Avalere HealthCandidate privacy notice

Data Privacy Notice for Candidates

This Data Privacy Notice for Candidates ("Notice") provides guidance and information to Avalere Health employees and external candidates (collectively "Candidate/s") regarding the personal data we collect from you or through our systems during your recruitment process.

In this Notice, references to "Avalere", "we", "us" and "our" will mean the hiring Avalere company (as specified in the job description or as the context of the job description provides). Avalere Health and its affiliated companies will be referred to collectively as "Avalere Health".

Most of your personal data is processed via our centralized and consolidated Applicant Tracking System("ATS"). The ATS allows Avalere Health to organize and manage the recruitment process. Avalere Health has chosen Lever TRM as the service provider for the Avalere Health ATS. Lever TRM provides its products and services as a cloud-based solution. However, the data (including personal data) will solely be hosted on servers in Oregon, United States. We may also process your personal data through other electronic and paper-based systems for the purpose of carrying out the recruitment process.

We seek to maintain the privacy, accuracy, and confidentiality of personal information (including your personal data) that we collect and use concerning our Candidates.

European privacy laws require that the following information is provided to you:

Identity of the controller

Avalere Health Global Limited

The Featherstone Building

66 City Road

London

EC1Y 2AL, UK

Tel: +44 1565 756 600

Information Commissioner's Office registration number: Z5586262

What information do we collect?

The categories of personal data we may collect:

• identification data, including first name and surname;
• contact information, including name, home address, phone/mobile/fax number, email address;
• equal opportunities monitoring information, including information about gender, date of birth, citizenship; your ethnic origin, sexual orientation, health and religion or belief;
• data regarding responses to screening questions (where applicable);
• background check information (where applicable);
• previous employment information, including date of hire, job title, experience, qualifications, remuneration, current benefits entitlements, department and business unit, work location, work status (full-time, part-time), data pertaining to work preferences and abilities;
• resume/CV, including education and qualifications, past work experience and references;
• information on certain health conditions (only where required by law) and any reasonable adjustments we need to make during the recruitment process;
• job interview notes;
• assessment results.

Most of the personal data we process is obtained from you when you file your application with Avalere Health (or when a recruitment agency or a friend file an application with Avalere Health on your behalf), but we also obtain personal data about you during the application process (for example, during interviews or from your CV/Resume). Other data types may be obtained from third parties, including for example, recruitment agencies.

In most cases, you will be required to submit your application on the Avalere Health careers page. You may have the opportunity in some instances to use your external social media account or a 3rd party, such as LinkedIn or a job board, to facilitate your application. In that event, Avalere Health will be provided with the latest information from your social media or job board account. Additional privacy terms of the social media and/or 3rd party service providers may apply.

Purposes for which the processing of the personal data is intended; legal basis for the processing; and your legitimate interests:

Avalere Health will process your personal data for job recruiting and placement purposes, including notification of future job opportunities, and, for successful candidates, for employment purposes.

Processing of this personal data is required to enable Avalere Health to administer the recruiting process, including the set-up of an electronic job applicant HR file, managing your application, organizing interviews - in short, the processing is necessary for us to consider entering into a contract with you or, if your application is successful, to enter into a contract with you (legal basis: Article 6 (1) b) GDPR).

In case of legal proceedings, we will need to process your personal data to establish, exercise or defend Avalere Health against the legal claim (legal basis: Article 6 (1) f) GDPR). We may also share your personal data with other Avalere Health companies and, for the purpose of considering you for future job openings, we will retain your data for a maximum period of 2 years beyond an unsuccessful application (legal basis: Article 6 (1) a) and/or f) GDPR). You can object to such use of your data at any time. The provision of personal data is voluntary, however, your failure to provide personal data may have an impact on the recruitment process.

Recipients or categories of recipients of the personal data:

Personal data will only be shared across Avalere Health in certain circumstances and where lawful to do so, for example with limited members of the Human Resources (HR) department or the IT (Information Technology) department, both of which may be working for different Avalere Health entities. Whenever we need to share your personal data, we will only do so on a need-to-know basis and with selected employees for tasks within their job responsibilities.

Avalere Health takes appropriate steps to ensure that such personnel are bound by duties of confidentiality with respect to your personal data. Your personal data will be shared with Avalere Health Global Limited and Avalere Health US Inc. for the central management and maintenance of the recruitment databases, including management of the recruitment process.

International transfers

Due to the global nature of Avalere Health, your personal data may be transferred to Avalere Health entities located in other countries, including outside the European Economic Area (EEA). For example, the hiring manager may be located and employed by the Avalere Health US Inc. entity in the US with access to personal data of employees of the Avalere Health Global Limited entity in the UK. These other countries will either have different data protection laws than your country of residence or they may not have data protection laws. Steps will however be taken to put in place safeguards (including around security) to protect your personal data when it is in other countries. For example, in respect of transfers outside the EEA, this includes the use of European Model Clause contracts. (You can find out what these are online at the following address: Standard Contractual Clauses.

Service Providers: We use third party service providers (Lever TRM or work agencies) who provide technical and support services in connection with the application and recruitment process (such as hosting or "Software as a Service"). In providing these services, your personal data will, where applicable, be processed by the service provider on Avalere Health's behalf. We will confirm with any third-party service provider we use that they can provide sufficient guarantees regarding the confidentiality and security of your data. We will ensure that any third party complies with our data security standards and international transfer restrictions.

Disclosure to third parties: In certain circumstances, we share and/or are obliged to share your personal data with third parties outside Avalere Health, for the purposes described above and in accordance with applicable data protection laws. These parties will act as controllers of your personal data in their own right, and they will be responsible for compliance with applicable data protection laws. These third parties are:

• administrative authorities (tax or social security authorities);
• financial institutions;
• insurance providers;
• police, public prosecutors;
• external advisors (such as legal advisors, accountants, auditors).

Period for which the personal data will be stored, or if it is not possible to state a specific period, the criteria used to determine that period: If your application for employment is successful and you commence employment with Avalere Health, your personal data will be transferred to your personnel file and will be processed for employment purposes. If your application for employment is not successful, we will keep your personal data for a limited period upon notification that your application was not successful for the purposes of:

(a) contacting you (with your consent, where required) for future job vacancies and;

(b) the establishment, exercise, or defence of legal claims.

Your rights

You have various rights under data privacy laws in your country (where applicable). These include (as relevant):

(a) the right to request access to the personal data we hold about you;

(b) the right to rectification including to require us to correct inaccurate personal data;

(c) the right to request restriction of processing concerning you or to object to processing of your personal data;

(d) the right to request the erasure of your personal data where it is no longer necessary for us to retain it;

(e) the right to data portability including to obtain personal data in a commonly used machine-readable format in certain circumstances such as where our processing of it is based on a consent;

(f) the right to object to automated decision-making including profiling (if any) that has a legal or significant effect on you as an individual;

(g) and the right to withdraw your consent to any processing for which you have previously given that consent.

Your right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy you may have, you have the right under data privacy laws in your country (where applicable) to lodge a complaint with the relevant data protection supervisory authority in your country if you consider that we have infringed applicable data privacy laws when processing your personal data. This means the country where you are habitually resident, where you work or where the alleged infringement took place.

Security

We maintain physical, electronic, and procedural safeguards to protect the confidentiality, integrity, and availability of your personal data. We have taken appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

Changes

We may decide to change this Notice. If the change is fundamental or may significantly affect you, we will provide you with the updated Notice in advance of the change taking effect. If you have any questions or would like further information about your data protection rights, please contact our Avalere Health data protection team dataprotection@avalerehealth.com.

Last reviewed: February 2025