This Personal Data Notice and Consent form describes how Curify, Inc and Citeline, Inc. (“Curify”, “Citeline”, “we”, “our” or “us”) may collect, use, share and transfer your personal data (i.e., data that identifies you) in the following circumstances:

• In connection with your participation in online membership communities on our sites that allow you to submit personal data to us and receive information and updates from clinical research sponsors (“Sponsors”) regarding;

  • potential clinical trials for which you may qualify

  • information about Sponsors’ and/or other parties’ research initiatives and education materials

  • program opportunities offered by Sponsors (including but not limited to opportunities to participate in Sponsors’ health, wellness and engagement programs)

  • questionnaires regarding your feedback on Sponsors’’ programs, studies initiatives and other outreach so that Sponsors may improve their existing products and services and developer new products, initiative, programs, features and functionalities

Such online membership communities are referred to herein collectively as the “Online Community

• In connection with Citeline’s Connect platform on which you may complete an online questionnaire which asks you various questions related to your health, such as various health conditions you may have, medications you may be taking or have taken in the past and/or other relevant information (such questionnaire referred to herein as the “Survey”). The purpose of the Survey is to determine if you may qualify for certain clinical studies (“Studies”).

This document also explains your rights as a data subject. Please carefully review the information below. Who determines the purposes and means of using your personal data?

Curify and Citeline determine the purposes and means of using your personal data.

You may contact Curify by emailing our Privacy Team at privacy@curify.us.

Our office address is:

Curify Privacy Team

548 Market St #39969,

San Francisco, California 94104, USA

You may contact Citeline by emailing our Privacy Team at privacy@norstella.com.

Our office address is:

Citeline Privacy Team

240 Blackfriars Rd

London, SE1 8BF, UK

What personal data is collected?

The following personal data is collected as part of your participation in the Online Community:

• Your basic contact information (including name, email address, postcode and phone number)

• Your date of birth

• Your gender

• Data about your location

• Your demographic information (e.g., data on race/ethnicity)

The following personal data is collected as part of the Survey:

• Your basic contact information (including name, email address, postcode and phone number)

• Your date of birth

• Your gender

• Data about your location

• Your demographic information (e.g., data on race/ethnicity)

• Your preference regarding Study locations, which may include hospitals and medical institutions (“Sites”)

• Data concerning your health, such as health conditions you may have and medications you may be taking or have taken

With whom is personal data shared?

In connection with the Online Community, Curify and Citeline will receive your personal data. Curify and Citeline do not share your personal data with Sponsors in connection with the Online Community. Curify and Citeline do share non-identifiable aggregated data with Sponsors so that they may send communications to the Online Community members who have opted to receive such communications as outlined at the top of this notice. You may opt out of the Online Community marketing communications at any time by following the link in the footer of any marketing email you receive.

In connection with the Survey, if your responses to the Survey indicate you are a potential candidate for a Study and you would like to be considered for the Study, you will have the option to provide your contact information and share your Survey answers with Citeline and with various Sites. If you elect to share your personal data with a Site and are contacted directly by a Site, you will receive the name of the Sponsor of the Study for which you are being considered and the Sponsor’s contact details. Please note that the Sponsor is an organization which separately determines purposes and means of collecting, using and sharing your personal data; as such, the Sponsor may provide you with its own personal data notice, which may include information regarding its data protection officer and how to contact that person.

We also share your personal data:

• with third parties who assist us in providing our products and services and administering our business, such as IT and marketing technology host suppliers, web and data hosting providers, mailing houses, ad servers, sales platform providers and communication tool providers; and

• with companies that are part of Citeline’s corporate group.

If you decide that you would not like Curify or Citeline to share any of your personal data in connection with the Survey, simply exit the Survey without submitting it. We will retain certain responses, but this data is anonymous.

Why is this personal data collected, used and shared?

In connection with the Online Community, personal data is collected, used and shared for the following reasons:

• So that you may receive communication as part of the Online Community as listed at the top of this notice

• For operational purposes, including to allow us to review the quality of our services and evaluate the performance of our staff

• As needed for the establishment, exercise or defense of legal claims

• As otherwise required by applicable laws

In connection with the Survey, personal data is collected, used and shared for the following reasons:

• To determine if you may qualify for certain Studies

• So that Sites may contact you directly regarding enrolling in certain Studies (*please note, however, that you are not agreeing to participate in any Study through this Personal Data Notice and Consent form)

• To verify which Studies you enroll in

• To contact you about additional Study recruitment opportunities

• For operational purposes, including for operating our Connect platform and to allow us to review the quality of our services and evaluate the performance of our staff

• To share your enrollment status with recruitment partners through which you were referred, so those recruitment partners can avoid reaching out to you again if you have already enrolled in a Study

• As needed for the establishment, exercise or defense of legal claims

• As otherwise required by applicable laws

How long will the personal data be kept?

In connection with the Online Community, your personal data will be kept by us for as long as you participate in the Online Community, unless we need to retain your personal data for a longer period to meet our legal requirements or to defend or exercise our legal rights. In these cases, we will retain your personal data only for the period necessary for us to pursue the relevant purpose.

In connection with the Survey, your personal data (should you choose to provide it to us) will be kept by us for 12 months from collection of the personal data from you, unless we need to retain your personal data for a longer period to meet our legal requirements or to defend or exercise our legal rights. In these cases, we will retain your personal data only for the period necessary for us to pursue the relevant purpose.

What are the grounds for the collection, use and sharing of your personal data?

We collect, use and share your personal data based on the following grounds and as permitted by applicable laws and regulations:

• Your consent;

• Compliance with legal obligations to which we are subject; and

• The establishment, exercise or defense of legal claims

What are your rights?

Under certain applicable laws and regulations, you have the right to make the requests listed below. Regardless of whether applicable laws and regulations specifically recognize your right to make the requests noted below, Citeline will review and respond to any of the following types of requests:

Request to know about how we handle your personal data;

Request to access, correct, or update your personal data, request to limit the use of your personal data, or object to the use of your personal data;

Request that your personal data be deleted;

Withdraw your consent to use your personal data, without affecting the previous use of personal data (before you withdrew your consent); and

Request for your personal data to be transmitted to another person or entity.

If you would like to make any of the requests noted above, please contact us (see “How can you contact us?” below). We will make reasonable efforts to honor your request whenever feasible and in all cases we will respond to your request as required by applicable laws and regulations. In your request, please make clear what personal data your request relates to.

You may also contact a data protection authority or other relevant government agency in your country of residence with any concerns about the collection, use, or handling of your personal data.

For individuals in the countries listed below, please refer to the addendum with additional explanation about your rights:

• Brazil

• Turkey

• Taiwan

• Argentina

• Georgia

• U.S.

• Canada

• South Korea

• Singapore

Are you obligated to provide your personal data to Citeline?

You are not obligated to provide Citeline with your personal data and the collection of your personal data by Citeline is not required by law, however, if you choose not to provide Citeline with your personal data this will mean that you cannot participate in the Online Community, receive information about Studies or be connected by Citeline to Sites for potential participation in Studies.

International Transfers of Your Personal Data

For purposes of the Online Community and the Survey, Curify and Citeline intends to transfer your personal data from your country of residence to the United States. Laws in the United States may differ from those in your country of residence and your personal data may therefore be subject to different legal protections once it is transferred to the United States. In any event, will use reasonable and appropriate measures to protect your personal data. How can you contact us? If you have any questions about this Personal Data Notice and Consent or about the way we use your personal data, or if you would like to submit a request to us, please contact us at privacy@curify.us and privacy@norstella.com.

I acknowledge that I may withdraw my consent at any time by contacting Curify's Privacy team at privacy@curify.us and
Citeline’s Privacy team at privacy@norstella.com.

Canada Appendix

This Appendix applies if you live in Canada. This Appendix should be read in conjunction with and in addition to the Personal Data Notice and Consent form to which this Appendix is attached.

How and why we use personal information

Canadian privacy laws require that we obtain your consent for the collection, use and disclosure of your personal information whenever possible.

The purposes of the collection, use and disclosure of your personal information are as described in the Personal Data Notice and Consent form. We will not collect, use or disclose your personal information for any new purpose without first identifying the new purpose and including it in an updated version of the Personal Data Notice and Consent form.

International transfer of personal information

Your personal information may be transferred outside of Canada to the United States, as set out in the Personal Data Notice and Consent form. We will ensure that technical and contractual measures are imposed on entities acting on our behalf to which we have transferred your personal information. Please note that when your personal information is transferred to another country, it may be accessible by law enforcement and/or national security authorities of that jurisdiction.

Your rights

If you have any questions in relation to our use of your personal information, you should first contact us. Under certain conditions, you may have the right to:

• Obtain the details of our use of your personal information

• Obtain a copy of the personal information in Citeline’s custody or control that you have provided to us or that we have collected about you

• Obtain the details of your personal information that has been disclosed or transferred to third parties or other Citeline entities

• Request that the personal information we hold about you be corrected or updated

• Request that we delete any personal information that we no longer have a business or legal reason to maintain

• Where processing is based on consent, to withdraw your consent so that we stop that particular processing

• Request that we cease direct marketing to you

• Make a complaint to supervisory authority (contact details below) if you consider that any of your rights have been infringed or if you consider the collection, use and/or disclosure of your personal information has not been in accordance with applicable Canadian privacy legislation.

Access to Information and Enquiries

Upon written request and authentication of identity, Citeline will provide you with your personal information under its custody or control, information about the ways that your personal information is being used and information regarding individuals or organizations to whom your personal information has been disclosed or transferred.

A request to access personal information must be made in writing and provide sufficient detail to identify the personal information being sought. A request to access personal information should be forwarded to Pharma Intelligence’s Privacy team .

Citeline may charge a reasonable fee for providing personal information in response to an access request and will provide an estimate of any such fee upon receiving a written access to personal information request. Citeline may require a deposit for all or part of the fee.

Citeline will make personal information available within 30 days or provide written notice where additional time is required to fulfill the request. In some situations, Citeline may not be able to provide access to certain personal information. Citeline may also be prevented by law from providing access to certain personal information.

Where an access request is refused in whole or in part, Citeline will notify you in writing, giving the reason for refusal and outlining further steps which are available to you.

Enquiries and complaints

If you have any concerns or complaints that are unable to be resolved by contacting Curify's or Citeline’s Privacy team, you may contact one or more of the following applicable supervisory entities in Canada:

Office of the Privacy Commissioner of Canada

30, Victoria Street Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 www.priv.gc.ca

Office of the Information and Privacy Commissioner of Alberta

Suite 2460, 801 6 Avenue SW Calgary, Alberta T2P 3W2 Toll-free:1-888-878-4044 generalinfo@oipc.ab.ca https://www.oipc.ab.ca

Office of the Information and Privacy Commissioner for British Columbia

4th Floor, 947 Fort Street, Victoria BC V8V 3K3 1-250-387-5629 info@oipc.bc.ca https://www.oipc.bc.ca

Commission d'acces a l’information du Quebec

Bureau 18.200 500, boul. René-Lévesque Ouest Montréal (Québec) H2Z 1W7 Téléphone : 514 873-4196 Télécopieur : 514 844-6170 www.cai.gouv.qc.ca