Last updated: November 13, 2019

Introduction

Bioxcel Therapeutics, Inc. (“we”, “our”, “us”) are committed to protecting and respecting your privacy. We are located in the United States with a registered office at 555 Long Wharf Drive, 12th Floor, New Haven, CT 06511.

If you are located in the United Kingdom (UK) or the European Economic Area (EEA), we are the data controller for the purpose of the General Data Protection Regulation (GDPR). Please contact Dr. Cedric Burg via email at cburg@bioxceltherapeutics.com for the purposes of the GDPR.

This policy sets out how we will process any personal information we collect from you, or that you provide to us, in connection with your participation in our clinical research studies (Study) and/or your use of our website at bioxceltherapeutics.com or your use of other means to contact us (Website). Please read this Privacy Policy carefully so that you understand your rights in relation to your personal information, and how we will collect, use and process your personal information.

What information do we collect and how do we use it?

- Study information

We will process the following information relating to you provided by you, your GP, your medical records, your Study doctor, your Study site for our Study:

  • Initials
  • Date of birth;
  • Gender and Sex;
  • NHS/ patient number;
  • Contact details;
  • Ethnicity;
  • Race;
  • Blood, tissue samples, and biological specimens including urine; and
  • Health history including the history of your disease.

The Study site, Study doctor and his/her team will have access to your contact details and will use these only where required to contact you in connection with the Study.

This information will be used only for the purposes of our Study, including to:

  • check your medical records and to make sure that our Study is being conducted properly for reliability and safety purposes and to ensure that the necessary information about your participation in our the Study is recorded for your care, and as it is necessary for our compliance with legal obligations and necessary for reasons of public interest in the area of public health; and
  • enable the performance of our Study and analyze your information for research purposes, as it is in our legitimate interests to perform our Study and to develop new drug products, and in each case such actions are necessary for reasons of public interest in the area of public health and/or in scientific research purposes or statistical purposes.

We will keep all information about you safe and secure. We have controls in place to limit who can access information about you and what they can see, to ensure that the minimum of data is processed for each purpose. People who do not need to know who you are will not be able to see your name or contact details. Your data will be identified by a number instead.

The Study doctor, Study staff, the institutional review board and their staff, legal counsel, research office and compliance staff, and officers of the organization who need to see your Study information (listed above) in order to conduct the Study or make sure it is being done properly will have access to your medical records.

A subset of data will be taken from your medical records and copied into a “Study record”, which will identify you only by your patient identifier and include only information relevant to the conduct of the Study.

We will keep some of your information in anonymised and aggregate form in connection with scientific research and will report your information in anonymised and aggregated form in connection with scientific reports and publications. You can stop being part of the Study at any time, without giving a reason, but we will keep information about you that we already have in accordance with the Section below “How long do we keep your personal information?”. Please note that we will still have certain legal and regulatory obligations to retain and process your personal information in certain circumstances.

If you choose to stop taking part in the Study, we would like to continue collecting information about your health from your Study doctor If you do not want this to happen, please tell us and we will not collect any further information about you.

- Website and related information

You may provide information by contacting us via our Website or email, telephone, and social media, including where you submit our “Contact Us” form and/or by signing up for our newsletters or alerts.

As it is in our legitimate interests to be responsive to you, respond to your queries and/or feedback and to ensure the proper functioning of our organisation, we will use your information to:

  • communicate with you;
  • sign you up for our newsletters or alerts; and
  • contact you via telephone or email.

- Information provided by organizations.

Where you are an employee or contractor with an organization engaged in providing us with goods and services, during the course of your organization’s relationship with us, and in the context of your organization providing us with those goods and services, we collect personal data such as your name, job title, organisation, and business postal address and other contact information.

Through your in-person and written communications and/or online interactions with us, we will ask you to provide information regarding your contact preferences. We will combine the information you provide to us through different communications and contact channels, such as combining data collected online with information provided offline.

As it is in our legitimate interests to be responsive to you and to ensure the proper functioning of our organisation and products, we will use information:

  • to manage our relationship with your organisation and receive goods and services from your organisation;
  • to conduct research and development, provide quality assurance and product validation;
  • to comply with our regulatory requirements for compliance purposes; and
  • to improve our technology.

- Technical usage information

When you visit our Website, we automatically collect the information sent to us by your computer, mobile phone, or other access device. This information includes:

  • your IP address;
  • device information including, but not limited to, identifier, name, and type of operating system;
  • mobile network information; and
  • standard web information, such as your browser type and the pages you access on our Website.

It is in our legitimate interests to process this information to provide an effective Website and useful content to you, as well as to:

  • personalise our Website to ensure content from the Website is presented in the most effective manner for you and your device;
  • monitor and analyze trends, usage and activity in connection with our Website to improve the Website;
  • administer the Website, and for internal operations, in order to conduct troubleshooting, data analysis, testing, research, statistical and survey analysis; and
  • keep the Website safe and secure.

Cookies

We use cookies to collect information about your browsing activities over time and across different websites following your use of our Website. They allow us to recognise and count the number of users, to see how users move around the Website when they are using it and assess our internal performance and functionality needs. This helps us to improve the services we provide to you and the way the Website works. You can find more information about cookies and how to manage them at http://www.allaboutcookies.org/.

In addition to cookies that are “strictly necessary” for the operation of our Website, we use the following cookies:

Functionality cookies: these cookies record information about choices you've made and allow us to tailor our Website to you. These cookies mean that when you continue to use or come back to our Website, we can provide you with our services as you have asked for them to be provided.

These cookies allow us to:

  • Save your location preference if you have set your location on your homepage;
  • Remember settings you have applied, such as layout, text size, preferences, and colors;
  • Show you when you are logged in; and
  • Store accessibility options.

Performance cookies: these cookies help us analyze how our Website is accessed, used, or is performing in order to provide you with a better user experience and to maintain, operate and continually improve our Website.

These cookies allow us to:

  • Better understand our Website visitors so that we can improve how we present our content;
  • Test different design ideas for pages, such as our homepage;
  • Collect information about visitors of our Website such as where they are located and what browsers they are using;
  • Determine the number of unique users of our Website;
  • Improve our Website by measuring any errors that occur; and
  • Conduct research and diagnostics to improve product offerings.

You may opt-out of functionality cookies and performance cookies at any time by [e.g. clicking the “Manage Cookies” link at the bottom of the page. You can then adjust the available sliders to “On’ or ‘Off”, then clicking “close”].

Alternatively, you can change your preferences by changing the settings in your browser. Most browsers will allow you to choose the level of privacy settings you want. This lets you control your cookie settings so that you can:

  • See what cookies or other locally stored data you’ve got and delete them on an individual basis;
  • Block third party cookies or similar technology;
  • Block cookies or similar technology from websites;
  • Block all cookies or similar technologies from being set; or
  • Delete all cookies or similar technologies when you close your browser.

For more information on how to manage the most popular browsers, please see below:

Internet Explorer

https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

Firefox

https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer?

Google Chrome

https://support.google.com/chrome/answer/95647?hl=en

Safari

https://support.apple.com/en-gb/guide/safari/sfri11471/mac

How do we share your personal information?

- Study information

Information from your Study records, or your Study records themselves, will only be shared with:

  • The Study doctor and his/her team;
  • Our subcontractors;
  • The European Medicines Agency and the United States Food and Drug Administration (“FDA”) or other countries’ governmental health agencies (e.g. as part of their review of the materials supporting an application for a marketing authorisation for a new drug or in the event that adverse events need to be reported);
  • Institutional Review Boards/Ethics committees (e.g., as part of a review of the conduct of the Study); and
  • Our affiliates, licensees and collaboration partners in connection with the development of new drug products.

We will also disclose information from your Study records and aggregated and anonymised information about you relating to the study to third parties:

  • in the event that we sell any business or assets, in which case we will disclose information from your Study records or your Study records themselves to the prospective buyer of such business or assets under conditions of confidentiality; or
  • if we or substantially all of our assets are acquired by a third party, in which case information held by us will be one of the transferred assets.

We will also share aggregated and anonymised information about you relating to the Study with researchers and institutions, as well as in publications and reports, in connection with the conduct of scientific research.

- Website and related information

We share your information with the following categories of recipients:

  • cloud storage provides; and
  • IT Services providers.

We will share your information with law enforcement agencies, public authorities or other organisations if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

  • comply with a legal obligation, process or request;
  • enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
  • detect, prevent or otherwise address security, fraud or technical issues; or
  • protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law.

We will also disclose your information to third parties:

  • in the event that we sell any business or assets, in which case we will disclose your information to the prospective buyer of such business or assets; or
  • if we or substantially all of our assets are acquired by a third party, in which case information held by us will be one of the transferred assets.

Where will we store and transfer your information?

If you are located in the UK and in the EEA, your information will be accessed by us in the United States and by our affiliates, licensees and collaboration partners which are based outside of the UK and the EEA and by other third-parties located outside the EEA.

All transfers of personal information outside the UK and EEA are subject to adequate safeguards, including in the form of the European Commission’s Standard Contractual Clauses (or “Model Clauses”).

We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this policy.

The security of your information

We take appropriate technical and organisational measures to safeguard your personal information against loss, theft and unauthorised use, access or modification.

Unfortunately, the transmission of information via the internet or email is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted through the Website or over email; any transmission is at your own risk.

We will, from time to time, host links to and from the websites of our affiliates or third parties. If you follow a link to any of these websites, these websites will have their own privacy policies and we do not accept any responsibility or liability for these policies. Please check these policies before you submit any information to those websites.

How long do we keep your information?

We will process and retain your information relating to the Study for as long as is required to enable us to comply with our legal and regulatory obligations and to enable the development and commercialisation of our products, including in particular the analysis of the safety and efficacy of our products and in connection with scientific research and in publications and presentations via scientific and medical journals and conferences but in any event for no longer than 10 years.

We will retain all other information as follows:

  • if you contact us via email or our “Contact Us” form we will keep your data three (3) years;
  • your technical usage information three (3) years; and
  • data on your use of our products, services and our Website for three (3) years.

When we have no ongoing legitimate business need or obligation to process your personal information, we will either delete or anonymise it, or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights

If you are located in the UK or in the EEA, you have the right to ask us for a copy of your personal information, and in certain circumstances, to correct, delete or restrict (stop any active) processing of your personal information. These rights may be limited, for example if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law to retain or have compelling legitimate interests in retaining.

In addition, you can object to our processing of your personal information based on our legitimate interests and we will no longer process your personal data unless we can demonstrate an overriding legitimate ground.

To exercise any of these rights, please contact our Head of Compliance mcarroll@bioxceltherapeutics.com. In addition, you have the right to complain to your applicable data protection supervisory authority which in the UK is the Information Commissioner’s Office (ICO).

Changes

Any changes we will make to this policy in the future will be posted on this page. Please check back frequently to see any updates or changes to this policy.

Contact

Questions, comments and requests regarding this policy are welcomed and should be addressed to mcarroll@bioxceltherapeutics.com.

If you are a participant in our Study, you can find out more about how we use your information: