1. Introduction

When you sign up for a clinical study via Studies&Me’s study specific landing page, and complete the associated online pre-screening questionnaire, Studies&Me will process different categories of personal data about you. Data is processed in accordance with the regulations of all jurisdictions in which work is performed, including but not limited to HIPAA and GDPR. You can read more specifically about the different categories of personal data processed and the purpose(s) for such processing in the section below.

If you express interest in being contacted for future studies, Studies&Me may retain your personal data for this purpose. This means we may contact you regarding participation in other clinical studies that may be relevant to you. Your consent to retain your data for future contact can be withdrawn at any time by contacting us.

Studies&Me A/S, CVR no: 41600020, Sølvgade 10, 5. Sal, DK-1307, Copenhagen K ('Studies&Me') is the data controller of your data in relation to your sign-up.

DPO E-mail: dataprotection@sanos.com

For specific studies and if you are not interested in being contacted for future studies, the Sponsor of the clinical trial you are participating in is the data controller of the data you provide related to the clinical trial. Data relating to the clinical trial is pseudonymized before sharing with sponsor, and your email and telephone number is not disclosed. For more information on the Sponsor’s processing of personal data relating to the clinical trial, please see Sponsor’s Privacy Notice.

2. Categories of personal data, purposes and legal bases for processing

Studies&Me will process your personal data as described below. Only users who have given informed consent will be able to sign up.

Data Collection and Processing:

• We process your personal data when you sign up via our landing page. This includes ordinary categories of personal data such as your full name, email address, phone number, country of residence, zip code, and IP address.

• The legal basis for processing these data is Article 6(1)(f) of the General Data Protection Regulation ('GDPR'), as we have a legitimate business interest in contacting potential participants who have shown specific interest in a study.

Direct Marketing:

• We process your personal data for direct marketing purposes, including contacting you about other relevant clinical studies for which you may be eligible, or for follow-up inquiries.

• The personal data processed for marketing includes your name, email address, and information about relevant studies. We may also target communications using broader categories such as geographic area, age, gender, or interests, in compliance with applicable marketing laws.

• This targeting may involve both registered data subjects and 'lookalikes' who may be relevant for our commercial activities. If previous targeting has been unsuccessful, we may use criteria to exclude certain groups from advertising.

• Targeted advertisements will invite potential recipients to fill out an initial questionnaire to express interest in a study, without determining eligibility.

Questionnaire and Eligibility Assessment:

• After signing up, you will be asked to complete a questionnaire to assess your eligibility for a study. We also store this data to contact you about other studies you may qualify for.

• We process personal data received from the study clinic as well. Please refer to the sources section below for more information.

Data Categories and Legal Basis:

• The personal data processed includes ordinary categories such as full name, email, and telephone number. The questionnaire may also collect special categories of personal data, including health data.

• The legal basis for processing ordinary personal data is Article 6(1)(f) of the GDPR, due to our legitimate business interest in finding eligible study participants.

• For special categories of personal data, including health data, the legal basis is your explicit consent, as per Article 9(2)(a) of the GDPR. We will obtain your prior and explicit consent when you complete the questionnaire.

3. Sources

We process the personal data you provide through our landing page and in the pre-screening questionnaire. Additionally, we process personal data about you that we receive from the study site. This data may include whether you have participated in the study in question and, if not, the reason for non-participation. The purpose of processing this data is to assess whether we have identified the right profile for the specific study and to determine your eligibility for future studies.

The legal basis for processing this personal data is your prior explicit consent, in accordance with Article 6(1)(a) and Article 9(2)(a) of the GDPR.

Data processors, such as IT platform providers, may have access to your profile data. These data processors are only permitted to process data on behalf of the data controller and are not allowed to use your data for other purposes.

4. Disclosure of personal data

Studies&Me does not disclose any of your special categories of personal data to third parties without your explicit consent. If we determine that you may be eligible to participate in a specific study, we will share your sign up with the relevant study site, which will contact you regarding the next phases of the study.

Targeted advertising on social media or other platforms may involve Studies & Me using tools for targeted advertising, which could result in the disclosure of personal data. In such cases, Studies & Me may become a joint controller with the social media platform vendor. Currently, this applies to Meta Platforms, Inc. For more information, please refer to the privacy policy of Meta Platforms, Inc.: https://www.facebook.com/privacy/policy.

5. Transfer of personal data to data processors

Studies&Me collects personal data directly from you.

Data processors, such as IT platform providers may have access to your profile data. Data processors are only allowed to process data on behalf of the data controller and are therefore not allowed to process your data with other purposes.

6. Transfer of personal data to recipients in third countries

In certain situations, your personal data may be transferred to a country outside of EU/EEA – for instance if we require support assistance from a data processor located outside EU/EEA.

Studies&Me ensures that such transfer(s) will be carried out in accordance with the applicable data protection legislation. Such transfer may only take place if we ensure an adequate level of data protection e.g., entering into the EU standard contractual clauses with the recipient or pursuant to Article 49 of the GDPR. If you wish to obtain a copy of the appropriate safeguards provided for the transfer, please contact Sanos DPO at dataprotection@sanos.com.

7. Security

Studies&Me has implemented reasonable security measures to protect both personal and non-personal data against loss, misuse and unauthorized access, disclosure, alteration or destruction.

8. Retention period

We will only keep your personal data for as long as it is deemed necessary to fulfil the above-mentioned purposes of processing your personal data, hereunder as long as the study is ongoing.

9. Your rights

Under the GDPR, you have the following rights as a data subject:

• The right to access personal data

• The right to rectify inaccurate or incomplete personal data

• The right to restrict the processing of personal data

• The right to object to processing

• The right to data portability

• The right to delete personal data

You also have the right to lodge a complaint with the competent supervisory authority in your country. For more information about your rights as a data subject, please refer to the website of your local data protection authority.

10. Contact

If you have any questions and/or comments regarding the above and/or wish to exercise your rights as a user, please contact us at dataprotection@sanos.com.