CCPA as:

Identifiers such as IP address, mobile device ID and cookies
Internet/network activity information relating to your interactions with the Zelta Application
Geolocation data such as information about the location of your device when you use the Zelta Application
“Sensitive Personal Information” such health information.
When you submit a Data Rights request, you provide us with personal information, including your name and contact details, which we use to respond to your request. In some circumstances, to verify your identity and to ensure we disclose the personal information to the correct individual, we may also request a copy of your photo ID, which is deleted immediately after verification of your identity.
Upon your Data Rights request, your personal information is processed for handling and fulfilling your request, in line with Merative’s legal obligations and commitments related to these requests.

Retention. For each category of personal information, Merative retains your personal information only for as long as necessary, based retention criteria including:

the time required to fulfill the business or commercial purposes for which personal information is processed,
the time required to comply with legal and regulatory retention requirements, and
the time required to maintain contractual and customer relationships.

2. Sources and Sharing of Personal Information

This Notice describes the types of sources from which we collect Personal Information and how we share your information with third parties. As explained, we may collect Personal Information directly from you or automatically from your device.

3. Rights relating to Your Personal Information

In addition to the rights granted above, as a California resident, you have the right to:

Know your Personal Information
You can request specific pieces of Personal Information, or information about the categories of Personal Information that Merative holds about you by submitting a request through our webform here Merative Privacy Contact Request Form or by calling (toll free) 1-866-457-3206.

Request Deletion or Rectify your Personal Information
You can request the deletion of or seek to rectify (correct, update or modify) the Personal Information that Merative holds about you by submitting a request through our webform here Merative Privacy Contact Request Form or by calling (toll free) 1-866-457-3206.

Under CCPA, you have the right to limit the use and disclosure of your SPI if we are using your SPI beyond what is reasonable and proportionate to provide the requested goods or services. To limit the use or disclosure of Sensitive Personal Information, then complete the details on this form as needed.

4. Non-Discrimination

If you choose to exercise any of these rights, we will not deny goods or services to you or provide different quality of services.

5. Authorized Agent

You may use an authorized agent to submit a request about your personal information via our webform here Merative Privacy Contact Request Form or by calling (toll free) 1-866-457-3206. To use an authorized agent, you must provide the agent with written authorization. In addition, you may be required to verify your own identity with Merative.

Zelta Application End Users may also submit questions to Zelta support at [email protected].

When you contact us to request support, we collect your contact information, problem description, and possible resolutions. We record the information that is provided to handle the support query, for administrative purposes, to foster our relationship with you, for staff training, and for quality assurance purposes.

The information that we collect may include any information exchanged during our phone conversations or provided during live chat support sessions on our websites. We may use this information to inform you of products or services that are related to your support request. This can include product updates or fixes, and we may combine the information that is collected through other interactions with you or your organization to provide more valuable suggestions in relation to product support, such as any available training regarding the issue.

While we handle the support case, we may have incidental access to information that you have provided or information that is on your system. This information may contain information about you, clients, client’s authorized users (including client’s employees) or other relevant parties. The conditions regarding the handling and processing of this information is covered by the applicable Terms of Use or other agreements between Merative’s client(s) and Merative.

Modifications to this Notice

Merative reserves the right, at its sole discretion, to modify this Notice from time to time, and your continuing use of the Application constitutes your acceptance of and agreement to any changed terms and conditions.

Controller and Representative Information

Merative does business through its subsidiaries worldwide. This Notice applies to Merative and its parents and subsidiaries. The privacy laws in some countries consider a Controller to be the legal entity (or natural person) who defines the purposes for which the processing of personal information takes place and how that information is processed. Parties that are involved in processing operations on behalf of a Controller may be designated as Processors. Designations and associated obligations differ, depending on the jurisdiction.

Where this is relevant for the privacy laws in your country, the Controller of your personal information is Merative’s main subsidiary in your country or region, unless Merative or another Merative subsidiary identifies itself as the Controller for a specific interaction with you.

Merative’s corporate headquarters can be contacted at: 100 Phoenix Drive, Ann Arbor, MI 48108.

Zelta Study Connect, Designer, and Teams Portal

This Zelta Application Privacy Notice (“Notice”) applies to Zelta users who will be CDMS/EDC study end users, study designers, or portal team members that access the Zelta platform (the “Application”) .

The Application is owned and operated by Merative U.S. LP (“Merative”) and is made available to you (“You”, “you” or “End Users”) through a “Participating Organization” (e.g., Client, clinical trial sponsor or site), who has engaged Merative as an authorized third-party vendor.

This Notice applies only when Merative acts as a “controller” of your information for the purpose of providing you access to the Application. By using the Application, you acknowledge that you have read and understand this Notice. Please read each carefully. If you do not wish for your information to be processed as set forth in this Notice, do not access the Application.

You acknowledge and understand that a Participating Organization may also process your information through the Application in order for us to provide certain services on behalf of the Participating Organization. Each Participating Organization is the “controller” of such information, and Merative only processes such information on behalf of the Participating Organization. For more general information on how Participating Organization is processing your information, including their data retention policies, please refer to their specific privacy policy.

Information Collected: We collect and process the following information to create and maintain End User accounts on, and to maintain functionality of, the Application:

Identity data, such as:
- First/last name
- User ID
Contact data, such as:
- Email
Company name, organization type, role
Primary time zone
You will select and provide the answers to three secret questions to be used for forgotten username or password retrieval, which may include user content or other personal information.
Device/network information, such as:
- IP address,
- Device identifiers
Inference data, such as:
- Usage analytics

Purpose & Legal Basis: We process your information in connection with the Application for the following purposes and related legal bases. The information collected within the Application is not used for any marketing activities, but:

With your consent so Merative can provide the features and services you requested
As necessary to perform contractual obligations to Participating Organizations, including:
- To operate and maintain your account
- To provide the services, features, and modules that you request
For our legitimate interests, e.g. to:
- Make sure the site works as intended
- Support products or services
- Fulfill your requests, as directed by you or by others involved in fulfillment
- Personalize your experience while you are on our sites, make navigation easier
- Web site usage statistics
- To secure our services and related information security processes and procedures; and
- If you are a Zelta Sponsoring Organization, we may contact you for customer satisfaction surveys or in connection with certain transactions.
As necessary to fulfill our legal obligations or establish or defend legal claims

Cookies and similar technologies: A cookie is a piece of data that a website or web application may send to your browser, which may be stored on your device and can be used to identify your device. Session cookies can be used to track your progression from page to page so that you are not asked for information that you have already provided during the current session, or information that is needed to be able to complete a transaction. Session cookies are erased when the web browser is closed. Persistent cookies store user preferences for successive visits to a website, such as recording your choice of language and country location. Persistent cookies erase their data within 12 months.

The Application uses only strictly necessary cookies and similar technologies (which do not directly identify you) to make sure the Application works as intended. Merative does not use any information collected by the Application for marketing activities.

Data Retention: Data will be retained and stored by Merative only for the period necessary to achieve the purposes for which it was collected (i.e., if you no longer have a role within the clinical trial) and as required to comply with any legal and regulatory obligations (e.g. pursuant to judicial proceeding, court order, or legal process), including such obligations applicable to Participating Organizations, unless it has been anonymized and no longer contains personally identifiable information. We generally consider the following factors when we determine how long to retain data (without limitation):

Retention periods established under applicable law;
Industry best practices;
Whether the purpose of processing is reasonably likely to justify further processing;
Risks to individual privacy in continued processing;
Applicable data protection impact assessments;
IT systems design considerations/limitations; and
The costs associated continued processing, retention, and deletion.

Your Rights:

You have certain rights when it comes to the handling of your personal information. The Merative Privacy Contact Request Form can be used to:

Request access to the personal information about you that we have and process and request a copy of this data,
Require rectification of inaccurate data about you
Request to obtain your personal information in a usable format and transmit it to another party (also known as data portability).
Request to delete the personal information we hold about you.
Restrict processing of data under certain specified circumstances
Object to processing, on grounds relating to your particular situation, at any time to the processing of your data.
Submit an opt-out request of specific personal information processing types or, where you have given your explicit consent for the processing of your data (e.g., Subscription to the Newsletter), withdraw it at any time without justification.

You may also have the right to complain to the competent supervisory authority. Contact details of Data Protection Authorities in the European Economic Area can be found here, and in the UK here.

California Consumer Privacy Act of 2018 (CCPA) Supplement (“CCPA Supplement”)

1. Disclosures about Your Personal Information

Collection, Business Purposes and Disclosure of Personal Information:

As described in this Notice to support your use of the Zelta Application, we may have collected and disclosed, for a business purpose, information from the following categories:

Information necessary to provide you with access to and use of the Zelta Application
Information necessary to respond to your request for information, order or support
Information about your use of Merative services