1. Introduction
SPM Clinical Research Consulting LLC (“Company,” “we,” “us,” or “our”) is a U.S.-based clinical research consulting firm providing services to clinical trial sites, sponsors, contract research organizations (CROs), pharmaceutical companies, and biotechnology companies.
This Privacy Policy explains how we collect, use, disclose, and safeguard information when you:
- Visit our website (https://spmclinicalresearchconsulting.com)
- Communicate with us
- Engage us for consulting services
This Policy is designed to comply with applicable U.S. federal and state privacy laws, including:
- The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)
- Other applicable state privacy statutes
2. Categories of Information We Collect
A. Information You Provide Directly
- Name
- Employer/organization
- Job title
- Business email address
- Business phone number
- Billing and payment information
- Project-related communications
- Information submitted via contact forms
B. Automatically Collected Information
- IP address
- Browser type
- Device identifiers
- Website usage data
- Cookies and tracking information
C. Client & Consulting Engagement Data
In connection with consulting engagements, we may receive:
- Study protocols and regulatory documents
- Standard Operating Procedures (SOPs)
- Operational performance data
- Audit findings
- Monitoring reports
- De-identified datasets
- Limited data sets (as defined under HIPAA)
3. HIPAA Compliance
A. Our Role
Depending on the engagement, SPM Clinical Research Consulting LLC may act as:
- A Business Associate under HIPAA
- A subcontractor to a Business Associate
- An independent consultant receiving de-identified data
When we receive Protected Health Information (PHI), we do so only:
- Pursuant to a written agreement
- Under a valid Business Associate Agreement (BAA), where required
B. Handling of PHI
If PHI is received:
- It will be used solely for permitted purposes defined in the applicable agreement.
- It will be safeguarded using administrative, physical, and technical safeguards consistent with HIPAA Security Rule requirements.
- It will not be used for marketing or sold.
- It will not be disclosed except as permitted by contract or law.
C. Website Disclaimer Regarding PHI
- Our public website is not intended for submission of PHI.
- Users should not submit patient-identifiable information through website forms unless expressly instructed under a secure engagement process.
4. How We Use Information
We may use personal information to:
- Provide and manage consulting services
- Communicate with clients and prospective clients
- Respond to inquiries
- Improve website functionality
- Maintain security and prevent fraud
- Comply with regulatory obligations
- Enforce contractual rights
We do not sell personal information.
5. State Privacy Law Disclosures (Including California)
If you are a resident of California or another applicable state with consumer privacy laws, you may have the following rights (subject to applicable exemptions, including B2B exemptions where applicable):
A. Right to Know
You may request information about:
- Categories of personal information collected
- Categories of sources
- Business purposes for collection
- Categories of third parties to whom information is disclosed
B. Right to Delete
You may request deletion of personal information, subject to legal and contractual retention obligations.
C. Right to Correct
You may request correction of inaccurate personal information.
D. Right to Opt-Out of Sale/Sharing
We do not sell personal information as defined under CCPA/CPRA.
E. Non-Discrimination
We will not discriminate against individuals who exercise privacy rights.
F. How to Exercise Your Rights
Submit requests to:
We may verify your identity before responding.
6. Categories of Information Disclosed for Business Purposes
In the past 12 months, we may have disclosed the following categories for business purposes:
- Identifiers (name, email, IP address)
- Professional information (job title, company)
- Internet activity data
- Contract-related information
Recipients may include:
- IT service providers
- Cloud hosting providers
- Legal and accounting advisors
We require such parties to maintain confidentiality.
7. Data Security
We implement safeguards appropriate for a healthcare consulting environment, including:
- Encrypted communications (where appropriate)
- Role-based access controls
- Secure document storage
- Vendor risk management
- Confidentiality agreements
- Incident response procedures
No transmission over the internet is guaranteed secure.
8. Data Retention
We retain personal information and project-related documentation only as long as necessary to:
- Fulfill contractual obligations
- Meet regulatory requirements
- Defend legal claims
- Comply with record retention obligations
Retention periods may vary depending on regulatory and contractual requirements.
9. Cookies and Tracking Technologies
We may use cookies for:
- Website analytics
- Security monitoring
- Performance improvement
You may control cookies through your browser settings.
10. Third-Party Services
We may use third-party vendors for:
- Website hosting
- Email services
- Analytics
- CRM systems
These vendors are contractually obligated to protect information.
11. Changes to This Privacy Policy
We may update this Policy periodically. The updated version will be posted with a revised effective date.