Clinical Trials Privacy Policy

Effective from: March 2023

Immunovant (referred to as “We, “Our” or “Us”), is committed to protecting the privacy and security of your Personal Data. This Privacy Notice (this “Notice”) describes how we use your Personal Data we may receive, either directly from you, or from third parties, in connection with the clinical trials (a “Trial” or the “Trials”) we sponsor. We take care to protect the privacy of our clients and their employees, our suppliers/vendors and their employees, investors, health care professionals, professional advisors, researchers, physicians (this Notice they will be known as “Personnel”) and all other users or parties that otherwise interact with us or visit our website.

Immunovant complies with the European General Data Protection Regulation (“EU GDPR”) regarding the collection, use and retention of Personal Data of participants and others mentioned above in Studies who are domiciled in the EEA (European Economic Area) or whose personal data is processed in the EEA. This includes any replacement legislation coming into effect from time to time.

Where processing takes place within the UK (United Kingdom), Data Protection Legislation includes the Data Protection Act 2018 (“DPA 2018”), the United Kingdom’s General Data Protection Regulation (“UK GDPR”). Data Protection Legislation includes any replacement legislation coming into effect from time to time.

Controllership

Within the scope of this Notice, Immunovant acts as a data controller for the Personal Data we collect, use and process. This means that we determine the purposes and the means of the processing of Personal Data.

However, we do not have direct access to Trial participants identifiable Personal Data, meaning that we are unable to directly identify Trial participants. Your Personal Data is collected by the clinical research organisation (CRO) assisting us with the Trial, the Trial site (the doctor’s office, clinic, hospital, or other healthcare facility where the Trial is being conducted), or other third parties, such as your primary care doctors. When any information relating to Trial participants is shared with us, it will be key-coded (also known as “pseudonymised”) so that you will not be identified by any direct personal identifier.

Personal Data We May Collect

Immunovant itself may have access to the following types of Personal Data about Trial Participants:

Health care information, such as the identity and contact information of your doctors and health care providers
Health information, such as your medical background, history, and reaction to the Trial drug; and your genetic information

The Trial participant Personal Data is collected by Immunovant’s Research Sites, acting on their behalf as Data Processors or independent Data Controllers. This data may be shared with clinicians, health authorities, ethics bodies and other personnel as authorised by Immunovant but only where Immunovant is legally obligated to provide this data in accordance with Clinical Trial Regulations and other applicable laws. Immunovant will not directly receive participant identifiable information and will not instruct their Data Processors to process or share this information other than where the law requires.

How We Collect and Your Personal Data

We may collect your personal data through several processes:

You provide it to us, the CRO, or a Trial site directly when you complete a pre-screening questionnaire on one of our Trial-specific websites
You provide it to us, the CRO, or a Trial site when you participate in a Trial
Your doctors or healthcare providers provide it to us; or

Why We Collect Your Personal Data

We will process Trial Participants Personal Data for the purposes of:

Determining your eligibility for a Trial
Conducting the Trials
Ensuring that each Trial drug is safe and reliable
Conducting related scientific and medical research

We also process the Personal Data of Trial Participants for the specific purposes described in the Trial information provided to Trial Participants by the Trial site (Informed Consent Form ICF (Informed Consent Form)).

How Do We Share Your Personal Data

We will share your Personal Data with service providers who process Personal Data on our behalf and who agree to use your Personal Data only to assist us in conducting our Trials or as required by applicable law, with the correct agreements in place:

With third party companies or individuals (data processors) to perform services on our behalf. This could include CROs; clinical laboratories, data storage and analytics companies; technology support and services.
With health care professionals, researchers, academics, public health organisations, and publishers for purposes consistent with this Notice
With professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us
With government or law enforcement officials or private parties as required by law and disclose and use such information as we believe necessary or appropriate

Lawful Basis for Processing

We only process, store or transfer your Personal Data when we have a legal basis for doing so. The legal basis we rely on to process the Personal Data identified in this notice are as follows:

To undertake clinical studies where consent is the legal basis
To perform contracts Immunovant has entered, or due diligence undertaken pre entering contract
Where the processing of your data is necessary for our legitimate interests
Where Immunovant needs to comply with a legal obligation

Processing activity	Lawful basis
Where you are a clinical trial participant in an area where clinical trials occur on the lawful basis of Consent, to collect information from you and process your health information to conduct a clinical trial. For example, Germany, Israel	Consent Article 6 (1) a … the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Where you are a clinical trial participant in an area where clinical trials occur on the lawful basis of Public Interest, to collect information from you and process your health information to conduct a clinical trial. For example, United Kingdom, France	Article 6 (1) e … processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Where you are a clinical trial participant in an area where clinical trials occur on the lawful basis of Legal Obligation, to collect information from you and process your health information to conduct a clinical trial. For example, Spain	Article 6 (1) c processing is necessary for compliance with a legal obligation to which the controller is subject
To inform you, plan and/or conduct other Clinical Studies including to identify suitable investigators for our studies.	Article 6 (1) f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
To share information with other companies or industry organisations in the context of planning and conducting Clinical Studies.	Article 6 (1) f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
To assess the effectiveness of the sites participating in our studies	Article 6 (1) f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
To support recruitment of study subjects	Article 6 (1) f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
To comply with the US Financial Disclosure regulation, which is intended to ensure that financial interests and arrangements of clinical investigators that could affect the reliability of data submitted to the Federal Drug Administration of the U.S.A. (“FDA”) are identified and disclosed to the FDA¹ and other disclosure obligations as required by applicable laws and regulations	Article 6 (1) c processing is necessary for compliance with a legal obligation to which the controller is subject
To ensure traceability and follow-up of drug safety notification	Article 6 (1) c processing is necessary for compliance with a legal obligation to which the controller is subject

How Long Do We Keep Your Personal Data

We will only retain Personal Data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory, or internal policy requirements. After such time periods have expired, we may either delete your Personal Data or retain it in a form such that it does not identify you personally. For example:

25 years following the conclusion of the clinical trial,
As determined by EU Clinical Trial Regulations (EU-CTRs)

Where Is Your Information Stored and Kept Secure

Data security is important to Immunovant, and we have implemented and will maintain technical, administrative, and physical measures that are designed to help protect Personal Data from unauthorised processing. This includes unauthorised access, disclosure, alteration, or destruction.

We take security measures to protect your information including:

Limiting access to our buildings and resources to only those that we have determined are entitled to be there (by use of passes, key card access and other related technologies)
Managing a data security breach reporting and notification system which allows us to monitor and communicate information on data breaches with you or with the applicable regulator when required to do so by law
Implementing access controls to our information technology
Deploying appropriate procedures and technical security measures (including strict encryption, anonymisation and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, and offices

Your Rights

You have specific rights regarding your Personal Data that we collect and process.

For Trial Participants: to exercise the rights we explain below, please first speak with your study doctor instead of contacting us directly as they will hold your Personal Data in relation to the clinical trial.

The right to be informed about our collection and use of Personal Data
Right to access your Personal Data
Right to rectification
Right to erasure
Right to restrict processing
Right to object to automated processing
Right to be forgotten
Right for data portability

To exercise your data protection rights, please email privacy@Immunovant.com

Right to Lodge a Complaint with a Supervisory Authority

Under the EU / UK GDPR, you have the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data.

Specifically, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR.

If we change this Notice, we will publish the revised Notice on our website. We will also update the “Effective” date.

Contact Us

The organisation responsible for processing your personal data is:

Immunovant Inc.

Our Data Protection Officer is:
David Smith
privacy@Immunovant.com

European Union Representative
We have also appointed The DPO (Data Protection Officer) Centre as our representative in the EU for data protection matters. While you may also contact us, please contact The DPO Centre on matters related to the processing of Personal Data. To contact The DPO Centre please use this contact:

DPO Centre Ltd:
Postal Address: The DPO Centre Europe Ltd, Alexandra House, 3 Ballsbridge Park, Dublin, D04C 7H2
Phone number: +353 1 631 9460
Email: privacy@immunovant.com

United Kingdom Representative
We have also appointed The DPO Centre as our representative in the United Kingdom (“UK”). While you may also contact us, please contact The DPO Centre on matters related to the processing of Personal Data. To contact The DPO Centre please use this contact:

Postal Address: The DPO Centre Ltd, 50 Liverpool Street, London, EC2M 7PY, UK
Phone number: +44 (0) 203 797 6340
Email: privacy@immunovant.com