Introduction and Scope

Altasciences and its affiliates (“Altasciences,” “we,” “us”) are a contract research organization providing clinical and preclinical research, bioanalytical services, and related consulting to pharmaceutical and biotechnology clients. This Notice describes how we Process Personal Information in connection with our websites, our Participant Portal, in-person interactions such as conferences and events, and commercial engagements such as requests for proposal and vendor onboarding.

This Notice does not cover offline internal workforce processes or the study-specific disclosures that govern participants enrolled in a clinical study. The Clinical Study Participants section of this Notice provides relevant context for individuals who express interest in or are enrolled in a clinical study. Your Informed Consent Form, ethics approvals, and applicable law govern your study records.

Where we collect Personal Information through our Online Services, we are acting as the data controller unless the context requires otherwise. Questions about this Notice or your Personal Information may be directed to our Privacy Officer at any time.

Our websites may link to third-party sites and services that Altasciences does not operate. Those parties’ privacy practices govern their sites. We recommend reviewing their notices before providing information.

Personal Information We Collect

The Personal Information we collect depends on how you interact with us. The following describes the categories we collect across our Online Services, events, and commercial engagements.

Information you provide directly

When you complete forms, register accounts, subscribe to communications, attend events, or engage with us commercially, you may provide:

• Contact and identity information: name, email address, telephone number, mailing address, country of residence, and preferred language.
• Professional details: job title, employer or organization name, and business contact information.
• Account credentials: username, password, and profile information for accounts on our Online Services or Participant Portal.
• Marketing and communication preferences: subscription choices, content interests, event registrations, and opt-out records.
• Event participation data: badge scans, session attendance, and lead-capture information at conferences and events that Altasciences hosts or attends.
• Commercial transaction information: information provided in requests for proposal, vendor onboarding forms, contract correspondence, and invoicing contacts.
• Recruitment interest information: contact details and limited eligibility information submitted by individuals who express interest in participating in a clinical study through our websites or Participant Portal. The Clinical Study Participants section below describes study-related processing in detail.
• Correspondence: the content of messages you send us by email, telephone, web form, or other channel, and our related responses.

Information collected automatically

When you use our websites or Participant Portal, we and our service providers automatically collect technical and usage information, including:

• Network and device identifiers: IP address, approximate location derived from IP address, device type and model, operating system, and browser type and version.
• Usage data: pages viewed, links followed, navigation paths, session duration and frequency, and referring website or search terms.
• Interaction and diagnostic data: error logs, load times, feature interactions, and other telemetry used to maintain and improve our services.

We collect this information using cookies, pixels, log files, and similar technologies. The Cookies and Tracking Technologies section below describes these technologies and your choices in detail.

Information received from third parties

Where lawful, we may receive business contact, recruitment, analytics, or security information from event platforms, recruitment and candidate-sourcing services, analytics providers, CRM systems, and other service providers that support our operations. We handle such information in accordance with this Notice.

Children and minors

Our websites and Online Services are not directed to children below the age of consent under applicable law. We do not knowingly collect Personal Information from children online. If we become aware that we have done so, we will delete it as required by law. For Québec, Altasciences supports the parental authorization requirements of Law 25 with respect to minors.

How We Use Personal Information

Altasciences uses Personal Information for the following purposes. We do not use Personal Information for purposes that are incompatible with those for which it was collected without providing additional notice and, where required, obtaining consent.

• Operating and securing our Online Services: Administering accounts, authenticating users, troubleshooting, ensuring availability and performance, and detecting and preventing fraud, abuse, and unauthorized access.
• Responding to inquiries and providing requested services: Answering questions, providing requested content, proposals, or information, and following up on event interactions and commercial engagements.
• Analytics and service improvement: Measuring how our websites and Participant Portal are used, diagnosing performance issues, and improving content, features, and user experience.
• Marketing and communications: Sending informational and promotional communications where applicable law permits and your preferences allow; managing subscription preferences, suppression lists, and opt-out requests.
• Clinical study recruitment: Assessing online expressions of interest in clinical studies, determining basic eligibility, and coordinating with study personnel. Where you proceed to screening or participation, your Informed Consent Form and applicable laws govern further processing of your Personal Information.
• Commercial transactions: Responding to requests for proposal, conducting vendor due diligence and onboarding, administering contracts, and processing payments where Personal Information forms part of business contact or remittance details.
• Legal compliance and enforcement: Meeting recordkeeping, tax, accounting, audit, anti-spam, and data protection obligations; responding to lawful requests from authorities; and enforcing our terms.

We may aggregate or anonymize Personal Information such that it is no longer capable of identifying an individual, in which case it is no longer considered Personal Information and may be used for any purpose to the extent permitted by applicable law.

How We Disclose Personal Information

Altasciences discloses Personal Information to the following categories of recipients in connection with the purposes described in this Notice. We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising. When we engage service providers and contractors, we require them to use Personal Information only to provide services to us under written terms that impose appropriate confidentiality and security obligations.

• Service providers and contractors: Organizations that provide hosting, cloud infrastructure, security, identity and access management, analytics, email and marketing automation, event management, customer relationship management, recruitment tools, and other services that support our operations.
• Corporate affiliates: Other Altasciences entities for internal administrative and business purposes consistent with this Notice.
• Customers and sponsors: Where our services support a contracted engagement, including disclosure of recruitment outputs to sponsors administering a study, subject to the terms of the relevant contract and applicable law.
• Professional advisors: Lawyers, auditors, insurers, and other professional advisors where disclosure is necessary for the relevant professional engagement.
• Regulatory, administrative, and judicial authorities: When we are required to respond to lawful requests, court orders, subpoenas, or other legal process. We verify authority and legal basis and limit disclosures to what the law requires.
• Corporate transactions: In connection with a merger, acquisition, divestiture, reorganization, or other transfer of assets or business, to the extent permitted by applicable law.
• Aggregated or de-identified information: We may disclose aggregated or de-identified information that does not identify any individual for lawful business purposes.

We do not sell your Personal Information. Where the law defines “sharing” as including cross-context behavioral advertising, you may opt out as described in the Your Rights and Choices and Jurisdiction Disclosures sections below.

Cookies and Tracking Technologies

Altasciences uses cookies, pixels, log files, and similar technologies on our websites and Participant Portal to operate and secure those services, to understand how they are used, and to support analytics and marketing. Our Cookie Policy provides a complete description of the technologies we use, the categories of cookies deployed (strictly necessary, functional, analytics, and marketing), the identity and purposes of third-party technologies, and how to manage your choices.

Consent and your choices

Where applicable law requires prior consent, Altasciences sets non-essential cookies only after you have consented through our cookie banner. You can withdraw or update your preferences at any time through Cookie Preferences. We honor valid Global Privacy Control signals as an opt-out of sale and sharing for cross-context behavioral advertising in jurisdictions where the law requires such recognition.

Google Analytics

We use Google Analytics to measure usage of our websites. Google may collect IP address, device and browser information, referring URLs, and page-view data in connection with this service. You can opt out of Google Analytics measurement using the Google Analytics Opt-Out Browser Add-On.

For more information, see Google’s Privacy Policy and its information on how Google uses data with partner sites.

Your Rights and Choices

Depending on where you live, you may have rights under applicable law to access, correct, delete, restrict, object to, or port your Personal Information. Some jurisdictions recognize a right to appeal a determination we make in response to a rights request. The Jurisdiction Disclosures section below provides additional information about rights available to residents of specific jurisdictions.

How to submit a request

To exercise a privacy right, please contact our Privacy Officer by email at privacyofficer@altasciences.com or by calling our toll-free number at 1-866-461-2526. Please describe the right you wish to exercise and provide sufficient information to allow us to locate your records. We will verify your identity before fulfilling any request. If you are using an authorized agent to submit a request on your behalf, we will verify the agent’s authority before proceeding.

Response timelines and limitations

We respond to rights requests within the timelines required by applicable law. We may deny or limit a request where the law permits us to do so, for example, to protect another individual’s privacy, to maintain legal privilege, or to comply with regulatory retention obligations. Where we deny a request in whole or in part, we will explain our reasons and describe any available appeal mechanism.

Marketing preferences

If you no longer wish to receive marketing communications from Altasciences, you may unsubscribe by following the unsubscribe link in any marketing email or by contacting us at privacyofficer@altasciences.com. We maintain suppression lists to ensure your preferences are honored. Opting out of marketing communications does not affect our ability to send you service-related or transactional messages.

Retention of Personal Information

Altasciences operates primarily in Canada and the United States and may process or store Personal Information through service providers in other jurisdictions where Altasciences or its vendors operate. We retain Personal Information for as long as necessary to fulfill the purposes described in this Notice and to meet applicable legal, regulatory, accounting, and audit requirements. When the applicable retention period ends, we delete or anonymize Personal Information using approved methods.

Website, analytics, and marketing records

Generally up to three years from your last interaction with our Online Services, subject to shorter cycles for security logs and other operational data.

Contract and commercial records

For the duration of the relevant commercial relationship and for such additional period as applicable legal, tax, and accounting requirements demand.

Study-related records

Altasciences retains study-related Personal Information for the periods required by applicable law and the study contract. Regulatory anchors include Health Canada’s requirements under the Food and Drugs Act, FDA requirements for investigational records, and Good Clinical Practice obligations. The study contract may specify a retention period that extends beyond the regulatory minimum. Altasciences informs study participants of the applicable retention period at the time of collection and through the Informed Consent Form.

Where deletion is not immediately possible, for example, because of statutory or regulatory retention requirements, GxP obligations, contractual constraints, accounting or tax rules, or an active legal hold, Altasciences retains the minimum necessary information, restricts access, and proceeds with deletion or anonymization once the applicable constraint ends. Backup copies expire on their normal rotation cycles. Altasciences does not restore backups solely to delete specific records unless required by law.

Security

Altasciences implements technical and organizational measures to protect Personal Information against loss, unauthorized access, disclosure, alteration, and destruction. Our security program is aligned to ISO 27001 and the NIST Cybersecurity Framework and includes role-based access controls, multi-factor authentication for privileged and remote access, encryption in transit and at rest where appropriate, security monitoring and logging, vulnerability and patch management, and secure development practices. We require service providers and contractors to maintain safeguards appropriate to the nature and sensitivity of the Personal Information they process on our behalf.

Altasciences maintains incident response processes to detect, contain, and remediate security incidents. If a security incident requires notification to you or to regulatory authorities under applicable law, Altasciences will provide that notification within the required timeframes.

Clinical Study Participants

Altasciences processes Personal Information in connection with the clinical studies it conducts on behalf of pharmaceutical and biotechnology sponsors. The following describes how we process Personal Information for individuals who express interest in participating in a study through our Online Services or Participant Portal, as well as for individuals who proceed to screening and participation.

Recruitment and pre-screening

When you express interest in a clinical study through our websites or Participant Portal, Altasciences collects your contact details, communication preferences, and limited eligibility information to evaluate your interest, assess basic eligibility, and present suitable study opportunities. We use this information to contact you, schedule next steps, and coordinate with study personnel. We disclose this information to service providers that support our recruitment tools and, where required by the study protocol, to the sponsor or their designated parties. Where pre-screening information is collected in connection with general recruitment and is not tied to a specific study protocol, Altasciences treats that information as recruitment data subject to the retention and rights provisions applicable to that category.

Screening and study participation

If you proceed to screening or participation in a study, Altasciences collects a broader range of Personal Information as required by the study protocol and applicable law. This includes:

• Identification and contact details: including demographic information required to verify eligibility and administer the study.
• Screening and eligibility information: clinical and health information required to determine whether you meet the study’s inclusion and exclusion criteria.
• Sensitive Personal Information: the information we collect for determining eligibility for a study and as a participant in a study will vary depending on the nature of the study but will typically include Sensitive Personal Information such as medical history, physical and mental health information, biological samples and associated data, genetic information, and other health-related information (constituting special categories of personal data under the GDPR and Personal Health Information under applicable Canadian law).
• Protocol-required observations and measurements: clinical observations, laboratory and imaging results, device or sensor outputs, and safety data generated during study visits and procedures.

Altasciences processes study Personal Information to verify eligibility, conduct study procedures, monitor and report safety, support quality assurance, audits, and regulatory inspections, and to meet its legal and contractual obligations as a contract research organization. Altasciences does not use Participant Personal Information for purposes unrelated to the study without your consent.

Disclosure of study Personal Information

By default, Altasciences discloses study Personal Information to the Sponsor and Sponsor-designated parties in coded or de-identified form. Identifiable Personal Information is accessed only for audits, monitoring, quality assurance, inspections, or where law or the study protocol requires identifiable access, and such access is limited, supervised, and logged. Altasciences discloses study Personal Information to study investigators, sites, laboratories, and imaging centers as required to perform study procedures, and to ethics committees (IRB/REB) and regulatory authorities as required by law or the study protocol. All disclosures of study data to service providers and subprocessors are governed by written agreements that impose appropriate restrictions and safeguards.

Consent and informed consent

Altasciences obtains initial consent at the recruitment stage for the collection of limited contact and eligibility information. Before any study-related processing begins, Altasciences presents you with a study-specific Informed Consent Form (ICF) issued on behalf of the sponsor. The ICF is developed through a documented process that includes sponsor input, IRB or REB review and approval, and Privacy Officer review. The ICF describes the purposes for which your Personal Information will be processed, the recipients of that information, your available rights, and the applicable retention period.

Retention of study records

Study records are retained for the periods required by applicable law and the study contract, as described under Study-related records in the Retention of Personal Information section above. If you withdraw from a study, previously collected Personal Information is retained as required by regulation and the ICF. Regulatory requirements may prevent deletion of data collected prior to withdrawal.

Rights requests relating to study records

Rights requests relating to study records are processed in accordance with applicable law and, where Altasciences acts as processor for a sponsor, in coordination with the sponsor where required by the applicable contract. We will explain any limitation on your rights that arises from regulatory retention obligations or contractual constraints at the time we respond to your request.

Jurisdiction Disclosures

Altasciences’ operations span Canada, the United States, and other jurisdictions. The following supplements this Notice for residents of specific jurisdictions. In the event of a conflict between this section and the general provisions of this Notice, the more specific or protective provision applies.

United States: California

California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), including the rights to know, correct, delete, and limit the use of Sensitive Personal Information, and to opt out of the sale or sharing of Personal Information. Altasciences does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising. Please see the California Privacy Notice for more information.

Altasciences does not currently use automated decision-making technology to make a significant decision about California residents interacting with our Online Services or Participant Portal. Beginning January 1, 2027, if this changes, Altasciences will provide notice before that use, an opt-out or appeal mechanism where the law provides one, and access to the logic involved, as required by the CCPA’s automated decision-making technology regulations.

To exercise any CCPA/CPRA right, or to submit a Shine the Light request (a list of third parties to whom we disclosed your Personal Information for their own direct marketing purposes in the preceding year, if any), please email privacyofficer@altasciences.com with the subject line “California Privacy Request” or “California Shine the Light,” or call 1-866-461-2526.

Canada and Québec

Altasciences applies the principles of accountability, identifying purposes, consent, limiting collection and use, accuracy, safeguarding, openness, individual access, and challenging compliance in respect of processing subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Altasciences provides breach notification to regulatory authorities and affected individuals where a breach creates a real risk of significant harm and honors opt-out obligations for commercial electronic messages under Canada’s Anti-Spam Legislation (CASL).

For Québec residents: Altasciences designates a person in charge of personal information (the Privacy Officer) and maintains a confidentiality incident register. Before communicating Personal Information outside Québec, Altasciences conducts a Privacy Impact Assessment and implements contractual and technical safeguards to ensure equivalent protection. Information about the principal locations where your Personal Information may be accessible or stored outside Québec is available on request by contacting privacyofficer@altasciences.com.

Altasciences does not use automated decision-making that produces decisions based exclusively on automated processing with respect to individuals interacting with our Online Services or Participant Portal. If this practice changes, Altasciences will provide the transparency required by Law 25, including the information used, the principal factors and parameters that led to the decision, and your right to request human review.

Québec residents may direct complaints to the Commission d’accès à l’information (CAI) at https://www.cai.gouv.qc.ca.

European Union, EEA, and United Kingdom

When Altasciences acts as a controller for Personal Information collected through our Online Services or during in-person interactions, we rely on the following lawful bases under the GDPR and UK GDPR:

• Legitimate interests: to operate and secure the Online Services, to measure and improve performance, to respond to inquiries, and to manage business and event contacts, where our interests are not overridden by your rights and interests. You may object to processing on this basis by contacting us as described in the Your Rights and Choices section.
• Consent: for non-essential cookies and for direct marketing where applicable law requires consent. You may withdraw consent at any time through Cookie Preferences or by contacting us.
• Performance of a contract: to set up and administer your online account and to respond to or perform commercial transactions you request.
• Legal obligation: to comply with applicable laws including recordkeeping, tax, anti-spam, and data protection requirements.

EU and UK residents have the rights described in the Your Rights and Choices section, including the right to lodge a complaint with your local data protection supervisory authority. For restricted transfers of Personal Information from the EU or UK to other countries, we use recognized transfer tools, including the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Agreement or Addendum, or rely on adequacy decisions where available. Where required under GDPR Article 27, Altasciences appoints EU and UK representatives whose contact details are available on request.

Altasciences does not engage in solely automated decision-making, including profiling, that produces legal or similarly significant effects on individuals through our Online Services or Participant Portal. If this changes, we will provide the disclosures required by GDPR Article 13(2)(f), including a description of the logic involved and the significance and foreseeable consequences of such processing.

Cross-Border Transfers

Altasciences operates primarily in Canada and the United States and may transfer Personal Information to service providers and affiliates located in other countries. Where such transfers are subject to legal restrictions, Altasciences uses recognized transfer mechanisms, performs required assessments, and implements supplementary safeguards to ensure an essentially equivalent level of protection. For Québec, Altasciences performs cross-border assessments and implements safeguards that ensure equivalent protection before communicating Personal Information outside Québec.

Changes to This Notice

Altasciences may update this Notice from time to time to reflect changes in our practices, applicable law, or the services we provide. When we update this Notice, we will post the revised version on our website with an updated effective date. Where a material change affects your rights or the way we process your Personal Information, we will provide additional notice as required by applicable law.

Contact Us

For privacy questions, rights requests, complaints, or accessibility needs relating to this Notice, please contact our Privacy Officer:

Email: privacyofficer@altasciences.com
Toll-free: 1-866-461-2526

Québec Commission d’accès à l’information (CAI)

This Notice is available in accessible formats on request. Email privacyofficer@altasciences.com.