1. Introduction

We, Lambda Therapeutic Research Limited are a leading global Clinical Research Organization (CRO) headquartered in Ahmedabad – India, with facilities and operations in Mumbai (India), Mehsana (India), Toronto (Canada), Warsaw (Poland), London (UK) and USA with approximate 750 employees located in our facilities across the globe.
Lambda offers full spectrum clinical trial solutions empowered by more than 14 years of service to the biopharmaceutical and generic industry. At Lambda, our gamut of services under the clinical research domain are executed with comprehensive efforts, to deliver positive results. Led by a management team of highly qualified & experienced industry leaders, we apply innovative technologies, therapeutic expertise and a commitment to quality in order to help clients develop products safely, effectively and quickly.

2. Definitions

• Data Subject – An identified or identifiable living individual natural person.
• Personal Data – Any information relating to a data subject who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that data subject.
• Processing – Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Special category of personal data – data that reveals your racial or ethnic origin, religious, political or philosophical beliefs or trade union membership; genetic data; biometric data for the purposes of unique identification; or data concerning your health / sex life.
• Controller – means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• Processor – means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• Joint controller – Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers.
• Group company (Group) – includes a holding company, subsidiary, associate company (including a joint venture company) and a subsidiary of a holding company to which the company is also a subsidiary.

If you have any questions or concerns about our processing of your personal data, then please contact us using the contact details provided.

3. Data Protection Officer

Lambda has appointed a Data Protection Officer (DPO)or you to contact if you have any questions or concerns about the Lambda’s personal data policies or practices. If you have any questions or concerns about this data privacy notice or how we handle your personal data, please contact the DPO at [email protected]

4. When do we collect your personal data?

Direct interactions

You may give us your identity, contact and transaction data by filling in forms or by corresponding with us by post, phone and email or otherwise. This includes sharing of personal data for the following purpose:

• Subscribe to our publications or newsletters;
• Records of your interactions with us such as telephone conversations, emails and other correspondence and your instructions to us;
• Providing your feedback;
• By filling in forms,
• By sending us emails and text messages;
• By adding posts, reviews and other comments to our website;
• Request marketing material notifications to be sent to you;
• By interacting with us on social media platforms such as Facebook or twitter etc.;

Automated technologies or interactions

Log Files. Log information is data about your use of the Service, such as IP (Internet Protocol) address, browser type, referring/exit pages, operating system, date/time stamps, and related data, which is stored in log files.
Cookies. A cookie is a small data file transferred to your computer (or other device) when it is used to access our service. Cookies may be used for many purposes, including to enable certain features of our service and remember your preferences, your equipment, browsing actions and patterns, to better understand how you interact with our service, to provide you advertising on and off the service, and to monitor usage by visitors and online traffic routing. You may be able to instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from the online services you visit. If you do not accept cookies, however, you may not be able to use all portions of our service or all functionality of our service. Please see our cookie policy for further details.

Third parties or publicly available sources

We may receive aggregated personal data about you from various third parties as set out below:

• Technical Data from the following parties:
• Analytics providers such as Google, Facebook, etc.;
• Social media platforms such as Facebook, Twitter, Instagram and YouTube;
• Advertising networks and search information providers.
• What sort of personal data do we collect?

5. What sort of personal data do we collect?

We may collect, store, and use the following categories of personal data about you:

Identity Data

• Full name;
• Date of birth;
• Gender

Contact Data

• Contact address;
• Email address;
• Telephone numbers

Special Category of Personal Data

• Medical Information / Medical Reports
• Biometric Data
• Genetic Data

Technical Data

• IP address;
• We also track how often you visit and use our website. We do this via email and website cookies and similar tracking technology built into our website . Please see our cookie policy for further details.

Aggregated Data (sometimes referred to a pseudonymised data)

We also collect, use and share aggregated data (sometimes referred to a pseudonymised data) such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in the applicable law (s) as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this data privacy notice.

6. How and why do we use your personal data?

We will only use your personal data when the applicable laws allow us to. We will use your personal data in the following circumstances but not limited to:

• It is necessary for the establishment, exercise or defense of legal claims, for the purposes of carrying out the obligations and exercising our or your rights in the field of employment and social security and social protection law or;
• Based on your explicit consent;
• Where we need to perform the contract we have entered into with you;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where processing is necessary in order to protect the vital interest of the data subject or of another natural person.
• The processing is necessary for reasons of substantial public interest, or for official purposes or requested for or by the Central Bureau of Investigation (CBI), police or governmental authorities on a lawful basis;

Legitimate Interest

• Means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience;
• We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests;
• We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law); and
• We may also use your personal data in the following situations, which are likely to be rare:
• Where we need to protect your interests (or someone else’s interests); and
• Where it is needed in the public interest or for official purposes.

Purpose/ activity, type of data and lawful basis for processing

Note that we may process your personal data for more than one lawful ground depending on the specific purposes for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
However, we normally collect personal data from you where we have your consent to do so, where we need the personal data to perform a contract with you, or where the processing is in the legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In certain cases, we may also have a legal obligation to collect personal data from you or may otherwise need the personal data to protect your vital interests or those of another data subject.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data:
However, we may also use your personal data for other purposes that are not incompatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable laws.

7. Who does Lambda share my personal data with?

On occasion we may have to share your personal data with the parties set out below for the purposes set out.

Internal Third Parties

We operate globally and may transfer your personal information to individual companies of the Lambda affiliated companies or third parties in locations around the world for the purposes described in this privacy policy.

External Third Parties

• Regulators and other authorities: acting as processors or joint controllers who require reporting of processing activities in certain circumstances.
• Any new business partners: we may have over time, for example, in the event of a joint venture, reorganization, business merger or sale that affects us.
• The Police, local authorities, the courts and any other government authority: if they ask us to do so (but only if we doing so is lawful).
• Other people who make a ‘subject access request’: where we are required to do so by law.
• We may also share the information we collect where we are legally obliged to do so, e.g. to comply with a court order.
• Any social media posts or comments you send to us: (on the Lambda page) will be shared under the terms of the relevant social media platform (e.g. Facebook, Twitter, Instagram, LinkedIn or YouTube) on which they’re written, and could be made public. Other people, not us, control these platforms. We’re not responsible for this kind of sharing.
• Third parties: to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International Transfers

We share your personal data within the Group on need to know basis with confidential obligation mentioned here in. This may involve transferring your data outside the European Economic Area (EEA).
Some of our external third parties are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA. Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection.

8. How we protect your personal data?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach.  In the event that we are required by law to inform you of any unauthorized access to your personal information we may notify you electronically, in writing, or if permitted by law, by telephone. We will also notify any applicable regulator of a breach where we are legally required to do so. However, no method of transmission over the Internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information. 

9. How long will we keep your personal data?

To make sure we meet our legal data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it for in the first place. After that we will either delete it or anonymize it so that it cannot be linked back to you.
We retain personal data, we process where we have legitimate interest, performance of the contract, vital interest of data subject or of another natural person, performance of a task carried out in the public interest or in the exercise of official authority vested or for the purposes of satisfying any legal, accounting, or other regulatory reporting requirements or with your consent.
Automated Decision Making
Automated decisions are decisions concerning you which are made automatically on the basis of a computer determination (using software algorithms), without human intervention. We do not use automated decision making.

10. What are your data protection rights?

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current.

Your rights in connection with personal data

Under certain circumstances, by law you have the right to:

• Request access: To your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it;
• Request rectification: Of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. We may need to verify the accuracy of any new data you provide to us;
• Request erasure: This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. You can ask us to delete your data by contacting us at [email protected].
• Object to processing: Of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which means we can continue to process your personal data;
• Request the restriction of processing: Of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
  • if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. 
• Request for portability: Of your personal data to another party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;
• Right to withdraw consent at any time: Where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent; and
• Right to lodge a complaint with a supervisory authority: In case you consider that the processing of your personal data infringes any of your rights or provisions related to the laws and regulations in scope.

If you wish to exercise any of the rights set out above, please contact us at [email protected].

Fees for excessive or unreasonable requests

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Time limit to respond

We try to respond to all legitimate requests within 30 days. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

11. Third party links

Occasionally, at our discretion, we may include or offer third party products or services on our website. These third party sites have separate and independent data privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

12. Changes to this data privacy notice

We may update this data privacy notice from time to time in response to emerging legal, technical, contractual, regulatory or business developments. When we update our data privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material data privacy notice changes if and where this is required by applicable laws.

If you have any questions about this data privacy notice, please contact the DPO at [email protected]