Privacy Policy

Privacy Notice

RxTra Clinical LLC d/b/a RxTra Clinical and its affiliated companies (collectively, "RxTra", "we", "our", or "us") respect the privacy of all individuals. References to our "affiliates" in this Privacy Policy include any entities controlling, controlled by, or under common control with RxTra Clinical LLC. This Privacy Policy (the "Privacy Policy") governs our collection, use, and disclosure of your Personal Information (as defined below) in connection with your use of our website(s) on which this Privacy Policy is linked (collectively, the "Sites"), and any transactions, interactions, or other engagements you might have with us (collectively, the "Services").

For clarity, the term "Sites" does not include any sites owned or operated by third parties. Please read this Privacy Policy carefully. By using the Sites or Services, you consent to the collection and use of your information by us as set out in this Privacy Policy. This Privacy Policy forms a part of and is incorporated into our Terms of Service, and any capitalized terms used but not otherwise defined in this Privacy Policy will have the meanings given to them in the Terms of Service.

If you are a resident of certain U.S. states, you may have additional rights under state law. Our "Additional State Law Consumer Rights" section and any state-specific supplements (including our California Privacy Policy) provide more detail.

ABOUT THIS PRIVACY POLICY

Privacy Policy Changes

This Privacy Policy is subject to change. We encourage you to review this Privacy Policy frequently for any revisions or amendments. If we make any material changes to this Privacy Policy, the revised policy will be posted on the Sites with the date of revision. Changes will be effective immediately upon posting. You will be deemed to have been made aware of and have accepted the changes by your continued use of our Sites or Services.

If we determine that a change to this Privacy Policy will result in us using your Personal Information acquired before the change being used in a materially new way, we will provide notice, such as by a posting on the Sites or an email to your last known email address, before using your Personal Information in the new way.

Conflict Between this Policy and Laws and Regulations

When federal, state, or local laws and regulations require a higher level of protection for your Personal Information, they take precedence over this Privacy Policy. The specific requirements of this Privacy Policy apply unless disallowed by applicable laws or regulations. Please be aware that the Sites and Services are subject to the laws of the United States of America and that your Personal Information will be processed in the United States and other jurisdictions.

The Sites and Services are intended for use by individuals in the United States who are 18 years of age or older.

INFORMATION WE COLLECT

For purposes of this Privacy Policy, "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being associated with you or your household. Some Personal Information may also be considered "consumer health data" or "sensitive personal information" under certain state laws.

Personal Information

Depending on how you use the Sites and Services and your relationship with us, we may collect the following categories of Personal Information:

• Identifiers and Contact Information such as name, address, email address, phone number, online identifiers, and similar information.
• Protected Classification Characteristics such as age, marital status, gender, and veteran or military status.
• Health Information such as symptoms, conditions, diagnoses, medications, treatment history, and other health information you choose to provide in connection with clinical trial or health-related program screening.
• Commercial Information such as products or services you have used, considered, or purchased, financial information, and health insurance information.
• Professional or Employment Information such as employment status or occupation where relevant to trial eligibility.
• Education Information such as level of education, where relevant to trial eligibility.
• Internet and Network Information such as IP address, device identifiers, device type and settings, browser type, browsing or search history on our Sites, pages viewed, clicks, referral URLs, and similar technical information.
• Derived Data and Analytic Information such as eligibility scores, risk or interest scores, predicted preferences, inferred health or demographic attributes, segments or cohorts, program matches, and other analytic attributes that we generate internally based on the information we collect from or about you.

Some of the Personal Information listed above may be considered "Sensitive Personal Information" or "consumer health data" under relevant privacy laws. This includes Health Information and certain Derived Data. Each type of such information may overlap with one or more categories of Personal Information listed above.

Business Information

We also collect information about businesses and their representatives that engage with us, such as EIN, TIN, business address, phone number, email address, and bank account information (collectively, "Business Information"). This information is generally not considered Personal Information because it relates to a business. If such Business Information relates to an individual business contact person, we will treat it as Personal Information.

Usage Data and Sites Activity

We automatically collect information in connection with the actions you take on the Sites ("Usage Data"). For example, each time you visit our Sites, we may automatically collect the type of web browser you use, the type of device you use, your operating system, the name of your Internet Service Provider, the pages you view on our Sites, referring and exit pages, the date and time of your visit, the number of clicks to, from, and within the Sites, and the duration of your visits to the Sites.

If this information is reasonably capable of being associated with you, we treat it as Personal Information (under the category "Internet and Network Information" or "Derived Data"). If this information is not reasonably capable of being individually associated with you, we treat it as Usage Data.

Communication Recordings

We may record calls and retain the content of text messages or other written or electronic communications between you and us. By communicating with us, you explicitly consent to our recording and retention of communications. We do not use message content or mobile phone numbers for third-party marketing and we do not sell or share mobile numbers, SMS/MMS consent status, or message content for third-party marketing. Such content is retained only for compliance, security, quality assurance, or support, subject to reasonable retention limits.

Text Messaging and Mobile Number Use (No Sale or Sharing for Marketing)

We use your mobile number and SMS/MMS opt-in solely to send the messages you request (for example, account or program updates, trial-related messages, appointment reminders, and - only where you provide the required consent - our own marketing messages). We do not sell, rent, share, or otherwise disclose your mobile number, SMS/MMS opt-in status, or related consent records to any third party for their own marketing or promotional purposes. Your opt-in is not transferable or assignable and applies only to the specific program(s) and brand(s) you joined. We do not accept or use purchased, rented, or shared opt-in lists. You can opt out at any time by replying STOP; reply HELP for help. Message frequency varies; message and data rates may apply.

SOURCES OF PERSONAL INFORMATION

We collect Personal Information from a variety of sources, including:

• Directly from you: When you complete forms on our Sites, respond to questionnaires or screeners, participate in calls or chats, interact with our SMS programs, or otherwise communicate with us.
• Automatically from your devices: When you use the Sites, we collect technical and Usage Data through cookies, pixels, SDKs, and similar technologies, as described in this Policy.
• Publishers, lead generators, and referral partners: We contract with publishers, media partners, and other third parties that operate websites and campaigns and may collect and transfer Personal Information to us ("Publishers" or "Partners"). This may occur through online forms, click transfers, display ads, telephonic transfers, or other lead generation mechanisms. We may buy or otherwise receive leads and related data from these Partners.
• Program partners and clinical trial partners: We may receive Personal Information and Health Information from clinical trial sponsors, trial sites, site networks, contract research organizations (CROs), pharmacy partners and pharmacy networks, health plans, and other health-related program partners (collectively, "Program Partners"), including information about your eligibility, screening status, referral status, or participation.
• Data providers and service providers: We may receive identifiers, demographic information, interest information, or other data from data providers or service providers to help us verify information, enrich or update records, improve matching, or measure performance.
• Public and publicly available sources: We may collect information from public sources, such as public websites, publicly available databases, or information you make public on social media or other platforms, consistent with your privacy settings on those services.

We may combine Personal Information we receive from different sources (including from third-party sources) with information we already have about you and treat the combined information as Personal Information as described in this Privacy Policy.

COOKIES AND OTHER AUTOMATED TOOLS

We and third parties use cookies (small text files placed on your computer to identify your computer and browser) and other automated tools such as pixels, SDKs, and clear gifs (collectively, "cookies") to track your interaction with our Sites and to improve the experience of our Sites and Services, such as saving your preferences from visit to visit, presenting you with a customized version of the Sites, measuring performance, and tracking certain aspects of your engagement with an email or other communications.

Many web browsers are initially set up to accept cookies. You can reset your web browser to refuse all cookies or to indicate when a cookie is being sent. However, certain features of our Sites may not work if you delete or disable cookies.

We use the following types of cookies:

• Strictly Necessary: These cookies are essential to operate the Sites and provide you with services you have requested.
• Functional: These cookies enable certain features or non-essential functionality on our Sites. For example, we might use these cookies to recognize you and remember your preferences or settings when you return to our Sites so we can provide you with a more personalized experience.
• Analytics Cookies: These cookies help us and third parties understand how our Sites are working and who is visiting our Sites.

User activity information collected by cookies may be associated with additional information about a user's session and Personal Information, if provided by the user.

If you arrive at our Sites by "clicking through" from another website, then certain information about you that you provided to that other website - such as search terms or campaign identifiers - may be transmitted to us and we may use it. You should review the privacy policy of any website from which you reached our Sites to determine what information the operator collects and how it uses such information.

We may retain information about you provided to us by other websites and third parties and will use it in accordance with this Privacy Policy. Such information may be associated with other Usage Data or Personal Information.

HOW WE USE PERSONAL INFORMATION

We generally use Personal Information to connect you with Program Partners, including clinical trial providers and related health programs, that can provide you with information about the goods and services that you have expressed interest in or that may be relevant to your profile.

Specifically, we may use your Personal Information for the following purposes:

• Provide and operate the Sites and Services: Including hosting the Sites, processing your submissions, responding to inquiries, providing customer support, and maintaining and improving the functionality and security of the Sites.
• Clinical trial and program matching: To review the information you submit (including Health Information and Derived Data), determine potential eligibility, and match you with clinical trials, research studies, pharmacy programs, and other health-related opportunities that may be a fit for your profile. This may include using automated tools and scoring models, along with human review.
• Connecting you with Program Partners: To share your information with Program Partners (for example, trial sponsors, CROs, trial sites, site networks, pharmacies, pharmacy networks, health plans, and other health program providers) so that they can contact you, provide information, and determine eligibility or enrollment.
• Multi-trial and multi-program opportunities: To contact you and, where permitted by law, re-contact you about one or more clinical trials or related health programs that may be relevant to you, including opportunities that are similar to or different from the specific trial or program you initially inquired about.
• Lead buying, enrichment, and quality: To receive, verify, enrich, merge, dedupe, and score leads from Publishers, data providers, and Program Partners, and to combine them with information we already have about you to improve accuracy, reduce duplication, and optimize matching.
• Marketing and market research: To send our own marketing communications (for example, email or SMS) where you have provided the required consent (such as prior express written consent for marketing texts); to perform analytics, reporting, and testing; and to understand and improve how users engage with our campaigns and Programs. We do not disclose Personal Information (including mobile numbers) to third parties for their own marketing or cross-context behavioral advertising.
• Other company communications: To send you information about our Services, updates, surveys, or other content that may be of interest, as permitted by law.
• Business operations: To evaluate, develop, and improve our business operations, products, and services; perform business administration; conduct internal research; support debugging and error repair; and manage our relationships with Publishers, Program Partners, and other third parties.
• Compliance: To comply with applicable legal requirements, government requests, industry standards, and contractual obligations, and to take actions we deem necessary to preserve and enforce our rights or the rights of others.
• Information security and fraud prevention: To operate information security, anti-fraud, and anti-abuse programs, including detection, prevention, and response to security incidents and malicious or fraudulent activity.
• Derived Data and analytics: To create, use, and maintain Derived Data and analytic information, such as eligibility scores, program matches, performance models, and aggregate statistics, for the purposes described above. Where feasible, we may aggregate or de-identify Personal Information and use it for any lawful purpose.

We also use Sensitive Personal Information, including Health Information, for the following purposes:

• Health Information: To provide the Services, including determining eligibility or potential eligibility for clinical trials and health programs, connecting you with Program Partners, and improving our matching algorithms and quality. We do not use Health Information for cross-context behavioral advertising or for making solely automated decisions that produce legal or similarly significant effects without appropriate human involvement.

We may also use Personal Information and Sensitive Personal Information as described to you at the point of collection, with your consent, or as otherwise required or permitted by applicable laws.

We are not a health care provider, and we do not provide medical care, diagnosis, or treatment. We provide the Services as a consumer-facing technology and information service and, unless we explicitly agree in writing in a separate agreement to act as a "business associate" under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), we are not a HIPAA covered entity or business associate. Where we do act as a business associate under a separate agreement with a Program Partner, that agreement governs our HIPAA-related obligations for that activity, and this Privacy Policy applies to all other processing of Personal Information.

HOW WE SHARE PERSONAL INFORMATION

We may disclose Personal Information as described in this Privacy Policy, at the time of collection, with your consent, or as otherwise permitted or required by law.

Service Providers

We may establish relationships with other businesses to provide services to us, which may include corporate affiliates and other vendors ("Service Providers"), including for:

• Provision, maintenance, and hosting of the Sites and Services.
• Facilitating marketing, non-marketing, and internal communications.
• Business analytics and reporting (both marketing and non-marketing related).
• Project management and collaboration.
• IT and network administration, such as data storage and management, security, and software development.
• Day-to-day business operations, such as payment processing, facility and document management, courier services, and electronic signature services.

We only provide our Service Providers with the Personal Information reasonably necessary for them to perform these services on our behalf. Each Service Provider is expected to use reasonable security measures appropriate to the nature of the information involved to protect your Personal Information from unauthorized access, use, or disclosure. Service Providers are prohibited from using Personal Information for any purpose other than performing services for us under a written contract.

We may share any of the categories of Personal Information described in this Privacy Policy with one or more Service Providers.

Program Partners and Clinical Trial Partners

We work with a variety of Program Partners to connect you with clinical trials and other health-related opportunities. We may disclose your Personal Information, including Health Information and Derived Data, to Program Partners such as:

• Clinical trial sponsors and their agents.
• Trial sites and investigators.
• Site networks and integrated research organizations.
• Contract research organizations (CROs).
• Pharmacies and pharmacy networks, and platforms that support them.
• Health plans, insurers, and other health program administrators where appropriate.
• Other health-related programs that may be relevant to your profile (for example, screening, care navigation, or coverage programs).

We may update or add Program Partners from time to time and share Personal Information with them as needed to provide and improve the Services. We may disclose your Personal Information to these Program Partners so that they can contact you, assess eligibility, enroll you in their programs or trials, manage the relationship, and otherwise provide their services. Program Partners may, in turn, disclose Personal Information to their own service providers or affiliates.

Program Partners may also provide information back to us, such as whether you were contacted, screened, deemed eligible or ineligible, enrolled, or completed a program. We use this information to improve our matching and Services, for analytics and quality assurance, and for the other purposes described in this Privacy Policy.

Publishers, Lead Generators, and Referral Partners

We work with Publishers and referral partners that operate websites, campaigns, or call centers and collect information from individuals who may be interested in clinical trials or other health programs. We may receive and share Personal Information with these third parties for:

• Lead generation and lead validation.
• Attribution, measurement, and payment.
• Campaign optimization and fraud prevention.
• Matching individuals to appropriate trials or programs.

In some cases, we may act as the "publisher" or lead partner for third parties. In other cases, we may receive leads from Publishers and then share those leads, as permitted by law and by this Privacy Policy, with one or more Program Partners.

Analytics and Non-Behavioral Advertising Partners

We may share limited Personal Information (such as device identifiers, Usage Data, or partial identifiers) with analytics providers and similar partners to help us understand how users interact with our Sites and campaigns, measure performance, and improve our Services.

We do not disclose Personal Information, including mobile numbers, to third parties for their own marketing or cross-context behavioral advertising purposes. If we ever propose to do so in the future, we will update this Privacy Policy and provide any required notice or choice.

Third-Party "Sale" or "Sharing" under State Law

Under certain state privacy laws (such as the California Consumer Privacy Act, as amended by the CPRA), some of the disclosures described above may be considered a "sale" or "sharing" of Personal Information, even if no money changes hands and even if the recipient is a clinical or health-related partner.

In the past twelve months, we may have sold or shared Personal Information with third parties who are not our Service Providers for the purposes described in this Privacy Policy, including to enable Program Partners to market and provide their goods and services and to enable us to measure and optimize campaigns. These third parties may include advertisers, Program Partners, and Publishers.

We do not sell or share mobile numbers, SMS/MMS opt-in status, or message content for third-party marketing.

You may have the right to opt out of certain "sales" or "sharing" of your Personal Information as described in the "Additional State Law Consumer Rights" section and our California Privacy Policy.

Other Third-Party Disclosures

We may also disclose Personal Information to third parties, for purposes such as:

• To comply with the law.
• To respond to legal requests (including court orders, investigative demands, and subpoenas) if, in our discretion, we believe it is necessary or appropriate.
• To prevent or stop any illegal, unethical, or legally actionable activity.
• To protect the safety, property, or rights of ourselves, consumers, or any other third party.
• If we are merged, acquired, or sold, or in the event of a divestiture, restructuring, reorganization, or transfer of some or all of our assets, where the disclosure is necessary to complete the transaction.
• To businesses controlling, controlled by, or under common control with us.
• For additional purposes with your consent where such consent is required by law.

OTHER TRANSFERS

We may share Personal Information and Usage Data with businesses controlling, controlled by, or under common control with us. If we are merged, acquired, or sold, or in the event of a transfer of any of our assets, we may disclose or transfer Personal Information and Usage Data in connection with that transaction.

CHILDREN'S PRIVACY

We do not knowingly collect or solicit Personal Information from anyone under the age of 16. The Sites and Services are intended for adults. If we learn that we have collected Personal Information from an individual under the age of 16, we will delete that information upon discovery.

CONSUMER HEALTH DATA NOTICE

Certain state laws regulate the collection, use, and sharing of "consumer health data." To the extent those laws apply, this section provides additional disclosures.

We collect health-related information that you provide to us or that we receive from Program Partners and Publishers in connection with clinical trial screening and health-related programs. We use this information to:

• Determine whether you may be a fit for specific clinical trials or health programs.
• Connect you with Program Partners and support your participation in their programs.
• Improve our matching, analytics, and Services.
• Comply with legal and regulatory requirements and ensure the security and integrity of our systems.

We share consumer health data with:

• Program Partners (for example, trial sponsors, trial sites, CROs, pharmacies, pharmacy networks, and health programs) to facilitate screening, eligibility assessments, enrollment, and program administration.
• Service Providers that support our operations, as described above.
• Other parties as described in the "How We Share Personal Information" section, where allowed by law.

You may have the right under certain state laws to withdraw consent to our collection and sharing of consumer health data, to request access to and deletion of such data, and to appeal our decisions regarding your requests. You can exercise these rights using the methods described in the 'Additional State Law Consumer Rights' section or any state-specific notices we provide, including our California Privacy Policy and privacy request form.

ADDITIONAL STATE LAW CONSUMER RIGHTS

If you are a resident of California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, or other states with similar privacy laws, you may have additional rights to access and control your Personal Information. Exemptions may apply.

Right to Know / Access

You may have the right to request, up to the number of times allowed by applicable law, that we provide you with:

• The categories or specific pieces of Personal Information we collected about you.
• The categories of sources from which we collected your Personal Information.
• The business or commercial purposes for which we collected, sold, or shared your Personal Information.
• The categories of third parties with whom we have disclosed, sold, or shared your Personal Information.

We are not permitted to provide access to specific pieces of Personal Information if the Personal Information is sensitive or creates a high risk of potential harm from disclosure to an unauthorized person. To protect consumers' Personal Information, you must provide required information and/or documentation to verify your identity. We will process verified requests within the time period required by law, subject to any applicable exceptions and extensions.

If you are an Oregon resident, you may have the right to request once per 12-month period that we provide you with a list of specific third parties to whom we disclosed (a) your Personal Information or (b) any Personal Information. We have the discretion to determine which list to provide.

Right to Deletion

You may have the right to request that we delete Personal Information we collected about you. We are not required to honor a deletion request if a legal exemption applies, such as if we need the information to complete a requested or reasonably anticipated transaction, prevent security incidents or fraud, enable internal uses that are reasonably aligned with your expectations, or comply with legal obligations. We will process verified requests within the time period required by law, subject to applicable exceptions and extensions.

Right to Correction

You may have the right to request that we correct inaccurate Personal Information that we have on file about you. When you make your request, please provide the specific information that you believe is inaccurate and the correct information, along with any documentation that supports your proposed correction. We will only correct the information if we determine, based on the totality of the circumstances, that your correction is more likely than not accurate. We may also choose to delete the allegedly inaccurate information instead of correcting it, to the extent permitted by law.

If you have a password-protected online account with us, we may fulfill your request through that account; otherwise, we will give you the option to receive your fulfillment by mail or electronic delivery.

Right to Opt Out from the Sale or Sharing of Personal Information

We do not sell or share Personal Information for third-party marketing; "sale" and "sharing" are legal terms defined broadly by certain state privacy laws (for example, the CCPA/CPRA) and may include some disclosures described in this Privacy Policy. You may have the right to direct us not to sell or share your Personal Information. We will process such requests within the time period required by law, subject to any applicable exceptions and extensions.

Submitting a Request

If you are a resident of a state that provides privacy rights and you would like to exercise your rights, you may submit a request by email to information@rxtraclinical.com or using our online privacy request form available on our Sites.

After you submit your request, we may contact you to obtain additional information necessary to verify your identity. For example, we may require you to verify certain information in our files or submit a signed declaration under penalty of perjury verifying your identity. We will not be able to process certain requests without verifying your identity, so please respond promptly to our request.

Authorized Agent

If you are an authorized agent submitting a request on behalf of a consumer (for example, a California resident), you must provide a copy of a lawful power of attorney or a written signed authorization from the consumer along with proof of your identity. You may provide this documentation via email to information@rxtraclinical.com after submitting the request. We may contact you and the consumer on whose behalf you claim to act to verify your identity, the consumer's identity, and your authorization to act on the consumer's behalf.

Non-Discrimination Notice

We will not discriminate against any consumer for exercising their privacy rights under law or this Privacy Policy.

DO NOT TRACK SIGNALS AND GLOBAL PRIVACY CONTROLS

Because there is not yet a consensus on how companies should respond to web browser-based or other "Do Not Track" mechanisms, we currently do not respond to web browser Do Not Track signals that provide a method to opt out of the collection of information about online activities over time and across third-party websites or online services.

Where required by law (for example, in California), we will treat browser- or device-based signals that meet applicable legal standards (such as certain Global Privacy Control signals) as a request to opt out of certain "sales" or "sharing" of Personal Information.

We may revisit our policy on responding to these signals, in which case we will post a revised Privacy Policy on the Sites.

DATA RETENTION

We retain your Personal Information for as long as we have a relationship with you and for a period of time thereafter where there is an ongoing business need to retain it. This includes - but is not limited to - retention to:

• Maintain records of your interactions with us and Program Partners.
• Support ongoing or future matching to clinical trials or health programs that may be relevant to you.
• Comply with our legal, regulatory, tax, and accounting obligations.
• Resolve disputes, enforce our agreements, and protect our rights and the rights of others.
• Maintain and improve the security and integrity of our systems.

When we no longer have an ongoing business need or legal obligation to retain Personal Information, we will delete, anonymize, or otherwise dispose of it in accordance with our policies and applicable law.

COMPLIANCE WITH LAWS AND LAW ENFORCEMENT

We cooperate with government and law enforcement officials and private parties to enforce and comply with the law.

We may disclose Personal Information, Usage Data, and any other information about you to government or law enforcement officials or private parties if, in our sole discretion, we believe it is necessary or appropriate to:

• Respond to legal requests (including court orders, investigative demands, and subpoenas).
• Protect the safety, property, or rights of ourselves, consumers, or any other third party.
• Prevent or stop any illegal, unethical, or legally actionable activity.
• Comply with applicable law.

SECURITY OF YOUR INFORMATION

We use administrative, technical, and physical security measures designed to help protect your Personal Information. While we have taken reasonable steps to secure the Personal Information you provide to us, please be aware that no security measures are perfect or impenetrable and no method of data transmission can be guaranteed against interception or other types of misuse. Any information disclosed online is potentially vulnerable to interception and misuse by unauthorized parties.

Therefore, we cannot guarantee complete security if you provide Personal Information to us, and we encourage you to exercise discretion regarding the Personal Information you choose to disclose.

HOW TO CONTACT US

If you have any questions about our Sites, Services, or this Privacy Policy, or if you would like to exercise your privacy rights, please contact us using the information below: