GDPR Supplement takes your privacy seriously and is committed to protecting your Personal Information. This Research Privacy Policy (“Policy”) addresses what Personal Information may be collected or acquired during the conduct of our clients’ research projects and how we comply with data protection laws, including the European Union General Data Protection Regulation (EU GDPR). This privacy policy supplements our Privacy Policy.


This Policy explains what Personal Information we may collect or acquire about you, how we may use it, when we may disclose the information, and the steps we take to ensure that your Personal Information is kept secure when we conduct our clients’ research projects. We also explain your rights with respect to your Personal Information. defines Personal Information as any information that identifies you either directly, such as name, address, email address, telephone number, internet protocol (IP) address, geolocation, etc. or indirectly such as gender, race, ethnicity, or location that, when combined may identify you. We may also infer your country of location from the IP address you have used to access our digital platforms.

1.1 How to Contact Us About Your Personal Information or This Policy

If you have any additional questions or complaints about this Policy or about how your Personal Information is used, disclosed, or secured by, please email us at or write to us at the following address:

Data Protection Official
Image Bloom, Inc.
8535 Wurzbach Rd., Suite 101
San Antonio, TX 78240

For individuals located in the EU, you may also contact the appointed Data Protection Authority (DPAs) for your country. A list of DPAs is available here.


When conducting research studies on behalf of clients, may be required to collect or obtain personal data from individuals, including but not limited to individuals residing in the European Union (EU), European Economic Area (EEA), and United Kingdom (UK). When that data is collected directly from you, whether by or by a third party acting on its behalf, information regarding the processing of that data and how you may exercise your rights is provided to you as part of the informed consent process. The informed consent terms control the processing of your data by and, where relevant, the third party acting on behalf of

When the data is collected by or obtained from third parties on behalf of without your direct consent via an informed consent process, will receive and process only data that is de-identified (pseudonymized), anonymized, or aggregated. The data will not include direct identifiers that would enable your identification by will treat any information you provide to us, or we obtain about you as confidential. We employ legally required technical and organizational measures to protect your personal information and your privacy. Your identifying information will not be disclosed or used in any personally identifiable form for any purpose beyond the purpose disclosed to you in the consent form unless otherwise compelled by law. Your personal data may be shared with researchers in the United States for data analysis and storage purposes. The United States has different data protection laws that may not be as strict as in your own country. Your personal data will not be linked to your name in any report or publication.

All personal information that we collect about you will be recorded, used, and protected by us in accordance with applicable data protection legislation, informed consent terms, study protocol, and this Policy. Your personal information will be retained only for such period as is appropriate for its intended and lawful use.

In all instances where we disclose your information to third parties, we will ensure that your information is appropriately protected.

3. RESEARCH INVOLVING CHILDREN AND OTHER VULNERABLE PERSONS recognizes the need for additional measures to protect the privacy, rights, and well-being of vulnerable persons, including children, who participate in research. will directly involve vulnerable persons, including children, in research only as necessary and appropriate for the specific research project. Prior to any data collection, the consent of the parent(s) or legal guardian, and as appropriate, the assent of the vulnerable person, will be obtained by the client,, or a third party acting on behalf of will provide the parent(s) or legal guardian, and the vulnerable person when appropriate, with information about the research purposes, any personal or sensitive information which may be collected, the way this data will be used, and whether and with whom may share such information.

4. YOUR DATA PROTECTION RIGHTS acts as a data processor for the client sponsoring the research study. If you have questions regarding your data or wish to access your data or take other actions as permitted under the data protection laws of your country, please contact us at and reference the name or number of the study in which you participated, if known.
If is processing your data based on your consent, you have the right to withdraw your consent at any time. Your withdrawal of consent will not affect the processing of your data that was done with your consent before consent was withdrawn. Once your data has been aggregated with responses from other participants so that it is no longer identifiable to you, it will not be possible to remove your data from the research study. To withdraw your consent, please contact at and identify yourself, tell us the name of the study, and that you wish to withdraw your consent to participate in the study.

4.1 EU GDPR and UK Data Protection Act

Under the EU GDPR and the United Kingdom Data Protection Act, individuals located in the EU/EEA and UK respectively, are allowed the following protections with respect to your Personal Data.

  • The right to access: You have the right to request copies of your personal data. We may charge you a small fee for this service.
  • The right to rectification: You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.
  • The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
  • The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
  • The right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
  • The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request per the EU GDPR or UK Data Protection Act, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at and reference the name or number of the study in which you participated, if known.

4.2 Canada

If you reside in Canada, you may have the right to be provided with access to Personal Information that we have collected about you and written information about our policies and practices with respect to the transfer of your Personal Information to vendors outside Canada. To find out more, please email us at and reference the name or number of the study in which you participated, if known.

5. CHANGES TO THIS POLICY complies with the legal, regulatory, and ethical standards that govern our research. As a result, our policies and procedures undergo frequent review. From time to time we may change this Policy. Accordingly, we recommend that you check this page periodically to review the latest version.