Legal information
Privacy Policy
Last updated: September 30, 2026
0. Scope of this policy
This Privacy Policy governs the processing of personal data of people who visit or interact with the website cecsaga.cl (hereinafter, the «Site»), including those who complete the contact form or the application and registration forms published on the Site to express interest in a clinical study or in a SAGA activity.This Policy does not replace or substitute the informed consent process specific to each clinical study, which is governed by Law No. 20,120, by the rules of the Institute of Public Health (ISP) and the Scientific Ethics Committees (CEC), and by the specific documents provided and signed in the context of each research protocol. Nor does it govern data processing carried out on the external portal «Mi Otra Opción,» which has its own privacy notice; this Policy describes only how SAGA receives and uses the information that said portal forwards to it.
1. Data controller
- Company name: Centro de Estudios Clínicos SAGA SpA
- RUT (Chilean taxpayer ID): 77.074.304-4
- Address: Av. Antonio Varas 497, Providencia, Santiago, Chile
- Legal representative: Julio San Martín Grob
- Contact channel for personal data protection matters: ciberseguridad@cecsaga.cl
2. Personal data we collect
2.1 Site contact form («Apply to a study» / Contact)
Through the form available on the Site we collect: first name, last name, telephone number, email address, and the content of the message field.The message field is free text. If you choose to voluntarily include information about your diagnosis, health condition, or medical history, SAGA will treat that information as sensitive data, applying enhanced safeguards and using it exclusively to evaluate and manage your interest in participating in a clinical study.2.2 Application forms for specific clinical studies
Some pages of the Site dedicated to specific clinical studies or therapeutic areas (for example, eligibility for oncology studies, lung cancer, gastric cancer, or melanoma) include an application form through which, depending on the form, we collect:- Identification and contact data: who is submitting the application (the patient themselves or another person on their behalf), first and last name, age, telephone number, email address, region, municipality or city of residence, and preferred means of contact.
- Health history: diagnosis or condition, specific mutations or markers, presence of metastases, and current stage of treatment, among other clinical information relevant to the study.
2.3 Activity registration forms
For registration for seminars or other SAGA activities, the Site may collect contact data and information needed to organize the activity (for example, profession, mode of participation, and parking needs), through the same LeadConnector platform.2.4 External portal «Mi Otra Opción»
SAGA also receives contact requests from the external platform «Mi Otra Opción,» aimed at people interested in oncology clinical studies, on which information related to the interested person’s oncological condition is collected. This information is initially received by SAGA’s Patient Access Manager, who may subsequently share the relevant oncological information with physicians at the Center to evaluate the case.2.5 Browsing data and cookies
The Site uses first-party and third-party cookies. The details of the cookies used, their purposes, and how to manage them can be found in our Cookie Policy (https://cecsaga.cl/politica-de-cookies/).2.6 Data generated if you enter a clinical study
If, following the corresponding evaluation, you enter a screening process or a clinical study, the processing of your data — including your electronic medical record — will be governed by the informed consent specific to the study and by the applicable health and research regulations, which are documents independent of this Policy.3. Purposes of processing
- Responding to and following up on contact requests from people interested in SAGA’s clinical studies.
- Evaluating, through the Patient Access Manager and the medical team, a person’s potential eligibility for a clinical study.
- Internally coordinating contact between the SAGA team and the interested person.
- Complying with regulatory obligations applicable to clinical research (ISP, Scientific Ethics Committees, sponsors), solely with respect to those who actually enter a study.
- Managing registration and participation in seminars or other SAGA activities.
- Maintaining the security, integrity, and proper functioning of the Site.
- Measuring and optimizing the performance of SAGA’s advertising campaigns on Google Ads and Meta (Facebook/Instagram), as detailed in section 3.5 below.
3.5 Advertising campaign measurement (Google Ads and Meta Pixel)
The Site has advertising measurement tools configured through Google Tag Manager (container GTM-TVC2KXWF) that use data associated with your interaction with the Site and, in particular, with its forms and the WhatsApp button:- Google Ads (account AW-18011342931): records as a conversion the submission of the application forms and clicks on the WhatsApp button. Through the «enhanced conversions» feature, the first name, last name, email address, telephone number, city, and country entered in the form are converted into an encrypted value (hash) and sent to Google, in order to associate your inquiry with a prior click on a Google ad and to measure the effectiveness of those campaigns.
- Meta Pixel (ID 930511152719082): records your visit to the Site («PageView» event), form submissions («Lead» event), and clicks on the WhatsApp button («Contact» event), which SAGA uses to measure and optimize advertising campaigns on Facebook and Instagram.
4. Legal basis for processing
The processing of your personal data is based on:
- Your consent, given when you voluntarily complete and submit a form on the Site and, in the case of analytics and advertising tools, when you accept the corresponding category in the cookie notice, except for the Meta events indicated in section 3.5.
- Express and enhanced consent, when you voluntarily provide sensitive data relating to your health.
- Legal obligation, with respect to processing required by health and scientific research regulations, in the case of those who enter a study.
- SAGA’s legitimate interest, to ensure the technical security and proper functioning of the Site.
5. Recipients of the data
Your data may be accessed by:
- SAGA internal staff in charge of contacting interested people.
- The Patient Access Manager and, where appropriate, SAGA team physicians who evaluate the information received (including that coming from «Mi Otra Opción»).
- Technology providers that supply hosting, email, and analytics/management tools for the Site, acting as data processors: the Site’s hosting is provided by Ecohosting Internet Limitada, with servers located in Chile; SAGA’s corporate email is provided by Microsoft 365 (Microsoft Corporation); and the application and registration forms are provided by HighLevel LLC (LeadConnector platform).
- Google LLC (Google Analytics and Google Ads) and Meta Platforms, Inc. (Meta Pixel), as data processors for web analytics and advertising campaign measurement purposes, with respect to the data described in section 3.5 of this Policy. Both providers may process data outside Chile, in accordance with their own privacy policies.
- Solely with respect to people who formally enter a clinical study: sponsors, contract research organizations (CROs), laboratories, ethics committees, and regulatory authorities (such as the ISP), to the extent necessary for the conduct and oversight of the corresponding study.
6. International data transfers
In the context of conducting clinical studies, SAGA may transfer coded or pseudonymized data of study participants to sponsors, CROs, and laboratories located outside Chile. The information that allows the direct identification of the patient (full name and other identifying information) is kept internally in SAGA’s electronic record in Chile and is not transferred together with the coded data.These transfers take place within the framework of clinical studies regulated by ethics committees and health authorities, and SAGA seeks to ensure that receiving sponsors and CROs have contractual commitments to confidentiality and information security equivalent to the standards of Law No. 19,628, of the future Law No. 21,719, and, where applicable by virtue of the sponsor’s nature, of the European Union’s General Data Protection Regulation (GDPR).With respect to the Site’s technology providers: the hosting (Ecohosting Internet Limitada) operates with servers located in Chile. SAGA’s corporate email is provided by Microsoft 365, whose provider (Microsoft Corporation) may process data in data centers outside Chile, in accordance with its own privacy policy and Microsoft’s contractual terms for business customers.The data entered in the Site’s application and registration forms, including health history, is stored on the LeadConnector platform of HighLevel LLC, a company based in the United States whose servers are located outside Chile. Google LLC and Meta Platforms, Inc. may also process outside Chile the measurement data described in section 3.5.
7. Retention period
- Data of people who express interest through the Site but ultimately do not enter a clinical study will be kept for a maximum of 24 months from the last contact, after which it will be securely deleted or anonymized.
- Data of people who enter a screening process or a clinical study will be kept for the period determined by the protocol of the respective study and the applicable regulatory and research rules, which may be longer than the period indicated above.
8. Minors
The Site’s forms may be completed by people over 18 years of age or by the parent or legal representative of a minor interested in a clinical study. This submission constitutes only a first contact: verification of the representation by the parent or legal guardian, and any additional consent process that may apply, takes place at later stages of the clinical process (evaluation and, where applicable, study screening), in accordance with the corresponding research protocol, and is not part of this Site. If you are a minor and wish to express interest in a clinical study, ask your parent or legal representative to complete the form on your behalf. Some studies are aimed exclusively at people over 18 years of age, which is indicated in the respective form.
9. Your rights
In accordance with Law No. 19,628 and the standards reinforced by Law No. 21,719, you have the right to:
Access: know what personal data of yours SAGA processes.
Rectification: request the correction of inaccurate or outdated data.
Cancellation/Erasure: request the deletion of your data when it is no longer necessary for the purpose for which it was processed.
Objection: object to the processing of your data in certain circumstances.
Portability: request delivery of your data in a structured format, where applicable.
Temporary blocking: request the temporary suspension of the processing of your data.
These rights (known as ARCO+ rights) may be exercised by sending a request to ciberseguridad@cecsaga.cl, stating your full name and the right you wish to exercise, and attaching a means of verifying your identity. SAGA will respond within the applicable legal deadlines.
These rights do not apply with respect to the information contained in the medical record of a patient who has entered a study, which is governed by Law No. 20,584 and the corresponding scientific research regulations.
10. Information security
SAGA has an Information Security Management System certified under the ISO 27001:2022 standard and a Quality Management System certified under the ISO 9001 standard, within the framework of which it applies technical and organizational measures to protect the personal data it processes against unauthorized access, loss, alteration, or improper disclosure.
11. Cookies
The use of cookies and tracking technologies on the Site is described in detail in our Cookie Policy.
12. Changes to this policy
SAGA may update this Privacy Policy to reflect regulatory changes — in particular, the entry into force of Law No. 21,719 — or changes in its data processing practices. The version in force will always be the one published at this same web address.
13. Contact
For questions about this Privacy Policy or about the processing of your personal data, write to us at ciberseguridad@cecsaga.cl.
