CENTESSA PHARMACEUTICALS PLC

GENERAL PRIVACY NOTICE FOR STUDY/PROGRAMME PARTICIPANTS

1.     Purpose of This Document

This privacy notice is applicable in the event that you are participating in a study or programme of research where your data are under the control of Centessa Pharmaceuticals plc (“we” or “Centessa“) and/or one of its group entities (together “Centessa Group“), as the Sponsor of the programme.

The Sponsor of the programme is the Data Controller for the personal data processed related to the study or programme.

This Notice makes you aware of how and why your personal data will be used for the purposes of the research or clinical trial exercise (“programme“), and how long it will usually be retained for. It provides you with certain information that must be provided under applicable privacy laws.

2.     The Kind of Information We Hold About You

The study doctor and study staff will use and share your health information as part of the programme. Except when required by law, you will not be identified by name, address, telephone number or other facts that could identify the health information as yours.

In connection with the programme, we will collect, store, and use the categories of personal data set out in the relevant participant Informed Consent Form (ICF) for the programme.

We are often required to collect the following data:

• your name (including name prefix or title);
• A unique identifier or reference number attributed to you, that allows for your information to be processed without identifying you personally;
• contact details including email or postal address, phone number(s);
• details of any enquiry or complaint submitted;
• racial or ethnic origin or sex life;
• medical history, diagnostic data; other health related information provided by you (such as health information, disability and disability type, health risk factors, personal exposure and surveillance data);
• details of any relevant product being taken, prescription and dosage data, why taken, and for how long;
• details of any other medicinal products that are being taken, prescription and dosage data, why taken. and for how long; and
• details of any adverse events, any treatment received, and other effects.

The Sponsor, or any successor entity to the Sponsor and their authorized parties, will use your health information:

• to complete this research
• to evaluate the results of the study
• to check that the study is being done properly
• to obtain marketing approval for new products resulting from this research
• for other lawful reasons described in this consent form

All of the information collected during the programme will remain strictly confidential to the extent prescribed by law. However, in clinical studies there is a risk that complete confidentiality may not always be maintained.

Please note that once your initial personal information has been captured in the programme Informed Consent Form, your details are then de-identified or coded to prevent you from being personally identified.  This process is called pseudonymisation and is a mechanism for protecting your identity and personal information that is processed during and after the programme.

Only study/trial staff have access to identifiable data and are bound by professional secrecy and a code of confidentiality to ensure that your personal information is protected.  The sponsor will only receive de-identified data and will not see any information that identifies you personally.

3.     How Your Personal Data Is Collected

We collect personal data about participants from the following sources:

• from you or your authorised party when you sign up to be part of the programme;
• from our partners who conduct and monitor the programme;

To effectively meet our pharmacovigilance and safety obligations, we may also need to collect and process certain information relating to adverse event reports and about the reporter and the affected individual (where different).

4.     How We Will Use Information About You

Your personal data will be processed in accordance with the EU/UK General Data Protection Regulation (GDPR) and any applicable country-specific legislation.

For the purposes of the programme, we will use the personal data we collect about you for the following lawful reasons:

In certain countries, we may seek your consent to process your personal information.  Where we have sought your consent for any processing, you have the right to withdraw this consent at any time (though this will not affect the lawfulness of processing based on consent before its withdrawal). Results of the programme may be presented at meetings or in publications, however, your identity will never be disclosed.

If you do not provide personal data

If you do not provide information when requested, which is necessary for your participation in the programme, then your participation may be discontinued or delayed. You will be informed of this at the time.

5.     How We Use Particularly Sensitive Personal Data

As set out in the table above, to the extent we process sensitive data or “special category data” for such purposes, we may process such information for reasons of public interest in the area of public health (such as to ensure a high standard of safety of medicinal products and/or methods) or as necessary for scientific research purposes or statistical purposes where permitted by applicable data protection law and subject always to ensuring suitable measures to safeguard the fundamental rights and interests of patients. This data will always be de-identifed or coded and will never identify you personally.

6.     Automated Decision-Making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

7.     Recipients of Your Personal Data

Your medical records (including uncoded personal information) may be reviewed by individuals and/or organisations that act on our behalf, including Clinical Research Organizations, monitors, auditors, regulatory agencies and independent review boards or ethics committees, that review and approve studies, monitor safety and conduct before, during and after the study.

We may disclose your coded personal data to authorised Centessa Group employees, who are required to see data in relation to their roles and responsibilities. In some cases, we may provide coded personal data to third parties including our vendors, partners and service providers (e.g., cloud service providers) who perform services on our behalf. These providers have limited access to your coded personal data only to the extent necessary to perform these support tasks on our behalf and subject to the same confidentiality and security safeguards as those applied by Centessa and its Group.

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

With your permission, the study doctor may tell your primary doctor of your participation in this study.

8.     Transfer of Personal Data Outside the EEA

Where you are located within the European Economic Area (“EEA”), the personal data that we collect from you may be transferred to, and stored at, a destination outside the EEA for the purposes described above. Due to the global nature of our activities, your personal data may be disclosed to members of our group outside the EEA, particularly in the UK and USA. It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers who act on our behalf.

Where we transfer such personal data, we will ensure appropriate legal safeguards, such as the European Commission approved standard contractual clauses, and that additional safeguards where required, are in place to protect the privacy and integrity of such personal data.

A description of the programme will be available on Clinical Trial Information System (CTIS) in https://euclinicaltrials.eu/ as required by European Law.  A description of the programme will also be available on https://www.ClinicalTrials.gov  as required by U.S. Law. These websites will not include information that can identify you. At most, the Website will include a summary of the results. You can search these websites at any time.

If you would like more information concerning such safeguards, please speak to your Study Doctor or you may contact the Sponsor’s Data Protection Officer, via privacy@centessa.com

9.     Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

10.   How Long Will You Use My Information For?

Personal data processed for the purpose of responding to enquiries and complaints will only be retained for as long as necessary to fulfil the purposes for which it was collected and relevant to the exercise of any rights or in anticipating or seeking to resolve any issues or legal claims.

Personal data relating to the programme and its outcomes will only be retained for as long as is necessary for the purpose of the programme. In some cases, these may be subject to legal retention time frames.

For the purposes of the programme, your clinical data will be retained for at least 25 years after the programme has been completed.

We may also retain aggregate information beyond this time for research purposes and to help us develop and improve our services. You cannot be identified from aggregate information retained or used for these purposes.

11.   Your Rights in Connection with Personal Data

You have a number of rights afforded to you under data protection laws that relate to the personal data processed by us, as follows:

• request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. However, in certain circumstances this right may be restricted where it is deemed that disclosure would not be in the best interests of the participant or the programme.  If this is the case, we will respond to keep you informed.
• request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• request erasure of your personal data. This enables you to ask us to delete or remove personal data in certain circumstances. You may also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below). There may be instances where we cannot delete your data due to a legal obligation to retain, or where it may negatively affect the programme.  If this is the case, we will respond to keep you informed.
• object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. Please be advised that there may be restrictions to this right, but we will keep you informed if this is the case.
• request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it. Again, in certain circumstances, it may not be possible to restrict processing where that data is critical to the programme.  If this is the case, we will respond to keep you informed.
• request the transfer of your personal data to another party. This is rarely applicable in a clinical trial or research setting due to the legal basis for processing.

If you would like to exercise or discuss the rights as explained above please contact us via privacy@centessa.com or speak to your Study Site/Investigator.

12.   Complaints

We will always endeavour to respond and resolve any concerns or complaints that you may have, however, if you are not satisfied with the way that your personal data have been processed, or how we have responded to your queries or requests, you have the right to contact the UK Information Commissioners Office via www.ico.org.uk or any other EU member state Supervisory Authority.

Individuals and data protection supervisory authorities in the EU may also contact our data protection representatives according to Article 27 GDPR:

EU: DP-Dock GmbH, Attn: Centessa Pharma, Ballindamm 39, 20095 Hamburg, Germany

www.dp-dock.com

centessa@gdpr-rep.com

You may also raise your concerns directly with the Study Site/Investigator.

13.   Further Information 

LIST OF CENTESSA GROUP DATA CONTROLLERS

The specific Data Controller and Sponsor will depend on the of the specific study/programme that you are participating in.

These are as follows: