Privacy Policy
This Policy was last updated on September 28, 2026.
1. Purpose and Scope
Everest Clinical Research Corporation and its affiliates, as applicable, respect individual privacy and are committed to protecting personal information or personal data (together referred to as “Personal Information”) in accordance with applicable privacy and data protection laws.
This Privacy Policy explains how Everest collects, uses, discloses, transfers, retains, and protects Personal Information in connection with its business operations, website, employment activities, investigator and study site relationships, vendor and client relationships, and clinical research services.
This Privacy Policy applies to Personal Information relating to:
- website visitors;
- clients, sponsors, vendors, suppliers, consultants, and other business contacts;
- job applicants, employees, and contractors;
- investigators, study site personnel, healthcare professionals, and other clinical research partners; and
- individuals whose Personal Information is processed by Everest in connection with clinical trials or other research activities.
2. Everest’s Role in Processing Personal Information
Everest’s role may vary depending on the context in which Personal Information is processed.
For certain business, website, employment, vendor, investigator registry, and corporate activities, Everest may determine the purposes and means of processing Personal Information.
For clinical trial and research-related activities, Everest processes Personal Information on behalf of, or under the instructions of, a clinical trial sponsor, institution, investigator, or other responsible party. In these circumstances, Everest processes Personal Information in accordance with applicable agreements, the protocol, informed consent form, study-specific documents, sponsor instructions, and applicable legal and regulatory requirements.
3. Personal Information We Collect
Everest may collect and process different categories of Personal Information depending on the individual’s relationship with Everest and the purpose for which the information is collected.
Website Visitors and General Contacts
This may include:
- name;
- business contact information;
- email address;
- telephone number;
- organization or company name;
- inquiry details;
- IP address;
- browser type;
- operating system;
- access times;
- website usage information; and
- cookie and analytics information.
Clients, Sponsors, Vendors, and Business Contacts
This may include:
- name;
- title;
- business address;
- business email address;
- telephone number;
- company or organization information;
- communications with Everest;
- contract and payment-related information; and
- information required for compliance, security, due diligence, and relationship management purposes.
Job Applicants, Employees, and Contractors
This may include:
- contact information;
- curriculum vitae or résumé;
- employment history;
- educational history;
- professional qualifications;
- references;
- government-issued identification, where required;
- date of birth, where required;
- payroll, tax, banking, benefit, and compensation information;
- training records;
- performance, role, and employment-related information; and
- other human resources information required to administer the employment or contractor relationship.
Investigators, Study Site Personnel, and Healthcare Professionals
This may include:
- name;
- title and role;
- contact information;
- affiliated institution or study site;
- curriculum vitae;
- professional qualifications;
- medical license or registration information;
- debarment or exclusion status;
- training records;
- study experience;
- delegated study responsibilities; and
- other information relevant to clinical trial feasibility, start-up, conduct, oversight, and regulatory compliance.
Clinical Trial and Research-Related Information
Where Everest provides clinical research services, Everest may process Personal Information relating to clinical trial participants, caregivers, guardians, investigators, study staff, and other individuals involved in a study.
Clinical trial participant information may include coded, pseudonymized, or otherwise protected health or research-related information, such as:
- age or year of birth;
- sex or gender, where collected for study purposes;
- race, ethnicity, or other demographic information, where collected for study purposes;
- health information;
- medical history;
- treatment information;
- laboratory, imaging, or other clinical data;
- genetic or genomic information, where applicable;
- adverse event or pharmacovigilance information; and
- other information described in the applicable informed consent form and study documents.
Where Personal Information is processed in connection with a clinical trial, the applicable informed consent form, study documents, sponsor instructions, ethics committee or institutional review board approvals, and applicable legal and regulatory requirements may provide additional or controlling information regarding the handling of such Personal Information. This Privacy Policy is not intended to replace or override any study-specific informed consent form or other approved clinical trial document.
4. How We Collect Personal Information
Everest may collect Personal Information:
- directly from individuals who contact Everest, use the website, apply for employment, register in an investigator registry, or otherwise provide information to Everest;
- directly from employees and consultants;
- from clients, sponsors, investigators, study sites, vendors, service providers, and business partners;
- through clinical trial systems, study databases, electronic data capture platforms, clinical trial management systems, safety systems, trial master file systems, and related research platforms;
- from public or professional sources, where appropriate and permitted by law;
- through cookies and analytical tools; and
- as otherwise permitted or required by applicable law.
5. Purposes for Processing Personal Information
Everest limits the Personal Information it collects to what is needed for the applicable purpose and processes Personal Information only for that purpose, or as otherwise permitted or required by applicable law. Everest may collect, use, disclose, and otherwise process Personal Information for the following purposes:
- operating and improving Everest’s website;
- responding to inquiries and requests;
- providing information about Everest’s services;
- managing client, sponsor, vendor, and business relationships;
- negotiating and performing contracts;
- administering employment, contractor, payroll, benefits, training, and human resources activities;
- recruiting and evaluating job applicants;
- maintaining investigator, site, and healthcare professional information;
- assessing clinical trial feasibility and site suitability;
- supporting clinical trial start-up, conduct, monitoring, data management, biostatistics, programming, safety, regulatory, quality, audit, project management, and related services;
- providing access to secure systems, portals, and study platforms;
- complying with legal, regulatory, contractual, audit, quality, safety, and pharmacovigilance obligations;
- protecting the security and integrity of Everest’s systems, facilities, information, and operations;
- investigating and responding to privacy, security, quality, compliance, or legal matters;
- enforcing agreements and protecting legal rights; and
- any other purpose disclosed at the time of collection or permitted by applicable law.
6. Legal Bases and Grounds for Processing
Depending on the applicable law and processing context, Everest may process Personal Information based on one or more of the following grounds:
- the individual’s consent;
- performance of a contract;
- compliance with legal or regulatory obligations;
- legitimate business interests, where permitted by law;
- employment, social security, or workplace-related obligations;
- research, public health, safety, pharmacovigilance, or regulatory purposes, where permitted by law;
- protection of legal rights and prevention of fraud or misuse; and
- other grounds permitted under applicable privacy and data protection laws.
Where clinical trial participant information is processed, the legal basis or permitted ground for processing may depend on the jurisdiction, study design, sponsor role, protocol, informed consent form, ethics committee or institutional review board approval, and applicable clinical research laws and regulations.
7. Clinical Trial Participant Information
Information regarding the collection, use, disclosure, transfer, retention, protection, withdrawal, and applicable privacy rights relating to clinical trial participant information is generally provided in the applicable informed consent form and other study-specific documents approved by the relevant ethics committee or institutional review board.
If an individual participates in a clinical trial, any withdrawal from study participation or request relating to clinical trial Personal Information will be handled in accordance with the applicable informed consent form, study documents, sponsor instructions, ethics committee or institutional review board requirements, and applicable legal and regulatory requirements.
Because clinical trial data may be subject to regulatory, scientific integrity, safety, pharmacovigilance, audit, and record retention obligations, certain information may need to be retained or continued to be used as required or permitted by applicable law, even after an individual withdraws from study participation or submits a privacy request.
Individuals with questions about clinical trial participation or study data should refer to the informed consent form and contact the study site, investigator, sponsor, or other study-specific contact identified in the informed consent form or study materials.
8. Investigator Registry and Non-Subject Clinical Research Contacts
Everest may maintain information about investigators, study sites, healthcare professionals, and clinical research personnel to support study feasibility, site selection, study start-up, clinical trial conduct, regulatory compliance, and sponsor requests.
Where Everest collects Personal Information for inclusion in an investigator registry or similar database, Everest may disclose relevant information to sponsors, clients, or other parties involved in clinical research activities for purposes consistent with the reason the information was collected or as otherwise authorized by the individual or permitted by law.
Individuals may contact Everest to ask questions or exercise applicable privacy rights regarding investigator registry or other non-subject clinical research contact information, subject to applicable legal, regulatory, contractual, and operational requirements.
9. Disclosures of Personal Information
Everest may disclose Personal Information to the following categories of recipients, as appropriate for the applicable processing purpose:
- affiliates and related companies;
- clients and clinical trial sponsors;
- investigators, study sites, institutions, and healthcare professionals;
- vendors, service providers, and technology providers;
- laboratories, central service providers, imaging providers, pharmacovigilance providers, and other study vendors;
- electronic data capture, clinical trial management, trial master file, safety, quality, regulatory, project management, human resources, payroll, and business system providers;
- auditors, monitors, inspectors, consultants, legal advisers, insurers, and professional advisers;
- ethics committees, institutional review boards, regulatory authorities, public health authorities, and governmental authorities;
- counterparties in business transactions, mergers, acquisitions, reorganizations, or similar events; and
- other parties where required or permitted by law, contract, consent, or study-specific requirements.
Everest does not sell Personal Information for monetary or other valuable consideration and does not share Personal Information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, unless otherwise disclosed in the California Privacy Notice below. Everest does not knowingly sell or share Personal Information of consumers under 16 years of age without the affirmative authorization required by applicable law. Everest does not use Personal Information for targeted advertising where prohibited by applicable law.
Everest does not use Personal Information for solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals.
10. International Transfers
Everest operates globally and may process (transfer to, access, or store) Personal Information in countries other than the country where the information was originally collected, including Canada, the United States, the United Kingdom, countries in the European Economic Area, Switzerland, China, Taiwan, South Korea, and other jurisdictions where Everest, its affiliates, sponsors, clients, vendors, or service providers operate.
Where Personal Information is transferred internationally, Everest uses appropriate safeguards as required by applicable law. These safeguards may include contractual protections, data processing agreements, standard contractual clauses, transfer impact assessments, security measures, consent where required, regulatory approvals or filings where applicable, and other lawful transfer mechanisms.
For Personal Information transferred from the European Economic Area, United Kingdom, Switzerland, or other jurisdictions to Everest in Canada, Everest relies, where applicable, on Canada’s adequacy status or other lawful transfer mechanisms available under applicable data protection laws. Where Personal Information is transferred onward to Everest’s U.S. operations, including its New Jersey office, Everest relies on that U.S. entity’s certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, together with any additional safeguards required by applicable law.
For Personal Information transferred from China in connection with clinical trial or research activities, the applicable client, sponsor, or other responsible party is responsible for determining and ensuring compliance with applicable requirements under the Personal Information Protection Law of the People’s Republic of China and related privacy, data security, cybersecurity, human genetic resources, and clinical research laws and regulations. Where Everest processes such Personal Information on behalf of, or under the instructions of, the client, sponsor, or other responsible party, Everest will process the information in accordance with applicable agreements, client or sponsor instructions, study documents, and applicable legal and regulatory requirements. Such requirements may include, where applicable, notice, separate consent, Personal Information protection impact assessments, cross-border transfer mechanisms, security assessments, standard contracts, certification, regulatory filings, localization requirements, or other obligations depending on the nature of the processing and the parties involved.
11. Data Privacy Framework Notice
Everest Clinical Research Corporation’s certified U.S. operations comply with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, as applicable, with respect to Personal Information received from the European Economic Area, the United Kingdom, Gibraltar, and Switzerland and transferred to the United States in reliance on those frameworks. Everest has certified to the U.S. Department of Commerce that it adheres to the applicable Data Privacy Framework Principles. If there is any conflict between this Privacy Policy and the applicable Data Privacy Framework (DPF) Principles with respect to DPF-covered Personal Information, the applicable Data Privacy Framework Principles will govern.
To learn more about the Data Privacy Framework program and to view Everest’s certification status, please visit the U.S. Department of Commerce’s Data Privacy Framework List at https://www.dataprivacyframework.gov/.
For DPF-covered Personal Information, Everest provides individuals with notice, choice, access, security, data integrity and purpose limitation, accountability for onward transfer, and recourse, enforcement, and liability protections as required by the applicable Data Privacy Framework Principles. Individuals may contact Everest using the contact information in this Privacy Policy to request access to, correction of, amendment of, or deletion of DPF-covered Personal Information, subject to applicable legal, regulatory, contractual, and clinical research limitations.
Where required by the applicable Data Privacy Framework Principles, Everest will provide individuals with an opportunity to opt out before DPF-covered Personal Information is disclosed to a non-agent third party or used for a purpose that is materially different from the purpose for which it was originally collected or subsequently authorized. Everest will obtain affirmative express consent before using or disclosing sensitive Personal Information for a materially different purpose or disclosing sensitive Personal Information to a third party where the applicable Data Privacy Framework Principles require opt-in consent.
Everest may transfer DPF-covered Personal Information to affiliates, clients, sponsors, vendors, service providers, and other third parties (together “Recipient”) as described in this Privacy Policy, where such information is only to be processed for limited and specified purposes. In these circumstances, Everest will comply with the Notice and Choice Principles and will enter into a contract requiring the Recipient to provide the same level of protection required by the applicable Data Privacy Framework Principles. Everest will take reasonable and appropriate steps to ensure that the Recipient processes the information consistently with Everest’s obligations, and, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized processing.
Everest remains liable under the applicable Data Privacy Framework Principles if a third-party agent processes DPF-covered Personal Information in a manner inconsistent with those Principles, unless Everest proves that it is not responsible for the event giving rise to the damage.
Everest may be required to disclose DPF-covered Personal Information in response to lawful requests by public authorities, including to meet national security, law enforcement, or regulatory requirements. Everest is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to its compliance with the Data Privacy Framework.
12. Security
Everest maintains administrative, technical, physical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, use, alteration, loss, destruction, or other unlawful processing.
These safeguards are designed to consider the nature of the Personal Information, the processing activity, the risks involved, and applicable legal, regulatory, contractual, and industry requirements.
13. Retention
Everest retains each category of Personal Information only for as long as reasonably necessary and proportionate to fulfill the disclosed purposes, unless a longer period is required or permitted by law. Retention is determined by the nature and sensitivity of the information, the individual’s relationship with Everest, the purpose of collection, applicable limitation periods, and legal, regulatory, contractual, audit, quality, safety, pharmacovigilance, tax, accounting, employment, security, dispute-resolution, and recordkeeping requirements.
Website, cookie, analytics, and inquiry information is retained according to the applicable technology configuration and for the period needed to operate, secure, evaluate, and improve the website, respond to the interaction, and meet legal obligations. Business-contact, client, sponsor, vendor, investigator, and study-site information is retained for the relationship and the period needed to administer agreements, meet audit and inspection obligations, and resolve disputes. Applicant information is retained for the recruitment process and any legally permitted period for future opportunities; employee and contractor information is retained for the relationship and the period required for payroll, benefits, tax, employment, safety, legal, and recordkeeping obligations. Clinical-trial and research-related information is retained for the period required by applicable law, sponsor requirements, study documents, ethics committee or institutional review board requirements, scientific-integrity obligations, safety and pharmacovigilance duties, and clinical-research record-retention requirements. Everest securely deletes or de-identifies Personal Information when continued retention is no longer reasonably necessary, subject to applicable restrictions.
14. Cookies and Analytics
Cookies are small files stored on a device when an individual visits certain online pages. Everest’s website uses cookies and Google Analytics to operate the website, understand how visitors use it, improve functionality, maintain security, and evaluate performance. Where required, non-essential cookies are placed only after an individual makes an affirmative choice through the cookie preference tool. Individuals may accept or reject categories of non-essential cookies and may change their preferences through the available cookie controls. Essential cookies may be used where necessary to provide the website or a service requested by the individual. Everest processes legally sufficient opt-out preference signals, including Global Privacy Control, as required by applicable law. Disabling cookies may affect website functionality.
Google Analytics may collect information such as IP address, your internet service provider domain name, browser type, device information, operating system, pages visited, referring pages, links followed, access times, and other website usage information.
Individuals may be able to manage cookies through browser settings or other available tools. You can find out more information about Google Analytics here: Google Analytics Cookie Usage on Websites. You can find out more about how Google protects your Data here: Google Privacy Policy. You can prevent the use of Google Analytics relating to your use of services by downloading and installing the browser plugin available here: Google Analytics Opt-out Browser Add-on.
15. Children’s Personal Information
Everest does not knowingly collect Personal Information from children through its public website. If Everest becomes aware that it has collected Personal Information from a child through the public website without appropriate consent, Everest will take steps to delete the information or otherwise handle it in accordance with applicable law.
This section does not apply to Personal Information processed in connection with pediatric clinical trials or other research activities, which is governed by the applicable informed consent form, assent form where applicable, study documents, ethics committee or institutional review board approvals, sponsor instructions, and applicable legal and regulatory requirements.
16. Privacy Rights and Choices
Depending on the individual’s location, relationship with Everest, and applicable law, individuals may have rights to:
- request access to Personal Information;
- request correction or amendment of inaccurate Personal Information;
- request deletion of Personal Information;
- object to or restrict certain processing;
- withdraw consent where processing is based on consent;
- request portability of Personal Information;
- opt out of certain disclosures, sales, sharing, or targeted advertising where applicable;
- lodge a complaint with a privacy or data protection authority; and
- exercise other rights available under applicable law.
These rights may be subject to limitations, exceptions, verification requirements, and legal or regulatory obligations.
Requests relating to clinical trial participant information may need to be directed to, or handled in coordination with, the applicable study site, investigator, sponsor, or study-specific contact identified in the informed consent form or study materials. Everest may not be able to respond directly to certain requests where Everest processes the information on behalf of a sponsor or other responsible party, but Everest will handle such requests in accordance with applicable law, contracts, sponsor instructions, and study requirements.
Individuals may contact the Everest Privacy Officer using the contact information provided below.
17. California Privacy Notice
This California Privacy Notice supplements the other provisions of this Privacy Policy and applies to California residents whose Personal Information is subject to the California Consumer Privacy Act, as amended (“CCPA”). Terms defined in the CCPA have the same meaning in this section. Certain information or processing may be exempt from the CCPA, including specified medical, health, and clinical-research information and information Everest processes solely as a service provider or contractor for another organization.
Personal Information Practices During the Preceding 12 Months
Depending on the individual’s relationship with Everest, Everest collects the categories identified below, in the CCPA Category Table, from individuals; employers and affiliated organizations; clients, sponsors, investigators, study sites, vendors, service providers, and business partners; clinical-research and business systems; public and professional sources; and cookies and analytics technologies. Everest uses these categories for the purposes described in Section 5 and discloses them for business purposes to the recipient categories described in Section 9.
| CCPA Category | Examples | Sources, purposes, and recipient categories |
|---|---|---|
| Identifiers | Name, address, email address, telephone number, IP address, account identifier, and government-issued identifier | Sources listed above; used for communications, relationship and account administration, recruitment, workforce administration, security, compliance, and research operations; disclosed to affiliates, clients, sponsors, service providers, professional advisers, and authorities as appropriate |
| Customer records | Contact, signature, identity, financial, banking, benefits, payment, and employment information | Used for contracting, payment, due diligence, human resources, and legal compliance; disclosed to business, payroll, benefits, financial, professional, and regulatory recipients as appropriate |
| Characteristics of protected classifications | Age or year of birth, race, ethnicity, sex or gender, disability, or related characteristics where lawfully collected for employment or study purposes | Used for employment administration, equal-opportunity compliance, clinical research, safety, analysis, and regulatory reporting; disclosed to authorized workforce, research, sponsor, institutional, and regulatory recipients |
| Commercial information | Business relationships, contracts, services, and transaction history | Used for relationship management, contracting, payments, and service delivery; disclosed to affiliates, clients, sponsors, service providers, advisers, and authorities as appropriate |
| Internet or electronic network activity | Browser, device, operating system, pages visited, links followed, access times, cookies, and analytics information | Used for website operation, analytics, security, troubleshooting, and improvement; disclosed to hosting, security, analytics, and technology providers |
| Geolocation information | Approximate location inferred from IP address, where collected | Used for security, fraud prevention, website operation, and analytics; disclosed to relevant technology and security providers |
| Professional or employment-related information | Résumé, employment history, references, role, performance, compensation, training, licenses, and professional credentials | Used for recruitment, workforce administration, investigator and site management, study operations, and compliance; disclosed to authorized affiliates, service providers, clients, sponsors, institutions, and authorities |
| Education information | Education history, degrees, certifications, and training records | Used for recruitment, qualification, assignment, and regulatory compliance; disclosed to authorized workforce, verification, sponsor, client, and regulatory recipients |
| Sensitive Personal Information | Government identifiers; account and financial information; precise geolocation if collected; racial or ethnic origin; health, genetic, or biometric information where applicable; contents of communications where Everest is not the intended recipient; and Personal Information of consumers under 16 | Used and disclosed only for lawful employment, payment, security, clinical-research, safety, regulatory, or other disclosed purposes, subject to applicable exemptions and limitations |
| Inferences | Assessments derived from professional, employment, website, or study-related information, where created | Used for recruitment, workforce administration, feasibility, site selection, security, and service improvement; disclosed to authorized recipients supporting those purposes |
Sale, Sharing, and Disclosure
Everest does not sell Personal Information for monetary or other valuable consideration and does not share Personal Information for cross-context behavioral advertising, as those terms are defined by the CCPA. Everest may disclose the categories listed above for business purposes to the recipient categories described above and in Section 9. Everest does not knowingly sell or share the Personal Information of consumers under 16 years of age.
Sensitive Personal Information
Everest uses and discloses Sensitive Personal Information only for purposes permitted without a right to limit under the CCPA, including providing requested services, maintaining security and integrity, resisting fraud or unlawful activity, processing employment and payments, and performing legal, regulatory, safety, and clinical-research obligations. Everest does not use or disclose Sensitive Personal Information to infer characteristics about a consumer.
California Privacy Rights
Subject to applicable exceptions, California residents may request that Everest: disclose the categories and specific pieces of Personal Information it collected about them; disclose the categories of sources, business or commercial purposes, and categories of third parties to whom the information was disclosed, sold, or shared; correct inaccurate Personal Information; delete Personal Information; and provide a portable copy of Personal Information where required. A request for Personal Information may cover information collected beyond the preceding 12 months, however, is not required to cover information collected before January 1, 2022, unless responding would be impossible or involve disproportionate effort. California residents may also opt out of sale or sharing and limit certain uses or disclosures of Sensitive Personal Information where those rights apply. Everest will not discriminate or retaliate against an individual for exercising CCPA rights.
Submitting Requests
California residents may submit a request by calling +1 (866) 393-8778, emailing [email protected], or using the online Contact Us page identified in Section 24. The request should state that it is a California privacy request and describe the right being exercised. Everest will acknowledge receipt within 10 business days and respond within 45 calendar days, subject to a permitted extension of up to an additional 45 calendar days with notice. Requests to opt out of sale or sharing and requests to limit will be processed as soon as feasibly possible and no later than 15 business days after receipt, where applicable.
Everest will use information reasonably necessary to verify the requester’s identity or authority and will not require more information than is proportionate to the request. If Everest cannot verify a request, it will explain the result where permitted. An authorized agent may submit a request on a resident’s behalf. Everest may require signed permission from the resident, direct confirmation of the authorization, or other proof permitted by law, unless the agent holds a valid power of attorney.
Opt-Out Preference Signals
Although Everest states that it does not sell or share Personal Information, it will process a legally sufficient opt-out preference signal, including Global Privacy Control, as a request to opt out for the browser or device sending the signal and, where known, the associated consumer. Everest will provide a means by which a consumer can confirm that the opt-out preference signal was honored. If Everest begins selling or sharing Personal Information, it will provide the notice and link or alternative mechanism required by law before doing so.
Notice at Collection, Retention, and Financial Incentives
At or before collection, Everest provides a notice describing the categories of Personal Information, including Sensitive Personal Information, to be collected; the purposes for which they will be collected or used; whether they are sold or shared; the applicable retention period or criteria; and a link to this Privacy Policy and any required opt-out mechanism. Collection-point notices may supplement this Policy. Retention periods and criteria are described in Section 13. Everest does not offer a financial incentive or price or service difference related to the collection, retention, sale, or sharing of Personal Information. If that practice changes, Everest will provide a compliant notice and obtain any required opt-in consent before implementing the program.
Workforce, Clinical-Research, and Automated Decision-Making Information
California job applicants, employees, contractors, and other workforce members receive a notice at collection describing the categories, purposes, retention criteria, disclosures, and rights applicable to workforce information. Clinical-trial and research information may be subject to exemptions under the CCPA or other medical, health, or research laws. When Everest acts solely as a service provider or contractor, the business that determines the purposes and means of processing is generally responsible for consumer requests, and Everest assists as required by contract and law. Everest does not use automated decision-making technology to make a significant decision concerning a consumer without human involvement. If that practice changes, Everest will provide any required pre-use notice and access, opt-out, and appeal rights before the applicable processing begins.
18. Other U.S. State Privacy Notices
Residents of other U.S. states may have additional privacy rights under applicable state privacy laws. These rights may include the right to know, access, correct, delete, obtain a copy of, or opt out of certain uses or disclosures of Personal Information, subject to applicable exceptions.
Everest does not sell Personal Information for monetary consideration. Everest does not knowingly sell or share Personal Information of minors as defined under applicable U.S. state privacy laws.
Everest will not discriminate against individuals for exercising privacy rights available under applicable law.
To exercise applicable U.S. state privacy rights, individuals may contact the Everest Privacy Officer using the contact information provided below.
19. Canada Privacy Notice
Everest Clinical Research Corporation is based in Canada and processes Personal Information in accordance with applicable Canadian federal and provincial privacy laws, which may include the Personal Information Protection and Electronic Documents Act, provincial private-sector privacy laws, and health information laws where applicable.
Individuals may have rights to access or correct Personal Information, withdraw consent where applicable, ask questions, or submit complaints regarding Everest’s handling of Personal Information, subject to applicable legal and regulatory limitations.
Individuals may contact the Everest Privacy Officer using the contact information provided below.
20. European Economic Area, United Kingdom, and Switzerland Privacy Notice
Individuals located in the European Economic Area, United Kingdom, or Switzerland may have additional rights under applicable data protection laws, including the right to access, rectify, erase, restrict, object to processing, withdraw consent, request portability, and lodge a complaint with a supervisory authority.
Where Everest is required to appoint a representative in the European Union or United Kingdom, Everest will provide relevant representative contact information.
For matters relating to the GDPR or UK GDPR, individuals may contact Everest’s appointed representative, where applicable, or the Everest Privacy Officer using the contact details below.
Where Personal Information is transferred to Everest’s certified U.S. operations under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, Everest will handle such Personal Information in accordance with the applicable Data Privacy Framework Principles and any additional requirements under applicable EEA, UK, or Swiss data protection laws.
21. China Privacy Notice
Where the Personal Information Protection Law of the People’s Republic of China or related Chinese privacy, data security, cybersecurity, human genetic resources, or clinical research requirements apply, Everest will process Personal Information in accordance with those requirements.
Depending on the processing activity, individuals in China may have rights to know, decide, restrict, refuse, access, copy, correct, supplement, delete, withdraw consent, request explanation, or exercise other rights available under applicable Chinese law.
Where Personal Information is transferred outside China, Everest will use applicable cross-border transfer mechanisms and safeguards as required by law. Where required, Everest will obtain separate consent, conduct Personal Information protection impact assessments, enter into required transfer agreements, complete required filings or security assessments, or take other legally required steps.
Requests relating to clinical trial participant information in China may also be subject to the informed consent form, study documents, sponsor instructions, ethics committee requirements, human genetic resources requirements, regulatory requirements, and applicable law.
22. Other Asia-Pacific and Other Jurisdiction Privacy Notices
Where privacy, data protection, cybersecurity, health information, clinical research, or related laws in other Asia-Pacific jurisdictions apply, including Taiwan, South Korea, Singapore, Australia, and other jurisdictions, Everest will process Personal Information in accordance with applicable requirements in those jurisdictions.
Depending on the jurisdiction, individual category, and processing activity, individuals may have rights to access, correct, delete, object to, restrict, or request discontinuation of certain processing of their Personal Information, withdraw consent where applicable, or exercise other rights available under applicable law.
Where Personal Information is transferred internationally from an Asia-Pacific jurisdiction, Everest will use applicable safeguards and transfer mechanisms as required by law, which may include notice, consent where required, contractual protections, transfer assessments, security measures, regulatory filings or approvals where applicable, or other legally recognized mechanisms.
Requests relating to clinical trial participant information in Asia-Pacific jurisdictions may also be subject to the applicable informed consent form, study documents, sponsor instructions, ethics committee or institutional review board requirements, regulatory requirements, and applicable law.
23. Changes to This Privacy Policy
Everest may update this Privacy Policy from time to time to reflect changes in legal, regulatory, operational, or privacy requirements. The updated version will be posted on Everest’s website with the updated effective date.
24. Contact Information
Individuals may contact Everest with questions, requests, concerns, or complaints regarding this Privacy Policy or Everest’s handling of Personal Information:
Privacy Officer
c/o Everest Clinical Research Corporation
675 Cochrane Drive, East Tower, 4th Floor
Markham, Ontario, Canada, L3R 0B8
Toll free: +1 (866) 393-8778
Or through Everest’s Contact Us page.
25. Complaints and Dispute Resolution
Everest will investigate and attempt to resolve privacy complaints and disputes in accordance with applicable law.
In compliance with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Everest commits to refer unresolved complaints concerning our handling of Personal Information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS Mediation, Arbitration and ADR Services (JAMS), an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Everest commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF in the context of the employment relationship. These services are provided at no cost to you.
For breaches or access/modifications of Personal Information, pursuant to Article 27 of the General Data Protection Regulation (GDPR) and UK GDPR, Everest Clinical Research Corporation has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU and EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO regarding matters pertaining to the GDPR and UK GDPR:
General Data Protection Regulation (GDPR) – EU Representative
Complete EDPO’s online request form: https://edpo.com/gdpr-data-request/
Write to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium
UK General Data Protection Regulation (GDPR) - UK Representative
Complete EDPO-UK’s online request form: https://edpo.com/uk-gdpr-data-request/
Write to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom
If your DPF complaint cannot be resolved through Everest’s internal process, the applicable independent recourse mechanism, or applicable regulatory channels, you may, under certain conditions, invoke binding arbitration for certain residual claims in accordance with Annex I of the applicable Data Privacy Framework Principles.
Individuals may also have the right to contact a local privacy or data protection authority, depending on their jurisdiction and the nature of the complaint.