Confidentiality & Data Security

At OnlineSPSS, protecting the confidentiality and integrity of our clients’ research is a fundamental part of our professional responsibility.

We understand that statistical consultancy frequently involves unpublished research findings, proprietary datasets, clinical research information, manuscripts, and other materials that require careful handling.

Our approach is founded on three principles: confidentiality, responsible data management, and professional accountability.

We use client research materials only for authorized purposes connected with the agreed engagement, subject to applicable law and contractual obligations.

This policy explains how we manage research confidentiality, control access to project information, handle file transfers, and respond to data security concerns.

Information submitted to OnlineSPSS in connection with a research project is treated as confidential unless it is already lawfully public or another exception applies.

Confidential materials may include:

• Research datasets and statistical databases.
• Clinical and healthcare research information.
• Study protocols and statistical analysis plans.
• Unpublished manuscripts, dissertations, and research findings.
• Survey responses and qualitative research materials.
• Statistical analysis outputs, code, and project documentation.
• Proprietary business information and commercial research.
• Project communications and related professional correspondence.

Confidentiality applies throughout the engagement and continues after project completion, cancellation, or refund, subject to applicable legal and contractual obligations.

Clients retain ownership of the original datasets, manuscripts, research documentation, and other materials they provide to OnlineSPSS.

Submitting information for statistical analysis does not transfer ownership of those materials.

OnlineSPSS receives only the permissions necessary to evaluate and perform the agreed services.

The ownership of statistical reports, analytical outputs, scripts, tables, and other work produced by OnlineSPSS is governed by our Terms & Conditions.

Under those terms, intellectual property rights in agreed project-specific deliverables transfer to the Client following full payment, subject to applicable legal formalities and any expressly identified exclusions.

Regardless of ownership or payment status, confidential research materials are not made available for unrelated commercial use or public disclosure without an appropriate lawful basis or authorization.

We encourage clients to share only the information necessary to complete the agreed statistical analysis.

Before submitting datasets, clients should remove unnecessary directly identifying personal information, including names, contact details, personal addresses, patient identifiers, and other information that could identify individual research participants.

Where appropriate, participants should be represented using unique study IDs or coded records. Clients should retain any corresponding identification key separately rather than including it in the dataset supplied for analysis.

We recognize that removing direct identifiers does not necessarily make information fully anonymous. Pseudonymized datasets may remain subject to applicable privacy and data protection laws.

Where unnecessarily identifying information is submitted, OnlineSPSS will assess the circumstances and take appropriate protective action. This may include restricting access, isolating or securely deleting affected materials, and requesting a corrected dataset.

Projects requiring identifiable or otherwise regulated personal information are subject to additional assessment and safeguards.

OnlineSPSS provides a designated online form system through 123orderform.com for project enquiries and file submissions.

Research materials may also be handled through our hosting infrastructure, Google Cloud services, and restricted-access encrypted email communications.

The specific transfer and storage arrangements may vary according to the project and the requirements of the client.

We use technical and administrative safeguards intended to protect information during transmission and storage. The specific protections available vary with the configuration and capabilities of the relevant form, hosting, cloud and email providers. We do not guarantee that every method of transfer or storage is risk-free.

Clients who require an alternative secure transfer method may contact us before submitting their materials.

For projects with additional confidentiality requirements, we will discuss suitable arrangements before accepting restricted information.

No method of electronic transmission or storage can be guaranteed to eliminate every security risk.

OnlineSPSS primarily delivers consultancy through its internal team and may engage experienced independent specialists for relevant projects. Access is limited on a need-to-know basis and subject to suitable confidentiality obligations.

Where personal data is processed by OnlineSPSS on behalf of a controller under UK/EU GDPR, independent specialists or other providers processing the data on our behalf may be subprocessors. Article 28 requires the client’s prior specific or general written authorization before such a subprocessor is engaged. If general authorization applies, we provide notice of intended changes and an opportunity to object where required. Equivalent contractual protection must be imposed on approved subprocessors.

A general confidentiality promise or NDA does not replace a mandatory Data Processing Agreement. We remain responsible for managing assigned specialists according to our contracts and applicable law.

All OnlineSPSS projects are subject to our general confidentiality commitments, regardless of whether a separate Non-Disclosure Agreement (NDA) is signed.

We recognize that universities, healthcare organizations, research institutions, and commercial clients may have specific contractual confidentiality requirements.

Individual clients: Where a separate NDA is required, clients may provide their proposed agreement for our review. We will assess the provisions and confirm whether the agreement can be accepted and signed.

Institutional and long-term collaborations: OnlineSPSS may also propose an NDA or a broader confidentiality agreement where appropriate.

The terms of any separate agreement must be reviewed and mutually accepted before execution.

An NDA may address additional matters such as permitted disclosures, data access, confidentiality duration, information security obligations, and the return or deletion of confidential materials.

We ordinarily ask clients to remove unnecessary direct personal identifiers before sharing research datasets. Coded or pseudonymized patient records may still be regulated personal data, and health information may be special-category data under UK/EU GDPR.

Where OnlineSPSS performs analysis as a processor under UK/EU GDPR, an Article 28 DPA is mandatory before processing. The instructing controller is generally responsible for establishing its Article 6 lawful basis and any Article 9 special-category condition, with both parties responsible for their respective legal duties. Separate study permissions, ethics approvals, security terms and international transfer safeguards may also be needed.

US healthcare projects must be assessed individually for HIPAA covered-entity/business-associate status and whether a Business Associate Agreement or another suitable arrangement is required. Not every health-research dataset is HIPAA protected health information.

We may defer receipt of restricted information until the required safeguards and agreements are in place.

We use established statistical and research software according to the analytical requirements of each project.

Certain software applications include integrated automation, machine-learning capabilities, or AI-assisted features.

These technologies may support selected analytical or administrative tasks where appropriate.

The selection of statistical methods, validation of results, and interpretation of findings remain subject to human professional oversight.

We do not treat unverified AI-generated outputs as substitutes for professionally validated statistical analysis.

Before confidential or regulated research information is processed through an external AI-enabled service, we assess the relevant contractual, confidentiality, and data protection requirements and establish necessary safeguards or authorization.

Client research materials are not authorized for unrelated general-purpose AI model training without an appropriate lawful arrangement.

Our standard retention period for research project files is 90 calendar days following project completion, subject to agreed project-specific arrangements and lawful exceptions. The Privacy Policy is the authoritative public description of research-file retention, early deletion requests, accounting records, provider-managed copies and backup lifecycles.

See Privacy Policy: Research Data Retention and Deletion for full details. A separate Data Deletion Policy page is not required for this purpose.

OnlineSPSS takes suspected unauthorized access, disclosure, loss, or misuse of research information seriously.

Where a security incident is identified, we will assess the circumstances and take appropriate steps to:

• Investigate the nature and extent of the incident.
• Contain the issue and reduce further exposure where possible.
• Determine the categories of information affected.
• Assess potential risks to clients or other affected individuals.
• Notify relevant clients, organizations, or regulatory authorities where required by applicable law or contractual obligations.
• Implement reasonable corrective measures to reduce the likelihood of recurrence.

Notification requirements and deadlines depend on the applicable legal framework, the nature of the incident, and our role in processing the affected information.

OnlineSPSS uses third-party infrastructure and service providers to support file collection, storage, communication, and project delivery.

These providers may include online form services, hosting infrastructure, Google Cloud, email providers, and authorized professional contractors.

Information may be processed in different jurisdictions depending on the systems and services involved.

Where applicable data protection laws require specific arrangements for international transfers, OnlineSPSS will use appropriate legal safeguards or permitted transfer mechanisms.

We assess project-specific restrictions before accepting information that requires additional legal or technical protection.

Maintaining research confidentiality is a shared responsibility.

We ask clients to:

• Submit only information reasonably necessary for the project.
• Remove unnecessary personal identifiers.
• Confirm that they have permission to share the research materials.
• Inform OnlineSPSS of any relevant institutional, regulatory, or security requirements before transferring restricted data.
• Use the agreed communication and file-sharing channels.
• Retain appropriate copies of their original research data.
• Inform us promptly if a submitted file contains information that should not have been disclosed.

We will work with clients to identify suitable data-handling arrangements for projects with specific requirements.

Our confidentiality commitments continue beyond delivery of the final project.

We do not publish client datasets, unpublished manuscripts, or confidential project findings without appropriate authorization.

Where a client requests that identifiable project information be used in a testimonial, case study, or portfolio, the relevant permission must be obtained before disclosure.

The expiration of a revision period, cancellation of a project, or issuance of a refund does not automatically terminate confidentiality and applicable data protection obligations.

Clients with questions concerning data security, confidentiality arrangements, NDA requests, file transfers, or deletion of research materials may contact:

OnlineSPSS

Website: https://www.onlinespss.com

Email: info@onlinespss.com

We encourage clients to discuss any special confidentiality or information security requirements before submitting restricted research materials.

---

End of Confidentiality & Data Security Policy