Advarra Privacy Policy

a) Patients / Caregivers

What Patient Personal Information do we collect?

Through your use of our Services to support you on your clinical trial, and with your consent, Advarra may collect your Personal Information and medical/health information (“Patient Personal Information”). This data may include, but is not limited to:

• Your name;
• Your contact information (such as email address, telephone number, etc.);
• Your demographic information;
• Your medical information and medical records; and
• The unique IP address of the device you use to access the system or application.

This Patient Personal Information may also be linked to other data you or your clinical site provide to Advarra, such as the name of the sponsor running the clinical trial, the name of the clinical trial, the clinical site you are attending, your unique Patient ID, the medical condition under study on the trial, your medical history data, and your visit schedule for the clinical trial.

How do we collect this Patient Personal Information?

As part of our offerings to customers, you may be able to register with one of our Services. If you choose to register to use our Services (such as the Patient Portal application) to support you on your clinical trial, you will be asked to create a user account and agree to Advarra’s processing of your Patient Personal Information as outlined in this Privacy Policy. Creating a user account requires certain Patient Personal Information fields to be provided, such as your contact details.

If you choose to receive reminders about upcoming visits on your study, we may also process your mobile telephone number and time zone.

Your clinical site may also enter or upload your data into our system, such as your medical information and medical records.

If you contact our Support Helpdesk for technical support of the application, your personally identifiable contact information and details of your support request will be processed by Advarra.

As part of the Services Advarra offers to its customers, these customers may provide Patient Personal Information about you. The transfer of this Patient Personal Information is governed by a separate written agreement with the customer or partner to address applicable legal requirements for data use and data security involving the transfer of data between us and the customer.  This Patient Personal Information includes, but is not limited to:

• Contact information (such as name, address and email address, social media, name of your company or department, and your business function or title);
• Demographic information (such as age, gender, etc);
• Professional information (such as work history, education, and other professional credentials)
• Financial records (such as information provided to our customers as part of a financial disclosure process); and
• Health information (such as patient records or researchers notes.

Any health information that we collect from other sources will be transferred to us under a separate written agreement to address applicable legal requirements for data use and data security and protection.

How do we use this Patient Personal Information?

Advarra uses this data to support your use of our system during the clinical trial, to provide technical support to you when requested, to keep the system and your Patient Personal Information secure and confidential, and to improve our Services. Your Patient Personal Information will never be used for marketing purposes, or be sold to third parties.

How do we share this Patient Personal Information?

Within Advarra, Patient Personal Information will be accessible only to a small subset of authorized Advarra staff. All staff have been trained on Advarra’s relevant policies and procedures, and receive ongoing training on security awareness, data privacy, and ICH GCP.

Advarra may share this Patient Personal Information with its partners and partners, including but not limited to, Advarra’s customers, partners, service providers and technology partners to fulfill the purposes for how we use this Patient Personal Information. More Specifically, we may share any of your Patient Personal Information with third parties as follows:

• Law Enforcement Officials and as Required by Law.We may release any or all of your Patient Personal Information to third parties when we determine, in our judgment, that it is necessary to (a) comply with the law, regulation, legal process, or enforceable governmental request; (b) enforce or apply the terms of any of our policies or user agreements; or (c) protect the rights, property or safety of us, our employees, our users, or others.
• Sales, Mergers, and Acquisitions. If we become involved in a merger, acquisition, or any form of sale of some or all of our assets, or other business transaction, your Patient Personal Information may be provided to the entities and advisors involved, and your Patient Personal Information may be transferred to a third party in connection with consummation of any such transaction. Such third parties will have appropriate technical controls to protect your Patient Personal Information and Advarra will place appropriate contractual controls through the use of a Data Protection Agreement.
• Other Advarra Business Units. Patient Personal Information may be provided to other Business Units in Advarra’s offices than the Business Unit that initially collected or received the Information.
• The Sponsor/CRO Study Team, Affiliates, or Other Authorized Study partners. We may share Patient Personal Information with the sponsor/CRO study team who are overseeing the clinical study, or with other partners that they have authorized to receive this information. For example, the study team will have access to the training records of clinical sites, as well as other high-level and anonymized metrics reports (number of patients screened, number of video views, etc.) Such third parties will have appropriate technical controls to protect your Patient Personal Information and Advarra will place appropriate contractual controls through the use of a Data Protection Agreement.
• Third-Party Processors/partners. We use some third-party partners to support our Services; in order to provide these Services, we are required to share Patient Personal Information with these processors/partners. Advarra will take reasonable steps to require third parties to have appropriate technical controls to protect your Patient Personal Information, and Advarra will put into place appropriate contractual controls through a Data Protection Agreement.

How do we control access to Patient Personal Information?

Patient-facing products, applications, and data are hosted on Advarra’s secure and SOC2 controlled Advarra Cloud environment. Within Advarra, access to Patient Personal Information is tightly controlled based on the principle of least privilege. Only a small subset of authorized staff members will be able to access your Patient Personal Information.

How long do we retain Patient Personal Information?

Patient Personal Information is retained only as agreed to in our contract with our customer for the duration of our contract with our customer (generally the controller of the Patient Personal Information such as the pharmaceutical sponsor or contract research organization running the clinical trial) or as required by regulation or law. At the end of this period, all patient identifiable data is purged from our systems.

b)Users of our Services

What Personal Information do we collect?

Through your use of our Services, Advarra may collect:

• Your name;
• Contact information (such as name, address and email address, social media, name of your company or department, and your business function or title);
• User account and login information;
• Profile information you provide such as education, professional experience and publications; and
• Operational and usage information about you contained within the Advarra Services.

How do we collect Personal Information?

When either you, or an Advarra customer creates for you, a user profile in one of our Services, you or they may supply Personal Information as part of that user profile.  Further as you use our Services our systems may collect usage information tied to your user profile.

When Advarra customers provide information about you, the transfer of this Personal Information is governed by a separate written agreement with the customer, which addresses applicable legal requirements for data use and data security involving the transfer of data between us and the customer.

How do we use this Personal Information?

Advarra uses Personal Information for its business purposes, including but not limited to the following purposes:

• To populate your information across Advarra applications;
• To improve and maintain Advarra Services;
• To provide new Services;
• To create analytics and insights from use of Advarra Services; and
• To deliver Advarra Services requested by you.

Information may be additionally governed by the Terms and Services you agree to when signing up for account with us.

How do we share this Personal Information?

Advarra may share this information with its partners and partners, including but not limited to, Advarra’s customers, partners, service providers and technology partners to fulfill the purposes for how we use this information. More specifically, we may share any of your information, which includes your Personally Identifiable Information, with third parties as follows:

• Law Enforcement Officials and as Required by Law.We may release any or all of your Personal Information to third parties when we determine, in our judgment, that it is necessary to (a) comply with the law, regulation, legal process, or enforceable governmental request; (b) enforce or apply the terms of any of our policies or user agreements; or (c) protect the rights, property or safety of us, our employees, our users, or others.
• Sales, Mergers, and Acquisitions. If we become involved in a merger, acquisition, or any form of sale of some or all of our assets, or other business transaction, your Personal Information may be provided to the entities and advisors involved, and your Personal Information may be transferred to a third party in connection with consummation of any such transaction.
• Other Advarra Business Units. Personal Information may be provided to other Business Units in Advarra’s offices than the Business Unit that initially collected or received the Personal Information.
• The Sponsor/CRO Study Team, Affiliates, or Other Authorized Study partners. We may share data with the sponsor/CRO study team who are overseeing the clinical study, or with other partners that they have authorized to receive this information. For example, the study team will have access to the training records of clinical sites, as well as other high-level and anonymized metrics reports (number of patients screened, number of video views, etc.)
• Third-Party Processors/partners. We use some third-party partners to support our Services; in order to provide these Services, we are required to share Personal Information with these processors/partners. Advarra will take reasonable steps to require third parties to have appropriate technical controls to protect your Personal Information, and Advarra will put into place appropriate contractual controls through a Data Protection Agreement.

How long do we retain Personal Information?

Personal information is retained only as needed to comply with our policies, regulations, or law.

c) Non-patients and non-users whose Personal Information is processed by our Services

What Personal Information do we collect?

As part of the Services Advarra offers to its customers, Advarra may collect certain Personal Information about you. This includes, but is not limited to:

• Contact information (such as name, address and email address, social media, name of your company or department, and your business function or title);
• Demographic information (such as age, gender, etc);
• Professional information (such as work history, education, and other professional credentials); and
• Financial records (such as information provided to our customers as part of a financial disclosure process).

How do we collect this Personal Information?

As part of the Services Advarra offers to its customers, these customers may provide Personal Information about you. We may also receive information from partners that provide additional Personal Information. The transfer of this Personal Information is governed by a separate written agreement with the customer or partner to address applicable legal requirements for data use and data security involving the transfer of data between us and the customer.

How do we use this Personal Information?

We use or may use this Personal Information to:

• Perform our contractual obligations with customers who make use of our Services;
• Conduct research and perform analyses in order to measure, maintain, protect, develop and improve the Websites, our Services, and the content provided through the Websites;
• Improve and maintain Advarra Services;
• Provide new Services; and
• Create analytics and insights from use of Advarra Services.

How do we share this Personal Information?

Advarra may share this information with its partners and partners, including but not limited to, Advarra’s customers, partners, service providers and technology partners to fulfill the purposes for how we use this information. More Specifically, we may share any of your Information, which includes your Personally Identifiable Information, with third parties as follows:

• Law Enforcement Officials and as Required by Law.We may release any or all of your Personal Information to third parties when we determine, in our judgment, that it is necessary to (a) comply with the law, regulation, legal process, or enforceable governmental request; (b) enforce or apply the terms of any of our policies or user agreements; or (c) protect the rights, property or safety of us, our employees, our users, or others.
• Sales, Mergers, and Acquisitions. If we become involved in a merger, acquisition, or any form of sale of some or all of our assets, or other business transaction, your Personal Information may be provided to the entities and advisors involved, and your Personal Information may be transferred to a third party in connection with consummation of any such transaction.
• Other Advarra Business Units. Personal Information may be provided to other Business Units in Advarra’s offices than the Business Unit that initially collected or received the Personal Information.
• The Sponsor/CRO Study Team, Affiliates, or Other Authorized Study partners. We may share data with the sponsor/CRO study team who are overseeing the clinical study, or with other partners that they have authorized to receive this information. For example, the study team will have access to the training records of clinical sites, as well as other high-level and anonymized metrics reports (number of patients screened, number of video views, etc.)
• Third-Party Processors/partners. We use some third-party partners to support our Services; in order to provide these Services, we are required to share Personal Information with these processors/partners. Advarra will take reasonable steps to require third parties to have appropriate technical controls to protect your Personal Information, and Advarra will put into place appropriate contractual controls through a Data Protection Agreement.

How long do we retain Personal Information?

Personal information is retained only as needed to comply with our policies, regulations, or law.

d) Business Contacts

What Personal Information do we collect?

As part of Advarra’s interactions with customers, partners, and other business contacts, we may collect certain Personal Information about you. This includes, but is not limited to:

• Contact information (such as name, address and email address, social media, name of your company or department, and your business function or title); and
• Professional information (such as work history, education, and other professional credentials).

How do we collect this Personal Information?

Advarra may collect Personal Information from business contacts when you interact with us, such as by visiting our Websites or using our Services.

We may also collect your Personal Information when you contact us or send inquiries through the Websites or via email. When you contact us for any reason, we may ask you to provide or confirm certain Personal Information so that we can better respond to your inquiry.

We may also collect Personal Information from your employer with whom we do business.

How do we use this Personal Information?

Your Personal Information allows us to communicate with you about the Websites, Services and the content. We use or may use your Personal Information to:

• Provide you with access to our Services, fulfill your online requests, and facilitate customer service;
• Perform our contractual obligations with customers who make use of our Services;
• Conduct research and perform analyses in order to measure, maintain, protect, develop and improve the Websites, our Services, and the content provided through the Websites;
• Make communications necessary to notify you regarding the Services that you have purchased and security, privacy, or administrative issues;
• Offer or advertise new Services or events that may be of interest to you;
• Communicate with you about Information or content you have posted to the Websites; or
• Administer assessment tools and surveys, where participation is completely voluntary, and you, therefore, have a choice whether to disclose any information requested in connection with the assessment tool. Information requested may include contact information (such as name and email address), and demographic information (such as zip code, years of professional or clinical experience), among other information.

How do we share this information?

We may share any of your information, which includes your Personally Identifiable Information, with third parties as follows:

• Law Enforcement Officials and as Required by Law.We may release any or all of your Personal Information to third parties when we determine, in our judgment, that it is necessary to (a) comply with the law, regulation, legal process, or enforceable governmental request; (b) enforce or apply the terms of any of our policies or user agreements; or (c) protect the rights, property or safety of us, our employees, our users, or others.
• Sales, Mergers, and Acquisitions. If we become involved in a merger, acquisition, or any form of sale of some or all of our assets, or other business transaction, your Personal Information may be provided to the entities and advisors involved, and your Personal Information may be transferred to a third party in connection with consummation of any such transaction.
• Other Advarra Business Units. Personal Information may be provided to other Business Units in Advarra’s offices than the Business Unit that initially collected or received the Personal Information.
• The Sponsor/CRO Study Team, Affiliates, or Other Authorized Study partners. We may share data with the sponsor/CRO study team who are overseeing the clinical study, or with other partners that they have authorized to receive this information. For example, the study team will have access to the training records of clinical sites, as well as other high-level and anonymized metrics reports (number of patients screened, number of video views, etc.)
• Third-Party Processors/partners. We use some third-party partners to support our Services; in order to provide these Services, we are required to share Personal Information with these processors/partners. Advarra will take reasonable steps to require third parties to have appropriate technical controls to protect your Personal Information, and Advarra will put into place appropriate contractual controls through a Data Protection Agreement.

How long do we retain Personal Information?

Personal information is retained only as needed to comply with our policies, regulations, or law.

e) Employees and Job Candidates

What Personal Information do we collect?

If you apply for a job with Advarra, or are employed by Advarra we may collect certain Personal Information about you, including:

• Biographical and identification information, such as first name, last name, date of birth, marital status, national identification/social security number, and copies of ID cards, driver’s licenses, and passports;
• Contact and location information;
• Professional and educational information;
• Health information;
• Financial information;
• Employment information; and
• Other information, such as photographs, audio and video recordings, and information from background checks (which may include criminal convictions and certification/license status).

How we collect this Personal Information?

As part of our human resources processes, we collect and process your Personal Information relating to job applicants and our staff. We may obtain your Personal Information when:

• You submit it to us during the process of your job application, for example, when we collect Personal information from application forms, CVs, resumes, or LinkedIn profiles, your passport or other identity documents, or through interviews or other forms of assessment, including online tests;
• Your recruitment agency submits your information to us;
• You provide it to us during your working relationship with us; and we collect it in the course of job-related activities throughout the period when you work for us; and
• We obtain Personal Information from other third parties, such as former employers, authorities, government entities, social networks, or other information providers.

Subject to applicable laws, your Personal Information may be obtained through background checks, security clearances, and other similar information sources as required by law or deemed necessary due to the nature and security requirements related to the position in question.

How do we use this Personal Information?

We may use this Personal Information for:

• Professional recruiting and employment application review;
• Managing employment;
• Carrying out our contractual obligations with consumers, customers, and suppliers;
• Responding to your requests or questions;
• Preventing fraud or criminal activities;
• Conducting criminal background checks;
• Assuring network and information security, including access management to prevent unauthorized access to our systems; or
• Enforcing our legal rights and complying with laws and regulations applicable.

Note that processing of Personal Information of Employees is governed by the relevant Advarra Employee Handbook, provided to you upon employment.

How do we share this Personal Information?

We may share any of your information, which includes your Personally Identifiable Information, with third parties as follows:

• Law Enforcement Officials and as Required by Law.We may release any or all of your Personal Information to third parties when we determine, in our judgment, that it is necessary to (a) comply with the law, regulation, legal process, or enforceable governmental request; (b) enforce or apply the terms of any of our policies or user agreements; or (c) protect the rights, property or safety of us, our employees, our users, or others.
• Sales, Mergers, and Acquisitions. If we become involved in a merger, acquisition, or any form of sale of some or all of our assets, or other business transaction, your Personal Information may be provided to the entities and advisors involved, and your Personal Information may be transferred to a third party in connection with consummation of any such transaction.
• Other Advarra Business Units. Personal Information may be provided to other Business Units in Advarra’s offices than the Business Unit that initially collected or received the Personal Information.
• customers. We may share data with customers as required in order to fulfill our agreements with them.
• Third-Party Processors/partners. We use some third-party partners to support our Services; in order to provide these Services, we are required to share Personal Information with these processors/partners. Advarra will take reasonable steps to require third parties to have appropriate technical controls to protect your Personal Information, and Advarra will put into place appropriate contractual controls through a Data Protection Agreement.

Note that sharing of Personal Information of Employees is governed by the relevant Advarra Employee Handbook, provided to you upon employment.

How long do we retain Personal Information?

Personal information is retained only as needed to comply with our policies, regulations, or law.

f) Visitors to the company Websites (Advarra.com)

What Personal Information do we collect and how do we collect this Personal Information?

Personal Information You Share With Us. We collect different types of information about you when you interact with us, such as by visiting our Websites or using our Services. When you register or create an account anywhere on the Websites or when using our Services, we may collect any or all of the following information, (i) your name, (ii) home or business address, (iii) professional information, including specialty or nature of concern, (iv) organization with whom you are affiliated and its address, and (v) your email address. We may also collect Personally Identifiable Information when you contact us or send inquiries through the Websites or via email. This includes one or more of any combination of your: name, e-mail address, and home address. When you contact us for any reason, we may ask you to provide or confirm certain Personally Identifiable Information so that we can better respond to your inquiry.

Information automatically collected. When you visit the Websites, we may automatically record information that your browser sends. For example, we may receive and collect: the name of the domain and host from which you access the Internet; the Internet Protocol (IP) address of the computer you are using; the date and time you access the Websites or make uploads or post to the Websites; and the Internet address of the website from which you linked directly to the Websites. This Information does not include any Personally Identifiable Information and we refer to this information as Non-identifiable Information. We use this Non-identifiable Information to monitor the usage of the Websites and to understand how to better serve our users.

The most common mechanisms for collecting this Information include:

• Cookies
• Service Analytics
• Pixel tags or clear Graphics Interchange Format files, known as GIFs

Cookies: Cookies are small files that are sent to your computer’s hard drive to tell us who you are when you are using the Websites. Cookies help us to: (1) associate you with your account and enable you to update and modify your account; (2) speed navigation; (3) remember information you gave us so that you do not have to re-enter it; and (4) count the total number of visitors and pages viewed. Browsers are typically set to create cookies automatically. You can choose to have your browser notify you when cookies are being written to your computer or accessed, or you can disable cookies entirely. If you disable cookies, however, you may not be able to create an account on the Websites. Also, by not using cookies, some features and Services on the Websites may not function properly.

Service Analytics: From time to time, we may work with one or more third-party service provider to help us better understand how you use the Websites. The service provider may place cookies on your computer to collect information. The information that is collected will tell us things like which search engine referred you to the Websites, how you navigated around the Websites, how quickly we helped you to enter account information, and what content you viewed. This information will help us to better serve you. We will not grant permission to the third-party service provider to collect your e-mail address or password information. The third-party service provider will be restricted to use your information to perform services for us, securely and in confidence, except they may be permitted to use the information on an aggregate, non-personally identifiable basis.

Pixel tags or clear GIFs: To help us understand the effectiveness of certain of our communications, we may use “message format” and “message open” sensing technologies that use pixel tags or clear GIFs (which are also called web beacons). These technologies allow us to know if your e-mail program is able to accept HTML e-mails and, if it is, to: (1) send you e-mails in that format; and (2) determine if you have opened our e-mail messages.

Information you provide through online blogs, reviews and community sources. In addition to the information described above, from time to time we may provide you with the ability on the Websites to create your own content and share your opinions and reviews with others viewing the Websites. You may choose to post Information as part of a blog or online interactive community. Because any Information you choose to post on the Websites or make visible via social media will be available on the internet, we can make no assurance that others will not use or misuse that information.

How do we use this Personal Information?

Your Information allows us to communicate with you about the Websites, Services and the content. We use or may use your Information to:

• Provide you with access to our Services, fulfill your online requests, and facilitate customer service;
• Perform our contractual obligations with customers who make use of our Services;
• Conduct research and perform analyses in order to measure, maintain, protect, develop and improve the Websites, our Services, and the content provided through the Websites;
• Make communications necessary to notify you regarding the Services that you have purchased and security, privacy, or administrative issues;
• Offer or advertise new Services or events that may be of interest to you;
• Communicate with you about Information or content you have posted to the Websites; or
• Administer assessment tools and surveys, where participation is completely voluntary, and you, therefore, have a choice whether to disclose any information requested in connection with the assessment tool. Information requested may include contact information (such as name and email address), and demographic information (such as zip code, years of professional or clinical experience), among other information.

How do we share this Personal Information?

We may share, sell or rent your Non-identifiable Information with: (i) our customers, (ii) third parties through scholarly publications relating to the Websites and its subject matter, (iii) reputable service providers, subcontractors, partners and agents who perform services on our behalf, and (iv) third parties who may benefit from the study or use of such information.

We may share any of your information, which includes your Personally Identifiable Information, with third parties as follows:

• Law Enforcement Officials and as Required by Law.We may release any or all of your Personal Information to third parties when we determine, in our judgment, that it is necessary to (a) comply with the law, regulation, legal process, or enforceable governmental request; (b) enforce or apply the terms of any of our policies or user agreements; or (c) protect the rights, property or safety of us, our employees, our users, or others.
• Sales, Mergers, and Acquisitions. If we become involved in a merger, acquisition, or any form of sale of some or all of our assets, or other business transaction, your Personal Information may be provided to the entities and advisors involved, and your Personal Information may be transferred to a third party in connection with consummation of any such transaction.
• Other Advarra Business Units. Personal Information may be provided to other Business Units in Advarra’s offices than the Business Unit that initially collected or received the Personal Information.
• The Sponsor/CRO Study Team, Affiliates, or Other Authorized Study partners. We may share data with the sponsor/CRO study team who are overseeing the clinical study, or with other partners that they have authorized to receive this information. For example, the study team will have access to the training records of clinical sites, as well as other high-level and anonymized metrics reports (number of patients screened, number of video views, etc.)
• Third-Party Processors/partners. We use some third-party partners to support our Services; in order to provide these Services, we are required to share Personal Information with these processors/partners. Advarra will take reasonable steps to require third parties to have appropriate technical controls to protect your Personal Information, and Advarra will put into place appropriate contractual controls through a Data Protection Agreement.

Certain links through the Websites may link to organizations located in or with facilities that are located in a different jurisdiction than either you or us. If you elect to link to a third-party’s website, then your Personal Information may become subject to the laws of the jurisdiction(s) in which that third party or its facilities are located. As an example, if you are located in Canada and you link to a website in the United States, then your Personal Information collected through that website may be subject to disclosure under United States legislation, including the Patriot Act

How long do we retain Personal Information?

Personal information is retained only as needed to comply with our policies, regulations, or law.

Children’s Privacy

The Websites are designed for adults. These Websites are not designed to attract minors, in particular children under the age of 13. We do not knowingly collect Personal Information from anyone under the age of 13. Children should always get permission from their parents before sending any information about themselves (such as their names, email addresses, and phone numbers) to anyone over the Internet.