CRC Privacy notice
Version 6.1 – March 2, 2026
CRC Research Inc. (“CRC”) is a CRIC Accredited market research company and operates premier facilities across Canada for focus groups and individual interviewing. CRC specializes in medical and consumer recruitment for qualitative projects. As per CRIC member requirements, CRC is compliant with the ISO 20252:2019 Market, Opinion and Social Research Vocabulary and Service Requirements.
CRC is committed to remaining compliant with the laws and regulations of the jurisdictions in which we operate, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the Privacy Legislation Modernization Act of Quebec, the European General Data Protection Regulation (“GDPR”), and other applicable provincial laws & regulations. We strive to adapt to changing industry standards and new technologies, and to remain compliant with new and incoming regulations and legislation.
This Privacy Notice is intended to communicate what information we collect about CRC Research candidates for research, past participants and/or active participants (“you”).
CRC Research Inc., (“we,” “us,” “our”) understands the importance of privacy and the protection of personal information. As such, we maintain a rigorous privacy and data security program, and strive to provide you with a privacy notice that is easy to follow, clear, and comprehensive. In the table below, we provide a summary of each section of our Privacy Notice:
| Section | Description |
|---|---|
| 1. Overview |
|
| 2. Collection of personal information, Choice and Transparency |
|
| 3. Purpose of collecting personal information |
|
| 4. Disclosure of personal information |
|
| 5. Retention of personal information |
|
| 6. Safeguards |
|
| 7. Accessing your personal information |
|
| 8. Cookies and similar technologies |
|
| 9. Changes to this Privacy Notice |
|
| 10. Contact us about our Privacy Program |
|
1. Overview
This Privacy Notice governs the collection, use, and disclosure of personal information and personal health information (together, “personal information”)] by CRC Research Inc.
We collect, use, and disclose personal information, including audio, video, and electronic information, for reasons that are consistent with the purposes described in this policy, or as otherwise permitted or mandated by law. Personal information is kept securely by us and our service providers and retained only as long as necessary to provide our services or to meet legal obligations. Except in limited circumstances, you (your, yours) have a right to access the information collected about you, within a reasonable time frame, in accordance with existing legislation.
We will, from time to time, review and revise our privacy practices and this Privacy Notice. Policy changes will apply to the information collected from the date of the revised Privacy Notice as well as to existing information held by us at the time of the amendment. Updates to this Privacy Notice will be published on our website. Should you have any questions or concerns, you are invited to contact us at privacy@crcresearch.com.
When you provide personal information, you agree that we may collect, use, and disclose your personal information in accordance with this Privacy Notice. You are free to withdraw your consent at any time. However, if you choose not to provide us with consent to collect, use, or disclose personal information, we may not be able to offer some of the services requested (see section 3, purposes, for more information about the services we provide)
2. Collection of personal information, Choice and Transparency
Personal information is defined as any information, whether recorded or not, about an identifiable individual, or an individual whose identity may be inferred or determined from the information. Examples of personal information include age, name, ID numbers, income, opinions, evaluations, comments, or disciplinary actions.
Personal information also includes personal health information about an identifiable individual such as:
• Physical or mental health;
• Any health service provided to the individual;
• Information that is collected in the course of providing health services to the individual and any testing results from that collection; or
• Information that is collected incidentally to the provision of health services to the individual and any testing results from that collection.
CRC collects information from those interested in participating in market research studies. We collect the following categories of personal information. The table below includes but is not limited to the categories of personal information that we collect as well as the source of our collection.
| Category | Description | Source of Information |
|---|---|---|
| Profile Data |
|
You Participant lists directly from clients – lists where participation consent provided by you to the client |
| Personal Data |
|
You |
| Personal Health Information |
|
You |
Privacy Rights:
Subject to certain limitations and depending on the privacy laws applicable to you, you may have the following legal rights to your information:
1. Right to openness about our collection, use and disclosure of your personal information. You have the right to be informed in a manner that is clear, transparent, and accessible.
2. Right to access or correct your personal information held by us, as detailed in our “Accessing your Personal Information,” section.
3. Right to have certain personal information that is held by us disposed of or removed as explained in our “Retention of Personal Information,” section.
4. Right to request that we restrict the processing of your personal information.
5. Right to object to certain processing of your personal information, including the right to object to marketing, and request that your personal information be moved to a third-party. You can object by changing your marketing and email preferences, as set out in unsubscribe.
6. Right to obtain your personal information in an accessible and transferable format so that you can re-use it for your own purposes with other service providers.
7. Right to receive non-discriminatory treatment for choosing to exercise your rights under applicable privacy legislation
Where we rely on your consent to process your information, you may have the right to withdraw or decline your consent at any time and, where we rely on legitimate interests, you have the right to object. Please note that withdrawing your consent may affect your access and ability to use our services (as detailed below).
You have the right to file a complaint about the way we use or process your information with the Information and Privacy Commissioner of Ontario (Canada) or other data protection authority as may be applicable to your jurisdiction.
Should you need to access or correct your personal information that is held by us, please use the contact information in the “Contact Us About Our Privacy Program” section at the end of this policy to reach us.
Requests to update, modify or delete information will be performed by the CRC Incidence Response team consisting of: VP of Operations, Privacy Officer/VP of Business Development (“BD”), IT Administrator & Recruitment Management team.
CRC collects written and at times verbal, consent from all participants recruited for active studies or during database registration. Consent forms are issued to all selected participants outlining the purposes of the given study and details around respondent participations.
3. Purpose of Collecting Personal Information
The purposes for which we collect your information, include, but may not be limited to, enabling, and supporting:
To conduct qualitative market, opinion, and social research with you on behalf of our clients;
To understand respondents’ opinions, demographic/socio economic profile, and product/service use to establish suitability for participation in research on specific topics;
To create an account for you;
To verify your identity;
To personalize your experience;
To allow our employees to screen information about you to identify you as a candidate for research projects;
To communicate with you, including for direct marketing purposes that you have agreed to receive and that are relevant to you;
To respond to your communications to us;
To deliver our services to you including market research and precision recruitment extracted through the use of computerized query, Artificial Intelligence (AI) and machine learning (ML) tools to efficiently find the most appropriate research participants from our participant pool for client research projects that CRC manually screens for best fit;
To aggregate and de-identify findings from research conducted by us to share with our clients for their use;
To improve our service offerings; and
To meet legal or regulatory requirements.
4. Sharing Your Personal Information
We may share information we collect with:
CRC Research employees: personal information about participants is only accessed by and shared amongst employees on a need to know basis.
Service providers: we may engage third-party providers, such as contractors or software vendors for service optimization. For example, CRC partners with Voxco to support panel management and survey deployment to enhance our recruitment processes and participant experience.
Corporate transaction entities: we might disclose personal information within the limits of the law and in accordance with this privacy policies for strategic business transactions such as sales or a merger.
Authorities identified in law: we may disclose personal information to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and safety.
Under no circumstances would CRC sell any participant information. Additionally, no third parties collect or have access to information that CRC gathers, and only authorized internal personnel access collected information stored in the database, client sample or target lists.
Please keep reading for more details about how we manage risks to your personal information, which can be found in sections 5 and 6, retention and safeguards, respectively.
5. Retention of Personal Information
We store and retain personal information for as long as necessary to fulfill the purpose for which it was collected or as otherwise permitted by law. Once this purpose has been fulfilled, subject to any legal exceptions, we destroy the information in a secure manner that protects the privacy of the individual to whom the information relates. Our retention and destruction policy is reviewed and updated regularly.
As per standardized best practices and guidelines, study materials are kept for a minimum of six (6) months. After one (1) year, study materials are deleted from the servers. If participants agree, their information may be kept on file for the sole purpose of inviting individuals to future studies. This information may be parsed using computerized query tools to efficiently pre-screen participants for said studies, which is then further screened by a CRC employee. Information will be permanently deleted at the request of any individual.
Where a client provides a list of potential participants, this list is automatically destroyed at the conclusion of the study.
6. Safeguards
We endeavour to maintain adequate physical, administrative, and technical security safeguards with respect to our offices and information storage capabilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of personal information. This commitment also applies to the disposal or destruction of personal information.
As part of these precautionary measures, we restrict access to personal information to those employees and, under appropriate contractual arrangements, third party service providers we determine need to know that information in order that we may provide our services. We treat employee misuse of personal information as a serious offence for which disciplinary action may be taken.
CRC does not rely on service providers where data will be transferred outside of Canada, and all information is stored within secure CRC servers located within our secure offices found in Toronto, Montreal, and Vancouver. CRC also partners with Voxco for panel management and survey deployment to enhance our recruitment processes and participant experience, and any personal information collected or processed through this partnership is managed in accordance with this Privacy Notice and CRC’s Canadian data-residency requirements. Voxco Security & Compliance details can be found here.
Strict and specific security access perimeters ensure that only certified staff have access to information. File transfer protocols require project specific login credentials, all of which are password encrypted and distributed only to authorized recipients.
Your information is collected via secure pre-screening links, which are programmed by dedicated recruiting coordinators for each study. At times, this information is also collected by telephone or via ZOOM or Teams calls, pending your accommodation needs.
CRC research requires proof of identity from all participants to prevent fraud, verify details against recruitment submissions, ensure accurate honorarium distribution, and confirm compliance with legal age regulations for research on regulated substances.
Breach Response
CRC has implemented comprehensive security measures and has not experienced any privacy breaches to date. The protocol for addressing potential breaches includes a documented and tested system, reviewed quarterly by the CRC Incident Response & Management team.
In the event of a breach, the system is shut down to quarantine the issue, allowing the IT team to identify and resolve it. The CRC Incident Response & Management Team is then notified to initiate the investigation, notify impacted clients or participants when a risk of real harm occurs, and follow breach protocols.
After resolving the breach, the IT team conducts a full system check and enhances security as needed and provides a complete update to all affected individuals.
7. Accessing Your Personal Information
You can access your Profile Data by logging in via the unique profile link found in the emails sent to you by a CRC coordinator. Alternatively, you can request profile data modification, deletion or access, along with any privacy policy and/or personal information management practices to the CRC Privacy Officer: privacy@crcresearch.com
8. Cookies and Similar Technologies
Please note CRC does not use cookies and does not track your browsing behaviour via our websites.
9. Changes to this Privacy Notice
The CRC Privacy Notice is reviewed at minimum once per year and/or as required reflecting changes made to CRC information practices.
Any chances to this policy are communicated to all CRC registered database participants via email and via notice on our websites.
We encourage you to periodically review this page for the latest information on our privacy practices.
10. Contact Us About Our Privacy Program
Any further questions regarding this Privacy Notice and/or personal information management practices may be submitted to the Privacy Officer:
Kathy Harsz
VP, Business Development & Privacy Officer
121 Bloor Street East, 2nd Floor
Toronto, ON M4W 3M5
416 544-3005
If you are unsatisfied with our response, please let us know and we will seek to make amends. You do have the right to contact the enforcement agency of your jurisdiction after exhausting communication with CRC Research to lodge a formal complaint about our compliance with privacy management practices.
Below are links to the websites of certain authorities:
Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/en/
Federal Communications Commission of the USA: https://www.fcc.gov/
Information Commissioner’s Office, United Kingdom: https://ico.org.uk/