This notice is for medical professionals whose professional activity we research. It repeats Section 6 of our privacy policy in full, so that you do not have to read the whole document to find it.
The controller is „ЕКСПЛИКАТОС” ООД (Explicatos Ltd.), EIK 204711009, ul. Rodopski Izvor 72, entr. A, floor 3, ap. 12, Vitosha district, Sofia 1618, Bulgaria. Data protection contact: privacy@explicatos.com.
What we do and why
Explicatos researches the professional and scientific activity of medical professionals and makes structured professional profiles available to organisations in the pharmaceutical and medical device sectors. Those organisations use them to identify appropriate experts for scientific exchange, clinical research, advisory activity, medical education and congress programmes.
The purpose of our databases is the systematic mapping of fields of medical activity and of the specialists who practise in them.
Categories of data
We process professional information only: full name; professional email address and the institutional address and telephone of the place of work; gender, which we infer from the name and the forms of address used in the sources; a photograph where the person has published one professionally; education, professional experience, specialisation and scientific degree; publications and authorship; participation in clinical trials; congress and event participation, including talks given; membership of professional societies; publicly accessible professional digital activity; and transfers of value disclosed by pharmaceutical companies under industry codes and national law. We also hold classifications we derive from this information. In a small number of cases we record a year of birth, where a project specifically requires it.
We do not process information about religion, sexual orientation, political affiliation, health, or private life. We do not process special categories of personal data within the meaning of Art. 9 GDPR.
We do not hold national identification numbers (EGN) or full dates of birth. All contact details we hold are those of the institution where the person works — we do not hold private addresses, private email addresses or private telephone numbers.
Sources
All data is collected from publicly accessible sources. We do not obtain it from the individuals themselves. The main categories of source are:
- Registers maintained by professional and branch organisations under statutory authority
- Websites and registers of hospitals, universities and research institutions
- Clinical trial registries, including clinicaltrials.gov
- Scientific literature databases, including PubMed
- Congress and event programmes, and published abstracts
- Professionally published curricula vitae and institutional profile pages
- Transparency and disclosure reports published by pharmaceutical companies
- Publicly accessible professional digital and social channels
Because the underlying material is spread across a very large number of public websites, an exhaustive list of individual sources is not possible. We record the source of each item of information we hold, and can tell you the source of any data relating to you on request.
Legal basis
We process this data on the basis of the legitimate interests pursued by us and by our client organisations under Art. 6(1)(f) GDPR: identifying medical experts whose professional and scientific activity is relevant to a given therapeutic area, so that scientific exchange, research collaboration and medical education can be directed to the appropriate specialists.
In reaching this position we have taken into account that the data concerns professional and scientific activity rather than private life, that it is drawn from sources the individuals themselves have made public in a professional capacity, that we process no special categories of data, and that individuals may object at any time and are notified as described below. We are happy to explain this reasoning further on request.
Recipients, and our role
Profiles are made available to client organisations in the pharmaceutical and medical device sectors under written contract. We also use service providers, in particular cloud hosting, which process data on our instructions under written data processing agreements.
We act in two different capacities. For the databases we build ourselves from public sources, we are the controller. Where a client commissions research and defines the scope and purpose themselves, we act as their processor under a data processing agreement.
Notification — Article 14
Where we hold an email address for a medical professional whose data we have collected, we send a notification informing them that they have been included, what categories of data we hold, and how to review, correct or be removed from the database.
Where we do not hold contact details, or where individual notification would involve disproportionate effort within the meaning of Art. 14(5)(b) GDPR given the number of individuals and the public nature of the sources, this page serves as the public information required in those circumstances.
Retention
Profiles are kept for as long as the individual remains professionally active in a relevant field and the information remains accurate, and are reviewed and updated periodically. Data that is no longer necessary is deleted.
Your rights, and how to use them
If you are a medical professional and believe your data appears in our databases, you may exercise all your rights under the GDPR by writing to privacy@explicatos.com. On request we will tell you what we hold about you and where each item came from.
Right to object. Because this processing relies on legitimate interests, you may object at any time on grounds relating to your particular situation, under Art. 21(1) GDPR. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is needed for legal claims. In practice, we remove the profile.
Where we have already supplied your data to a client, we will inform that client of your correction or erasure request, unless this proves impossible or would involve disproportionate effort.
Complaints
You may lodge a complaint with a supervisory authority, in particular in the country of your habitual residence or place of work. Our lead authority is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, www.cpdp.bg.