Privacy Policy

The Concurrent Biologics Registry ("the Registry") is committed to protecting the privacy of all website visitors, submitters, and users. This Privacy Policy describes the types of information collected through the Website, how that information is used, and the measures taken to safeguard it.

The Registry operates as a quality assurance and practice improvement resource. It brings together published and clinician-contributed cases, without direct patient identifiers, to support informed decision-making when concurrent biologic therapy is considered. The Registry does not collect information directly from patients.

The Registry is operated from Canada and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA). For submitters located in the European Economic Area (EEA), the Registry processes personal data in accordance with the principles of the General Data Protection Regulation (GDPR).

The following types of information may be collected through the Website:

• Submitter Information: first name, last name, and email address (required); institution or affiliation (optional). This information is collected when a healthcare professional submits a case through the submission form. Each submission record also includes the submitter's attestation that the submission contains no direct patient identifiers (the accepted flag, the attestation version, and the time of acceptance), and the results of an automated screen of free-text fields for identifying details (dates, contact details, institution names, initials, and exact ages), which are stored with the submission for the reviewer.
• Patient Case Data (no direct identifiers): age band, biological sex, geographic region (continent-level only), care setting, diagnoses (disease categories, recorded as ICD-10 codes where available; primary and comorbid conditions, including specialty-specific terminology, may be listed), biologic and targeted oral agents, duration of therapy, concomitant systemic therapy, disease activity measures (validated instrument scores at baseline and follow-up, with the follow-up recorded only as a relative timepoint such as week 24), a clinical outcome category for each diagnosis with an optional outcome comment, adverse event status with a description when an event occurred, and additional notes. The Registry is designed so that no direct patient identifiers are collected. Submitters must remove all direct identifiers and must not include identifying details in free-text fields.
• Automatically Collected Technical Data: IP address, browser user agent string, and submission timestamp. This data is collected from HTTP request headers for the sole purpose of rate limiting and abuse prevention.

The following types of information are not collected:

• The Website does not use cookies.
• The Website does not use third-party analytics, advertising trackers, or marketing tools.
• The Website does not access geolocation, microphone, camera, or USB device data.

Information collected through the Website is used for the following purposes:

• Submitter contact information: to correspond with submitters regarding their case submissions, including clarification requests during the quality review process.
• Patient case data: to build and maintain the Registry dataset and to display case-level and summary information on the Website, without direct identifiers, for quality assurance and practice improvement purposes.
• IP address and user agent: exclusively for rate limiting (a maximum of five submissions per IP address per hour and three submissions per email address per hour) and for preventing abuse. This data is not used for tracking, profiling, or analytics.
• Submission review: all submissions undergo quality review by Registry administrators for completeness, clinical plausibility, and consistency before inclusion in the dataset. Submissions may be approved, rejected, or have their status changed during review.

For submitters located in the European Economic Area (EEA), the legal bases for processing personal data are as follows:

• Submitter personal information (name, email, institution): processed on the basis of consent. Submitters voluntarily provide their information when submitting a case and agree to the Terms of Service and this Privacy Policy at the point of submission.
• Technical data (IP address, user agent): processed on the basis of legitimate interest in maintaining the security and integrity of the Website and preventing abuse.
• Patient case data: case information is collected through a data-minimized template that excludes direct identifiers such as names, dates of birth, exact clinical dates, record numbers, and addresses. Submitters are responsible for ensuring that their submissions comply with the privacy laws and professional obligations that apply to them.

The Registry is designed so that no direct patient identifiers are collected. The submission template captures a minimal set of structured clinical variables: age band, biological sex, geographic region (continent-level only), care setting, diagnoses (recorded as ICD-10 codes), biologic and targeted oral agents, duration of therapy, concomitant systemic therapy, disease activity measures with relative follow-up timepoints, a clinical outcome category for each diagnosis with an optional outcome comment, adverse event status with a description when an event occurred, and additional notes. Disease activity measures are recorded against relative follow-up timepoints only, never against calendar dates. No dates of birth, treatment dates, assessment dates, medical record numbers, patient names, addresses, or other direct identifiers are requested at any stage.

The responsibility for ensuring that submissions contain no identifying information rests with the submitter. Submissions undergo quality review, during which any data that appears to identify a patient is flagged and removed. If the Registry discovers that a submission contains identifying patient information, that submission is deleted from the dataset.

• Approved submissions: approved case submissions, including submitter attribution and patient case data, are retained as part of the Registry dataset.
• Pending submissions: submissions awaiting review are retained until the quality review process is completed.
• Rejected submissions: rejected submissions are retained for a limited period for audit purposes and then deleted.
• Technical data: IP address and user agent data is retained alongside the associated submission record. Rate limiting calculations use a rolling one-hour window.

Submitter personal information is never sold to third parties and is never shared for marketing purposes.

Patient case data are displayed on the Website as case-level and summary information without direct identifiers. Individual case data with submitter attribution are not shared publicly.

Any future use of Registry information for research would be treated as a separate project and submitted for research ethics board review where required.

Information may also be disclosed when required by law, regulation, or legal process.

The Registry is hosted and operated from Canada. Submitters located outside of Canada, including those in the European Economic Area (EEA), should be aware that their data will be transferred to and stored in Canada.

Canada has been recognized by the European Commission as providing an adequate level of data protection under the GDPR. This adequacy determination provides a legal basis for the transfer of personal data from the EEA to Canada for organizations covered by PIPEDA.

The following measures are taken to protect information collected through the Website:

• HTTPS encryption for all data transmitted between users and the server.
• Content Security Policy (CSP) headers restricting script sources, frame embedding, and form submission targets.
• Permissions-Policy headers blocking access to geolocation, microphone, camera, and USB devices.
• Server-side validation and input sanitization for all form submissions.
• Rate limiting to prevent abuse and excessive submissions.
• Database access restricted to authorized administrators.

While reasonable measures are taken to protect information, no method of electronic transmission or storage is completely secure, and absolute security cannot be guaranteed.

Under PIPEDA, individuals have the following rights:

• Access: the right to request access to personal information held by the Registry.
• Correction: the right to request correction of inaccurate or incomplete personal information.
• Withdrawal of Consent: the right to withdraw consent for the collection, use, or disclosure of personal information, subject to legal or contractual restrictions.
• Deletion: the right to request deletion of personal information, subject to applicable retention requirements.
• Complaints: the right to file a complaint with the Privacy Commissioner of Canada regarding the handling of personal information.

For submitters located in the EEA, the following additional rights apply under the GDPR:

• Data Portability: the right to receive personal data in a structured, commonly used, and machine-readable format.
• Restriction of Processing: the right to request restriction of the processing of personal data.
• Objection: the right to object to processing based on legitimate interest.
• Supervisory Authority: the right to lodge a complaint with the relevant EU data protection supervisory authority.

To exercise any of these rights, the Registry may be contacted using the information provided in the Contact Information section below.

The Registry is intended for use by healthcare professionals only. The Website is not directed at individuals under the age of 18. Personal information is not knowingly collected from minors. If it is discovered that personal information has been inadvertently collected from an individual under 18, that information will be deleted promptly.

This Privacy Policy may be updated at any time without prior notice. Continued use of the Website following any changes constitutes acceptance of the revised policy. The "Last updated" date at the top of this page indicates when the most recent changes were made.

For questions or concerns regarding this Privacy Policy, or to exercise privacy rights, the Registry may be contacted through the contact page.