Privacy Notice

ClinicalConnect is a platform operated by Newtown Clinical Research Centre, which is the responsible party for your personal information under POPIA.

Information Officer: Essack Mitha
Contact for all privacy matters: mmitha7860@gmail.com

Please note that Newtown Clinical Research Centre both operates this platform and conducts clinical research of its own. It is therefore one of the research organisations that may contact you about a trial. We tell you this so you can weigh it when deciding whether to consent.

We collect only what is needed to assess whether you may be eligible for a clinical trial:

• Identity and contact details — first and last name, email address, cellphone number, and a next-of-kin cellphone number if you choose to give one.
• Demographic details — age, sex and province.
• Health information — the medical conditions you select, the medications you list (including dose, frequency and how long you have taken them), any supplements, and whether you are undergoing or have recently completed cancer treatment, with any notes you add.
• Consent record — which permissions you granted and when.
• Contact history — which trials you were contacted about, on which channel, and when.

If you give us a next-of-kin number, please tell that person, since it is their personal information too. You are not required to provide one.

POPIA prohibits processing health information unless a specific exception applies. We rely on section 27(1)(a) — your explicit consent, which you give before any information is collected, and which you can withdraw at any time.

We keep a record of the consent you gave so that both you and we can verify it later.

One purpose only: assessing whether you may be eligible for clinical trials run by research organisations subscribed to ClinicalConnect, and contacting you about those trials.

We do not sell your information, use it for advertising, or use it for any purpose beyond the one stated here.

If you consented to sharing, research organisations subscribed to ClinicalConnect can view your profile — including your conditions and medications — to assess eligibility. The organisations currently on the platform are listed publicly on our community page.

Organisations only ever see people who consented to data sharing, and every outreach message is approved by a person at that organisation before it is sent. Nothing is sent automatically.

We use the following providers, each of which is contractually required to protect your information and use it only on our instructions:

• Supabase — database and login, hosted in Frankfurt, Germany.
• Vercel — website hosting.
• Resend — email delivery.
• SMS Messenger — SMS delivery, South Africa.
• Meta Platforms — WhatsApp message delivery.

Your information is stored outside South Africa, primarily in the European Union. POPIA section 72 permits this because the EU provides a level of protection substantially similar to POPIA under the GDPR. We tell you plainly rather than leaving you to assume your data stays local.

We keep your profile for as long as your consent stands, because that is what allows us to match you to trials that may only open years from now.

If you delete your profile, your personal and health information is removed permanently. We retain only a dated record that a deletion took place, containing no name, contact detail or health information, so that we can demonstrate the request was honoured.

You choose your channels — email, SMS and WhatsApp are each opted into separately, and you can change or switch them all off from your profile at any time.

You do not need to log in to stop us. Reply STOP to any SMS or WhatsApp message, or use the unsubscribe link at the bottom of any email we send you, and we will switch that channel off immediately. Turning off one channel leaves the others as they are.

Under POPIA you may:

• ask what information we hold about you and receive a copy;
• correct anything that is inaccurate or out of date;
• object to how we process your information;
• withdraw your consent and have your data deleted; and
• complain to the Information Regulator.

You can update your contact details and consents yourself from your profile. For anything else, email mmitha7860@gmail.com and we will respond as soon as we reasonably can.

Information is encrypted in transit and at rest. Access controls in our database restrict each research organisation to the records it is entitled to see, and profiles are only visible to organisations if you consented to data sharing.

No system is perfectly secure. If your information is ever compromised, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 requires.

ClinicalConnect is for adults. Registration requires you to be 18 or older, and we do not knowingly collect information about children. If you believe a child has registered, contact us and we will delete the profile.

If we change how we handle your information we will update this page and change the date at the top. Where a change materially affects you, we will tell you directly on a channel you have consented to.

Please raise concerns with us first at mmitha7860@gmail.com. You also have the right to complain directly to: