Last Updated Date: November 2023
Subject Well, Inc. and its group entities (“SubjectWell”, “we”, or “us”) offer clinical trial participant recruitment services (the “Services”). This Privacy Policy sets out how we use and protect your Personal Information and your rights and choices with regard to that information. This Privacy Policy applies to Personal Information collected by or on behalf of SubjectWell, including information collected through our website https://subjectwell.com and mobile versions of our websites (the “Site”) or anywhere else we display this Privacy Policy. It also applies to information collected by email, phone, or other offline communication mechanisms. For information on how we handle information collected from registered end users or applicants for the Services, please refer to our recruiting website at: https://trialsearch.com .
By visiting or using the Site, you accept and consent to the terms of this Privacy Policy in effect at the time of your visit or use.
For purposes of this Privacy Policy, “Personal Information” means information that directly or indirectly identifies you or can be used to identify you as an individual.
When you use the Site or otherwise communicate or interact with us, we collect information that you provide to us directly. For example, we collect information in the following circumstances: when you contact us; when you inquire about or apply for a job; and when you otherwise communicate with us. You may choose whether or not to provide or disclose your Personal Information in connection with your use of the Site. If you choose not to provide the Personal Information we request, you may still visit and use parts of the Site, but may be unable to access or use certain features of the Site.
The Personal Information you provide to us may include the following:
Certain information is collected automatically on the Site by means of various software tools. We have a legitimate interest in using such information to assist in log-in, systems administration purposes, information security and abuse prevention, to track user trends, and to analyze the effectiveness of the Site. Alone or in combination with other information, such automatically collected information may constitute Personal Information. Some of our service providers (described in Section V., below) may use cookies or other methods to gather information regarding your use of the Site and to track your activities over time and across sites to provide advertising services to us.
Some browsers have a “Do-Not-Track” feature that lets you tell websites that you do not want to have your online activities tracked. When you choose to turn on the Do-Not-Track setting in your browser, your browser sends a signal to websites, analytics companies, ad networks, plug-in providers, and other web services that you may encounter while browsing the Internet, instructing them to stop tracking your activity via cookies or other online tracking technologies. The Site does not currently respond to browser based Do-Not-Track signals. For information regarding Do-Not-Track and how to enable this setting if available on your devices, please see https://allaboutdnt.com.
We may use Personal Information obtained through the Services in the following ways:
We may disclose Personal Information you provide to us or that we collect automatically on the Site or in and through the Services with the following categories of third parties:
With your consent (unless otherwise permitted by applicable law) we use the Personal Information you provide us to send you information on our products and Services and other information based on the interests that you have indicated to us. You have the right to opt out of getting those messages. If you do not wish to receive these messages, click the unsubscribe link in your email. Please note that these selections are not permanent; they may be changed in the event you register for other Services or communications and consent to receive marketing messages. Please also note that even if you unsubscribe from commercial email messages, we may still email you non-marketing emails related to your account or the Services for which you have registered. You may also email us at privacy@subjectwell.com for assistance.
The Site may contain links to other sites, which are not owned or operated by us or our affiliates. We provide such links only as a convenience, and the inclusion of a link on the Site does not imply our endorsement of the linked site. Other sites may also reference or link to our Site. If you provide any Personal Information through a third-party website, your transaction will occur on such third party’s website (not our Site) and the Personal Information you provide will be collected by, and controlled by the privacy policy of, that third party. We are not responsible for the privacy practices or the content of such third-party websites, including such websites’ use of any Personal Information that you provide to them.
The information in this section applies to residents of California. Please contact us at privacy@subjectwell.com if you have any questions about this Privacy Policy, including this section specific to California residents, or if you would like a printed copy of this Privacy Policy. You may also print a copy of this Privacy Policy by selecting the “Print” button in your web browser.
In accordance with the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), this section describes the Personal Information we collected about California residents in the last 12 months, the sources of that information, our business or commercial purposes for collecting the information, and the third parties with whom we shared that information.
We collected the information listed in the table below from the following sources: directly from you, your authorized personal representative, or from third parties (such as medical providers or other entities you have authorized to share your Personal Information with us).
In some cases, we may share your information with our service providers or contractors that help us operate our business such as data storage or IT providers. We may also share your information with third parties, such as when required by law, to provide information or services you request, and pursuant to you consent or authorization.
For purposes of this Privacy Policy, when we use the term “third party,” we mean entities that are not service providers or contractors providing services on our behalf and that are not entities with whom you interact directly.
The categories of third parties with whom we may share your Personal Information for business purposes include: law enforcement or other governmental authorities or agencies, and clinical trial investigators and sites when applicable to your engagement with our services.
In the last 12 months, we have collected and, disclosed for a business purpose each of the categories of Personal Information noted in the table below, to the categories of recipients listed. We do not share your personal information for cross-context behavioral advertising or sell your personal information for monetary or other consideration and have not done so in the last 12 months.
Please refer to the section of this Privacy Policy above titled PURPOSES FOR OUR COLLECTION AND USE OF PERSONAL INFORMATION for descriptions of the business or commercial purposes for which we collected the information.
Under the CCPA, California residents have certain rights with regard to their Personal Information. Those rights may only apply in certain circumstances and may be subject to limitations or exceptions. A summary of those rights is provided below as well as information on how to exercise your rights. Please note that we will require certain identifying information about you as necessary for us to verify your request in accordance with applicable law.
We will not discriminate against you for exercising any of the rights noted above. However, we may offer certain financial incentives, charge reasonable fees related to your requests, or deny your right to know, right to access, or right to deletion in accordance with applicable law.
You can exercise these rights yourself or you can designate an authorized agent to make a request on your behalf. If you would like an authorized agent to submit a request on your behalf, please send us an email at privacy@subjectwell.com for instructions and details on proof and information required for use of an authorized agent or select “Authorized Agent” when submitting the online form.
Under California Civil Code § 1798.83, California residents with whom we have a business relationship can request information about the types of personal information, if any, we shared with third parties for the direct marketing purposes of the third parties and the identities of the third parties with whom we shared such information in the immediately preceding 12 months. We do not share your Personal Information with third parties in this manner and have not done so in the last 12 months. You may request more information by contacting us using the contact information at the bottom of this Privacy Policy.
The information in this section applies to residents of Virginia. This section addresses additional rights to Virginia residents.
In accordance with the Virginia Consumer Data Protection Act (“VCDPA”), this section describes the Personal Information we collect about Virginia residents. Please refer to the corresponding sections of this policy above for details on the following:
Under the VCDPA, Virginia residents have certain rights with regard to their Personal Information. Those rights may only apply in certain circumstances and may be subject to limitations or exceptions. A summary of those rights is provided below as well as information on how to exercise your rights. Please note that we will require certain identifying information about you as necessary for us to verify your request in accordance with applicable law.
You can exercise these rights yourself or you can designate an authorized agent to make a request on your behalf. If you would like an authorized agent to submit a request on your behalf, please send us an email at privacy@subjectwell.com for instructions and details on proof and information required for use of an authorized agent.
Where we process Personal Information pertaining to individual located in the European Economic Area (“EEA”) or Switzerland, those individuals are entitled to ask us for an overview of the Personal Information we have about them and also to access, correct or delete certain Personal Information, restrict processing of their Personal Information, or to ask us to transfer Personal Information to other organizations. Certain individuals can also object to some processing of their Personal Information and, where we have asked for their consent, they can withdraw their consent at any time. Insofar as Personal Information about them is processed, certain individuals also have a right to know more about the protection we apply when transferring Personal Information to areas outside the EEA.
Note that we are not legally obligated to agree to such requests in all circumstances, and in certain circumstances, agreeing to a request may be infeasible – for example, a deletion request when we are required by law to maintain the Personal Information. Please also note that we are not able to act on any of the above requests if we are not in a position to identify an individual filing such request.
Where applicable, these rights can be exercised by completing the request form available here: or by sending us an email through the contact details further below. Depending on where you live, you may have a right to lodge a complaint with a supervisory authority or other regulatory agency if you believe that we have violated any of the rights concerning your Personal Information. We encourage you to first reach out to us at privacy@subjectwell.com so we have an opportunity to address your concerns directly before you do so. We are committed to compliance with the General Data Protection Regulation (“GDPR”) where applicable, so please contact us through the details listed below if you have any questions about these rights.
SubjectWell is a U.S.-based company with domestic and international business clients. As a result, Personal Information that we collect through the Site may be transferred to our U.S. offices to permit us to comply with our legal and contractual obligations, to provide information and services to prospective and current clients, and to perform related business activities. In addition, we may work with third-party service providers in the U.S. and in other countries to support our business activities. Thus, Personal Information may be transferred to, stored on servers in, and accessed from the U.S. and countries other than the country in which the Personal Information was initially collected. In all such instances, we use, transfer, and disclose Personal Information solely for the purposes described in this Privacy Policy.
Subject Well, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Subject Well, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Subject Well, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Subject Well, Inc. commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact us via email at: privacy@subjectwell.com.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Subject Well, Inc. commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.
These recourse mechanisms are available at no cost to you. Damages may be awarded in accordance with applicable law. Please note that if your complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Data Privacy Framework Panel. Pursuant to the Data Privacy Framework, SubjectWell remains potentially liable for the transfer of Personal Information to third parties acting as our agents unless we can prove we were not a party to the events giving rise to the damages.
In cases of onward transfer to third parties of Personal Information of individuals in the EEA, UK or Switzerland received pursuant to the Data Privacy Framework, SubjectWell is potentially liable.
The Federal Trade Commission has jurisdiction over Subject Well, Inc.’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).
We keep Personal Information for as long as it is needed to fulfill the purposes for which it was collected, to provide our Services, to deal with possible legal claims, to comply with our business interests and/or to abide by all applicable laws. Thereafter, we either delete Personal Information about you or de-identify it. Please note that even if you request the deletion of Personal Information about you, we may be required (by law or otherwise) to retain the Personal Information and not delete it. However, once those requirements are removed, we will delete Personal Information about you in accordance with your request.
We follow generally accepted industry standards to protect the Personal Information we collect or process through the Site. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect Personal Information, we cannot guarantee its absolute security.
The Site is not intended for children under the age of 13. Accordingly, we do not intend to collect Personal Information from anyone we know to be under 13 years of age through the Site. If we become aware that a child under age 13 has provided Personal Information through the Site, we will delete such information from our files.
This Privacy Policy may change from time to time, effective from the date mentioned in the updated version of the Privacy Policy. Please check the Site periodically to review such changes in the Privacy Policy. We may email periodic reminders of our agreements and policies in the event of a material change.
If you have any questions about this Privacy Policy or about our privacy or data security practices, please contact us or our Data Protection Officer via the following:
E-mail: privacy@subjectwell.com Address: 8300 N MoPac Expressway Suite 300 Austin, TX 78759 USA
You can also contact our representatives in the European Union and United Kingdom:
European Data Protection Office (EDPO): EDPO online request form: https://edpo.com/gdpr-data-request/
In writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium.
UK General Data Protection Regulation (GDPR) – UK Representative:
EDPO online request form: https://edpo.com/uk-gdpr-data-request/
In writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom.
