In a corporate setting, an audience of professionals energetically applauds a presentation, highlighting engagement, enthusiasm, and a thriving corporate culture.

Privacy Policy

The purpose of this policy is to provide information on how the Society for Pediatric Research® (SPR) may collect and utilize your personal data.

For users in the European Union (EU), European Economic Area (EEA), or United Kingdom (UK): This policy also serves as notice under the General Data Protection Regulation (GDPR) and the UK GDPR. SPR processes personal data in compliance with applicable data protection laws, including GDPR, where it applies.

For California residents: This policy includes disclosures required under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

For U.S. individuals whose information may involve protected health information (PHI): SPR is not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). We do not collect, use, or disclose PHI as defined by HIPAA while providing healthcare services or acting on behalf of a covered entity. However, to the extent that any user voluntarily submits health-related information through forms, abstracts, or communications, SPR treats such information with heightened confidentiality and restricts its use to the purposes described herein.

For parents and guardians of children under 13 (U.S.): See the COPPA & Child Privacy Notice below.

Accessibility Compliance Statement

(EU – European Accessibility Act / EN 301 549 | U.S. – Section 508)
 
SPR is committed to ensuring digital accessibility for people with disabilities. We strive to conform to WCAG 2.1 Level AA standards and applicable legal requirements.

Current Efforts
  • Perceivable: Text alternatives for images, captions for videos, sufficient color contrast.
  • Operable: Keyboard navigation, no keyboard traps, clear focus indicators.
  • Understandable: Predictable navigation, readable content, input assistance.
  • Robust: Compatible with assistive technologies (screen readers, voice control).
Feedback & Assistance

If you encounter accessibility barriers:

We will respond within 5 business days.
Accessibility Statement Link: Available on the website footer.

Cookie & Tracking Technology Consent Notice

(EU/EEA/UK – ePrivacy Directive / PECR / LSSI-CE)

When you visit www.societyforpediatricresearch.org or use SPR digital platforms, we use cookies and similar tracking technologies (e.g., pixels, local storage, device identifiers) to:

  • Ensure website functionality (strictly necessary cookies)
  • Improve user experience and performance (analytics cookies)
  • Deliver personalized content or recommendations (functional/preference cookies)
  • Support security and fraud prevention 
Your Consent is Required (Except for Strictly Necessary Cookies)

Under EU ePrivacy Directive, and GDPR Art. 6(1)(a), we do not set non-essential cookies until you provide active, informed consent.

  • A cookie banner appears on first visit.
  • You may accept all, reject all, or customize preferences.
  • Consent is granular and revocable at any time via the Cookie Preferences link in the site footer.
  • Strictly necessary cookies (e.g., session management, security) are exempt and always active. 
Your Consent is Required (Except for Strictly Necessary Cookies)
  1. Via SPR Cookie Banner: Click “Cookie Preferences” anytime. 
  2. Browser Settings: Block or delete cookies (may impair site function). 
  3. Opt-Out Tools:

Withdrawal of Consent: Rejecting or withdrawing consent does not affect prior lawful processing. Analytics data is anonymized where possible.

Personal Data and Data Sources that SPR May Collect

Personal Data

Personal Data Sources

Name, email and physical address,
telephone numbers

SPR members or users, when submitting forms, abstracts, session or event proposals, or engaging in communications with us

Personal data about your transactions with us and personal data about your transactions with unaffiliated third parties (“Third Parties”) that are shared with SPR. Such transactional personal data can include but is not limited to, billing information, educational materials, or claims related to SPR policies or policy violations

SPR member organizations, SPR websites, digital platforms, and applications

Third-party data, including personal data you provide to Third Parties when you have authorized the Third Party to share such personal data with other parties, such as personal data collected through Third Party applications, websites, or other digital interfaces, personal data you have authorized us to receive, or personal data you have authorized Third Parties to share with us

Third-Party applications, websites, or other digital interfaces where you have agreed to share your personal data

  • Assistive technologies, mobile or wearable devices, or other similar technology

To better understand the pediatric research community we serve, in the future SPR may expand the types of data it collects to include, for example, gender, race, ethnicity, cultural affiliations, or other demographic information (considered “sensitive personal information” under CCPA and “special category data” under GDPR if collected).

Note on Health Information: SPR does not request or require submission of protected health information (PHI) as defined by HIPAA. Any health-related data submitted in research abstracts, presentations, or discussions is considered scholarly or educational content and is not subject to HIPAA.

COPPA & Child Privacy Notice
U.S. – Children’s Online Privacy Protection Act (COPPA)

SPR’s websites, platforms, and services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

  • If you are a parent or guardian and believe your child under 13 has provided us with personal information without consent, contact privacy@societyforpediatricresearch.org immediately.
  • We will promptly delete such information from our systems.
  • SPR does not sell or share personal information of minors under 16 for marketing purposes.
Legal Bases for Processing (GDPR-Compliant – EU/EEA/UK Users Only)

SPR processes your personal data only when we have a lawful basis under GDPR. These include:

  • Consent: When you explicitly agree (e.g., opting in to receive newsletters or marketing communications).
  • Contract: To fulfill obligations under membership agreements, event registrations, or other services you request.
  • Legal Obligation: To comply with applicable laws, regulations, or legal processes.
  • Legitimate Interests: For purposes such as improving services, ensuring security, preventing fraud, or administering programs—provided these interests are not overridden by your rights and freedoms.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

How We Use Your Personal Data

We use personal data to provide our services for purposes allowed by law. This includes use authorized by you. For example, we may use your data to:

  • Process registration, program, or education transactions
    • Example: For CME credits to be claimed by SPR participants, SPR transmits data such as participant name, email address, SPR registration number, session participation, and/or evaluation data to the official SPR CME provider.
  • Create and deliver educational programs and events
    • Example: SPR shares participant name and email with vendors (e.g., Zoom, ScholarOne) for webinars and sessions.
  • Maintain your accounts
    • Example: Name, title, institution, specialty used to track roles (reviewer, speaker, committee member).
  • Comply with SPR policies and applicable laws 
    • Example: Monitor abstract submissions for ethics policy compliance.
  • Prevent and prosecute fraud or policy violations 
    • Example: Share data with law enforcement if required.
  • Create, maintain, operate, and market scholarly services 
    • Example: Use participation data to pilot new research webinars.
  • Support online experiences 
    • Example: Share error logs with vendors to resolve technical issues.
Data Breach Notification Policy

(GDPR Art. 33–34 | CCPA § 1798.150 | U.S. State Laws)

SPR maintains a Data Incident Response Plan.

Internal Reporting

Report suspected breaches to privacy@societyforpediatricresearch.org within 24 hours.

Notification to Data Subjects

High-risk to individuals: Notify without undue delay (within 7 days).

CCPA / U.S. State Laws
  • CA: Report to Attorney General if 500+ residents affected.
  • Individual notice: Most expedient time possible.
Record-Keeping

All breaches documented for 5 years.

Data Retention Policy

GDPR Art. 5(1)(e) | CCPA

Data Type

Retention Period

Rationale

Deletion Trigger

Membership Records

Active + 7 years

Audit/tax

End + 7 yrs

Abstracts & Scholarly Content

Indefinite

Research archive

Deletion request

Event Participation

5 years

CME/evaluation

5 yrs post-event

Billing Data

7 years

Financial law

7 yrs post-transaction

Support Inquiries

3 years

3 yrs post-resolution

3 yrs post-resolution

Marketing Preferences

Until opt-out

Consent

Immediate

Cookie Data

Max 2 years

Consent

Expiry/opt-out

Breach Logs

5 years

GDPR Art. 33(5)

N/A

CCPA Privacy Notice (California Residents Only)

SPR does not sell or share personal information for targeted advertising.

Categories Collected (Past 12 Months)

Category

Examples

Collected

Identifiers

Name, email, phone

Yes

Customer Records

Billing, transactions

Yes

Commercial Info

Services used

Yes

Internet Activity

IP, browser

Yes

Professional Info

Title, institution

Yes

Inferences

Preferences

Yes

Sensitive Info

Race, ethnicity

Yes

Sensitive Info

Health in Research

No

Your CCPA Rights
  • Know, Delete, Correct, Opt-Out, Limit Sensitive Use, Non-Discrimination 
  • Submit: privacy@societyforpediatricresearch.org (Subject: “CCPA Request”) 
  • Response: 45 days
HIPAA Context (U.S. Users)

SPR is not a HIPAA-covered entity or business associate.  No PHI collected in covered capacity.  Research data = scholarly, not PHI.

International Data Transfers (GDPR)

SPR is U.S.-based. Transfers from EU/EEA/UK use Standard Contractual Clauses (SCCs).

Your Rights Under GDPR (EU/EEA/UK)
Security

SPR uses encryption, access controls, audits, and breach detection.

Contact Information

Data Controller & DPO: 

Society for Pediatric Research (SPR) 

Email: privacy@societyforpediatricresearch.org 

Website: [www.societyforpediatricresearch.org] 

Accessibility: accessibility@societyforpediatricresearch.org

All Privacy Inquiries: privacy@societyforpediatricresearch.org

Last updated: November 11, 2025

This policy may be updated periodically. We will notify you of material changes via email or website notice.