privacy policy Market research
ELMA RESEARCH Ltd. is a market research institute specialised in the pharmaceutical field.
ELMA RESEARCH Ltd complies with the articles of the EPhMRA (European Pharmaceutical Marketing Research Association), and its specific Code of Conduct. It is also part of the ESOMAR (European Society of Marketing and Research), an organisation that outlines strict guidelines to ensure anonymity and confidentiality of the respondents who participate in market research studies.
Pursuant Data Protection ACT 2018 and to Article 13 of UK GDPR (hereinafter, “UK GDPR”), we inform you that the data you provide will be processed using procedures and methods designed to ensure that the processing of personal data is carried out in compliance with fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to privacy and security, personal identity
and the right to protection of personal data. To this end, we hereby inform you of the following.
1. OBJECT OF THE PROCESSING
The data processed by the Data Controller are those provided by you as a respondent in the context of your participation in market research activities and may include:
– contact details, such as name, email address, and telephone number;
– administrative and accounting data, such as Tax Identification Number or IBAN;
– personal data requested or collected in the course of the market research, gathered for the purpose
of enabling the conduct of the research itself.
In the context of personal interviews, whether conducted individually or in groups, voice recordings and images collected during participation in the market research may also be processed.
Where respondents are patients/consumers, the personal data collected may also relate to special categories of personal data, including:
– data concerning health status, collected for the purposes of preparatory activities necessary for the conduct of the research and during the performance of the market research;
– contextual information (such as, by way of example, medical conditions or medications taken), collected exclusively for the purpose of completing information relating to the reporting of any adverse events, which will be communicated anonymously to the pharmaceutical company.
The procedures and modalities for the conduct of each individual market research activity will be communicated to each respondent prior to the commencement of the research.
2. LEGAL BASIS OF THE PROCESSING
The legal basis of this processing can be observed:
– in the provision of consent, provided when deciding to participate in the market study
– in the performance of the obligations resulting from the relation set out by the client sponsoring the
– market study with the Patient to be surveyed;
– in the fulfilment of the obligations provided for by law.
3. DATA SOURCE
The personal data processed by the Data Controller is spontaneously provided by the interested party who agreed to participate in theresearch through specific contact forms and, only in some cases, it might come from third parties.
4. PURPOSE OF THE PROCESSING
The personal information and the possible variations that you will communicate to ELMA Research Ltd in the future are collected and processed only for the following purposes:
4.1. Execution of a contract or fulfilment of mandatory obligations:
– accounting and administrative management;
– management of activities related to the transparency of financial flows;
– legal obligations to report adverse events, anonymously; if needed, the patient will be asked to
– consent to passing their name to the sponsoring pharmaceutical company.
Pharmacovigilance Management
In accordance with pharmacovigilance regulations, any adverse events that may emerge during the market research must be reported to the sponsoring pharmaceutical company. In the case of patients/consumers, reports are always submitted in anonymised form. In the case of physicians/healthcare professionals, and where necessary, specific consent will be obtained in order to provide the pharmaceutical company with the name of the respondent involved in the market research.
4.2. Purposes related to the market research in which the data subject has agreed to participate:
– processing of data to define the reference sample;
– conduct of the research study;
– provision of incentives to respondents in accordance with industry standards;
– improvement of accuracy in the definition of research samples.
Data will be collected through the various methods of conducting the research in which the data subject may choose to participate:
– telephone interviews;
– online interviews;
– individual or group face-to-face interviews.
Telephone and face-to-face interviews may be audio and/or video recorded. Interviews (individual or group) may also be observed (live or recorded) by representatives of the commissioning party of the research and may be transmitted via video streaming, always subject to the data subject’s explicit consent provided at the end of this document.
The data subject may be contacted by email or telephone, depending on the contact details he/she chooses to provide.
4.3.Further purposes based on the data subject’s explicit consent, collected for each individual survey:
– transmission of the data subject’s contact details to the Drug Safety Department of the Sponsoring Company should you mention, an adverse event and/or relevant safety information during the market research discussion; if needed, the patient will be asked to consent topassing their name to the sponsoring pharmaceutical company.
– transmission of a copy of the audio recording of your interview to the sponsoring company, to allow them to better understand the research findings, as specified in the consent from about the delivery of the audio files;
– transmission of an audio/video file which portrays the patient / the respondent to the sponsoring company;
– transmission and publication of the respondent’s / patient’s image, as per the Consent Form on the exercise of the right of image
– Publication and dissemination of the respondent’s / patient’s image via the channels used by the sponsoring company, as per the Consent Form on the exercise of the right of image.
5. PROCESSING METHOD
Your personal data is processed by means of the operations described in Article 4 No. 2) of the GDPR and, specifically: collection, recording, organisation, storage, consultation, processing, alteration, selection, retrieval, alignment, use, combination, blocking, communication, erasure and destruction of data. In particular:
– Data collection from the data subject, by completing paper forms or business applications;
– Registration and processing in electronic format or hard copy;
– Profiling based on collaboration in previous studies, prior to specific consent provided by the patient
at the end of this document;
– Organisation of files in a mainly automated form, through company applications and computerised
data.
– Clustering of name lists within the database based on the historicization of previously performed
researches.
The data will be processed using instruments that guarantee their confidentiality, integrity and availability. This data will not be subject to disclosure or dissemination.
6. DATA RETENTION
Data Controller is in charge of processing personal data for the time needed to fulfil the purposes mentioned above, in particular:
– personal data: 5 years from the last collaboration;
– administrative and accounting data: 10 years or as required by current regulations;
– audio recording of the interview with the respondent / patient: from 3 to 10 years, or for the time
required by the Sponsoring Company to meet quality check requirements for Drug Safety issues.
The information collected during the interviews is stored in a pseudo-anonymous form and is not directly attributed to you by name, in accordance with the market research codes of conduct.
7. ACCESSING THE PROCESSING
For the purposes described in point no. 4, the data will be made accessible to the employees/partners of Elma Research Ltd in their capacity as authorised processing parties. The data may also be accessible to third parties, subject to them being appointed Data Processorswhere necessary, who perform outsourced activities on behalf of Elma Research Ltd, such as:
– Fiscal Consultants/Banking Institutes for the payment of compensations;
– Providers of support services that are required to conduct the research activities.
8. DATA COMMUNICATION
The data collected will not be made available to any third party, but the results of the research will always be reported in an aggregated form to the sponsoring company of this research whilst respecting patient’s’ anonymity. The interview may be made accessible to the subject which commissioned this research to Elma Research Ltd. but, in this case, you will be asked to give your consent, as per point 4.3.
9. DATA TRANSFER
Personal data will be managed and stored on servers based in United Kingdom or within the European Union in the secure care of the Data Controller and/or third-party companies duly tasked and appointed as Data Processors. If data is transferred to third countries, the security levels established by Article 45 of the UK GDPR will be guaranteed.
10. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF REFUSING TO RESPOND
The respondent / patient is required to provide their personal information. They are also required to provide information on their health and their conditions, otherwise it will not be possible to proceed with the research. They have option to choose whether to provide their own image or not and to accept audio/video recording or not.
11.DATA SUBJECTS RIGHTS
You have the right to view/listen to the audio-video recordings and request their destruction at any time. According to the provisions of the GDPR, the data subject has the following rights vis-à-vis the Data Controller:
– to obtain confirmation as to whether or not personal data is being processed and, if it is, to obtain access to the personal data (Right of access, Article 15 of UK GDPR);
– to obtain the correction of inaccurate personal data that concerns them without undue delay (Right to rectification Article 16 of UK GDPR);
– to obtain the erasure of personal data concerning them without undue delay and the data controller is obliged to delete the personal data without undue delay, if certain conditions are met (Right to be forgotten Article 17 of UK GDPR);
– to obtain the restriction of processing in certain cases (Right to restriction of processing Article 18);
– to receive the personal data that concerns them provided in a structured, commonly-used and machine-readable format and have the right to transmit such data to another Data Controller, without hindrance from the controller to which the personal data have been provided, in certain cases (Right
to data portability Article 20 of UK GDPR);
– to object to the processing of personal data that concerns them at any time, for reasons connected
with their particular situation (Right to object Article 21 of UK GDPR);
– to receive, without undue delay, notification of the personal data breach suffered by the Data
Controller (Article 34 of UK GDPR);
– to withdraw their consent at any time (Conditions for consent Article 7 of UK GDPR ).
– the right to lodge a complaint with the Commissioner
As applicable, the data subject may exercise the aforementioned rights by contacting the Data Controller by e-mail or telephone. The Data Controller reserves the right to verify the identity of the data subject before taking further actions based on their request.
12. DATA CONTROLLER
ELMA RESEARCH LTD 3 Waterhouse Square 138-142 Holborn London EC1N 2SW (United Kingdom).
The data subjects can exercise the rights referred to in point 11 of this policy by sending an e-mail to: phv.compliance@elmaresearch.com
13. DATA PROTECTION OFFICER (DPO) – CONTACT DETAILS
Frareg S.r.l. Viale Jenner 38, 20159 Milano, tel. 02 69010030 Referente Ing. Barbosa. Email dpo@frareg.com
14. UPDATES TO THIS PRIVACY NOTICE
This Privacy Notice may be subject to changes. Any material modifications will be communicated to the data subjects via email or through publication on the company’s websites
Last update February 2026