REDCap Privacy Policy

REDCap is a digital platform that enables document and process management within clinical research whilst guaranteeing data security, ensuring dematerialised and secure processes. The platform was designed to facilitate the workflow of academic, scientific and institutional research, offering functionalities that include structured data collection, secure export for analysis and rigorous access control.

2CA-Braga hereby informs you of its privacy policy, intended to inform you of your rights and clarify how your personal data is collected and used within the scope of REDCap's activities.

The use of services provided by REDCap 2CA-Braga, as well as the completion of any forms available on the respective website and the direct or indirect provision of data, implies knowledge of the conditions defined in this policy.

1. Data Controller

2CA-Braga is the entity responsible for the processing of personal data carried out within the scope of REDCap 2CA-Braga's activities, defining the data collected, the processing means and the purposes for which said data will be used.

As data controller, 2CA-Braga:

  • Ensures that the processing of your personal data is carried out only within the scope of the purposes for which it was collected or for purposes compatible with those;
  • Collects, uses and retains only adequate, relevant and limited data in relation to the purposes for which it is processed;
  • Does not proceed with any data transmission for commercial or advertising purposes.

2. Data Protection Officer

2CA-Braga has appointed a data protection officer. They may be contacted for clarification of any queries or to submit complaints, through the following email address: dpo@ccabraga.org.

Without prejudice to complaints submitted to the data protection officer, the data subject may also submit their complaints to the National Data Protection Commission (CNPD).

3. Personal data, data subjects, categories and method of collection

3.1 Personal data

Under the applicable legislation, personal data is considered to be any information relating to an identified or identifiable natural person. In this regard, an identifiable natural person is considered to be one who can be identified, directly or indirectly, in particular by reference to an identifier. Examples of identifiers include: a name, an identification number, location data, electronic identifiers or one or more specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Certain personal data is of a particularly sensitive nature, being classified by the General Data Protection Regulation (GDPR) as "special categories of data". Special categories of personal data are considered to be data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data to uniquely identify a person, health-related data or data concerning a person's sex life or sexual orientation. Health-related data is considered to be data relating to the health status of the data subject, which reveals information about their physical or mental health, past, present or future.

3.2 Data subjects

Data subjects are the natural persons to whom the personal data relates and who benefit from or wish to benefit from the services provided by REDCap 2CA-Braga.

3.3 Categories of personal data

Within the scope of services and channels provided by REDCap 2CA-Braga, the following personal data may be collected:

redcap_PP_UK

3.4 Time and method of data collection

Your personal data may be collected directly when you use the platform for registration and management of research studies.

4. Purposes and legal basis for data processing

  • Data collected at the time of registration will be used exclusively for creating and managing your account, authentication on the platform and provision of associated functionalities.
  • To comply with legal obligations: data may be processed to comply with obligations to provide information to competent authorities.

5. Personal data retention period

Personal data of REDCap 2CA-Braga users is processed in compliance with applicable legislation, being stored in databases specifically created for this purpose. Said data is retained in a format that allows identification of data subjects only for the period necessary to pursue the purposes for which it is processed. Where there is no legal obligation requiring data retention for a specific period, it will be retained by 2CA-Braga only for the period necessary to fulfil the purposes that determined its collection.

6. Transmission of personal data

Only employees bound to 2CA-Braga by contract may process your personal data for the purposes set out therein, being prohibited from using, transferring, disclosing or recording the data subject's personal data for any other purpose than that for which they were specifically contracted (or without your consent, as applicable). Within the scope of using the REDCap 2CA-Braga platform, personal data may be shared with third parties, exclusively to the extent necessary to pursue legitimate purposes associated with the management and conduct of research studies or to comply with legal obligations.

2CA-Braga may transmit personal data to:

  • Clinical research study sponsors and their respective authorised representatives;
  • National and European regulatory entities (including the National Data Protection Commission, INFARMED and other health authorities);
  • Courts and criminal police bodies, when legally required;
  • Technical subcontractors, namely entities responsible for maintaining and hosting the platform's technological infrastructure, under written agreements that guarantee compliance with the obligations set out in Article 28 of the GDPR.

Whenever personal data processing is carried out by third parties on behalf of 2CA-Braga, it guarantees that subcontractors offer adequate guarantees of security, confidentiality and compliance with the documented instructions of the data controller, through the conclusion of a written contract.

Transmission of personal data may also occur when:

  • The data subject has given explicit consent, under applicable legislation;
  • Sharing is necessary to comply with legal or regulatory obligations;
  • Sharing is necessary to protect vital interests of the data subject or another natural person.

2CA-Braga undertakes to adopt all appropriate technical and organisational measures to ensure that personal data transmitted to third parties is processed in accordance with applicable legislation and exclusively for authorised purposes.

6.1 Data transfers outside the European Economic Area

Where transfers of data outside the European Economic Area are envisaged, 2CA-Braga undertakes to ensure that such transfers are carried out in compliance with the GDPR, namely through the adoption of standard contractual clauses approved by the European Commission or other adequate safeguards that ensure a level of protection equivalent to that of the European Union.

7. Rights of personal data subjects

Within the scope of using the REDCap platform, 2CA-Braga guarantees respect for the rights of personal data subjects, under the terms and with the limits provided for in applicable legislation on data protection.

In accordance with the General Data Protection Regulation (GDPR), data subjects may exercise, at any time, their rights of access, rectification, erasure, restriction of processing, objection and portability of their personal data, where applicable, by contacting the Data Protection Officer through the email address: dpo@ccabraga.org.

Data subjects also have the right to lodge a complaint with the National Data Protection Commission (www.cnpd.pt), as the competent supervisory authority.

8. Security measures

2CA-Braga is committed to ensuring the confidentiality and security of personal data of REDCap 2CA-Braga users. To this end, 2CA-Braga implements the technical and organisational measures necessary to protect said data against any form of improper or unlawful processing and against any accidental loss or destruction. 2CA-Braga creates and updates procedures for preventing unauthorised access and accidental loss and/or destruction of personal data.

9. Privacy policy updates

This privacy policy, whose careful reading is recommended, may be amended or updated at any time. Said amendments or updates will be published by 2CA-Braga on the REDCap 2CA-Braga website, with express mention of the update date. More significant changes may also be notified by other means before they come into effect.

10. Use of the REDCAP platform

10.1 Copyright and intellectual property rights

The content of the REDCAP platform is subject to copyright and related rights, as well as industrial property rights. Said content may not, therefore, be used outside the conditions provided for in current legislation. Any attempts to alter or upload information or other actions likely to affect the integrity of the system are prohibited.

11. Competent jurisdiction

For resolution of any disputes arising from the interpretation or application of this privacy policy, the parties elect as competent, with express waiver of any other, the jurisdiction of the District of Braga.

12. Questions

If you have any questions about these Terms of Use, please send us your request for clarification via email dpo@ccabraga.org or by registered post to the address 2CA-Braga, Unidade Local de Saúde de Braga, Sete Fontes – S. Victor, 4710-243 Braga.

13. Applicable law

The management, administration, use and application of the Terms of Use of the REDCap platform is applicable in accordance with Portuguese law.