Privacy Policy

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Date of birth and government-issued identification (used to verify Your identity for enrollment and
  eConsent)
• Emergency contact and, where required by a Study, caregiver or legally authorized representative contact
  details
• Bank account details used to pay Virtual Rewards and other compensation to You within the Service
• Usage Data

When We pay You a Virtual Reward via bank transfer, We may ask You to provide information to facilitate this transaction and to verify Your identity. Such information may include, without limitation:

• Date of birth
• Passport or National ID card
• Bank card statement
• Other information linking You to an address

Health Data and Clinical Trial (Study) Data

Because ProCTTH is used to support Your participation in a Clinical Trial, We collect a category of Personal Data that is more sensitive than ordinary account information. We treat this Health Data with heightened care, as described in the “Health Information and HIPAA Notice” section below. Depending on the Study You join, Health Data may include:

• Medical history, current diagnoses, medications, allergies, and eligibility/screening questionnaire responses
• Study data You enter directly into the Application, such as symptom reports, questionnaires, patientreported outcomes, and case report form entries
• eDiary entries, including medication adherence records, dosing times, and symptom or side-effect logs
• Lab and vital sign results collected during in-person or at-home visits scheduled through the Service
• Adverse event and safety information You or a Site Team member records in connection with Your
  participation
• Photographs, audio, or video You submit at the request of a Study protocol (for example, a wound photo or
  a symptom video)
• Data captured from a connected Wearable Device, described further below
• Demographic information such as sex, race, ethnicity, and pregnancy status, where relevant to a Study

We only collect Health Data that is required by the specific Study’s protocol and that You have agreed to provide
through the eConsent process. Health Data is used solely to conduct the Clinical Trial and is shared only with the
Sponsor, the Site Team, regulators, and Service Providers who need it to support the Study, as described in
“Disclosure of Your Personal Data” below.

Electronic Informed Consent (eConsent) Data
Before You can participate in a Study, You will be asked to review and electronically sign an informed consent form within the Application. To support this eConsent workflow, ProCTTH integrates with a third-party electronic signature service (Example: Zoho Sign). When You complete eConsent, We and third-party electronic signature service may collect and store:

• Your electronic signature and the date/time it was applied
• The version of the consent form and any addenda You reviewed and signed
• Your IP address, device identifier, and authentication details associated with the signing session
• A tamper-evident audit trail and certificate of completion confirming who signed, when, and from where

Signed consent documents are retained as part of Your Study record and shared with the relevant Sponsor, Site Team, and, where required, regulatory authorities and auditors, to demonstrate that valid informed consent was obtained.

Video Calls, Voice Calls, and Chat with Your Site Team
ProCTTH lets You connect with Your Site Team to ask questions or complete Study visits remotely, using third party video and voice call service provider (Example: Zoho Meeting), and an in-app chat feature. When You use these features, We may collect:

• Your name, email address, and other information needed to schedule and join a video or voice call
• Call metadata, such as date, time, and duration of a call
• If a call is recorded for clinical or quality-assurance purposes, the audio/video recording itself — You will be notified before any recording begins and, where required by law, asked for Your consent
• The content of chat messages You exchange with the Site Team, including any files, images, or documents You share

Call and chat content may be reviewed by authorized Site Team members, the Sponsor’s clinical operations staff, and, where relevant to a safety concern, the Sponsor’s medical monitor, and may be retained as part of Your Study record.

Wearable and Smartwatch Data (Example: Fitbit Integration or Apple watch integration)
If Your Study protocol calls for it, You may be asked to connect a Wearable Device (Example: Fitbit Integration or Apple watch integration) to automatically share health and activity information with the Service.
If You choose to connect a Wearable Device, We may collect data such as:

• Heart rate and heart rate variability
• Step count, distance, and general activity/exercise data
• Sleep duration and sleep stages
• Calories burned and other activity-derived metrics made available through the Fitbit API
• Device identifiers and sync timestamps

You control this connection: You decide whether to link Your Wearable device account, and You may disconnect it at any time through Your Device or Account settings, or by revoking ProCTTH’s access directly within Your Wearable device account. Wearable data collected for a Study is used to support the Study’s research objectives and safety monitoring, and is shared with the Sponsor and Site Team as part of Your Study data. Our use of data obtained through the Wearable device integration is also subject to Wearable device’s own privacy policy, available at
Wearable device’s website.

eDiary and Medicine Records
The eDiary feature lets You log medication doses, symptoms, and other patient-reported information requested by Your Study, on the schedule set by the protocol (for example, daily or after each dose). eDiary entries are timestamped and stored as part of Your Study record, and may include reminders and adherence data used by the Site Team and Sponsor to monitor Your safety and compliance with the Study protocol.

Scheduling and Lab Visit Data
ProCTTH allows You to view, request, and manage appointments for lab visits, home health visits, and other Study procedures. To provide this feature, We collect information such as Your preferred appointment times, visit location or address (including for at-home visits), confirmation and reminder communications, and visit completion status. This information is shared with the Site Team and any local lab or mobile health provider needed to carry out the visit.

Virtual Rewards (ProCoins) and Compensation Data
Where a Study offers compensation for Your participation, ProCTTH lets You receive Virtual Rewards (such as a stipend, digital gift card, or prepaid card load) for completing eligible Study activities. To process a Virtual Reward, We collect:

• Your name and contact details, to notify You of an available reward
• The bank account details needed to issue payment
• Tax identification information, where required by law for reportable compensation
• A record of rewards earned, issued, and outstanding, associated with Your Account

Payment and bank details are transmitted to and processed by Our secure third-party payment Service Providers; the Company does not sell, and does not use, Your bank details for any purpose other than issuing Your Virtual Rewards and complying with Our financial and tax obligations.

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Information from Third-Party Social Media Services
The Company allows You to create an account and log in to use the Service through the following Third-party Social Media Services(Example: Google).

If You decide to register through or otherwise grant us access to a Third-Party Social Media Service, We may collect Personal data that is already associated with Your Third-Party Social Media Service’s account, such as Your name, Your email address, Your activities or Your contact list associated with that account.

You may also have the option of sharing additional information with the Company through Your Third-Party Social Media Service’s account. If You choose to provide such information and Personal Data, during registration or otherwise, You are giving the Company permission to use, share, and store it in a manner consistent with this Privacy Policy.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Information regarding Your location, for example to identify nearby lab or visit locations
• Information from Your Device’s phone book (contacts list), for example to help You add an emergency contact
• Pictures and other information from Your Device’s camera and photo library, for example to submit a Study-required photograph
• Access to a paired Wearable Device (such as a Fitbit device), where You have connected one for a Study

We use this information to provide features of Our Service, to improve and customize Our Service, and to support Your participation in a Clinical Trial. The information may be uploaded to the Company’s servers and/or a Service Provider’s server or it may be simply stored on Your device.

You can enable or disable access to this information at any time, through Your Device settings.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.
• Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons that permit the Company to, among other things, count users who have visited those pages or opened an email and for other related statistics.

Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

We use both Session and Persistent Cookies for the purposes set out below:

Necessary / Essential Cookies

Type: Session Cookies.

Administered by: Us.

Purpose: These Cookies are essential to provide You with services available through the Application and to enable You to use some of its features, including authenticating users and preventing fraudulent use of Accounts.

Functionality Cookies

Type: Persistent Cookies

Administered by: Us

Purpose: These Cookies allow us to remember choices You make when You use the Application, such as remembering Your login details or language preference.

Tracking and Performance Cookies

Type: Persistent Cookies

Administered by: Third-Parties

Purpose: These Cookies are used to track information about traffic to the Application and how users use it, and to test new pages, features, or new functionality to see how our users react to them.

Third-Party API Integrations Used by ProCTTH

ProCTTH connects to a small number of trusted third-party platforms to power specific features of the Service. The table below summarizes the integrations currently in use, what they are used for, and what information is shared with them. Each provider processes data in accordance with its own privacy policy and, where applicable, under a data processing agreement or business associate-equivalent agreement with the Company.

Zoho Meeting
Zoho Meeting’s privacy practices are described at: https://www.zoho.com/meeting/privacy-policy.html

Fitbit
Fitbit’s privacy practices are described at: https://www.fitbit.com/global/us/legal/privacy-policy

Zoho Sign
Zoho Sign’s privacy practices are described at: https://www.zoho.com/sign/privacy.html

We may add, change, or remove API integration partners from time to time as the Service evolves. Where a new integration involves a materially different use of Your Personal Data, We will update this Privacy Policy and, where required, seek Your consent.

Health Information and HIPAA Notice

We recognize that Health Data and Study Data are highly sensitive. We apply the following additional protections to this category of information:

• Purpose limitation: Health Data is collected and used solely to conduct the Clinical Trial(s) You have consented to join, to monitor Your safety, and to meet the Company’s and Sponsor’s regulatory obligations. We do not use Health Data for advertising or marketing.
• Access restrictions: Access to Clinical Trial Health Data is limited to authorized Site Team members, Sponsor personnel, and Service Providers who need it to support the Study, and is logged and monitored.
• No sale of Health Data: We do not sell, rent, or trade Your Health Data or Study Data.
• Explicit consent: Clinical Trial Health Data is collected only after You have completed the eConsent process for the applicable Study, and You may withdraw from a Study at any time, subject to the Study protocol’s provisions on data already collected.

HIPAA Notice: The Company is generally not a “covered entity” under the U.S. Health Insurance Portability and Accountability Act (HIPAA); rather, the Company typically acts as a service provider or business associate supporting a Sponsor or clinical trial site. Where a Sponsor or site is a HIPAA-covered entity, the Company enters into a Business Associate Agreement (“BAA”) governing its handling of protected health information on their behalf. Regardless of whether HIPAA applies to a particular Study, We apply industry-standard administrative, technical, and physical safeguards to protect all Health Data processed through ProCTTH.

Where applicable, We also comply with U.S. state consumer health data laws (such as the Washington My Health My Data Act, the Connecticut Data Privacy Act, and the Nevada Consumer Health Data Privacy Law) to the extent they apply to Our processing of Your Health Data.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Study Data, eConsent records, eDiary entries, wearable data, and call/chat records collected in connection with a Clinical Trial are retained for the period required by the Study protocol, the Sponsor’s records retention obligations, and applicable clinical research regulations (which commonly require retention for many years after a Study concludes, for example under FDA or ICH-GCP requirements). We retain this data even after Your Study participation ends, unless and until the Sponsor or applicable law permits its deletion.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data and Health Data, is processed at the Company’s operating offices, at Our Service Providers’ facilities, and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place, including appropriate contractual safeguards such as Standard Contractual Clauses where required, to protect the security of Your data and other personal information.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Sponsors, Sites, and Regulators

As described above, We disclose Your Study Data, Health Data, eConsent records, and related information to the Sponsor and Site Team responsible for the Study You join, and, where required, to regulatory authorities, IRBs/ECs, and auditors overseeing the Study.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, restricting and logging access to Study Data, and requiring Our Service Providers to maintain appropriate safeguards — We cannot guarantee its absolute security.