CENTESSA PHARMACEUTICALS PLC
PRIVACY NOTICE FOR ADVOCACY GROUPS/PARTICIPANTS
1. Purpose of This Document
You are being provided a copy of this privacy notice because you are participating in advocacy activities with, or on behalf of Centessa Pharmaceuticals plc and/or its affiliates (together, “Centessa“,“we”, “us” or “our”). This participation will involve your personal information being processed by Centessa.
Under information protection and privacy legislation, including the UK/EU General Information Protection Regulation (GDPR), Centessa are the Data Controllers of the personal information collected and processed and are responsible for ensuring that this is handled securely and responsibly.
This notice makes you aware of how and why your personal information will be used for the purposes of any advocacy activities you are involved in. Examples of such activities include, but are not limited to, conferences, panels, webinars, groups and social media posts. This notice provides you with certain information that must be provided under applicable privacy laws.
2. Details of the Programme/Activity
Centessa engage with a number of global patient advocacy organisations to identify individuals who would like to be involved with activities that, amongst other things, promote awareness and education regarding their condition or disease and could assist future development of studies and treatments. These organisations provide Centessa with contact details, to enable us to engage with you.
Centessa will contact you via your email address to arrange your participation in specific activities and/or events where we believe you might have an interest. It is entirely your choice as to whether you decide to participate.
3. The Kind of Information We Hold About You
In connection with advocacy activities, we will collect, store, and use certain categories of personal information for the purposes of education and awareness of the specific condition or disease, promotion of relevant advocacy or support groups and resources, and to gather insights and information that may assist in the development of future clinical trial/study programmes, as required under clinical trial regulations and Good Clinical Practice (GCP).
For the purposes of advocacy activities, we process the following personal information:
- your email address to contact you to participate;
- your name to engage with you personally (only your first name will appear in any public sharing of your advocacy activities); and
- images of you such as photographs and video footage.
Please note that when you participate in advocacy activities and/or events, you may divulge information about your health and your condition, either directly or by inference, that may become publicly available. You will be asked to provide your explicit consent in these instances.
4. How We Will Use Information About You
For the purposes of the activities mentioned, we will use the personal information we collect about you for the following lawful reasons:
| Purpose | Lawful basis (personal information) | Lawful basis (special category information) |
| Advocacy activities, including conferences, events, panels, etc where photographs and videos are taken | Performance of a contract. | Public interest in the area of public health. Research and statistical purposes. (Where applicable, explicit consent). |
| Clinical Trial/Study Planning | Complying with legal obligations to which we are subject. | Public interest in the area of public health. Research and statistical purposes. |
| Research and reporting | Legitimate interest in research improving diagnostic and clinical treatment decisions. | Research and statistical purposes. |
| Patient Protection | Necessary in any emergency situation in order to protect your vital interests (or the interests of another person). | Necessary in any emergency situation to protect your vital interests (or the interests of another person). |
| Participation Remuneration | Performance of a contract. | n/a |
Where we have sought your consent for any processing, you have the right to withdraw this consent at any time (though this will not affect the lawfulness of processing based on consent before its withdrawal).
If you do not provide personal information
If you do not provide information when requested, which is necessary for your participation in the activity, then your participation may be discontinued or delayed. You will be informed of this at the time.
5. How We Use Particularly Sensitive Personal Information
As set out in the table above, to the extent we process sensitive information about you (often referred to as “special category data”) for such purposes, we may process this for reasons of public interest in the area of public health (such as to ensure a high standard of safety of medicinal products and/or methods) or as necessary for scientific research purposes or statistical purposes where permitted by applicable information protection law and subject always to ensuring suitable measures to safeguard the fundamental rights and interests of patients.
6. Automated Decision-Making
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
7. Recipients of Your Personal Information
When you agree to participate in advocacy activities and events, your personal information, including images (e.g. video footage, photographs, etc) will be shared internally within Centessa and, where appropriate, photographs may be shared externally via social media or similar, as advised by the team involved and described in the relevant Release and Assignment Waiver. Such sharing activities are subject to strict review and approval to ensure appropriateness and protection.
Additionally, we provide personal information to third parties including our vendors, partners and service providers (e.g., cloud service providers) who perform services on our behalf. These providers have limited access to your personal information only to the extent necessary to perform these support tasks on our behalf and subject to the same confidentiality and security safeguards as those applied by Centessa.
In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
We are responsible and remain liable for the processing of personal information we receive, including where this involves an International Transfer of personal information as described further below.
8. Transfer of Personal Information Outside the EEA
Where you are located within the European Economic Area (“EEA”), the personal information that we collect from you may be transferred to, and stored at, a destination outside the EEA for the purposes described above. Due to the global nature of our activities, your personal information may be disclosed to members of our group outside the EEA, including in particular in the USA. It may also be processed by staff operating outside the EEA who work for us, or for one of our suppliers who act on our behalf.
Where we transfer such personal information, we will ensure appropriate legal safeguards, such as the European Commission approved standard contractual clauses, and any additional safeguards where required, are in place to protect the privacy and integrity of such personal information.
If you would like more information concerning such safeguards, please contact us via privacy@centessa.com
9. Information Security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. Where applicable, they will only process your personal information on our instructions, and they are subject to a duty of confidentiality.
10. Your Rights in Connection with Personal Information
You have a number of rights afforded to you under information protection laws that relate to the personal information processed by us, as follows:
- request access to your personal information (commonly known as a “information subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- request erasure of your personal information. This enables you to – in certain circumstances – ask us to delete or remove personal information. You may also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). There may be instances where we cannot delete your information due to the nature of publication or where we have a legal obligation to retain. If this is the case, we will respond to keep you informed.
- object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. Please be advised that there may be restrictions to this right, but we will keep you informed if this is the case.
- request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it. Again, in certain circumstances, it may not be possible to restrict processing where that information has been published publicly. If this is the case, we will respond to keep you informed.
- request the transfer of your personal information to another party. This is rarely applicable in a clinical trial or research setting due to the legal basis for processing.
If you would like to exercise or discuss the rights as explained above please contact us via privacy@centessa.com
11. Complaints
We will always endeavour to respond and resolve any concerns or complaints that you may have, however, if you are not satisfied with the way that your personal information has been processed, or how we have responded to your queries or requests, you have the right to contact the UK Information Commissioners Office via www.ico.org.uk or any other EU member state Supervisory Authority.
Individuals and information protection supervisory authorities in the EU may also contact our information protection representatives according to Article 27 GDPR:
EU: DP-Dock GmbH, Attn: Centessa Pharma, Ballindamm 39, 20095 Hamburg, Germany