Privacy Policy

1. About this policy

This policy explains how Berry Consultants collects, uses, shares, and protects personal information through our website at berryconsultants.com (the “Site”), and the privacy rights available to you.

Scope — please read. This policy covers the Site only. It does not cover:

• Clinical trial data, patient data, or study data that Berry processes on behalf of sponsors, institutions, or research networks. That processing is governed by the applicable clinical trial agreements, protocols, statistical analysis plans, data processing agreements, and research ethics approvals — not by this policy.
• Licensed software (FACTS, ADDPLAN, QUOTES) installed in your own environment. Data you process in that software stays in your environment and is governed by your licence agreement.
• Recruitment and employee data, which is covered by [our Candidate Privacy Notice / a separate notice provided at the point of application].

2. Who we are

The controller of personal information collected through the Site is:

Berry Consultants LLC
3345 Bee Caves Rd, Suite 201
Austin, Texas 78746, United States

Our United Kingdom office is:

[FULL LEGAL NAME OF UK ENTITY]
The Lambourn, Wyndyke Furlong
Abingdon, OX14 1UJ, United Kingdom
[Company number: ____]

[CONFIRM: which entity is the controller for visitors in the UK and EEA, and whether the two are joint controllers.]

Privacy contact: [privacy@berryconsultants.com]
General contact: info@berryconsultants.com · +1 (512) 213-6428

3. Information we collect

3.1 Information you give us

Contact enquiries. First name, last name, email address, company, title or role, country, how you heard about us, the topic of your enquiry, and your message.

Software enquiries. First name, last name, company name, email address, phone number, the product you are interested in, and your message.

Newsletter sign-up. Email address, and a record of the page you signed up from.

Site search. The terms you type into our search box.

You do not have to give us any of this information to browse the Site. If you choose not to provide the information marked as required on a form, we may not be able to respond to your enquiry.

3.2 Information collected automatically

When you visit the Site we and our service providers may collect: your IP address, browser type and version, operating system and device type, referring website, the pages you view and links you click, the date, time and duration of your visit, and an approximate location derived from your IP address (typically city or region level).

3.3 Information we do not collect

We do not knowingly collect personal information from children. The Site is not directed to children under 16.

We do not ask you for, and we ask that you do not send us through the Site, any patient-identifiable information, personal health information, or confidential study data. Please use the secure channels agreed in your contract with us instead.

4. Cookies and similar technologies

We use cookies and similar technologies on the Site. Non-essential cookies are only set after you consent through our cookie banner, wherever in the world you are.

Full details of every cookie we use, what it does, how long it lasts, and how to change your choice at any time are in our Cookie Policy.

5. How we use your information

• Responding to enquiries — answering questions about our consulting services, software, training, contracts, or invoicing.
• Providing and improving the Site — operating, securing, and maintaining the Site; fixing faults.
• Understanding how the Site is used — measuring which pages and resources are useful, in aggregate.
• Marketing communications — sending our newsletter and event or webinar information, where you have asked to receive it.
• Security and fraud prevention — protecting our forms from spam and automated abuse.
• Legal and regulatory compliance — meeting our legal obligations, responding to lawful requests, and enforcing our rights.

We do not sell your personal information, and we do not use it for cross-context behavioural advertising or targeted advertising. We do not run advertising on the Site and we do not operate advertising accounts linked to it. We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

6. Legal bases for processing (EEA and UK visitors)

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Responding to your enquiry — performance of a contract, or steps taken at your request prior to entering a contract (Art. 6(1)(b)); our legitimate interests in responding to business enquiries (Art. 6(1)(f)).
• Newsletter — your consent (Art. 6(1)(a)).
• Analytics cookies — your consent (Art. 6(1)(a)), and PECR reg. 6 in the UK.
• Media players and embedded content — your consent (Art. 6(1)(a)).
• Site security, spam prevention, essential Site operation — our legitimate interests in keeping the Site secure and functioning (Art. 6(1)(f)).
• Compliance with legal obligations — Art. 6(1)(c).

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it.

7. Who we share information with

We do not sell personal information. We share it with the following categories of service provider, who act on our instructions and are bound by contract to protect it:

• Webflow, Inc. (United States) — hosts the Site; delivers our forms and site search; provides first-party visit statistics.
• Google LLC (United States) — Google Analytics 4 for traffic measurement; reCAPTCHA for form spam protection; YouTube for video playback when you press play.
• Embedly, A Medium Corporation (United States) — renders embedded media players on our podcast and video pages.
• Transistor, Inc. (United States) — hosts our podcast and its audio players.
• Loops (United States) — sends our newsletter and manages subscriber lists.
• Make (Celonis SE) — routes software enquiry form submissions to the right team inbox. [Confirm account region.]
• Content delivery networks (jsDelivr, Cloudflare, unpkg, Amazon CloudFront) — deliver scripts and fonts that make the Site work.

We may also disclose personal information to our professional advisers where necessary; to a buyer or successor in the event of a merger, acquisition, financing, or sale of assets; where required by law, regulation, court order, or a lawful request from a public authority; and to establish, exercise, or defend legal claims.

[CONFIRM: whether enquiry data is also entered into a CRM or Berry's internal systems. The audit only sees what the website sends; internal onward flows need to be added here.]

8. International transfers

Berry operates in the United States and the United Kingdom, and our service providers are largely based in the United States. If you are in the EEA, the UK, or Switzerland, your personal information will be transferred outside your country to the United States.

Where we make such a transfer we rely on one or more of the following safeguards: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, the EU–US Data Privacy Framework and its UK Extension where the recipient is certified, or your explicit consent. [CONFIRM which mechanism Berry relies on for each provider.]

You may request a copy of the relevant safeguards by contacting us at [privacy@berryconsultants.com].

9. How long we keep information

• Contact and software enquiries — [proposed: 24 months after our last contact with you, unless a client relationship begins, in which case contract retention rules apply].
• Newsletter subscribers — until you unsubscribe, plus [proposed: 12 months] to honour your unsubscribe request.
• Analytics data — [proposed: 14 months in Google Analytics].
• Cookie consent records — [proposed: 24 months, as evidence that consent was obtained].
• Site security and server logs — [proposed: 12 months].

Where we no longer need personal information we delete it or irreversibly anonymise it.

10. Security

We use appropriate technical and organisational measures to protect personal information, including encryption in transit (HTTPS across the Site), access controls, and vetted service providers. No system is completely secure, and we cannot guarantee the security of information transmitted over the internet. Please do not send confidential study data or patient information through the Site's forms.

11. Your privacy rights

Your rights depend on where you live. We honour the rights below regardless of whether a particular law compels us to, except where a law requires us to verify your identity first.

11.1 Everyone

• Change your cookie choices at any time using the “Your Privacy Choices” link in the footer of every page.
• Unsubscribe from our newsletter using the link in any email we send.
• Ask us a privacy question at [privacy@berryconsultants.com].

11.2 EEA, UK, and Switzerland

You have the right to: access your personal information; have inaccurate information corrected; have your information erased; restrict how we process it; object to processing based on our legitimate interests; receive your information in a portable format; and withdraw consent where we rely on it.

You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EEA it is the authority in your country of residence, work, or where the issue arose. We would appreciate the chance to address your concern first.

[CONFIRM: whether Berry has appointed an EU representative under Art. 27 GDPR and/or a UK representative.]

11.3 United States — all states

Depending on your state of residence, you may have the right to:

• Know and access what personal information we hold about you, the categories we collect, the sources, our purposes, and the categories of third parties we disclose it to;
• Delete the personal information we hold about you;
• Correct inaccurate personal information;
• Obtain a portable copy of your personal information;
• Opt out of the sale or sharing of personal information, targeted advertising, and profiling with legal or similarly significant effects. Note that we do not sell or share personal information, do not conduct targeted advertising, and do not carry out such profiling, so there is nothing to opt out of. Our cookie banner lets you decline analytics and media cookies in any event;
• Limit the use of sensitive personal information — we do not collect sensitive personal information through the Site;
• Not be discriminated against for exercising any of these rights. We will not deny you services, charge a different price, or provide a lower quality of service because you exercised a privacy right.

How to make a request. Email [privacy@berryconsultants.com] with the subject line “Privacy Rights Request”, or call +1 (512) 213-6428. Tell us which right you wish to exercise and the state you live in. We will verify your identity using the information we already hold — usually the email address you contacted us from. We respond within 45 days and may extend once by a further 45 days where necessary, and will tell you if we do.

Authorised agents. You may use an authorised agent to make a request. We will ask the agent for written proof of your authorisation and may ask you to confirm it directly.

Appeals. If we decline your request, you may appeal by replying to our decision with the word “Appeal” and your reasons. We will respond to your appeal within 45 days and, if we deny it again, tell you how to contact your state Attorney General.

11.4 California

This section supplements the above for California residents under the CCPA as amended.

Categories of personal information collected in the past 12 months:

• Identifiers — yes: name, email address, phone number, IP address.
• Customer records information — yes: name, phone number, employer.
• Commercial information — yes: products you enquired about.
• Internet or network activity — yes: pages viewed, referring site, search terms.
• Geolocation data — yes: approximate city or region from IP address.
• Professional or employment information — yes: company, job title or role.
• Not collected: characteristics of protected classifications, biometric information, precise geolocation, audio or visual information, education information, sensitive personal information, and inferences used to create a profile.

Sources. Directly from you; automatically from your device as you use the Site; and from our service providers listed in section 7.

Business purposes for collecting. As set out in section 5.

Disclosures for a business purpose. We disclose the categories marked “yes” above to the service providers listed in section 7.

Sale or sharing. We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the past 12 months. We do not do so now. We do not sell or share the personal information of consumers we know to be under 16.

Opt-out preference signals. We honour the Global Privacy Control (GPC) and similar browser-level opt-out signals. Because we do not sell or share personal information, and because we ask for your permission before setting any non-essential cookie, no tracking occurs unless you actively consent. When we detect a GPC signal, our cookie banner will confirm on screen that your opt-out has been recognised and applied.

“Do Not Sell or Share My Personal Information.” We do not sell or share personal information, so no separate opt-out link is required. Use “Your Privacy Choices” in the footer to manage cookies.

11.5 Washington and Nevada — consumer health data

Berry Consultants works in clinical trial design and statistics, and our Site describes therapeutic areas and disease states. We want to be clear about what that does and does not mean for you.

• We do not collect, use, or infer consumer health data about visitors to the Site. We do not build profiles of visitors based on the therapeutic-area, disease, or publication pages they read, and we do not share such information with anyone.
• We do not sell consumer health data. We would not do so without the separate signed authorisation the law requires.
• Our analytics cookies are used to count page views in aggregate and are only set with your consent. They are not used to categorise you by health condition or interest.
• If you are a Washington resident and believe we hold consumer health data about you, you may ask us to confirm this, tell you who we have shared it with, and delete it, by writing to [privacy@berryconsultants.com]. You may withdraw any consent you have given at any time.

[COUNSEL REVIEW FLAGGED: the statements above commit Berry to not inferring health interest from browsing behaviour. That is consistent with the current technical setup and with the consent design being implemented, but it must remain true. If Berry ever adds retargeting, LinkedIn or Meta pixels, or page-level audience segmentation, this section and the underlying configuration must be revisited. Washington's My Health My Data Act carries a private right of action.]

12. Do Not Track

Some browsers offer a “Do Not Track” setting. There is no common industry standard for how to respond to it, so we do not respond to DNT signals. We do honour the Global Privacy Control, as described in section 11.4, and we require your consent before setting non-essential cookies in any case.

13. Third-party links

The Site links to third-party websites and profiles, including LinkedIn, X, YouTube, Spotify, and journal and regulatory websites. We are not responsible for their privacy practices. Please read their policies before providing information to them.

14. Children

The Site is intended for professional and business audiences. It is not directed to children, and we do not knowingly collect personal information from anyone under 16 through the Site. If you believe a child has provided us with personal information, contact [privacy@berryconsultants.com] and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, where the changes are significant, give notice on the Site. Please review it periodically.

16. Contact us

Privacy enquiries: [privacy@berryconsultants.com]
General: info@berryconsultants.com · +1 (512) 213-6428

Berry Consultants LLC
3345 Bee Caves Rd, Suite 201, Austin, Texas 78746, United States

[UK ENTITY NAME]
The Lambourn, Wyndyke Furlong, Abingdon, OX14 1UJ, United Kingdom