Privacy Shield
eu-us and swiss-eu frameworks

Effective Date: January 1, 2020


Prelude Dynamics is a Software as a Service (SaaS) provider who offers a Clinical Trial Optimization Platform (CTOP) VISION™, for the conduct of clinical trials. The software includes electronic data capture (EDC), data analysis (CDMS), and clinical trial management (CTMS) functionality in a premium custom built, template pre-built or do-it-yourself platform. Our clients are pharmaceutical companies and Contract Research Organizations (CROs), hereinafter referred to as “Sponsors”, who contract with us to implement our Clinical Trial Optimization Platform to collect, store, report on, analyze and export clinical trial information for sponsor-specific projects. The information collected by VISION™ is digitally transferred to, and stored in two SSAE-16 compliant data centers located in Austin, TX, and can be accessed by our Sponsors and other authorized users via the Internet. The information gathered is used solely for the purpose of the Sponsor’s clinical trials and is ultimately transferred to our Sponsors, who hold rights and responsibilities with respect to that information. Per contract, Prelude Dynamics is explicitly prohibited from disclosing any trial-related information to third parties without explicit authorization or as required by law.


“Sponsor” means any individual, corporation, or other entity which contracts with Prelude Dynamics to perform services involving the transfer, processing, or reporting of clinical trial information on behalf of and under the instructions of said ”Sponsor”.

“Personal Information” or “Information” means information that (1) is transferred from the European Union (“EU”) or Switzerland (“Swiss”) to the United States; (2) is recorded in any form; (3) is about, or pertains to a specific individual; and (4) can be linked to that individual.

Prelude Dynamics Privacy Policy

Prelude Dynamics is dedicated to ensuring the privacy of Sponsors, their staff members, and clinical trial participants.

This privacy policy outlines our general policy and practices for implementing the Principles, including the types of information we gather, how we use it, and the notice and choice affected individuals have regarding our use of and their ability to correct that information. This privacy policy applies to all personal information received by Prelude Dynamics. All such information is received in electronic format.

Privacy Principles


As a SaaS provider, it is the duty and responsibility of our Sponsors to notify individuals of how their information will be used and/or distributed to third parties. As a contracted agent of the Sponsor, we have no authority, and in fact are prohibited from, distributing data concerning an individual to anyone other than the Sponsor (or their agents as directed). Should the CTOP be used in any way to document or provide notice, we will work with the Sponsor to ensure that the notification provided is complete and easily understood, and refrain from allowing the trial to register any individuals until we feel that the notification provided sufficiently complies with this principle.

i. Notice of participation in the Privacy Shield

Prelude Dynamics complies with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information transferred from European Union, the United Kingdom and Switzerland to the United States in reliance on Privacy Shield. Prelude Dynamics has certified to the Department of Commerce that it adheres to the Privacy Shield Principles with respect to such information. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification page, please visit

ii. Types of Personal Data Collected

Personal data is collected by Sponsor organizations as required for the conduct of clinical studies in which the participant might participate. The type of personal data collected varies from study to study. Generally, all efforts are made to include only de-identified data, however in some cases personal information is used to track participants. The personal data might include: name, contact information, demographics such as race and gender, and sensitive medical information such as medical or health conditions, medications, and mental health status.

In some cases, only a patient key is used to identify the individual. In this case, only the principal investigator has access to identifiable personal information. If this is the case, the information that is transferred or contained within CTOP is exempt from the Privacy Shield as it does not contain any identifiable personal information.

iii. Commitment to the Privacy Shield Framework

Prelude Dynamics is committed to uphold the principles and framework set forth by the EU-US and Swiss-US Privacy Shield framework and its principles. Please see section i. Notice of Participation in the Privacy Shield.

iv. Purpose and Use of Personal Data

Sponsors have different reasons for collecting personal information. Generally, the purpose for collecting it is to be able to identify the participant across study visits and to be able to communicate important information with the participant. Because CTOP access is permission-based, only certain roles have access to personal data. During data analysis only de-identified data is used.

v. Contact for inquiries and complaints

Questions, comments or complaints regarding the Prelude Dynamics’ EU-US and Swiss-US Privacy Shield Principles or data collection and processing practices can be communicated using one of the methods below.

Prelude Dynamics
Attn: Chief Technology Officer
3906 Menchaca Rd
Austin, TX 78704

Privacy Shield organizations must respond within 45 days of receiving a complaint.

vi. Third parties and disclosure of information

It is the duty and responsibility of our Sponsors to notify individuals of how their information will be used and/or distributed to third parties. As a contracted agent of the Sponsor, we have no authority, and in fact are prohibited from, distributing data concerning an individual to anyone other than the Sponsor (or their agents as directed) per our contract without explicit authorization or as required by law.

While Prelude Dynamics will not authorize access to any study data, the Sponsors might assign access to agents acting on their behalf. The responsibility for ensuring Sponsor agents abide by the Privacy Shield is the Sponsor’s responsibility.

vii. Limiting use and disclosure of personal data

Sponsors are responsible for notifying and obtaining consent from all participants prior to disclosing their personal data to third parties. CTOP provides role based permissions which enable the Sponsor to limit access to personal identifiable information. Additional information about choice to opt-in or opt-out is located in the Choice section below.

ix. Independent dispute resolution

If you have not received a timely or satisfactory response to your question or complaint from Prelude Dynamics, please contact the EU Data Protection Authorities or the Swiss Data Protection and Information Commissioner. Prelude Dynamics agrees to cooperate with them to resolve any issues that might arise.

x. Investigation and Enforcement

The Federal Trade Commission has jurisdiction over Prelude’s compliance with the EU-US and Swiss-US Privacy Shield.

xi. Binding Arbitration

Under certain limited conditions, individuals may invoke binding arbitration before the Privacy Shield Panel created by the U.S. Department of Commerce and the European Commission. Information on your rights under the privacy shield is located at and additional information about when binding arbitration can be invoked is located at

xii. Response to lawful requests for information

In rare cases, personal information may be disclosed in response to lawful requests by public authorities. Such requests must be approved by the Sponsor and include requests made to meet national security or law enforcement requirements.

xiii. Liability in cases of onward transfers to third parties

The Sponsor retains all rights and responsibilities with respect to onward transfers. Our Sponsors transfer data to Prelude Dynamics for storage and processing, but we are contractually prohibited from releasing this information to anyone other than the Sponsor unless specifically authorized to do so, or are obligated to do so for legal reasons. This means Prelude Dynamics’ is held harmless related to liability in cases of onward transfers to third parties by the Sponsor.


Use of Personal Data, Purpose and the Choice to Participate

Trial participants, by their participation, are volunteering to supply certain medical information to support the Sponsor’s study goals. Participants may or may not be compensated by the Sponsor for participation. The Sponsor determines the study design, content, goals, and end usage of collected information.

a. Opportunity to opt-out of third party disclosure

Our contractual Sponsors are obligated to provide individuals with the ability to choose (opt out) whether their Personal Information will to be disclosed to a third party or used for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual. Individuals will typically opt out by communicating directly with our Sponsors. When notified by a Sponsor that an individual has chosen not to give permission, or has revoked their permission to use their Personal information, we will suppress that data from view. FDA 21CFR11 and GCP rules dictate that clinical trial data (including the audit trail) can never be deleted until the required retention period has expired.

Should an individual contact us directly with an opt-out request, we will notify the Sponsor on the individual’s behalf and proactively work with the Sponsor to resolve the individual’s issue or request.

b. Disclosure to third parties acting as agents to Sponsor

Prelude Dynamics has no authority to disclose data to any third parties unless required by law.

c. Obtaining affirmative expressed consent for sharing of sensitive information with third parties

For sensitive information (i.e., personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual), our contractual Sponsors must obtain affirmative express consent (opt in) from individuals if such information is to be (i) disclosed to a third party or (ii) used for a purpose other than those for which it was originally collected or subsequently authorized by the individuals through the exercise of opt-in choice. In addition, Prelude Dynamics will treat as sensitive any personal information received from our contractual sponsors where our contractual sponsor identifies and treats it as sensitive.

Accountability for Onward Transfers

The Sponsor retains all rights and responsibilities with respect to onward transfers. Our Sponsors transfer data to Prelude Dynamics for storage and processing, but we are contractually prohibited from releasing this information to anyone other than the Sponsor unless specifically authorized to do so, or are obligated to do so for legal reasons. Our contract with Sponsor organizations will require the Sponsor to uphold the EU-US and Swiss-US Privacy Shield Principles.

Data Security

a. Secure data storage

Prelude Dynamics hosts its Clinical Trial Optimization Platform in two SSAE-16 compliant data centers hosted in Austin, TX to ensure the data from physical loss.

b. Secure communication and access

All communications with our servers are implemented via secure, encrypted https protocol and a dedicated firewall appliance. The data center itself is manned 24/7/365 and stringent authorization and entry procedures are in place. The VISION™ system itself requires a role-permission based user ID/password combination to be entered before access to the system is granted. Issuance of such user IDs and passwords is the responsibility of the Sponsor and Sponsor representatives with strict need-to-know for a specific trial. While every effort has been made to reasonably safeguard Personal Information, we cannot absolutely guarantee the security of Information transmitted via the Internet. While every effort is made to detect and prevent unauthorized access to data on our servers, new electronic threats emerge every day. Prelude Dynamics will notify its’ Sponsors within 72 hours in the event a breach is detected.

c. Safeguard for Alteration and Destruction

CTOP utilizes a field by field audit trail to track who (user name and role) has entered the data and the time of the data entry or modification. Regular backups per standard operating procedures help ensure data safety and retrieval.

All participants using the CTOP VISION™ system, regardless of role, are expected to have and maintain anti-malware software on their local computers. They are also required to safeguard their ID and password.

Data Integrity and Purpose Limitation

i. Limited to Collection of Relevant Information

Our Sponsor organizations are responsible for ensuring that personal information collected is limited to the information that is relevant for the purposes of processing, and that the personal information collected is not processed in a way that is incompatible with the purposes for which it has been collected or authorized by the individual.

ii. Accuracy and Integrity of Data

Our Sponsor organizations are responsible for assuring data integrity at the time of data entry or during monitor review. Prelude Dynamics adds to this assurance by providing a comprehensive audit trail of data entered, and VISION utilizes comprehensive error and constraint checking to encourage correctness at data entry time. In addition, the data transmission protocol utilizes advanced technology to guarantee that the data transmitted to our secure server is identical to the data entered. If any participant believes information collected is in error, they should contact their Sponsor representative as soon as possible.

iii. Data Retention

Our Sponsors are responsible for maintaining archived data files in compliance with federal regulations set forth by the Food and Drug Administration Agency. Additionally, per our contract, Prelude maintains a copy of the archived data for the timeframe specified in the contract. All archived data files in Prelude’s possession are safeguarded either in a fire proof safe or a secure server located in the data center with only key officers within the organization having access.


a. Individual’s access to their personal information

All requests for access to personal information should be directed to the appropriate Sponsor. When necessary, Prelude Dynamics will assist the Sponsor in compiling an electronic copy of the personal information requested in XML format.

b. Individual’s access to treatment information when participating in a clinical trial

Participants in clinical trials may not be given access to information about treatment they might be receiving if doing so would jeopardize the validity of the research study and results. If the participant has agreed to participate in a blinded study, the right to access this information is foregone until the end of the trial. At which time, the individual may request the information from the physician or health care provider from which treatment was received.

c. Individual’s ability to correct their personal information

All request to change or correct personal information should be directed to the appropriate Sponsor. The Sponsor personnel or appropriate study personnel will be able to make changes to the individual’s personal information.

Recourse, Enforcement and Liability

a. Enforcement

Prelude Dynamics uses a self-assessment approach to assure compliance with this privacy policy and periodically verifies that the policy is accurate, comprehensive for the information intended to be covered, prominently displayed, completely implemented and accessible and in conformity with EU-US and Swiss-US Privacy Shield Principles. We provide training to our employees on an annual basis, and are prepared to take disciplinary action with employees in the event they fail to comply with the Principles.

b. Recourse

After communicating with the Sponsor, Prelude Dynamics encourages individuals to raise complaints directly with us prior to proceeding to an independent recourse mechanism for resolution. We agree to give prompt and courteous attention to complaints about an individual’s privacy, and to address them in a timely manner.

In addition to self-assessment, Prelude Dynamics commits to cooperate and comply with both European Data Protection Authorities (DPAs) and the Federal Data Protection and Information Commissioner of Switzerland in the investigation and resolution of complaints brought under EU-US and Swiss-US Privacy Shield Principles. We will comply with any advice given by these authorities where the authorities take the view that our organization needs to take specific action to comply with the EU-US and Swiss-US Privacy Shield Principles and will provide these authorities with written confirmation that such action has been taken.

The contact information for the above-mentioned authorities can be found at:
Swiss FDPIC:

c. Liability

Prelude Dynamics is not liable under the Privacy Shield Principles as we merely transmit and cache information. As is the case with the Directive itself, the Privacy Shield does not create secondary liability. To the extent that an organization is acting as a mere conduit for data transmitted by third parties and does not determine the purposes and means of processing those personal data, it would not be liable.


This privacy policy may be amended from time to time in order to remain consistent and compliant with the most recent EU-US and Swiss-US Privacy Shield Principles guidelines. Revisions to our Privacy Policy will be posted on this Website.