Privacy Notice for Clinical Trial Participants

I. How We Handle Your Information

What we collect:

• We don't collect information that directly identifies you
• Instead, we receive coded data (your information replaced by an ID number)
• The clinical site staff are the ones who maintain your identifiable medical information

Your clinical site staff:

• Control your identifiable medical information
• Can answer questions about your specific trial
• Are your main point of contact for privacy concerns

‍

II. Contact Information

For coded data (Hemab):
‍Hemab ApS
Nordre Fasanvej 215
2000 Frederiksberg, Denmark
‍privacy@hemab.com

For your identifiable records:
‍Contact your clinical site staff listed in your Informed Consent Form

‍

III. Key Terms Explained

• Anonymous Data: Information that cannot be linked back to you at all
• Coded Data (Pseudonymised): Your information with your name replaced by a unique ID number. The link between your name and ID is kept separate and secure
• Personal Data: Any information that relates to you as an identifiable person
• Health Data: Information about your physical or mental health, genetic information, and medical history

‍

IV. What Information We Collect

Basic Information:

• Your unique participant ID number
• Country and study site location
• Year of birth, age, and sex

Health Information:

• Height, weight, Body Mass Index (BMI)
• Pregnancy status (if applicable)
• Physical examination results
• Quality of life ratings
• Mental health information
• Genetic data (if part of the study)
• Racial or ethnic origin (when applicable)

‍

V. Why We Process Your Information

We use your information for scientific research to study the effects of medical treatments.

Legal Basis:

• Legal requirements for conducting clinical trials
• Your consent (note genetic testing requires a separate consent)
• Public health interests
• Legitimate research purposes

‍

VI. Who We Share Data With

We work with organizations that help us conduct trials:

• Contract Research Organizations (CROs)
• Statistical analysts
• Clinical advisors
• Technology providers (hosting and software)
• Safety monitoring boards

All these partners are required by law and contract to:

• Keep your information confidential and secure
• Only use it for appropriate purposes
• Follow all privacy laws

‍

VII. International Data Transfers

• Hemab is based in Denmark and the United States
• Your data may be processed in other countries, including the United States
• We only transfer data with proper legal protections in place
• Your data is coded before being sent outside your country
• Our US team follows the same privacy standards as our Danish company

‍

VIII. How Long We Keep Your Data

We keep clinical trial data for 25 years in the European Economic Area, as required by law. This ensures we can monitor long-term safety and effectiveness.

‍

IX. Your Rights

Depending on where you live, you may have the right to:

• Access your medical record
• Correct inaccurate information
• Restrict how certain data is used
• Get a copy of your data electronically
• Withdraw consent to stop data collection
• Complain to a data protection authority

Important: We may not be able to directly help with some requests because we don't have information that identifies you by name. Contact your clinical site staff, who can assist you with exercising these rights.

Note: You cannot request deletion of clinical trial data because it's needed for legal requirements and public health research.

‍

X. Children in Clinical Trials

Some of our trials include children. We will:

• Only collect a child's data with parental or legal guardian consent
• Follow all laws in the country where the trial is conducted
• Collect partner consent if a pregnancy occurs

‍

XI. Security Measures

We protect your information through:

• Technical security systems
• Organizational safeguards
• Controlled physical access to data
• Privacy-by-design principles in our hardware and software
• Regular security assessments

‍

XII. Questions or Complaints

• Contact our Data Protection Office: privacy@hemab.com
  
  • Please don't include personal or health information in your email subject line
  • We'll respond within 30 days
  • You can also file a complaint with your country's data protection authority
• Denmark: Datatilsynet - https://www.datatilsynet.dk/english

‍

XIII. No Automated Decisions

We will not make any decisions about you based solely on automated computer processing during the trial.

For questions about your specific trial or to review your Informed Consent Form, please contact your clinical site staff.

Hemab ApS and its subsidiaries

‍

‍

‍