Statement of Information Privacy and Privacy Policy

WCCT Global, Inc.

WCCT and its subsidiaries, Medelis, Inc., and clinCORE, have determined that the protection of personal information is critical for our company and our clients. Accordingly, this policy has been designed and adopted effective April 12, 2017 to implement a consistent and comprehensive policy on the protection of personal information.

It is also the Company’s objective that this privacy policy will ensure compliance with all applicable international laws and regulations, including, for example, the European Union’s Privacy Shield Act, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Japan’s Personal Information Protection Action (PIPA), Switzerland’s Privacy Shield Act, and the US Health Insurance Portability and Accountability Act (HIPAA).

The Company’s EU-US Privacy Shield and Swiss-US Privacy Shield sets forth the privacy principles that it has committed to follow with respect to transfers of personal information from the European Union and Switzerland to the United States. WCCT adheres to the Privacy Shield Principles in connection with the transfer of all personal data from the EU and Switzerland to the US. The Company understands the importance of protecting information of all kinds, especially individual personal information.

WCCT complies with the EU-US Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries and Switzerland.  WCCT has certified that it adheres to the Privacy Shield Principles.  If there is any conflict between the policies in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov/.

WCCT Privacy Policy

SCOPE

This Policy applies to all personal information, either in electronic or paper format, received by WCCT in the United States from the EU.

DEFINITIONS

For purposes of this Policy, the following definitions shall apply:

“Agent” means any third party that uses personal information provided to it by WCCT to perform tasks on behalf of and under the instructions of WCCT.

“WCCT” means WCCT Global, Inc., its successors, subsidiaries, divisions and groups in the United States.

“Personal Data” or “Personal information” are data about an identified or identifiable individual that are within the scope of the Directive, received by WCCT in the United States from the European Union, and recorded in any form.

“Processing” of personal data means any operation or set of operations which is performed upon personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure or dissemination, and erasure or destruction.

“Controller” means a person or organization which, alone or jointly with others, determines the purposes and means of the processing of personal data.

PRIVACY SHIELD PRINCIPLES

WCCT adheres to the following EU-US and Swiss-US Privacy Shield Principles:

NOTICE

This notice must be provided in clear and conspicuous language when individuals are first asked to provide personal information to WCCT or as soon thereafter as is practicable, but in any event before WCCT uses such information for a purpose other than that for which it was originally collected or processed by the transferring organization or discloses it for the first time to a third party.

CHOICE

The personal data or personal information collected by WCCT or Agents of WCCT (that WCCT is under contract with) is intended for clinical research use.  This information will only be collected if you consent to studies managed by WCCT.  Your express permission for WCCT or its Agents to use sensitive personal information (such as medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual) is included in the consenting process of the clinical trials that we manage.  You have the choice at any time before, during, or after the study to discontinue such consent via written notice, which would render your data ineligible for use (unless study reports have already been created with the consenting data).  Your personal data or personal information will not be used for anything except the clinical trials that you provided consent to participate in.

ACCOUNTABILITY FOR ONWARD TRANSFER

WCCT may be liable for the onward transfer of the personal data of EU and/or Swiss individuals.

SECURITY

WCCT, or Agents that WCCT contracts with (and acts as Controller, if applicable), maintains consistent security of personal data or personal information provided by individuals consenting to have their data/information used in specific clinical trial research studies.  The systems that hold this data during and after clinical trial research are routinely audited to ensure that data/information stored remains secure.  Any unauthorized access, disclosure, alteration or destruction of personal data or personal information is immediately investigated, all applicable parties notified, and a Corrective Action Plan is set forth to ensure that security continues to provide the highest level of protection of patient personal information.  For EU countries that do not permit initials, dates of birth, etc., such information would be included in any plans for the clinical trial and would not be entered into the data system (and therefore transferred from the EU to the US).  Permitted personal data or personal information will be input into data system and transferred securely as necessary in order to facilitate the clinical trial being managed by WCCT.

DATA INTEGRITY AND PURPOSE LIMITATION

Personal information collected after a patient has consented to a specific clinical trial will only be used for that specific clinical trial, for the duration of time during and after the study that the information is necessary to maintain.  WCCT will not process personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual.  WCCT will adhere to the Principles for as long as it retains such information.

ACCESS

An individual has the right to correct, amend, or delete personal information where it is inaccurate, or has been processed in violation of the Principles, except where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the case in question, or where the rights of persons other than the individual would be violated.  While individuals will not have direct access to the data systems that WCCT or Agents of WCCT house such personal information on, a patient can either contact WCCT directly or the physician that consented them during the process to provide updates to their personal information as necessary.  As long as the information is retained by WCCT or its Agents, the applicable organizations will make the requisite changes as instructed by the individuals whose data requires updating, as long as such changes do not affect the overall results of the ongoing or completed clinical trial of the pharmaceutical company for whom WCCT manages its trial(s).  For example, an individual has the right to correct, amend, or delete personal information where inaccurate, but does not have the right to correct, amend, or delete any data relating to the compound or device that the individual consented to using/obtaining/testing.

RECOURSE, ENFORCEMENT, AND LIABILITY

WCCT is subject to the jurisdiction and enforcement authority of the US Federal Trade Commission (FTC). If WCCT becomes subject to a Federal Trade Commission (FTC) order or court order based on non­compliance, WCCT shall make public any relevant Privacy Shield­ related sections of any compliance or assessment report submitted to the FTC, to the extent consistent with confidentiality requirements. The FTC will give priority consideration to referrals of non-compliance with the Principles from the Department and EU Member State authorities, and will exchange information regarding referrals with the referring state authorities on a timely basis, subject to existing confidentiality restrictions.

TYPES OF DATA COLLECTED

WCCT, or Agents of the organization, collect personal data or personal information for the purpose of managing clinical research trials for pharmaceutical companies in the United States, Europe (including the European Union and Switzerland), and other countries across the world.  Personal data types may include: individual’s full name, address, phone number, medical or health conditions, racial or ethnic origin, or information specifying the sex life of the individual.

CONTACT INFORMATION FOR PRIVACY SHIELD INQUIRIES OR COMPLAINTS

Any inquiries or complaints regarding WCCT, or Agents of the organization, violating the Principles of the EU-US Privacy Shield or Swiss-US Privacy Shield Framework should contact complaint@wcct.com.  Once verified, a response to your inquiry or complaint will be sent within 10 business days by an authorized representative of WCCT.

WCCT DISCLOSING PERSONAL INFORMATION TO AGENT(S)

In order to conduct the management of clinical trial research, WCCT may contract with Agent(s) to complete the services on behalf of pharmaceutical companies with which WCCT is contracted.  These parties can include: advertisers, vendors, or contractors.  The purpose of sharing personal information with these Agent(s) is to facilitate clinical trial research on behalf of the pharmaceutical companies with which WCCT is contracted.  These Agent(s) provide a service necessary to clinical trial research projects that we are contracted to manage, and thus need to share personal information with these Agent(s) in order to complete work for ongoing projects.

PERSONAL DATA PROTECTION

WCCT, or Agents of the organization, take the protection of personal data or personal information for individuals participating in clinical trial research very seriously.  WCCT (or Agent(s)) ensure that all employees with access to this information are properly trained under company Standard Operating Procedures (SOPs) to protect such data/information, ensuring the safekeeping of such information.  The systems in which personal data or personal information is stored are subject to Quality Audits, ensuring that this data is continually protected and maintained appropriately.  Employees with access to personal data and personal information are also subject to Quality Audits to ensure their training maintains the high standards set forth in this policy.

EU-US, SWISS-US PRIVACY SHIELD AFFIRMATIVE COMMITMENTS, INDEPENDENT DISPUTE RESOLUTION MECHANISM

In compliance with the EU-US and Swiss-US Privacy Shield Principles, WCCT commits to resolve complaints about your privacy and our collection or use of your personal information.  European Union and Swiss individuals with inquiries or complaints regarding this privacy policy should first contact WCCT at: complaint@wcct.com

WCCT has further committed to refer unresolved privacy complaints under the EU-US and Swiss-US Privacy Shield Principles to BBB EU PRIVACY SHIELD, a non-profit alternative dispute resolution provider located in the United States and operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers/ for more information and to file a complaint.

Under certain conditions, EU and Swiss individuals can invoke binding arbitration before the Privacy Shield Panel to be created by the U.S. Department of Commerce and the European Commission.  This binding arbitration is through a Privacy Shield Panel, which is an arbitration mechanism made up of three arbitrators.  This panel settles disputes out of court and its decisions are binding in U.S. courts.  Should WCCT or the BBB fail to resolve your complaint, you will need to formally notify WCCT of your intent to invoke binding arbitration and include a summary of steps already taken to try and resolve your complaint, as well as description of the alleged violation.  Such arbitration procedures are resolved within 90 days of formal notice to WCCT.  If the result of the outcome during arbitration is unsatisfactory, you have the option to challenge it under U.S. law under the Federal Arbitration Act.

ENFORCEMENT AUTHORITY, LIMITED LIABILITY STATEMENTS

The FTC has enforcement authority jurisdiction over the EU-US Privacy Shield and Swiss-US Privacy Shield Frameworks. Under certain conditions, WCCT may be required to disclose personal information in response to a lawful request by public authorities, including the FTC, to meet national security or law enforcement requirements.  In such cases where WCCT is required to disclose personal information in response to a request by a governmental authority, WCCT will strive to limit such personal information to the least amount of information as possible to remain in legal compliance with such disclosure and will disclose the information in accordance with the terms of this policy, as applicable.