Privacy Notice

This notice describes how the Celiac Disease Foundation of 5850 Canoga Avenue, 4th Floor
Woodland Hills, CA 91367, USA (“CDF”, “we”, “our” or “us”) will make use of your personal data when you volunteer and participate in our study to understand the experiences and preferences of adults diagnosed with coeliac disease. It also describes your data protection rights, including the right to object to some of the processing which we carry out. More information about your rights, and how to exercise them, is set out in the “Your choices and rights” section.

See the “Controllers” section for information on how to contact us in your country.

1. Type of personal data collected

We collect and process your personal data when you complete our screening and study questionnaires and provide consent for us to process your personal data.

The personal data we collect directly from you include:

Category	Details
Contact information	Your first name and last name, age category, city and country of residence, email address
Health information	Your coeliac disease symptoms, diagnosis, medical care and dietary information
Treatment information	Your treatment preferences including your preferences in relation to a potential clinical trial

2. How do we use this information, and what is the legal basis for this use?

We will only use your personal data for the purposes and legal bases set out below:

Purpose	Legal Basis
We collect your Contact Information when you respond to: – CDF’s advertisement communications or applicable patient advocacy organization communication or a social media post and/or radio broadcast, and when we check your eligibility to participate in the survey using the link in the communication.	Your consent.
We store and use your Contact Information to make your compensation payment where permitted by law.	We rely on our legitimate interest to make payment as you have consented to participate in the survey.
We anonymise your Contact Information, Health Information and Treatment Information to analyse your survey responses so that we can understand how coeliac disease treatments could be developed.	Your consent.
We use your Contact Information, Health Information and Treatment Information to communicate with you regarding future studies, updates, and potential opportunities to participate in clinical trials, as well as to provide you with relevant information and materials.	Your consent.
We use your Contact Information, Health Information and Treatment Information to ensure compliance with our policies and applicable laws, as well as protecting our business interests and legal rights.	Complying with a legal obligation and our legitimate interest in carrying out internal reviews and defending any allegations or claims made against us.

Where we process your personal data with your consent, you can withdraw this consent at any time by sending an email to the contact information set out in the “Controllers” section below. Please note that a withdrawal of consent does not have any effect on the collection and use of your personal data by us before you withdrew your consent.

There are instances where we have a legitimate interest in using your personal data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. When processing personal data based on a legitimate interest, we conduct a balancing test as required by data protection law to document our interests, to consider what the impact of the processing will be on individuals and to determine whether the individual’s interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of the notice.

In some instances, we are required to comply with legal, regulatory and other requirements under laws in many countries where we operate. We have to use your data to meet these obligations.

3. Your Rights

You may be entitled under applicable law to ask us for a copy of your personal data, to correct it, erase or restrict its processing, or to ask us to transfer some of this information to other organisations. You may also have rights to object to some processing. These rights may be limited in some situations – for example, where we can demonstrate we have a legal requirement to process your personal data.

If you have any concerns about how we process your personal data or wish to exercise any of your rights or wish to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us using the contact details set out in the “Controllers” section below.

We hope that we can satisfy any queries you may have about the way in which we process your personal data. However, if you have unresolved concerns, you also have the right to complain to the data protection authority in the location in which you live, work or believe a data protection breach has occurred.

4. How we share your Personal Data and International Transfers

CDF use third-party providers (including IT service and support providers e.g. SurveyMonkey and cloud hosting providers) located in other jurisdictions. When transferring personal data to other countries outside or Europe that are not subject to an “adequacy decision” by the EU Commission (or equivalent), we generally rely on EU Commission approved standard contractual clauses. Information on the relevant mechanism can be provided upon request to each of us using the information in the section “Controllers” below.

In addition, in the event of any reorganization, restructuring, merger or transfer of all or any portion of our business or assets, your personal data may be transferred to our affiliates or related bodies corporate.

5. Data Retention Policy

We maintain your information for the duration of your active involvement in the study and then as reasonably necessary for the purposes set out above, in accordance with applicable laws. For more information on your particular circumstance, please contact us using the contact information listed below.

6. Controllers

The Celiac Disease Foundation is an organization established in the US. You can contact us directly using the e-mail address info@celiac.org or icureceliac@celiac.org or our Contact Us form here.

6. Privacy Notice Updates

This Notice may change from time to time. We will send an update to you using your Contact Information where required by data protection laws.