PRIVACY POLICY

1GENERALThis Privacy Policy describes how Dilafor AB (“the Company” or “Dilafor”) processes anduses personal data about you in your capacity as a subject in Clinical trials orrepresentative of a company that is a partner of Dilafor. This Privacy Policy also details
how Dilafor processes personal data about you in your capacity as a visitor to our website,www.dilafor.com, and in the event of you applying for a position at Dilafor (recruitment).
This Privacy Policy also describes your rights and how you can exercise them in relation
to Dilafor.
You should always feel secure when providing Dilafor with your personal data. Dilafor’s
aim, through this Privacy Policy, is to show how the Company ensures that your personal
data are processed in accordance with applicable legislation. Dilafor defends yourpersonal integrity and endeavours to protect the personal data of registered persons in asecure manner.
2PERSONAL DATA CONTROLLER AND DATA PROTECTION OFFICER

Dilafor AB, company registration number 556642-1045, of Fogdevreten 2 A, SE-171 65
Solna, Sweden is the Personal Data Controller for the processing of your personal dataand is, therefore, responsible for ensuring that your data are processed correctly andsecurely and in accordance with applicable legislation.
Dilafor has appointed Hanna Ersson to the position of Data Protection Officer (“DataProtection Officer”). The Data Protection Officer is tasked with, amongst otherthings, monitoring the processing of data by the Personal Data Controller to ensurethat it is conducted in accordance with applicable legislation. The Data Protection
Officer’s contact details are: dpo@dilafor.com.
3

WHAT PERSONAL DATA DO YOU COLLECT?

Dilafor collects and stores information on you, in your capacity as a Clinical trial subject
information we need both to enable you to undergo clinical trials and to enable Dilafor toaccess the results of the trial and to use these results in Dilafor’s research anddevelopment of pharmaceuticals. This information includes your age, gender, ethnicity,
health data, results of examinations and samples taken during the clinical trial, etc. Your
personal data in the form of your name, postal address, and telephone number, arecollected from your doctor at the clinic where you are treated within the framework of thetrial. The data are stored in the hospital’s records system and will not be forwarded toDilafor.
Representatives of companies/organisations
Dilafor collects and stores information about you that we need to enable us to contact you
in your capacity of a representative of a company/organisation, such as your name,position, postal address, email address, and telephone number. We also, where relevant,collect personal data in the form of information that you provide in conjunction withmeetings or events, e.g. the need for accessible premises, or food and drink preferences.
Your personal data are also collected in conjunction with email correspondence between
you and Dilafor. Your personal data are usually collected from the company/organisation

PRIVACY POLICY DILAFOR 2020-10-15

1

that you represent, but is also, where relevant, collected directly from you. Dilafor may
also obtain your personal data from Dilafor’s other partners. The Company also makes
use of external information services in order, when necessary, to complement existing
information with information about your position or how to contact you.
Visitors to the website
The Company collects information about you and how you use our website(www.dilafor.com) that we need to enable us to improve, enhance the efficiency of,simplify, and develop our website, such as your IP address, MAC address, cookies, webbrowser, your equipment’s/unit’s operating system, and other types of technicalinformation (equipment/unit information). Such data collection occurs in conjunction withyour visits to our website.
Recruitment
The Company collects information on you that we need in order to be able to recruit theright people to positions within the Company. Personal data collected for recruitment
purposes comprises your name, postal address, email address, telephone number, CV,
any presentation image, and other personal data with which you have chosen to provide
us. We also collect your personal data in conjunction with email correspondence between
you and Dilafor.
4DILAFOR’S PROCESSING OF YOUR PERSONAL DATA

4.1

For experimental subjects

The personal data we collect, the purposes for which we intend to process your personaldata, and the lawful basis for each type of processing, are shown in the table below.
Personal data categories• Personal data such asdate of birth and details of
health data and othermedical information frombefore and during
treatment as part of aclinical trial, such asprevious and current
conditions, results ofexaminations and samples
taken, etc.
• Details of race andethnicity

4.2

Purpose of theprocessing

Lawful basis

To conduct researchand develop
pharmaceuticals.
Individual data are
saved to verify researchfindings.

In accordance with yourinformed consent

To conduct researchand develop
pharmaceuticals.
Individual data are
saved to verify researchfindings.

In accordance with yourinformed consent.

For representatives of companies/organisations

The personal data we collect, the purposes for which we intend to process your personaldata, and the lawful basis for each type of processing, are shown in the table below.

PRIVACY POLICY DILAFOR 2020-10-152.
Personal data categories

Purpose of theprocessing

Lawful basis• Personal data and contact
information, such as name,address, telephone number,email address, job title, etc.

To enable theadministration of therelationship with you or
thecompany/organisation
you represent.

• Personal data and contact
information, such as name,address, telephone number,email address, job title, CV
etc.

The processing isnecessary due to Dilafor’s
legitimate interest in
fulfilling the agreement withthe company/organisationthat you represent, and inorder to enable theadministration of therelationship with you or thecompany/organisation you
represent (balance ofinterests).

To comply with statutory
requirements, e.g.
handling of regulatory,security, andbookkeeping
requirements.

The processing isnecessary to comply with
the Company’s legalobligations.

• Personal data and contact
information, such as name,address, telephone number,email address, job title, etc.

To enable marketingand communication
regarding the progressof Dilafor’s research anddevelopment, in order topromote collaborations
and other commercialrelationships.

The processing isnecessary to Dilafor’s
legitimate interest in
marketing its research anddevelopment to you or thecompany/organisation thatyou represent (balance ofinterests).

For visitors to our website

4.3

The personal data we collect, the purposes for which we intend to process your personaldata, and the lawful basis for each type of processing, are shown in the table below.
Personal data categories•

Equipment/unit
information, such as IPaddress, MAC address,
information for cookies
etc.

PRIVACY POLICY DILAFOR 2020-10-15

Purpose of theprocessing

Lawful basis

To enable thedevelopment of ourwebsite(www.dilafor.com) tobring it more in line withthe way our website isused.

The processing isnecessary due to theCompany’s legitimate
interest in improving,enhancing the efficiency of,simplifying, and developing
its website, attracting morepartners, and publishingprogress information withregard to the Company’s

3research (balance ofinterests).

For those applying for jobs at Dilafor

4.4

The personal data we collect, the purposes for which we intend to process your personaldata, and the lawful basis for each type of processing, are shown in the table below.
Personal data categories•5Personal data andcontact information,such as name, address,telephone address, email
address, CV, and otherpersonal data with which
you choose to provide us.

Purpose of theprocessing

Lawful basis

In order to enable us, inconjunction withrecruitment, todetermine who is best
suited for a position andto ensure that theperson in question has
the requisitecompetence.

The processing isnecessary due to theCompany’s legitimate
interest in employing theright personnel andensuring that competent
individuals work for theCompany (balance ofinterests).

STORAGE PERIOD

Dilafor will not store your personal data for a period that is longer than that required tofulfil the purposes for which the data were collected, or for the period for which Dilafor has
a statutory obligation to store your personal data, or to protect Dilafor’s legal interests,
e.g. while legal proceedings are in progress. Your data will then be deleted.
Some personal data will, in order to comply with relevant bookkeeping legislation, besaved for seven years from the end of the calendar year when the financial year to which
the information relates came to an end.
Contact details for company representatives will be stored for the period for which, in theopinion of the Company, the data are necessary to the maintenance of the relationshipwith the company/the organisation. Deletion will occur at such time as the Company ismade aware that the data are no longer adequate or relevant for the purpose, or at therequest of the contact persons.
Contact details and CVs from clinic employees participating in clinical trials, together withresearch findings, details of health data, and other information obtained from treatment
during clinical trials, will be saved for at least 15 years from the completion of the trial, inorder to verify research findings and to comply with regulatory and statutory requirements.
6PROTECTION OF YOUR PERSONAL DATA

Dilafor has implemented the security measures required to protect your personal datafrom unauthorised access, alteration, and deletion to ensure that you feel secure whenproviding us with your personal data.
The security measures that Dilafor has taken to protect Clinical trial subjects personal
data include pseudonymising names and civic ID numbers (i.e. replacing names and civic
ID numbers with a special code number), restricting access to personal data by means ofuser permissions, and encrypting certain personal data, individual study data, andresearch findings, etc.

PRIVACY POLICY DILAFOR 2020-10-15

4

Dilafor will only disclose personal data on Clinical trial subjects at group level and will nototherwise disclose your personal data to any other party, other than as specificallypermitted by this Privacy Policy (see section below).
7TRANSFER OF PERSONAL DATA TO THIRD PARTIES AND THIRD-PARTY
COUNTRIES

Dilafor does not disclose personal data to third parties other than in situations where suchdisclosure is a requirement that derives from a statutory obligation or in order to fulfil
Dilafor’s partnerships with clinics and physicians for the conduct of clinical trials. Your
personal data will not be transferred or sold to third parties for advertising purposes. The
following table sets out the situations in which your personal data may be disclosed to athird party.
Third party

Reason why personal data are disclosed to a third party

Cloud service providers

Dilafor stores certain information in cloud services and yourpersonal data may, therefore, be disclosed to providers of suchcloud services.

Suppliers and partners

Dilafor may disclose your personal data to our various operating
suppliers. This will occur when the suppliers or partners need yourpersonal data in order to fulfil their engagements on behalf ofDilafor.

Authorities

Personal data may be transferred to authorities (including foreignauthorities) when this is required to comply with statutory
obligations. The results of clinical trials will only be disclosed toauthorities at group level.

Dilafor endeavours to process your personal data within the EU/EEA. Dilafor will nottransfer your personal data to a country outside the EU/EEA other than as provided below.
If personal data are transferred to a country outside the EU/EEA, Dilafor will take steps toensure that your personal data continue to be protected and will also implement themeasures required to ensure that personal data are transferred to countries outside theEU/EEA in a legal manner.
Dilafor uses IT providers with servers in the USA for data storage. Dilafor’s use of such IT
providers’ services may result in your personal data being transferred to the USA. Dilafor
has ensured that your rights are guaranteed in conjunction with data transfer to the USA
by entering into agreements containing the European Commission’s standard contractual
clauses with these IT providers, or by ensuring the presence of other appropriate security
measures.
8YOUR RIGHTS

You are, on condition that Dilafor is the Personal Data Controller, entitled at any time, freeof charge, to obtain an extract from the register containing details of your registeredpersonal data, together with information on the purpose of the processing of these data,
where these personal data were obtained, and the recipients to whom the data has beenor will be disclosed. You are also entitled, in the register extract, to obtain information on
the predicted period for which the data will be stored and the criteria used to determine
this period. Requests for such information shall be submitted in writing and sent to Dilafor
at the address shown below under the “Contact” heading.

PRIVACY POLICY DILAFOR 2020-10-155

You are entitled to data portability, i.e. you have the right, under certain circumstances, toretrieve and transfer your personal data in a structured, commonly used, and machinereadable format to another Personal Data Controller.
Dilafor will, at your request, or on its own initiative, correct, anonymise, complement, ordelete data found to be incorrect, incomplete, or misleading. Dilafor is, under certain
circumstances, obliged to process your personal data despite you having requested its
removal.
You can, under certain circumstances, request restrictions on the ongoing processing ofyour personal data (if, for example, you dispute the correctness of the personal data orwhether their processing is legal) and are, furthermore, entitled to object to the processing
under the conditions permitted by applicable personal data legislation.
If you wish to exercise any of the above rights or if you have any questions about personal
data held by Dilafor, or about this Privacy Policy, please do not hesitate to contact Dilafor(see contact details below under the “Contact” heading).
Please contact Dilafor if you are dissatisfied with Dilafor’s processing of your personaldata, at which time Dilafor will do its best to address your complaints. Your integrity is very
important to Dilafor and Dilafor endeavours at all times to protect your personal data in a
relevant and secure way. If you believe that Dilafor has, nonetheless, failed to live up tothis ambition, you are also entitled to submit a complaint to the Swedish Data Protection
Authority.
9COOKIES

Dilafor uses cookie-like techniques in order to provide certain functions on thewww.dilafor.com website, in order to improve the website and to provide a better and more
personal service. The information is stored in the form of a file containing encrypted login
data and is used to remember any website settings selected and to analyse the use of thewebsite.
10LINKS TO OTHER WEBSITESDilafor’s website, www.dilafor.com, may include links to external websites over which
Dilafor has no controlling influence. These websites are not covered by this PrivacyPolicy. Dilafor accepts no responsibility whatsoever for the content of the websites linked
to from www.dilafor.com.
11

AMENDMENTS

Dilafor is entitled to amend this Privacy Policy at any time. Dilafor will, in conjunction withany amendments to this Privacy Policy, publish the amended Privacy Policy on
the www.dilafor.com website, together with details of when the amendments come intoforce, and will inform Clinical trial subjects and partners in an appropriate manner.
12CONTACT

If you have any questions about how Dilafor processes your personal data or wish
to exercise your rights, contact Dilafor by email at dpo@dilafor.com, or by letter inthe post to Dilafor AB, Fogdevreten 2 A, SE-171 65 Solna, Sweden.

PRIVACY POLICY DILAFOR 2020-10-156