This policy explains how Explicatos Ltd. handles personal data. It covers three groups of people, and the section that applies to you depends on which group you are in:
- Visitors to this website — Section 3
- People using our platforms on behalf of a client organisation — Section 4
- Medical professionals whose professional activity we research — Section 6
1. Who is responsible
Controller: Explicatos Ltd., EIK 204711009, ul. Rodopski Izvor 72, entr. A, floor 3, ap. 12, Vitosha district, Sofia 1618, Bulgaria
Data protection contact: privacy@explicatos.com
Data Protection Officer: we have assessed the criteria in Art. 37 GDPR and have not appointed one. Data protection enquiries are handled at the address above.
2. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy (Art. 15)
- Have inaccurate or incomplete data corrected (Art. 16)
- Have data erased, in the circumstances set out in Art. 17
- Restrict how we process your data (Art. 18)
- Receive your data in portable form, where processing is based on consent or contract and is automated (Art. 20)
- Object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21)
- Withdraw consent at any time where processing is based on consent, without affecting what was lawful before
To use any of these rights, write to privacy@explicatos.com. We reply within one month, extendable by two further months if the request is complex. We may need to confirm your identity first.
You may also complain to a supervisory authority, in particular in the country where you live or work. Ours is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, www.cpdp.bg.
3. Visitors to this website
Server logs
Our hosting provider records technical data each time the site is accessed: IP address, date and time, page requested, referring URL, browser and operating system. We use this to keep the site running and secure, on the basis of our legitimate interest (Art. 6(1)(f)). Hosting is provided by DigitalOcean LLC on servers in the European Union, under a data processing agreement incorporating the Standard Contractual Clauses. Logs are deleted after 30 days.
Contact form and demo requests
When you submit the form we process what you enter: name, business email address, company, country, your area of interest and any message. We use it only to answer your enquiry and arrange a demonstration, on the basis of steps taken at your request before a possible contract (Art. 6(1)(b)) or our legitimate interest in replying to business enquiries (Art. 6(1)(f)).
We keep enquiries for 12 months after our last contact with you, unless a business relationship begins, in which case we keep the records for as long as that relationship lasts and as long as Bulgarian accounting and tax law requires.
Appointments
Demonstrations are arranged by email. This website does not embed any third-party calendar or scheduling service.
Cookies
We use only cookies that are strictly necessary for the site to work. These do not require your consent. We do not use advertising cookies and we do not profile visitors.
Fonts
Typefaces are served from our own servers. No connection is made to third-party font providers and no data about your visit reaches them.
4. People using our platforms
Where your organisation has a project or subscription with us, we process your name, business email address, organisation, role, and login and usage records, so that you can use InSpire or OpenPay Europe, so that we can keep those systems secure, and so that we can support you. The basis is the contract with your organisation (Art. 6(1)(b)) and our legitimate interest in system security (Art. 6(1)(f)). Records are kept for the term of the subscription and a defined period afterwards for audit and security.
5. Job applicants
Applications sent to us are used only to assess the application. Unsuccessful applications are deleted within six months unless you agree to us keeping them longer.
6. Medical professionals in our databases
What we do and why
Explicatos researches the professional and scientific activity of medical professionals and makes structured professional profiles available to organisations in the pharmaceutical and medical device sectors. They use them to find the right experts for scientific exchange, clinical research, advisory work, medical education and congress programmes. The purpose of our databases is to map fields of medical activity and the specialists working in them.
What we hold
We process professional information only: full name; the professional email address, institutional address and telephone of the place of work; gender, which we infer from the name and the forms of address used in the sources; a photograph where the person has published one professionally; education, professional experience, specialisation and scientific degree; publications and authorship; participation in clinical trials; congress and event participation, including talks given; membership of professional societies; publicly accessible professional digital activity; and transfers of value disclosed by pharmaceutical companies under industry codes and national law. We also hold classifications we derive from this information. In a small number of cases we record a year of birth, where a project specifically requires it.
We do not hold national identification numbers or full dates of birth. All contact details we hold are those of the institution where the person works — we do not hold private addresses, private email addresses or private telephone numbers. We do not process information about religion, sexual orientation, political affiliation, health or private life, and we do not process special categories of personal data within the meaning of Art. 9 GDPR.
Where it comes from
All of it comes from publicly accessible sources. We do not obtain it from the individuals themselves. The main categories are:
- Registers kept by professional and branch organisations under statutory authority
- Websites and registers of hospitals, universities and research institutions
- Clinical trial registries, including clinicaltrials.gov
- Scientific literature databases, including PubMed
- Congress and event programmes, and published abstracts
- Professionally published CVs and institutional profile pages
- Transparency and disclosure reports published by pharmaceutical companies
- Publicly accessible professional digital and social channels
Because the underlying material is spread across a very large number of public websites, we cannot list every individual source. We do record the source of each item we hold, and we can tell you where any data about you came from.
Why we are allowed to do this
We rely on the legitimate interests of Explicatos and of our client organisations under Art. 6(1)(f) GDPR: identifying medical experts whose professional and scientific work is relevant to a given therapeutic area, so that scientific exchange, research collaboration and medical education reach the right specialists.
In reaching that position we took into account that the data concerns professional and scientific activity rather than private life, that it comes from sources the individuals themselves made public in a professional capacity, that we process no special categories of data, and that anyone may object at any time. We are happy to explain this reasoning further on request.
Who receives it
Profiles are made available under written contract to client organisations in the pharmaceutical and medical device sectors. We also use service providers, in particular cloud hosting, who process data on our instructions under written data processing agreements.
Our role
We act in two different capacities, depending on the arrangement. For the databases we build ourselves from public sources, we are the controller and decide what is collected and why. Where a client commissions research and defines the scope and purpose themselves, we act as their processor and work on their documented instructions under a data processing agreement. Which applies to a given engagement is set out in the contract for that engagement.
Telling people we hold their data
Where we have an email address for a medical professional whose data we have collected, we send a notification telling them they have been included, what we hold, and how to review, correct or be removed.
Where we have no contact details, or where telling each person individually would involve disproportionate effort within the meaning of Art. 14(5)(b) GDPR, given the number of people and the public nature of the sources, this page serves as the public information required in those circumstances.
How long we keep it
Profiles are kept while the person remains professionally active in a relevant field and the information remains accurate, and are reviewed and updated on yearly basis. Data that is no longer needed is deleted.
Your rights, and how to use them
If you are a medical professional and think your data is in our systems, you can use every right in Section 2 by writing to privacy@explicatos.com. On request we will tell you what we hold and where each item came from.
Because this processing relies on legitimate interests, you can object at any time on grounds relating to your particular situation, under Art. 21(1) GDPR. If you object we stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for legal claims. In practice, we remove the profile.
Where we have already supplied your data to a client, we inform that client of your correction or erasure request, unless that proves impossible or would involve disproportionate effort.
7. Transfers outside the EEA
Personal data is stored on servers within the European Union. Our hosting provider, DigitalOcean LLC, is established in the United States; where its staff may access data for support or maintenance, this is covered by a data processing agreement incorporating the Standard Contractual Clauses.
8. Security
We apply technical and organisational measures appropriate to the risk: access on a need-to-know basis, individual user accounts and passwords, encryption of data in transit, backups, contractual security guarantees from our cloud provider, written confidentiality undertakings from everyone who processes data on our behalf, and internal review of compliance at least twice a year.
9. Children
Our services are for businesses and professionals and are not intended for children. Under Art. 25c of the Bulgarian Personal Data Protection Act, a child must be at least 14 for consent to be valid in connection with information society services. We do not knowingly process children’s personal data.
10. Changes
We may update this policy. The current version is always here, with its version number and effective date at the top. Where changes are material we take reasonable steps to notify those affected.
11. Contact
Questions about this policy: privacy@explicatos.com, or by post to Explicatos Ltd., ul. Rodopski Izvor 72, entr. A, floor 3, ap. 12, Vitosha district, Sofia 1618, Bulgaria.