How we protect your privacy.

Overview

Valis Biosciences Inc. Company having its primary address at 185 Great Neck Road, Suite 424, Great Neck, New York 11021 (“we”) is committed to protecting and preserving your privacy. Valis Biosciences Inc. develops and operates technology solutions supporting regulated clinical research and other healthcare-related services. We are committed to processing personal information in accordance with applicable privacy laws, contractual obligations, and recognized Good Clinical Practice (GCP) principles, where applicable. This Privacy Notice provides information about how we process any personal data we collect from you, that you provide to us, or that we obtain about you in connection with your use of our mobile application (“Apps”), website, or Website Portal (“Web Portal”). As used herein the term “Services” means the functionalities of our Web Portal and Apps.

If you use Valis’ website, Web Portal, or Apps, your personal information will be processed in accordance with this Privacy Policy and applicable privacy laws. Where required by applicable law, we will obtain your consent before processing personal information. We do update this Privacy Policy from time to time so please review this Privacy Policy regularly. If we materially alter our Privacy Policy, we will notify you of such changes by contacting you through your user account e-mail address or by posting a notice on our Site. Your continued use of the Site or Application will be deemed your agreement that your information may be used in accordance with the new policy. If you do not agree with the changes, then you should stop using the Site or Applications and you should notify us that you do not want your information used in accordance with the changes.

Certain features of the Web Portal or Apps have been developed for clinical trial Sponsors, and for clinical trial Study Participants who are using the Application under the direction of licensed health care professionals, in order to facilitate and coordinate Study Participant visit sessions in connection with those clinical trials. We have agreed to provide our electronic data and video capture services to Sponsors of clinical trials and to provide you a statement concerning your privacy rights on behalf of such Sponsors, who retain at all times control over the use of your data in the course of such clinical trials (“Covered Clinical Trials”).

1. Data Processing on Behalf of Sponsors of Clinical Trials

In the context of providing our Services, we are collecting and processing personal data on behalf of individual clinical trial Sponsors. Where such processing activities are subject to the EU General Data Protection Regulation (“EU GDPR”), the United Kingdom General Data Protection Regulation, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), or other applicable privacy or data protection laws, Valis may act as a data processor, service provider, or similar regulated role, as defined under applicable law, pursuant to a Data Processing Agreement (“DPA”) or other legally required contractual mechanism, where applicable.

• a) Individuals enrolled in a Covered Clinical Trial,
• b) persons working with a clinical trial site and need access to our system.

In all those instances, the clinical trial Sponsors determine the means and purposes of such processing activities, including, which Study Participants will use a Web Portal or App, the principal Application functions, the personal data it will collect, how that data will be used and by whom such data is accessed, and how long the data will be retained. The Sponsor (or other applicable customer, healthcare organization, or research organization) generally acts as the data controller, business, or equivalent regulated entity under applicable law and determines the purposes and means of processing Personal Information. Valis processes Personal Information only in accordance with applicable contractual obligations, Sponsor instructions, applicable law, and documented regulatory requirements. The Privacy Notices applicable to the processing of your data in connection with such Covered Clinical Trials can be found in the clinical trial material provided to you, including the Informed Consent Form reviewed in accordance with your entry into the clinical trial.

Where applicable, Valis processes personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), UK data privacy regulations, and other applicable privacy legislation. Depending on the circumstances, processing may be based upon contractual necessity, legal obligations, legitimate interests, public interest in scientific research, consent where required, or other lawful bases permitted under applicable law.

Where Valis processes Protected Health Information (“PHI”) on behalf of Covered Entities or Business Associates, such processing will be performed in accordance with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), applicable implementing regulations, contractual obligations, and other applicable healthcare privacy laws.

2. Processing of Personal Data for Purposes of Improvement of our Application and Meeting our Compliance Obligations

In the context of your enrollment with a Covered Clinical Trial, or if you use our system outside the context of a clinical trial, we will process certain of your personal data for purposes that may go beyond the immediate requirements of a Covered Clinical Trial. Where processing activities are subject to applicable privacy laws, including the EU GDPR, UK data privacy regulations, Swiss FADP, or other applicable national or regional privacy legislation, such processing will be conducted in accordance with the lawful bases, safeguards, and individual rights required by those laws. Such processing activities may also support quality management, regulatory compliance, system security, fraud prevention, and other legitimate operational purposes consistent with applicable law and Sponsor agreements.

3. Use of Data of Users not Subject to GDPR, General Privacy Practices

In all cases not covered by the Special Privacy Notices described in Sections 1 and 2 above the following privacy practices shall be applicable e.g., if you visit our website, or if you are a Study Participant using our Services, a Provider, or Authorized Personnel, as such terms are defined below.

We will use and disclose a Study Participant’s health information only to provide the Services to the Study Participant or the Provider, for those uses and disclosures permitted by applicable law and the agreement with the applicable Sponsor, Provider, or customer organization and for any other purpose to which you specifically consent. Where Valis acts solely as a processor or service Provider on behalf of a Sponsor or healthcare organization, requests regarding the exercise of applicable privacy rights may be referred to the appropriate data controller. In the event that there is a conflict or inconsistency about the handling of health information between (i) this Privacy Policy and (ii) our compliance obligations with applicable law and contractual commitments with Providers, then the latter will govern.

Our services have been developed for the Sponsors of clinical trials and population health studies, and potentially healthcare organizations, hospitals, medical groups, research institutions, or other organizations receiving the Services (“Providers”) and for Study Participants who are using the Site and/or Applications under the direction of a Provider to facilitate and coordinate Study Participant study visit sessions or treatment sessions. Providers and personnel who are authorized to access and use the Site and Applications with respect to a Study Participant’s information, including, without limitation, administrators, clinicians, physicians, nurses, and other caregivers are described here as Authorized Personnel.

Where our Services are provided through third parties, we may not obtain your personal information directly through the sale or registration of our Applications. You should review and understand any additional privacy policy provided by the third party before you purchase or use our Web Portal or Apps through them.

4. Website and Applications Privacy Notice

Please read this Policy carefully to fully understand how we collect, share, and protect information about you. This Privacy Policy is incorporated into and is a part of the Terms of Use.

By accessing and using the Web Portal or Apps, you agree that you have read and understand this Privacy Policy and that you accept and consent to the privacy practices and uses or disclosures of information about you that are described herein.

In order to deliver personalized and relevant information to you through our Web Portal and our Apps, we collect certain information from users.

4.1 Information We Collect

As you navigate through, interact with and/or use our website (valisbiosciences.com) or the Web Portal or App used in clinical trials, or provide posted information or user comments, we may use automatic data collection technologies to collect certain information about you, regardless of whether you have an account, with us. The information we may collect in this manner includes your equipment, browsing actions, and patterns, including:

• Details of your visits to, access to or use of the website (valisbiosciences.com), Web Portal or the App, including traffic data, location data, logs, and other communication data and the resources that you access and use on the website (valisbiosciences.com), Web Portal or the App;
• Information about your computer and internet connection, including your IP address, operating system, and browser type;
• Information about your mobile device; and/or
• Device identifiers, authentication information, application version information, operating system information, audit log information, and system usage information necessary to maintain system security, integrity, and regulatory compliance.

If you are an Authorized Personnel user, we collect personal information about you when the Provider subscribes to the Services as well as when you register to use the Services. The Personal Information about Providers and Authorized Personnel that we collect includes, without limitation, the Provider’s and Authorized Personnel’s name, position, specialty, email address, phone number, and business postal address. We do not collect health information about Providers or their Authorized Personnel.

If you are a Study Participant of a clinical trial, we collect Personal Information about you when you register to use the Services as well as: Details of your use of our Web Portal and Apps, the date and time you use our site or application to confirm study visits and study assessments or other actions you perform while interacting. Some parts of our Site may use cookies and other technologies to collect this information about your general internet usage. See section below “How We Use Cookies” to learn more.

Your International Mobile Equipment Identity (IMEI) associated with your mobile device, and video images, audio recordings, and other electronic records generated during use of the Services. This data is initially collected in a non-anonymized, non-pseudonymized format. The data is stored in an encrypted format, both when in motion and at rest.

Certain information collected through the Services, including facial images, voice recordings, or similar information, may constitute biometric information under certain applicable laws. Valis processes such information solely for authorized clinical research, identity verification, quality assurance, fraud prevention, duplicate Study Participant detection where authorized, system integrity, or other purposes permitted by applicable law, Sponsor agreements, and Study Participant authorization.

Information that you provide directly to us by filling in forms on our Web Portal or Apps (for example, to contact us, you must provide your name and e-mail address on the site, or a mobile phone number in the application).

Health information that you provide directly to us, including but not limited to your sensitive health care information which may include, but is not limited to, HIV/AIDS information, sexually transmitted disease information, genetic testing information, assessment or test performance information, mental/behavioral health information, and alcohol and/or drug treatment information. This information may be submitted in text form, recorded video, or photos.

Information provided to us when you communicate with us for any reason.

4.2 How We Use Cookies

A “cookie” is a piece of text, which asks permission to be placed on your computer’s hard drive. Once you agree, this cookie file is stored on the hard drive of your computer. They help us and our affiliates to improve our Site and Applications. They ensure that the content from our website (valisbiosciences.com) is presented in the most effective manner for you and your computer.

All computers have the ability to decline cookies. This can be done by activating the setting on your browser, which enables you to decline the cookies. Please note that should you choose to decline cookies, you may be unable to access parts of our website (valisbiosciences.com).

We do not track our users across time or across websites, and we do not use cookies and similar technologies (including local storage technologies where applicable) on our Web Portal or Apps.

4.3 Use of Your Information

The information that we collect and store relating to you is primarily used to enable us to provide our services to you in the best possible manner. In addition, we may use the information for the following purposes:

• to provide our Services to you, to communicate with you about your use of our Services, to respond to your inquiries, and for other customer service purposes.
• for the purpose of improving, validating, monitoring, and maintaining the functionality, security, quality, performance, usability, and reliability of our Services, including quality assurance, security monitoring, fraud prevention, system improvement, and development of analytical technologies where permitted by applicable law and study documentation.
• to tailor the content and information that we may send you, to offer personalized help and instructions, and to otherwise personalize your experiences while using the Site and Applications.
• to better understand how users’ access and use our Site and Applications, both on an aggregated and individualized basis, in order to improve our Services and respond to user desires and preferences, and for other research and analytical purposes.
• to send you important information regarding the Services, changes to our terms, conditions, and policies and/or other administrative information.
• for our business purposes, such as data collection and analysis, audits, regulatory compliance, quality management, vendor oversight, and service improvement.
• as we believe to be necessary or appropriate: (a) under applicable law, including laws outside your state or country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities including public and government authorities outside your state or country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of our affiliates; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

4.4 Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is protected using administrative, physical, and technical safeguards appropriate to the nature of the information processed. Nonetheless, the transmission of information via the internet is not completely secure and therefore we cannot guarantee the security of data sent to us electronically on our Web Portal or Apps, and transmission of such data is therefore entirely at your own risk.

Security controls may include encryption of data in transit and at rest, role-based access controls, authentication mechanisms, audit logging, routine security monitoring, vulnerability management, disaster recovery planning, and other administrative, physical, and technical safeguards appropriate to the nature of the information processed.

The safety and security of your information also depend on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Web Portal of Apps, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the website, Web Portal or App within any collaborative features made available through the Serivces. You should take steps to protect against unauthorized access to your password, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.

Valis maintains incident response procedures designed to identify, investigate, document, and respond to actual or suspected security incidents or personal data breaches in accordance with applicable legal, regulatory, and contractual requirements.

The information you share in public areas may be viewed by any user of the website, Web Portal, or App. Even information which is shared privately on the website, Web Portal, or Apps may be recorded, copied (i.e. using a screen shot or other means) and saved by the User(s) with whom it was shared. We do not have control over such recording, copying, or saving by other Users and we disclaim all liability related to any information which has been recorded, copied, or saved by another User.

4.5 Disclosing Your Information

Where applicable, we may disclose your personal information to any affiliated business entities or third parties necessary to provide products and services to you. This includes, where applicable, our subsidiaries, our holding company, and its other subsidiaries (if any), as well as third parties involved in the administration and operation of our products and services, including, but not limited to our cloud hosting Providers, infrastructure Providers, software vendors, analytics Providers, regulatory consultants, auditors, professional advisors, and other vendors supporting operation of the Services, subject to appropriate confidentiality and data protection obligations.

We may disclose your Personal Information, including Health Information (defined below) as follows:

• if you are a clinical Study Participant, to your Provider and its Authorized Personnel, Sponsor, Contract Research Organization (CRO), or other authorized parties, as applicable, for purposes authorized by the applicable study protocol, informed consent documentation, contractual agreements, applicable law, healthcare operations where applicable, or other uses and disclosures permitted by law.
• to our third-party service Providers who provide services such as website hosting, data gathering, data analysis, customer service, email delivery services, auditing services and other similar services.
• to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
• as we believe to be necessary or appropriate: (a) under applicable law, including laws outside your state or country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities including public and government authorities outside your state or country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of our affiliates; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
• to third parties for research or similar purposes, but only if such Personal Information has been de-identified.

Where Personal Information is transferred across international borders, Valis will implement administrative, technical, organizational, and contractual safeguards appropriate to the applicable jurisdiction. Depending on the country from which Personal Information originates, these safeguards may include adequacy decisions, the European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), the UK International Data Transfer Addendum to the SCCs, contractual safeguards recognized under the Swiss Federal Act on Data Protection (FADP), the EU-U.S. Data Privacy Framework (where applicable), approved governmental certifications, data processing agreements, security assessments, participant authorizations, data localization measures, or other legally recognized transfer mechanisms required by applicable law.

Valis does not sell personal information or share personal information for cross-context behavioral advertising except as permitted or disclosed under applicable law. Nothing in this Privacy Policy expands, modifies, or limits the rights and obligations established by applicable clinical trial agreements, informed consent documentation, or applicable law.

4.5A International Data Transfers

Valis provides technology services to Sponsors, healthcare organizations, research institutions, and customers located in multiple jurisdictions. Personal Information may therefore be transferred to, stored, or processed in countries other than the country in which it was originally collected. Where required by applicable law, Valis implements appropriate safeguards designed to protect Personal Information during international transfers and to maintain a level of protection substantially equivalent to that required under applicable law.

Where Personal Information originates from jurisdictions such as Canada, Australia, Japan, Singapore, South Korea, China, or other countries with applicable cross-border data transfer requirements, Valis will implement the safeguards required by the applicable laws of those jurisdictions.

4.6 Third Party Website and Interaction

Third parties who distribute our website (valisbiosciences.com) may also use cookies, over which we have no control. Such cookies (if used) would be downloaded once you click links from our website or purchase and/or use our Web Portal and Apps through other third-party interfaces. We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible Provider directly.

By accessing other third-party websites or applications through our website, Web Portal or App, you are consenting to the terms and privacy policies of those websites. We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

4.7 Users Only of Legal Age of Majority

Our Site and Applications are designed and intended for those who have reached the age of majority (18 years of age). By using our Site or Applications, you affirm that you are at least 18 years of age or older. We are not liable for any damages that may result from a user’s misrepresentation of age. Parents or legal guardians of children over 13 but under 18 years of age can agree to this Privacy Policy on their behalf.

No one under age 13 is authorized to submit or post any information, including personally identifying information, on our Site. Under no circumstances may anyone under age 13 use our Site. Parents or legal guardians of children under 13 cannot agree to this Privacy Policy on their behalf or use of our site.

4.8 Access to My Personal Information

You may modify Personal Information that you have submitted by logging into your account and updating your profile information. Please note that copies of information that you have updated, modified, or deleted may remain viewable in cached and archived pages of the Web Portal or App for a period of time.

You may also contact us directly if you would like to review, correct, update, delete, restrict processing, object to certain processing activities, request data portability where applicable, withdraw consent where consent is the legal basis for processing, or exercise other rights including rights available under the EU GDPR, UK data privacy regulations, Swiss FADP, applicable U.S. state privacy laws, or other applicable privacy legislation. In your request, please make clear what information you would like to have changed, whether you would like to have your Personal Information deleted from our database or otherwise let us know what limitations you would like to put on our use of your Personal Information. We will try to comply with your request as soon as reasonably practicable. Please note that in order to comply with certain requests to limit use of your Personal Information we may need to terminate your account with us and your ability to access and use the Services, and you agree that we will not be liable to you for such termination. Although we will use reasonable efforts to do so, you understand that it may not be technologically possible to remove from our systems every record of your Personal Information. The need to back up our systems to protect information from inadvertent loss means a copy of your Personal Information may exist in a non-erasable form that will be difficult or impossible for us to locate or remove.

4.9 Data Retention on Web Portal or Apps that Collect Clinical Trial Data

We will retain Personal Information only for as long as necessary to fulfill the purposes described in this Privacy Policy, applicable contractual obligations, regulatory requirements, Sponsor instructions, litigation hold obligations, records retention schedules, and applicable law. Clinical trial records may be retained for extended periods where required by applicable regulations, Good Clinical Practice, Sponsor requirements, or regulatory authorities, or to establish, exercise, or defend legal claims.

Where permitted by applicable law, Sponsor agreement, protocol, and Study Participant authorization, information collected through the Web Portal or Apps may be retained and used to improve, monitor, maintain, secure, and support the functionality, quality, usability, performance, regulatory compliance, cybersecurity, quality management, analytical technologies, machine learning models, fraud prevention, duplicate Study Participant detection (where authorized), and other legitimate operational purposes associated with the Services.

The following provisions apply only where such activities are expressly authorized by the applicable informed consent form, study documentation, Sponsor agreement, or other legally valid authorization. Nothing in this Privacy Policy supersedes or replaces Study Participant informed consent documentation.

• Where required for the conduct of a clinical study, the Web Portal or Apps may capture photographs, video recordings, audio recordings, electronic assessments, or other study-related information. Such information will be collected, processed, accessed, shared, retained, and protected only as authorized by the applicable study protocol, informed consent documentation, Sponsor instructions, contractual obligations, and applicable law. Access to identifiable recordings will be limited to authorized personnel with a legitimate business, clinical, quality, regulatory, or research need.
• Where authorized, recordings and related study data may be reviewed, processed, edited, converted into other technical formats, or reproduced solely for legitimate clinical research, quality assurance, validation, regulatory, audit, training, system maintenance, or other approved operational purposes consistent with the applicable study documentation and Study Participant authorization. Such processing will not alter the scientific integrity of the underlying study records.
• Ownership, custodianship, intellectual property rights, and control of clinical trial data and recordings are governed by the applicable clinical trial agreements, Sponsor contracts, study protocols, informed consent documentation, and applicable law. Nothing in this Privacy Policy is intended to modify, expand, or limit those rights or obligations.

4.10 United States (U.S.) State Privacy Rights

Residents of certain U.S. states may have rights regarding their personal information under applicable privacy laws. Subject to applicable exemptions, including exemptions for regulated clinical research and healthcare activities, these rights may include the ability to request access to, correction of, deletion of, or portability of personal information, or to object to certain processing activities.

Valis will respond to applicable requests in accordance with governing law. Where Valis processes information solely on behalf of a Sponsor, healthcare provider, or other controller, requests may be referred to the appropriate organization. Residents of countries outside the United States may also have rights under applicable privacy or data protection laws. Valis will honor applicable rights requests in accordance with the laws governing the processing activity.

4.11 Changes to our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page with a notice that the privacy policy has been updated on the website home page. If we make material changes to how we treat our users’ personal information, we will notify you through a notice on the website home page.

The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our website and this privacy policy to check for any changes.

4.12 Contacting Us

To ask questions or comment about this privacy policy and our privacy practices, contact us at:
Valis Biosciences Inc.
Attn: Data Privacy Officer
185 Great Neck Road,
Suite 424
Great Neck, NY 11021
United States
Phone: (925)338-0000
privacy@valisbiosciences.com