Introduction and Scope
CTI BioPharma Corp. (“CTI,” “our,” “us”) takes the protection of your personal data very seriously. This Privacy Notice (this “Notice”) describes how we collect, use, disclose, and otherwise process personal data of individuals (“data subjects,” “you,” “your”) in connection with conducting clinical trials of drug substances. For our Privacy Notice governing our data processing practices for our website, ctibiopharma.com, click https://www.ctibiopharma.com/privacy.
We will provide specific terms, privacy notices, and consent forms to you at the time we collect your personal data in connection with our clinical trials. Such notices will govern how we process your personal data in that context.
Categories of Data Subjects
We process personal data about the following types of individuals:
• clinical trial participants;
• compassionate-use patients;
• physicians and other health care professionals, including clinical trial investigators;
• researchers;
• pharmacists;
• contractors; and
• consultants.
Categories of Personal Data
We may process the following types of personal data:
• name;
• biographical and demographic information;
• health and medical information, which constitute special categories of personal data (“Sensitive Information”);
• personal contact information and preferences; and
• programs and activities in which you participated.
Controllership
In the context of this Notice, CTI acts as a data controller for the data we process.
How We Receive Personal Data
We may receive your personal data directly from you or third parties with whom we contract.
Basis of Processing
Within the scope of this Notice, we process your personal data on several different legal bases, depending on the purpose of processing.
• Consent. In some situations, we may ask for your consent to collect and process your personal data, including Sensitive Information. These situations will be governed by specific terms, privacy notices, or consent forms that provide additional information about how we will use your personal data. We strongly recommend that you review such additional terms prior to participating in such programs. However, if you withdraw your consent it will not affect any processing of personal data that has already occurred.
• Compliance with legal obligations. In some situations, we may need to process your personal data in order to comply with applicable laws or regulations, such as with reporting adverse events. In such situations, it is unlikely that you will be permitted to object. However, you will usually have the right to access or review this information, unless it would impede our legal obligations or is otherwise prohibited by law. We may also process your personal data as permitted by applicable legal requirements, such as laws and regulations that authorize us to process your personal data for purposes of clinical trials.
• Our legitimate interests. In some cases, we process your personal data based on our legitimate interests in facilitating and managing clinical trials. In addition to the other rights you may have (described below), you have the right to object to such processing of your personal data. You can register your objection by contacting us as described in the “Contact Us” section below.
• Ensuring high standards of quality and safety of medicinal products. In some cases, we may process your personal data for reasons of public interest in the area of public health, namely ensuring high standards of quality and safety of the medicinal products we are developing. In such cases, the processing of your personal data will be conducted on the basis of European Union or Member State law that provide for specific measures to safeguard your rights and freedoms.
• Scientific research. In some situations, we may process your personal data in order to conduct scientific research. In these situations, the processing of your personal data will be conducted in accordance with European Union or Member State law and shall: (1) be proportionate to the aim pursued; (2) respect the essence of the right to data protection; and (3) provide for suitable and specific measures to safeguard your fundamental rights and the interests.
Purpose of Processing
We process your personal data for the purposes of:
• staffing, facilitating, and managing clinical trials;
• complying with legal or regulatory obligations, such as reporting of adverse events;
• complying with company policies;
• facilitating and cooperating with legal proceedings and government investigations; and
• communicating about our clinical trials, the products we offer, and responding to requests, inquiries, comments, and suggestions.
Data Retention
When the purposes of processing are satisfied, we will delete your personal data within six months.
Cookies
Some of the information systems included within the scope of this Notice may use session cookies, which are used to enable basic functionality. However, within the scope of this Notice, we do not use cookies for monitoring or tracking your behavior online.
Sharing Personal Data with Third Parties
We share personal data with our service providers, who process personal data on behalf of CTI. Such third parties include:
• business partners, such as contract research organizations and study sites, with whom we contract to carry out services on our behalf;
• other service providers providing IT systems and infrastructure; and
• government agencies, auditors, and authorities.
International Transfers
We may store and process your personal data in any country or area where we have facilities, are conducting clinical trials, or where we engage service providers. Your personal data may be transferred to countries other than the country where you reside, including but not limited to the United States. In some cases, the European Commission may not have determined that the legal environment in those countries provides a level of data protection that is essentially equivalent to the level of protection provided under European law. Transfers of your personal data to such customers are subject to appropriate safeguards, such as the standard contractual clauses, as approved by the European Commission. CTI remains liable for the protection of your personal data that we transfer to our service providers, except to the extent that we are not responsible for the event giving rise to any unauthorized or improper processing.
International Transfers
We may disclose your personal data (i) to the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with applicable laws or regulations, official investigations, or legal proceedings initiated by governmental and/or law enforcement officials, or private parties, including but not limited to: in response to subpoenas, search warrants, or court orders, or (ii) if we sell or transfer all or a portion of our company’s business interests, assets, or both, or in connection with a corporate merger, consolidation, restructuring, or other company change, or (iii) to our subsidiaries or affiliates only if necessary for business and operational purposes as described in the “Purpose of Processing” section above.
If we must disclose your personal data in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, we may not be able to ensure that such recipients of your personal data will maintain the privacy or security of your personal data.
Data Integrity & Security
CTI has implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your personal data from unauthorized processing such as unauthorized access, disclosure, alteration, or destruction.
Access & Review
If you have participated in one of our clinical trials, you may have the right to see and copy your health records related to the trial, as well as correct any errors, for as long as this information is held by your trial physician. You might not be able to view or reproduce your trial records until the trial has been completed by all trial participants.
You can withdraw your consent to have your information analyzed for a trial at any time. If you decide to do so, please tell your study investigator about your decision. However, if you withdraw your consent, you will not be able to continue to participate in the trial. If you withdraw your consent, no more information about you will be collected after your withdrawal. However, the information that was collected before your withdrawal will be used for the trial.
Please note that even if you stop sharing your information for a trial, the study investigator may still need to contact you to ask questions about your health if you have taken the trial medication.
If you are a resident of the EU or EEA, you may have the right to request that we delete your information that we process or that our processing be restricted.
If you would like to withdraw (1) from a trial or (2) your permission to have your information analyzed or would like to assert other rights to which you may be entitled to under applicable laws, you may contact us using the information provided below under the heading “Data Protection Officer.” Our Data Protection Officer will coordinate with our EU Representative to respond to your inquiry. You should also contact your study investigator.
Privacy of Children
We do not knowingly collect personal data from anyone under 18. In the event that we learn that we have processed personal data from a child under age 13, we will delete the information we have stored as quickly as possible. If you believe that we might have any information from or about a child under 13, please contact us as described in the “Contact Us” section below.
Changes to this Privacy Notice
If we make any material change to this Notice, we will post the revised Notice to this web page and update the “Effective on” date to reflect the date on which the new Notice became effective.
Contact Us
If you have any questions about this Notice or our processing of your personal data, please contact us via email at dataprivacy@ctibiopharma.com. Alternatively, you may also contact us by postal mail at:
CTI BioPharma Corp.
Attn: Data Privacy Team
3101 Western Ave., Suite #800Seattle, WA 98121
U.S.A.
Please allow up to four weeks for us to reply.
EU Representative
CTI Life Sciences Deutschland GmbH has been appointed as CTI’s representative in the EU for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union. To make an inquiry, please contact CTI Life Sciences Deutschland GmbH via email at dataprivacy@ctibiopharma.com. Alternatively, you may also contact CTI Life Sciences Deutschland GmbH by postal mail at:
CTI Life Sciences Deutschland GmbH
c/o CTI BioPharma Corp.Attn: Data Privacy Team
Universitätsstraße 7150931 Köln, Germany
On matters related to the processing of personal data, in addition to CTI, you may also contact VeraSafe. VeraSafe may be reached by email at experts@verasafe.com.
Please allow up to four weeks for a reply.
Data Protection Officer
We have appointed Jim Cormier of VeraSafe as our data protection officer. He may be contacted as follows:
Jim CormierSenior CounselVeraSafe
22 Essex Way #8203Essex, VT 05451
U.S.A.
Email: experts@verasafe.com
Please allow up to four weeks for us to reply.
Supervisory Authority Oversight
If you are a data subject whose personal data we process, you may also have the right to lodge a complaint with a data protection regulator in one or more of the European Union member states.
