Effective Date: April 19, 2021
Last Updated: June 4, 2024
In this Privacy Notice, we explain how FHI 360 and its subsidiaries FHI Clinical Inc., FHI Partners LLC, FHI Solutions LLC and FHI Ventures Inc. (collectively, “FHI 360,” “Company,” “we,” “our” or “us”) collect, use, store, share and protect your personal information. This Notice applies to FHI 360’s family of websites, mobile applications, and programs that post a link to this Notice.
Overview
FHI 360 understands the importance of protecting your personal information. We are committed to being transparent and fair when we collect and use your personal information and to complying with the data protection laws that apply in the countries where we operate. FHI 360 has adopted the principles and requirements of the European Union’s General Data Protection Regulation (GDPR) as the basis for its general privacy practices.
This Notice describes our general privacy practices and applies to the information we collect through our websites or when you communicate with us by email, phone or other means. When you access or use our websites, you acknowledge that you have read this Privacy Notice and understand its contents. Your use of our websites is subject to this Privacy Notice and any applicable Terms of Use.
This Privacy Notice applies to users of our websites, applications, and participants in our programs, around the world. Unless stated otherwise, this Notice does not apply to any third-party sites that may link to, or be accessible from, our websites.
Personal Information We Collect and How We Collect It
In this notice, the term “personal information” refers to information that identifies a living individual or can be used by itself or in combination with other information to identify a living individual.
FHI 360 collects the personal information we need to provide our services.
The type of personal information we collect from you depends on how you interact with us. We collect personal information when you voluntarily provide it to us. For example, you may provide:
- Your name, email address and information about your areas of interest when you sign up to receive newsletters, updates and other information from us
- Your contact information and any other information you choose to include in emails or other electronic messages to us or if you contact us through the website
- Personal information contained in articles, photos, videos, feedback, comments or other content you post on our website, participate in video conferences, or submit via online portals, forms or surveys
- Your contact information and other information you choose to provide when you participate in programs we offer
- Personal, educational, or professional information you provide us when you apply for a position with us
- Health information if you participate in a clinical trial or health-related program with us.
You can choose not to provide personal information when asked for it, but it may restrict our ability to provide you with some services you have requested.
We may collect this information directly from you, or through other sources, such as third-party vendors.
We also collect personal information automatically as you navigate through the Site, through your browser and the use of cookies and other tracking technologies, which allows us to store information about your connection and preferences and make your use of the site easier and more customized. The collected information may include:
- Information about your website usage, such as time and date of visits, frequency of visits, pages viewed, resources downloaded and information about your Site usage and resource requests
- Information about the devices and internet connections you use to access or use the Site, such as device type, operating system, browser type, domain, IP address and system settings for language, time zone, etc.
For more information about the information we collect automatically, please read our complete Cookies Policy.
How We Use and Share Your Personal Information
FHI 360 only collects and uses your personal information when we have a lawful basis for doing so. We use the personal information we collect to administer our websites, provide services (including programs and clinical trials), communicate with you, and facilitate changes in our business, as required by law or with your consent. For instance, we may use or disclose personal information for purposes of:
- Responding to inquiries and fulfilling requests for information about FHI 360 and our projects and services, including information you ask to receive by signing up for newsletters and alerts
- Providing web and email content that reflects your interests, informing you about events, and targeting content and communications to you
- Enabling you to apply for jobs or register as a consultant or vendor with FHI 360
- Preventing malicious activity and unwanted communications and ensuring website security
- Performing data analysis, audits, and fraud monitoring and prevention to enhance and improve our website, identify usage trends, determine program effectiveness, and carry out and expand our business activities
- To ensure compliance with laws and regulations
- To conduct clinical trials, research studies or programs
- To conduct research or analysis activities for FHI 360 or our clients
- To develop websites or applications for FHI 360 or our clients.
We may share personal information as follows:
- With our employees, and with our partners and affiliates who need the information for the purposes described above, which may include government agencies, multilateral organizations, corporations, and foundations who fund our programs and activities.
- With third-party vendors and service providers who provide cloud storage, website hosting, data analysis, payment processing, information technology, clinical trial services, accounting, auditing and similar services related to our business
- When we believe disclosure is necessary and appropriate to prevent physical, financial or other harm, injury or loss, including fraud
- With governmental or judicial authorities as required or ordered by those authorities or applicable laws or regulations
- In connection with legal action, such as response to subpoenas or investigation of suspected illicit or illegal activities
- Where we are bound by contract or law to enable a client or business partner to comply with applicable laws
- With your consent or at your direction, such as when you choose to share information or publicly post content and comments on our websites
- In response to requests from other participants in the Steering Committee for Humanitarian Response’s Inter-Agency Misconduct Disclosure Scheme (MDS) for information about sexual abuse, exploitation, or harassment by employment candidates.
FHI 360 does not sell your personal information to any third parties or share it with any third parties for marketing purposes.
In GDPR terms, our lawful bases for processing your personal information are as follows:
- To take steps at your request prior to entering into a contract with you, or to perform a contract with you
- Where necessary for compliance with legal obligations
- Where necessary for tasks carried out in the public interest
- To pursue our legitimate interests
- In some cases, with your consent.
Where We Keep Your Personal Information
To facilitate our global operations, FHI 360 may transfer, store, or process your personal information within our corporate locations or with service providers based around the world, including in the United States (US), United Kingdom (UK), and the European Union (EU). Laws in these countries may differ from each other and from your country of residence. FHI 360 takes appropriate steps to ensure personal information is processed and transferred according to applicable laws, but not all countries are subject to the same data protection laws. When necessary by applicable law, we ensure appropriate safeguards are in place through the use of written agreements with recipients that require them to provide certain protections to your personal information, such as Standard Contractual Clauses adopted by the EU. Please contact privacy@fhi360.org for more information regarding these safeguards.
How Long We Keep Your Personal Information
FHI 360 keeps your personal information for as long as we need it to carry out the purpose for which it was collected, or as required by applicable laws and regulations.
How We Keep Your Personal Information Safe
We use administrative, organizational, technical, and physical safeguards to protect the personal information we collect and process. Our security controls are designed to maintain data confidentiality, integrity, and an appropriate level of availability.
If we provide your information to third parties for the purposes listed above, we require that such third parties:
- Comply with applicable data protection laws and principles of this Notice
- Only process the personal information for the purposes permitted in this Notice
- Implement appropriate technical and organizational security measures designed to protect the integrity and confidentiality of your personal information.
Additional Information for Job Applicants and Individuals Who Register for Our Consultant Database
Personal Information We Collect and How We Collect It
If you apply online for a job with FHI 360, or register online with our Consultant Database to be considered for future opportunities, FHI 360 collects a broader range of personal information, including:
- Your name, email address, mailing address and telephone numbers
- Your education, employment history, work experience, skills and qualifications
- Whether you are over 18 years of age
- Whether you are legally authorized to work in the relevant country
We collect this information in several ways. Much of it is provided by you when you complete the application or registration forms. In addition, we may obtain information from your resume, CV or any other documents you upload, or from your LinkedIn profiles. We may also seek information from third parties, such as references supplied by former employers (typically only after an offer has been made).
How We Use and Share Your Personal Information
We use this personal information to:
- Manage and keep records of the recruiting and consultant engagement process
- Assess the qualifications and suitability of job candidates and make hiring decisions
- Include you in our Consultant Database and enable FHI 360 to assess your qualifications and suitability for consultant opportunities and make decisions about engaging consultants
- Comply with our legal obligations, such as our obligation to verify your legal eligibility to work in the U.S.
- Respond to and defend against legal claims.
We may also process special categories of data, such as information about ethnic origin, sexual orientation, or religion, to monitor recruitment statistics and comply with legal reporting requirements. We may also collect information about whether an applicant has a disability requiring reasonable accommodation, to facilitate exercise of employment rights.
We may share your personal information internally with people involved in the employee recruitment and hiring processes and/or consultant recruiting and engagement processes, and others who need access to the information to perform their jobs, including recruiters, HR staff, Procurement or Contract Management staff, IT staff, proposal staff, hiring managers and interviewers.
We will not share your data with third parties unless we offer you employment or engagement as a consultant, at which point we may share your data with former employers to obtain references and/or with background-check providers to obtain necessary background checks.
How Long We Keep Your Personal Information
If your application for employment is successful, the personal information we collect during the recruitment process will be transferred to your HR personnel file (electronic and/or paper) and retained during your employment and thereafter for the periods outlined in FHI 360’s Record Retention Policy.
If your application for employment is unsuccessful, we will keep your personal information on file for as long as we are required to do so by applicable law. If you consent to allow us to keep your personal data on file beyond that period, we will hold it until you withdraw your consent or ask to have your personal information deleted, as described in the “Your Rights” section below. This allows us to consider you for hire for future positions that may become available.
When you register on our Consultant Database, we will keep your personal information on file for one year. If you consent to allow us to keep your personal data on file beyond that period, we will hold it until you withdraw your consent or ask to have your personal information deleted, as described in the “Your Rights” section below. This allows us to consider you for future consultant opportunities that may become available.
Your Rights
Depending on your country of residence, you may have the right to:
- Access or request a copy of the personal information we hold about you
- Obtain or have transferred to another processor a copy of certain personal information in a commonly used, machine-readable form
- Object to processing for direct marketing, or to processing for scientific/historical research/statistical purposes, except where necessary for performance of a task carried out for reasons of public interest
- Restrict processing of your personal information
- Review your personal information for completeness or accuracy and ask to have your information corrected or completed as applicable
- Have your personal information deleted from our files and data stores in certain circumstances, such as withdrawal of consent or when the data is no longer necessary for the purpose for which it was collected or processed
- Withdraw your consent in situations where our collection and use of your personal information is based solely on your consent.
Data subjects may exercise these rights by contacting FHI 360’s Data Privacy Officer at privacy@fhi360.org. FHI 360 will notify the data subject of action taken on the request within 30 days after receipt (or within 90 days where an extension is warranted by the complexity and volume of requests, or sooner if required by applicable national law). As required by law, FHI 360 may take steps to verify your identity prior to taking any actions with regard to your personal information.
You may also lodge a complaint with the relevant supervisory authority.
Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. When we make these updates, we will change the “Effective Date” above. If there are any material changes in this Privacy Notice, we will post a notice on this website. We encourage you to periodically review this page to make sure you have the most current information on our privacy practices.
How to Contact Us
If you have any questions or concerns about this Privacy Notice, please contact us via email at privacy@fhi360.org or write to us at:
FHI 360
Attn: Legal Department – Data Protection Officer
359 Blackwell Street, Suite 200
Durham, NC 27701