Skip to main content

Clinical studies and data privacy

Clinical studies represent a major part of a new therapy’s overall time to market and can typically run for at least six to seven years across the industry as a whole.

When we plan and conduct clinical research, we involve patients wherever possible throughout the process: they, as well as physicians, payers and other healthcare professionals, all have a voice in designing the studies. For example, patients are consulted on the study design concept, including the clinical design with a specific emphasis on patient-relevant measurements, and how educational materials can be developed to support patients and their families.

By using this patient-led approach, we aim to achieve outcomes that will be meaningful and helpful to patients.

Throughout our clinical studies, patient safety is a priority. There are, rightly, stringent requirements regarding patient safety in clinical studies. It is important to collect, analyse and act upon any new information about the benefits and risks of our products whether in clinical research or once a therapy is on the market.

Confidentiality and personal data protection

To perform clinical studies and to meet the studies’ objectives, processing of personal data is required. This section provides information regarding the use of patients’ personal data in Sobi’s studies, and patients’ rights in relation to personal data, which is required by applicable data protection laws including the EU Regulation 2016/679 called the General Data Protection Regulation (GDPR).

The legal basis for collecting and processing patients’ personal data for the above-mentioned purposes is consent provided by him/her or according to local requirements, the legitimate interest and scientific research in the public interest, as prescribed by EU General Data Protection Regulation 2016/679 (section 6.1 (f) and 9.2(j)).

Personal data may also be processed for the purpose of complying with legal requirements related to the conduct of a clinical study i.e. safety reporting, archiving of clinical data, and disclosure of clinical data to national competent authorities in the course of an inspection. The legal basis for processing such personal data is to comply with a legal obligation and, that processing is necessary for reasons of public interest in the area of public health (EU General Data Protection Regulation, “GDPR”, article 6(1)(c) and 9(2)(i)).

Patients enjoy rights under GDPR whether they live in the European Union (EU)/European Economic Area (EEA) or not, because Sobi is located in Sweden, a member state of the EU/EEA.

What personal data is being processed?

During a study, personal information of patients will be collected, processed, and archived by Sobi, as the study sponsor. Such information may include patients’ initials, date of birth/age, sex as well as health data.

How will personal data and privacy be protected?

Personal data collected and processed in a study will be coded. Sobi as the study sponsor will only process coded personal data. The coded personal data can only be directly traced back to patients by using the code’s key, which remains with the study doctor. Only the study doctor and authorised personnel at the study hospital/clinic can connect the coded data to patients’ identity.

To whom will personal data be transferred or disclosed?

To conduct the study, coded study data may be transferred to personnel and contractors of Sobi. Coded study data may also be shared with successors and partner companies of Sobi. Coded study data may also be disclosed in interactions with regulatory authorities. All documents containing study data which leaves the study hospital/clinic will be coded in such a way that patients cannot be directly identified. If required for verification of study procedures and data, authorised representatives of Sobi and regulatory authorities may be granted access to non-coded personal data (which means that patients may be directly identified by such persons), including parts of patients’ medical records relevant for the study. Any reports, publications or presentations resulting from the study will never contain patients’ names or other personal data that directly identifies patients.

How long will personal data be stored?

Study data, including personal data, will be stored as long as needed according to legal and regulatory requirements.

Transfer to, or processing in, countries outside the EU

In a study it may be necessary that patients’ coded personal data and samples are transferred to, or processed in, countries outside the EU/EEA, where the laws may not protect personal data to the same extent as laws in the EU/EEA. When personal data and samples are transferred to, or processed in, such countries outside the EU/EEA, the study sponsor is responsible for taking all reasonable steps to ensure that the level of protection and confidentiality of personal data is the same as required in the EU/EEA.

Patients can withdraw consent for further collection of their personal data

Patients may always withdraw consent for further collection of personal data by contacting the study doctor. If consent is withdrawn, patients will no longer be able to participate in the study. Data that has already been collected up until the date when consent was withdrawn will continue to be processed, but no new data will be collected.

Patients’ rights regarding their personal data

Patients have the right at no cost to access the personal data collected and processed during the study and ask for corrections of any inaccurate data. Patients have the right to complain to their study doctor about how personal data is handled. Patients also have a right to complain to a supervisory authority that is responsible for enforcing data protection law. For example, they can complain to the supervisory authority in the country where they live. Patients always have a right to complain to the supervisory authority in Sweden, the Swedish Data Protection Authority (Sw. Integritetsskyddsmyndigheten).

For more information regarding the processing of personal data in Sobi’s studies and patients’ rights in relation to such processing, please contact Sobi's data protection officer at [email protected].