Submit RFP/RFI
Submit RFP/RFI
Search
Submit RFP/RFI
Submit RFP/RFI
Search
Submit RFP/RFI
Submit RFP/RFI
Search

Rho Privacy Notice for Commercial Processing of Clinical Trial Personnel Data

Effective on: November 1, 2025
Last updated on: October 28, 2025

Introduction

Rho, Inc., along with its affiliate entities (collectively “Rho”, “we”, “us”, “our”), takes the protection of your personally identifiable information (“Personal Data”) very seriously. This Rho Privacy Notice for Commercial Processing of Clinical Trial Personnel Data (the “Notice”) provides you with information about what we do with information that can be used, directly or indirectly, to identify you (“Personal Data”), how we protect it, and your privacy rights.

What Is Covered by this Privacy Notice?

This Notice addresses data subjects whose Personal Data we receive and process in connection with clinical trials we conduct on behalf of our customers, including principal investigators, doctors, nurses, and other investigative healthcare practitioners and clinical trial site staff (collectively, “Trial Personnel”).

Our Role with Respect to Your Personal Data

Within the scope of this Notice, Rho acts as a “data controller” or “business” for the Personal Data we process, which means we decide how and why your Personal Data is collected and processed.

Lawful Basis for Processing

Within the scope of this Notice, we may process your Personal Data on the lawful basis of our legitimate interest in conducting feasibility assessments of clinical trial sites and investigators on behalf of existing and prospective customers engaging us as a contract research organization (CRO).

If the Israel Privacy Protection Law applies to our processing of your Personal Data, such processing is based on your consent, and you may inform us via the contact information provided below if you do not consent to this processing.

What Personal Data We Process and How We Obtain It

We collect and process the following categories of your Personal Data when you provide it to us in the context of your activities as Trial Personnel:

  • First and last name, postal address, postal code, phone number, email address, or other similar identifiers
  • Job title, company/employer name, company/employer address, job email, job phone number, previous work experience, education, qualifications, and area(s) of medical research specialty(ies), including, in some cases, full curricula vitae (“CVs”)

We will not collect additional categories of your Personal Data without informing you.

For What Purposes Do We Use Your Personal Data?

We process your Personal Data for the purpose of conducting feasibility assessments of clinical sites and investigators in order to assist our existing and prospective customers, who are typically biopharmaceutical or biotechnology companies, in identifying appropriate sites in which to conduct planned clinical trials of their products.

In order to enable this feasibility assessment process, we maintain an internal database of Trial Personnel that we work with and, based on consultation of that database during our sales and study feasibility processes, we identify whether your professional background and experience may align with the clinical research our customers plan to engage in (collectively, the “Commercial Activities”).

The Commercial Activities do not include making your Personal Data available publicly.

How Long We Keep Your Personal Data

We will retain your Personal Data for as long as is necessary to fulfil the purpose for which we collected your Personal Data and any other permitted linked purpose and in compliance with our data retention policies.

Sharing Personal Data with Third Parties

We disclose Personal Data that we hold about you to existing and prospective customers.  In addition, such Personal Data may be stored and processed in software systems provided by and accessible to third-party service providers. The categories of Personal Data we share with each category of third party are as follows:

  • We share your name, title, company/employer name, country, work experience, education information, qualifications, and areas of research with our existing and prospective customers.
  • We share your name, contact information, employment information, work experience, education, qualifications, and areas of research with:
    • Email software providers;
    • Office productivity software providers;
    • Customer Resource Management (CRM) software providers; and
    • Providers of other third-party software systems that support our Commercial Activities.

We may also disclose your Personal Data to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties). If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

We may also disclose your Personal Data if we sell or transfer all or some of our company’s business interests, assets, or both, or in connection with a corporate restructuring. Finally, we may disclose your Personal Data to our Affiliates, but only if necessary for business purposes, as described in the section above.

We do not sell your Personal Data, nor do we share your Personal Data with third parties for cross-context behavioral advertising purposes.

We reserve the right to use, transfer, sell, and share aggregated and anonymous data for any legal purpose. Such data does not include any Personal Data. The purposes may include analyzing usage trends or seeking compatible advertisers, sponsors, and customers.

International Data Transfers

Sharing your personal data in connection with any of the above purposes may involve transferring it to third parties in countries outside of your own whose data protection and privacy laws may not be equivalent to, or as protective as, those that exist in your country of residence. Many of these third parties are situated in the United States of America.

We will only transfer your Personal Data to third parties in countries not recognized as providing an adequate level of protection to personal data when there are appropriate safeguards in place. These safeguards may differ depending on the jurisdiction in which you reside. For example, if you reside in the EEA, these safeguards may include the Standard Contractual Clauses as approved by the European Commission under Article 46(2) of the General Data Protection Regulation (2016/679) of the European Union (“EU GDPR”). If you reside in the UK, these safeguards may include the UK’s International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses approved by the European Commission under the EU GDPR. If you require further details, please contact us using the contact information provided in this Notice.

Please note that we will only transfer your Personal Data outside of your country in accordance with applicable laws.

Privacy of Children

Our Commercial Activities are not directed at, intended for use by, or intended to process the Personal Data of children under the age of 16.

Data Integrity & Security

We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your Personal Data from unauthorized processing.

Your Privacy Rights

Depending on the jurisdiction where you reside, you may have any or all of the following specific rights regarding your Personal Data that we collect and process:

  • Right to Know What Happens to Your Personal Data: This is also known as the right to be informed, which means the right to obtain from us all information regarding our data processing activities that concern you. This Notice is how we inform you about how we process your Personal Data.
  • Right to Know What Personal Data Rho Has About You: This is also known as the right of access, which is the right to ask whether or not we process Personal Data about you, and for the full details of the Personal Data we hold on you.
  • Right to Change Your Personal Data: This is also known as the right to rectification, which means the right to ask us to correct without undue delay anything that you think is wrong with the Personal Data we have on file about you, and to complete any incomplete Personal Data.
  • Right to Delete Your Personal Data: This is also known as the right to erasure, which means the right to ask for your Personal Data to be deleted. Sometimes we can delete your information, but other times it is not possible for either technical or legal reasons. If that is the case, we will consider if we can limit how we use it. We will also inform you of our reason for denying your deletion request.
  • Right to Ask Us to Limit How We Process Your Personal Data: This is also known as the right to restrict processing, which means the right to ask us, in certain circumstances, to only use or store your Personal Data for certain purposes. For example, you can ask us not to process your Personal Data for purposes of targeted advertising.
  • Right to Opt Out of the Sale or Sharing of Your Personal Data: This is also known as the right to opt out, which means the right to ask us not to sell or share your Personal Data at any time. However, as noted above we do not sell your Personal Data or share your Personal Data with third parties for cross-context behavioral advertising purposes.
  • Right to Ask Us to Stop Using Your Personal Data: This is also known as the right to object, which means the right to request that we stop using your Personal Data. You have this right under applicable law where we rely on a legitimate interest of ours (or of a third party). If you make this request, we will stop using your Personal Data unless there are legal or other legitimate grounds for continuing to process your Personal Data.
  • Right to Port or Move Your Personal Data: This is also known as the right to data portability, which is the right to ask for and receive a portable copy of your Personal Data.
  • Right to Withdraw Your Consent. Where our processing of your Personal Data is based on your consent, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent.
  • Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights.
  • Right to Make a Complaint to the Controller: You may have the right to make a complaint to us, as the controller of your personal data, if you believe that we have infringed our obligations relating to the protection of your personal data under applicable privacy law.

How Can You Exercise Your Privacy Rights?

To exercise any of the rights described above, please submit a request by reaching out to us via the contact information provided in the “Contact Us” section below.

When you make a privacy rights request, we will need to verify that you are either the data subject to whom the request relates or that you have authority to act on behalf of the data subject, and we may require additional information to confirm that you are who you say you are.

You may also submit a privacy rights request through an authorized agent. In such cases, we will need to verify the agent’s authority to act on your behalf. When contacting us, the agent should provide us with proof that you gave signed permission to submit this request, a valid power of attorney on your behalf, or proof of parental responsibility or legal guardianship. Alternatively, you may directly contact us by using the contact details above to verify your identity and confirm with us that you gave the agent permission to submit this request.

We will confirm receipt of your request within ten (10) business days, describe our identity verification process (if needed), and tell you when you should expect a response, unless we have already granted or denied the request.

Please allow us up to one month from the day we receive your request to reply to your requests. If we need more time (up to 90 days in total), we will inform you of the reason why and the extension period in writing.  If we cannot satisfy a request, we will explain why in our response.

We will not charge you a fee for processing or responding to your requests. However, we may charge a fee if we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request.

Right to Lodge a Complaint with a Supervisory Authority

You may have the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data.

• If the EU GDPR applies to our processing of your Personal Data, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or of the alleged violation location.
• If the UK GDPR applies to our processing of your Personal Data, you can lodge a complaint with the UK Information Commissioner’s Office.
• If the Israel Privacy Protection Law applies to our processing of your Personal Data, you can lodge a complaint with the Israel Privacy Protection Authority.

Contact Us

If you have any questions about this Notice or our processing of your Personal Data, or want to submit a verifiable rights request, please contact us by:

1. Calling us at +1 919-408-8000
2. Emailing us at data_privacy@rhoworld.com
3. Writing to us at: Rho, Inc.,
Attn: Data Protection Officer
2635 East NC Hwy 54
Durham, NC 27713
USA; or

4. Filling out the online contact form in our website privacy notice at https://rhoworld.com/privacy-notice.

If the EU GDPR applies to our processing of your Personal Data, you may also contact our European Union Representative, DOKUMEDS SIA, by email at privacy_europe@rhoworld.com or in writing at:

Dokumeds SIA
Attn: Data Protection Officer
Katrinas dambis 20
Riga, LV-1045 Latvia

If the UK GDPR applies to our processing of your Personal Data, you may also contact our United Kingdom Representative, RhoWorld UK LTD, by email at Data_Privacy@rhoworld.com or in writing at:

RhoWorld UK LTD
Ashcombe House,
5 The Crescent, Leatherhead, Surrey
United Kingdom, KT22 8DY

Please allow up to one month for us to reply.

Changes to this Notice

If we make any material change to this Notice, we will provide you with an updated copy. We will also update the “Effective” date.

Scroll to Top