healthcare providers media publications & posters WE ARE KIADIS OUR RESEARCH FOCUS FOR INVESTORS KIADIS NEWS CAREERS Last updated 11 March 2020 Introduction General information Controller and contact details Your rights Information per role As a patient you are a participant in one of our clinical trials You are a healthcare professional working with Kiadis You are website visitor of Kiadis Possible other use and disclosures Jurisdiction and cross-border transfer Updates of the privacy notice INTRODUCTION This Privacy Notice of Kiadis Pharma Netherlands B.V. and its affiliates (collectively “Kiadis,” “we,” or “us”) explains how we collect, use and disclose (together “process”) personal data about the patients that are involved in our clinical trials, healthcare providers, website visitors and other persons we deal with (referred all together as “Data Subjects”). This Privacy Notice is organized according to the different roles in which you can be in contact with us. If you are for instance a trial subject in one of our clinical trials, you can click on ‘clinical trials’ to read which personal data is processed with the scope of clinical trial studies, why, to which parties we disclose personal data and how long we retain personal data. This Privacy Notice starts with a general part which is applicable to all Data Subjects. GENERAL INFORMATION 2.1. Controller and contact details Kiadis Pharma Netherlands B.V., located at Paasheuvelweg 25A, 1105 BP in Amsterdam, The Netherlands is controller of your personal data. For questions about privacy or data protection or to contact Kiadis for your rights, you can reach Kiadis at +31 (0)20 240 52 50 or privacy@kiadis.com. The Dutch data protection officer of Kiadis can also be reached via these contact details. 2.2. Your rights Access: You have the right to request a copy of your personal data that are processed by or on behalf of Kiadis. We can perform this request for you when we are able to identify you and process the personal data you request access to. You can also request information about other details of the processing of your personal data, such as the retention period of your data (or the criteria to determine that period) and categories of third-party recipients. You can always find general information in this Privacy Notice. Where appropriate and where we are able to identify you, you also have the following other rights. Please note, due to our legal obligations or compelling reasons in light of scientific integrity we may not always be able to (fully) facilitate these rights. You can request us to rectify or complete personal data which we have on you and which are incorrect, incomplete or have not been processed in accordance with applicable data protection law. You can ask Kiadis to restrict the processing of your personal data, for example during the period that we check your request to rectify your personal data. You have the right to have your personal data deleted by Kiadis. You can request Kiadis to provide you with a structured, commonly used and machine-readable copy of the personal data that you have provided to us. In those cases, you also have the right to have Kiadis transfer such personal data to a third party without hindrance. You can object to the processing of your personal data by Kiadis. Kiadis can request you to state reasons related to your specific situation. You can exercise all these rights by sending an email to privacy@kiadis.com. We can ask you to identify yourself to make sure we perform the requested action on the correct personal data. When you are a trial subject in a clinical trial, we will usually not be able to identify you and refer you to your hospital or another party involved in the clinical trial. We will try to comply with your request as soon as reasonably practicable. Where the processing of personal data by Kiadis was based on your consent, you can withdraw this consent at any time. Your withdrawal has no consequences for the lawfulness of the processing of personal data before the withdrawal of your consent. You always have the right to submit a complaint to the Dutch Data Protection Authority (at www.autoriteitpersoonsgegevens.nl). INFORMATION PER ROLE 3.1. As a patient you are a participant in one of our clinical trials 3.1.1. Which personal data do we process about you and why? We collect personal data of patients and donors participating in clinical trials for the following purposes: We collect pseudonymized details, such as a coded patient number, of each patient to be able to individualize each patient in as far as this is necessary for the clinical trial and related regulatory requirements. Where you are a donor, we will collect pseudonymized details, such as coded donor number and health data to assess whether you are eligible for the study. We collect health data such as medical observations related to that coded patient/donor number to perform the clinical trial and related regulatory requirements. We collect other personal data as necessary for the trial and related regulatory requirements and as further indicated on your information and consent form, such as age, genetic data and hospital. The information and consent statement as signed by you in scope of the clinical trial will contain additional information about personal data processing. Where there is a conflict between your information and consent statement and this Privacy Notice, the information and consent statement will prevail. We will engage in these clinical trial activities with your explicit consent. Where we can, we will work with data which is pseudonymized or fully anonymized. 3.1.2. To which parties discloses Kiadis personal data? Where this is regulatory required or necessary for the clinical trial, we will disclose pseudonymized personal data to the following parties: To relevant regulatory authorities for the purpose of obtaining authorization for clinical trials, the products tested during clinical trials and for obtaining marketing authorizations. To relevant regulatory authorities who may need to see this information to ensure that the clinical trial is being conducted in accordance with laws and ethical requirements. To governmental or regulatory agencies overseeing the clinical trial. To third parties which assist us with the clinical trial, such as hospitals and universities. To our third party service providers, to facilitate services they provide to us, such as hosting, data analysis, information technology and related infrastructure provisions, auditing, and other services. To our Kiadis affiliates where this is required for the clinical trial. 3.1.3. How long are my personal data stored? To comply with clinical trial regulations as applicable to Kiadis, the personal data that are processed by Kiadis in scope of a clinical trial will be kept for a period of 30 years after your participation in the clinical trial. 3.2. You are a healthcare professional working with Kiadis 3.2.1. Which personal data do we process about you and why? We collect personal data of doctors, nurses, investigators and/or physicians (all ‘healthcare professionals’) working at clinical trial sites for the following purposes: Contact details, such as name, telephone number, email address, home or work postal address in order to: communicate in relation to the clinical trial. communicate for medical research purposes to help with the design of future studies, to publish results of research studies in study reports or for scientific presentations. keep you informed about our products, events and other news about our company. Name, ID information in order to: facilitate any investigation or compliance proceeding by relevant regulatory authorities. We will engage in these activities to manage our contractual relationship, with your consent, or where we have a legitimate interest. Where we rely on legitimate interest, we always seek to maintain a balance between our legitimate interest and your privacy. Our legitimate interests include keeping a relationship with healthcare professionals and informing them about our products and services. 3.2.2. To which parties discloses Kiadis personal data? Where this is required for the purposes described above, we will disclose personal data to the following parties: To relevant regulatory authorities for the purpose of obtaining authorization for clinical trials, the products tested during clinical trials or for obtaining marketing authorizations. To relevant regulatory authorities who may need to see this information to ensure that the clinical trial is being conducted in accordance with laws and ethical requirements. To governmental or regulatory agencies overseeing the clinical trial. To third parties which assist us with the clinical trial, such as hospitals and universities. To our third party service providers, to facilitate services they provide to us, such as hosting, data analysis, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services. To our Kiadis affiliates where this is required for the clinical trial or relationship management. 3.2.3. How long are my personal data stored? Any personal data of health care professionals that relate to a clinical trial are kept for a period of 30 years after the clinical trial. Personal data that are processed for relationship management purposes will be kept for 5 years after the last contact with that healthcare professional. 3.3. You are website visitor of Kiadis 3.3.1. Which personal data do we process about you and why? We collect personal data of individuals visiting our website for the following purposes: IP address and mobile device ID in order to calculate usage levels, diagnose server problems and administer our website. Other information that website visitors may submit via our online contact form in order to respond to their inquiries and fulfill requests. We will engage in these activities with your consent and/or because we have a legitimate interest. Where we rely on legitimate interest, we always seek to maintain a balance between our legitimate interest and your privacy. Our legitimate interests include improving our website and communicating with our website visitors. 3.3.2. To which parties discloses Kiadis personal data? Where this is required for the purposes described above, we will disclose personal data to the following parties: To our Kiadis affiliates where this is required for the purposes described above. To our third party service providers, to facilitate services they provide to us, such as website hosting, data analysis, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services. 3.3.3. How long are my personal data stored? Kiadis will anonymize your personal data within 18 months after your last contact with us. POSSIBLE OTHER USE AND DISCLOSURES If we are required to do so, we may need to further use and disclose personal data. This paragraph explains when this may be the case. Where possible, we will always inform you of any additional use or disclosure of your personal data which is not included in this Privacy Notice. To comply with applicable law and regulations. To cooperate with public and government authorities. To respond to a specific lawful request for information or to provide information we believe is important. To cooperate with law enforcement. For example, when we respond to law enforcement requests and orders or provide information we believe is important. To enforce our terms and conditions and to protect our rights, privacy, safety or property, and/or that of our affiliates, Data Subjects or others. In connection with a sale or business transaction: we have a legitimate interest in disclosing or transferring personal data to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings). Such third parties may include, for example, an acquiring entity and its advisors. JURISDICTION AND CROSS-BORDER TRANSFER Were this is required for the purposes as mentioned in this Privacy Notice, Kiadis will transfer personal data to countries outside the European Economic Area. Certain non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). For transfers from the EEA to countries not considered adequate by the European Commission, we will put in place adequate measures, such as standard contractual clauses adopted by the European Commission to protect Personal Data. Data Subjects may obtain a copy of these measures via the contact details mentioned in this Privacy Notice. UPDATES OF THIS PRIVACY NOTICE The latest version of this Privacy Notice will always be published on the Kiadis website. As we may not always have the contact details to inform you separately where required, please check our website regularly for possible updates on this Privacy Notice. LOCATIONS LEGAL DISCLAIMERS COOKIES CONTACT PRIVACY SITEMAP CODE OF ETHICS © Copyright 2021 Kiadis Pharma