VIRTUS TUE PRIVACY NOTICE
This Notice describes the personal information processing that will occur in connection with your submission of a TUE Application.
TYPES OF PERSONAL INFORMATION (PI)
The information provided by you or your physician(s) on the TUE Application Form (including your name, date of birth, contact details, sport and discipline, the diagnosis, medication, and treatment relevant to your application); Supporting medical information and records provided by you or your physician(s); and Assessments and decisions on your TUE application by ADOs (including WADA) and their TUE Committees and other TUE experts, including communications with you and your physician(s), relevant ADOs or support personnel regarding your application.
PURPOSES & USE
Your PI will be used in order to process and evaluate the merits of your TUE application in accordance with the International Standard for Therapeutic Use Exemptions In some instances, it could be used for other purposes in accordance with the World Anti- Doping Code (Code), the International Standards, and the anti-doping rules of ADOs with authority to test you. This includes:
- Results management, in the event of an adverse or atypical finding based on your sample(s) or the Athlete Biological Passport; and
- In rare cases, investigations, or related procedures in the context of a suspected Anti-Doping Rule Violation (ADRV).
TYPES OF RECIPIENTS
Your PI, including your medical or health information and records, may be shared with the following:
- ADO(s) responsible for making a decision to grant, reject, or recognize your TUE, as well as their delegated third parties (if any The decision to grant or deny your TUE application will also be made available to ADOs with testing authority and/or results management authority over you;
- WADA authorized staff;
- Members of the TUE Committees (TUECs) of each relevant ADO and WADA; and
- Other independent medical, scientific or legal experts, if needed.
Note that due to the sensitivity of TUE information, only a limited number of ADO and WADA staff will receive access to your application. ADOs (including WADA) must handle your PI in accordance with the International Standard for the Protection of Privacy and Personal Information (ISPPPI You may also consult Virtus to obtain more details about the processing of your PI.
Your PI will also be uploaded to ADAMS by the ADO who receives your application so that it may be accessed by other ADOs and WADA as necessary for the purposes described above. ADAMS is hosted in Canada and is operated and managed by WADA. For details about ADAMS, and how WADA will process your PI, consult the ADAMS Privacy Policy (ADAMS Privacy Policy)
FAIR & LAWFUL PROCESSING
When you sign the Athlete Declaration, you are confirming that you have read and understood this TUE Privacy Notice. Where appropriate and permitted by applicable law, ADOs and other parties mentioned above may also consider that this signature confirms your express consent to the PI processing described in this Notice. Alternatively, ADOs and these other parties may rely upon other grounds recognized in law to process your PI for the purposes described in this Notice, such as the important public interests served by anti-doping, the need to fulfill contractual obligations owed to you, the need to ensure compliance with a legal obligation or a compulsory legal process, or the need to fulfill legitimate interests associated with their activities.
RIGHTS
You have rights with respect to your PI under the ISPPPI, including the right to a copy of your PI and to have your PI corrected, blocked or deleted in certain circumstances. You may have additional rights under applicable laws, such as the right to lodge a complaint with a data privacy regulator in your country.
Where the processing of your PI is based on your consent, you can revoke your consent at any time, including the authorization to your physician to release medical information as described in the Athlete Declaration. To do so, you must notify your ADO and your physician(s) of your decision. If you withdraw your consent or object to the PI processing described in this Notice, your TUE will likely be rejected as ADOs will be unable to properly assess it in accordance with the Code and International Standards.
In rare cases, it may also be necessary for ADOs to continue to process your PI to fulfill obligations under the Code and the International Standards, despite your objection to such processing or withdrawal of consent (where applicable This includes processing for investigations or proceedings related to ADRV, as well as processing to establish, exercise or defend against legal claims involving you, WADA and/or an ADO.
SAFEGUARDS
All the information contained in a TUE application, including the supporting medical information and records, and any other information related to the evaluation of a TUE request must be handled in accordance with the principles of strict medical confidentiality. Physicians who are members of a TUE Committee and any other experts consulted must be subject to confidentiality agreements.
Under the ISPPPI, ADO staff must also sign confidentiality agreements, and ADOs must implement strong privacy and security measures to protect your PI. The ISPPPI requires ADOs to apply higher levels of security to TUE information, because of the sensitivity of this information. You can find information about security in ADAMS by consulting the response to How is your information protected in ADAMS? in our ADAMS Privacy and Security FAQs.
RETENTION
Your PI will be retained by ADOs (including WADA) for the retention periods described in Annex A of the ISPPPI. TUE certificates or rejection decisions will be retained for 10 years. TUE application forms and supplementary medical information will be retained for 12 months from the expiry of the TUE. Incomplete TUE applications will be retained for 12 months.
CONTACT
Consult tue@virtus.sport at Virtus for questions or concerns about the processing of your PI. To contact WADA, use privacy@wada-ama.org
World Anti-Doping Agency ADAMS Database Privacy Policy