Privacy Policy

About This Notice

SAI MedPartners, LLC and its affiliates (“SAI Group,” “we,” “us,” or “our”) may process personal information as described in this Privacy Notice (“Notice”).

This Notice covers all SAI brands and divisions, websites and managed platforms (“Sites”), consulting and research services, expert and advisory activities, and recruitment and employment processing (collectively, “Services”).

Supplemental privacy notices may apply to particular regions, websites, platforms, services, projects, or workforce activities. These notices identify the responsible SAI entity and provide additional processing details and local privacy information. Where provisions conflict, the supplemental notice applies to the processing it covers, subject to mandatory law and our applicable Data Privacy Framework commitments. Applicable Terms of Use govern service use.

Personal information means legally protected information about an identifiable person, household, or device. We act as controller where we determine the purposes and means of processing.

Anonymous, deidentified, and publicly available information is excluded only as law permits; coded or pseudonymized identifiable information remains protected. We use excluded information subject to law and contracts, maintain deidentified information in that form, and prohibit reidentification, including by recipient contract, except testing lawfully permitted to assess deidentification compliance.

Where we act as a client’s processor or service provider, we follow its lawful instructions and applicable legal obligations. The client’s privacy notice explains its processing. This does not limit our legal duties or DPF commitments. We assist with rights requests or direct them to the client where appropriate.

Information We Collect

We collect only personal information reasonably necessary for the purposes below.

Without information needed for a requested service, engagement, payment, or legal requirement, we may be unable to proceed. Relevant collection notices identify mandatory information and the consequences of not providing it.

Depending on your interaction with us, we collect:

Sensitive information includes health information, racial or ethnic origin, and account credentials, as relevant to the activity. Where we process health-related information, we do so subject to applicable healthcare, research, privacy, confidentiality, and data-protection laws and any applicable contractual obligations. Criminal history is processed only where permitted. We meet applicable requirements for a lawful basis and additional legal conditions and obtain explicit or separate consent where required. Collection or workforce notices identify the applicable special-category or criminal-data condition.

Sources include you; Site and tracking interactions; public sources, including directories and databases; social-networking and advertising providers; clients, service providers, and references, as relevant to the activity.

Our Sites automatically collect:

Usage and Device Data.  Browsing, search, usage and diagnostic information; device and connection identifiers, including IP addresses; browser, operating-system, and network information.

Cookies, pixels, and similar technologies support operation, preferences, analytics, and marketing. We obtain consent for nonessential technologies where required; use cookie settings or browser controls to manage or withdraw it. See our Cookie Policy.

Our Sites and Services are not directed to children. Research involving minors follows applicable law, ethics requirements, and project procedures, including required parent or guardian notice and consent and participant assent.

How We Use Information and Our Legal Bases

We rely on the grounds below only where recognized by applicable law. Using our Services does not itself constitute consent.

We use personal information for the following purposes:

• Services and administration, deliver consulting and advisory Services; manage access, engagements, payments, and support; and send operational messages, based on contractual necessity where applicable or legitimate interests in service delivery.
• Marketing and personalization, communicate by email, phone, or SMS about Services and events and tailor professional content, based on consent where  required or legitimate interests in professional outreach where permitted.
• Analytics and security, improve Services and  prevent fraud, unauthorized access, or harmful activity, based on legitimate interests in improvement and  protection and  applicable legal obligations.
• Research, conduct interviews, surveys, and benchmarking and develop aggregated or deidentified client insights, based on consent or legitimate interests in research and service delivery where permitted. Where research involves sensitive information or special-category personal data, we rely on any additional legal condition required by applicable law and obtain explicit consent where required.
• Compliance and legal rights, meet legal obligations or pursue legitimate interests where permitted in lawful contractual requirements, safety/transparency reporting, audits, and legal claims.
• Recruitment and workforce, assess candidates, conduct lawful checks, administer  employment, benefits and accommodations, and protect legal rights, based on contractual necessity, legal obligations, or legitimate interests where applicable. Workforce notices provide specific details and additional legal conditions, subject to mandatory law and our DPF commitments.

Before recording or transcribing research, meetings, events, or support interactions, we inform participants and obtain consent required by law, contracts, or approved SAI procedures. Collection materials explain purposes, recipients, retention, and material AI use.

Artificial Intelligence and Automated Tools

We use approved AI and automated tools to support research, expert engagements, transcription, analysis, workflows, and deliverables, with appropriate security, contractual controls, and human oversight. Such tools are subject to risk-based review and approval processes appropriate to their intended use.

AI tools support human-led work. We do not currently make solely automated decisions about individuals that produce legal or similarly significant effects. Any future use is subject to legally required notice, safeguards, and rights. We prohibit unlawful AI uses and unauthorized disclosure of personal or confidential information to public or personal AI tools.

Identifiable personal, client-confidential, or restricted information is not used to train public AI models except where separately disclosed, lawful, contractually authorized, and supported by any required consent. Material AI outputs receive appropriate human review. Where third-party AI providers process personal information on our behalf, we require contractual and security protections appropriate to the processing.

Disclosures and International Transfers

We disclose personal information for the purposes above, subject to applicable law and confidentiality requirements, to:

• SAI affiliates and operating divisions, for business operations and service delivery.
• Service providers supporting hosting, analytics, research, communications, marketing, payments, and approved AI tools, under contracts restricting use and requiring appropriate protection.
• Business partners supporting Services or joint initiatives, including research sponsors, event partners, healthcare and life-sciences organizations, and other organizations involved in a relevant engagement or initiative.
• Clients and prospective clients, for expert identification, project delivery, participation administration, payments, and lawful compliance, using limited relevant professional, demographic, screening, and engagement information. Research outputs are generally aggregated or deidentified. Identifiable disclosures require a valid legal basis, compliance with confidentiality restrictions, and any required consent.
• Parties to business transfers, including mergers, acquisitions, financing, or restructuring, subject to appropriate confidentiality and security protections.
• Authorities, advisers, insurers, or other recipients where reasonably necessary and lawful for legal or contractual compliance, safety and transparency reporting, audits, security, protection of individuals, or establishing, exercising, or defending legal claims.
• Other recipients with your consent or direction where permitted by law.

We do not knowingly disclose information for unrelated third-party direct marketing. Independent third-party websites have their own privacy and security practices.

Personal information may be stored or accessed in the United States and other countries in which SAI operates including by affiliates and service providers. We use applicable adequacy decisions, the DPF for eligible transfers to covered U.S. entities, standard contractual clauses with required UK or Swiss adaptations, or another lawful transfer mechanism. Where required, we assess transfers and apply supplementary safeguards.

Data Retention and Security

We retain personal information as long as reasonably necessary for the purposes described here, including service and study administration, expert relationships, payments, legal and lawful contractual requirements, audits, safety reporting, and legal claims.

Retention varies by information type and project; applicable collection or workforce notices provide specific periods or criteria. In determining retention periods, we consider the nature of the information, the purposes of processing, legal requirements, contractual obligations, and potential legal claims. Legal holds may extend retention. When no lawful retention purpose remains, we securely delete or anonymize the information.

We maintain administrative, technical, and organizational safeguards appropriate to the information and processing risks. Learn more about our security and compliance practices in our Trust Center. No system or transmission, including over networks outside our control, is completely secure. Protect your account credentials and report suspected compromise. We provide legally required incident notices by permitted methods. Any contractual liability limits remain subject to mandatory law and our DPF commitments.

Your Information and Privacy Choices

Subject to applicable law and exceptions, you may request access or information about collection, sources, purposes, use and recipients; correction, deletion, restriction or portability; object to processing based on legitimate interests or direct marketing; withdraw consent without affecting prior lawful processing; opt out of sale, sharing, or targeted advertising; or limit sensitive-information use or disclosure to requested services and other permitted purposes. We do not unlawfully discriminate against or retaliate for exercising rights.

Where the California Consumer Privacy Act, as amended (“CCPA”), applies, these rights include access to specific information.

Use the contact details below to exercise rights or raise concerns. We respond within applicable deadlines and explain lawful extensions or denials. Where an appeal right applies, email  privacy@sai-med.com with “Privacy Request Appeal”; we explain the outcome and regulator complaint route.

You may use an authorized agent, with proof of authority where permitted. We verify identity proportionately where required or permitted, requesting only necessary information. Sale/sharing opt-outs and sensitive-information limitation requests do not require identity verification.

You may complain to the competent authority, including your local EEA authority, the UK ICO, or the Swiss FDPIC. For UK privacy complaints, we acknowledge receipt within 30 days, investigate without undue delay, keep you informed, and communicate the outcome.

A sale may include disclosure for money or other valuable consideration; California “sharing” includes cross-context behavioral advertising. Exercise applicable sale, sharing, or targeted-advertising opt-outs through “Do Not Sell or Share My Personal Information” privacy options or the contact details below, including after prior consent. Other lawful processing may continue; service limitations may apply, where permitted by law.

Unsubscribe through marketing emails or contact us. Where applicable, we stop direct marketing and related profiling when you object. Lawful service, payment, security, and compliance communications may continue.

Where required, we honor qualifying opt-out preference signals, including Global Privacy Control, for sale, sharing, or targeted advertising. Enable GPC through a supporting browser or extension. We apply signals to the browser/device and associated profiles and, where required and identifiable, to accounts and offline sale/sharing. We do not respond to legacy “Do Not Track” signals.

Provide accurate, relevant information you are lawfully authorized to disclose. You remain responsible for unlawful disclosures. This does not limit statutory rights, SAI’s legal obligations, or  lawful remedies.

Data Privacy Framework

SAI MedPartners, LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), as set forth by the U.S. Department of Commerce. SAI MedPartners, LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. SAI MedPartners, LLC has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

Our certification covers human resources and non-human resources information and all information received in reliance on the applicable Framework, including covered transfers from the EEA and Gibraltar where applicable. Our Swiss-U.S. DPF certification covers non-human resources information only. If this Notice conflicts with the applicable DPF Principles, the Principles govern. Learn more and view our certification at https://www.dataprivacyframework.gov/. Covered U.S. entities also adhering to these Principles are SAI MedPartners, LLC, Strategic Reports, and Fulcrum Research Group.

For DPF-covered information, you may request access and correction, amendment, or deletion of information that is inaccurate or processed in violation of the Principles, subject to applicable exceptions. Where the Choice Principle applies, you may opt out of non-agent third-party disclosures or materially different uses. Sensitive-information disclosures or different uses require affirmative express consent, subject to the Principles’ exceptions. Contact privacy@sai-med.com with DPF questions or complaints. We respond to complaints within 45 days.

Dispute Resolution: VeraSafe, an alternative dispute resolution provider based in the United States, handles unresolved complaints concerning non-HR information covered by our certification. If we do not acknowledge your complaint promptly or resolve it to your satisfaction, you may contact VeraSafe.

If a privacy complaint or dispute relating to Personal Data received by SAI MedPartners, LLC in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://verasafe.com/public-resources/dispute-resolution/submit-dispute/.

For HR data received in the employment context in reliance on the applicable DPF:

If a complaint or dispute cannot be resolved through our internal process, we have also agreed to cooperate with the EU and UK data protection authorities and to participate in the dispute resolution procedures of the panel established by such data protection authorities.

We also comply respectively with the advice of the EU DPA panel, UK Information Commissioner’s Office (ICO), and, where applicable, the Gibraltar Regulatory Authority (GRA). This recourse is free.

Binding Arbitration: If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

For DPF-covered information transferred to an agent acting on our behalf, SAI remains liable for processing inconsistent with the Principles, except where SAI demonstrates it was not responsible for the event causing the damage. SAI MedPartners, LLC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. We may be required to disclose personal information in response to lawful public-authority requests, including national security or law enforcement requirements.

Contact Us

Contact us to request this Notice in an accessible alternative format.

For privacy questions, requests, or complaints, contact our privacy team;

Email: privacy@sai-med.com
Telephone: +1 (610) 685-4200
Mail: Privacy Team, SAI MedPartners, 4970 DeMoss Road, Suite 300, Reading, PA 19606, USA

EEA/UK/Swiss representative: DataRep, appointed in accordance with applicable data protection laws. For privacy matters, contact DataRep and identify SAI MedPartners in all correspondence:

Email: datarequest@datarep.com, with “SAI MedPartners” included in the subject line;
Online webform: https://www.datarep.com/data-request; or

Mail:

Changes to this Notice

We may update this Notice and its “Revision Date”. We provide additional notice and obtain consent for changes where required