Privacy Notice

UBC is a global contract research organization (“CRO”) and technology provider in the healthcare and clinical research industry that provides business-to-business Services to pharmaceutical companies and related organizations (“Clients”). As part of these Services, UBC may collect, use, and disclose (“Process”) Personal Information about you in various ways, including:

1. When you interact with our Sites, request information from us, or receive communications from us for authorized marketing purposes;
2. When you interact with us, directly, as part of a Client’s program; or
3. When a Client has hired us to provide our Services, on their behalf, and provide us your Personal Information.

The term “Personal Information” refers to many types of information that can identify, relate to, or describe a person and can link the information directly, or indirectly, to a person or household. This includes “protected health information” (“PHI”) as defined under the United States Health Insurance Portability and Accountability Act of 1996, (“HIPAA”), “Personal Data,” as defined under the European Union (“EU”) General Data Protection Regulation 2016/679 (“GDPR”) and the United Kingdom (“UK”) Data Protection Act 2018, and “Personal Information,” as defined under the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et. seq., as amended (“CCPA”), and the California Privacy Rights Act (“CPRA”), collectively “Data Protection Laws.”

Please note that UBC operates globally, and this is not an exhaustive list of all applicable Data Protection Laws. UBC strives to ensure its practices and this Privacy Notice meets requirements worldwide, but you may always contact us, as outlined under Section 18 below for additional information if it’s not available in this Privacy Notice.

Additionally, UBC may Process “Usage Data” about you in various ways for its business activities. ‘Usage Data’ are information about an individual’s activity (on or through the Services) that, by itself, does not identify an individual, such as a web-browser type, operating system, and webpages visited. Usage Data are not considered Personal Information, unless it can (with other information) identify an individual, as outlined under certain Data Protection Laws.  In those limited scenarios, Usage Data may be considered Personal Information.

As outlined under Section 1 above, there are various ways we will Process Personal Information about individuals. For each use case, there may be different types of Personal Information required to perform our Services or fulfill your requests. In general, this includes the following categories of individuals, purposes, and legal basis for which we Process your Personal Information:

A. Patients and Clinical Trial Participants

Purpose and Legal Basis

For patients and clinical trial participants, Personal Information will be Processed (e.g., collected, stored, retrieved consulted, disclosed or shared, erased or destroyed), as instructed by our Clients, as the data controllers, to provide our Services, as listed under a contract, and in all cases, consistent with applicable law. Our Processing activities are based on the relevant contract terms, your informed consent obtained by the relevant Client, healthcare provider, or UBC, to participate in a study or program, UBC’s legitimate business interests in performing our Services, and where relevant, as necessary for archiving in the public interest and scientific, research, or statistical purposes.

Please note that in many instances, unless otherwise agreed to in a contract between a Client and UBC, healthcare professionals will be responsible for obtaining your informed consent for a particular study or program.

Types of Personal Information

Patients

If you are a patient enrolled in a program that UBC is supporting, such as Patient Access Solutions, UBC may Process the following Personal Information about you:

• Your full name and contact information (such as phone or mobile phone number, email address, and physical address);*
• Demographic information, such as date of birth or gender;
• Racial or ethnic origins;
• Health information, including physical or psychological state of health, disease state, medical history, medical treatment or diagnosis, healthcare provider information, and health insurance identification or account information;
• Voice recordings for quality assurance or safety calls; and
• Other data, as may be specified in an informed consent provided by your healthcare provider or prescriber.

*Please note that UBC may utilize “tokenization” technology to help ensure your identity, or identifying information, is separated from sensitive health data. For more information, please review Section 16 (Security) of this Privacy Notice.

Clinical Trial Participants

If you are participating in a clinical study where UBC is providing support Services on a Client’s behalf (i.e., sponsor), UBC may Process the following Personal Information about you:

• An assigned identifier (e.g., Subject ID);
• Demographic information, such as date of birth (or age/year of birth) and gender;
• Racial or ethnicity origins;
• Health information related to the particular study, including physical or psychological state of health, disease state, medical history, medical treatment or diagnosis, healthcare provider information; and
• Other information, as may be specified in an informed consent provided by a study sponsor or UBC (as directed by a sponsor).

B. Healthcare Professionals (“HCPs”)

Purpose and Legal Basis

As part of our Services, UBC may interact with HCPs located at clinical trial sites, doctor’s offices, and hospitals, as may be required to perform our Services. Additionally, employees at these facilities may use UBC platforms, or other technologies, where your Personal Information, and other employees’ Personal Information, may be stored. This Personal Information will be Processed, as instructed by our Clients, as the data controllers, to provide our Services based on consent obtained by the relevant HCP, or Client, and UBC’s legitimate business interests in performing our Services.

Types of Personal Information

The following Personal Information may be Processed by UBC in support of the relevant Services:

• Your full name and business contact information (such as phone number, email address, and physical address);
• Job title and other information about your employment, where required;
• Log-in data: An individual’s username, email address, password, password reset questions, access code, security questions and answers;
• Usage Data (Possibly): IP address, cookies, log data, and other Internet activity; and
• Identity Confirmation (Possibly): Handwritten and digital signature, and where necessary, other required information to verify identity.

If you are a healthcare professional, or an institutional healthcare provider, in some cases you may be responsible for obtaining any legally required authorization, consent, or other permission from your patients before providing their Personal Information to UBC in support of our Services.  By submitting any Personal Information about a patient, you represent and warrant to UBC that you have obtained all required permissions, where legally required to do so.

C. Client Employees

Purpose and Legal Basis

As part of our Services, UBC will interact with Clients’ employees who have hired UBC to perform the relevant Services. Additionally, Clients’ employees may use UBC platforms, or other technologies, where your Personal Information, and other employees’ Personal Information, may be stored. This Personal Information will be Processed, as instructed by our Clients, as the data controllers (or joint controllers), to provide our Services based on the relevant contractual agreement and UBC’s legitimate business interests in performing our Services.

Types of Personal Information

The following Personal Information may be Processed by UBC in support of the relevant Services:

• Your full name and business contact information (such as phone number, email address, and physical address);
• Job title and other information about your employment, where required;
• Log-in data: An individual’s username, email address, password, password reset questions, access code, security questions and answers;
• Usage Data (Possibly): IP address, cookies, log data, and other Internet activity; and
• Identity Confirmation (Possibly): Handwritten and digital signature, and where necessary, other required information to verify identity.

D. Third-Party Suppliers

Purposes and Legal Basis

As part of our Services, UBC may interact with Third-Party Suppliers’ employees who have been hired by UBC to support Services on UBC’s behalf. Additionally, Third-Party Suppliers’ employees may use UBC platforms, or other technologies, where your Personal Information, and other employees’ Personal Information, may be stored. This Personal Information will be Processed, as agreed to within a service agreement and within UBC’s legitimate business interests in performing our Services or facilitating the supplier relationship.

Types of Personal Information

The following Personal Information may be Processed by UBC in support of the relevant Services:

• Your full name and business contact information (such as phone number, email address, and physical address);
• Job title and other information about your employment, where required;
• Log-in data: An individual’s username, email address, password, password reset questions, access code, security questions and answers;
• Usage Data (Possibly): IP address, cookies, log data, and other Internet activity; and
• Identity Confirmation (Possibly): Handwritten and digital signature, and where necessary, other required information to verify identity.

E. Website User/Prospects

Purposes and Legal Basis

As a website user, or someone who is seeking information from us about our Services, we may collect your Personal Information that are collected directly through our Sites.  Your Personal Information will be Processed as part of the use of our Sites and for reach-outs we may do to assist you with questions related to our Services, based on your consent, and for our legitimate interest in providing you information and resources related to our Services.

You have the right to opt-out of our direct marketing at any time. You can do this by; (i) following the instructions in the communication where this is an electronic message; or (ii) contacting us using the methods noted below under Section 8 below, “Your Rights.”

Types of Personal Information

The following Personal Information may be Processed by UBC in support of the relevant Services:

• (Possibly) Name (first and last); 
• (Where relevant) Log-in data (e.g., username, email address, password, password reset questions); 
• (Possibly) Business communication data (e.g., telephone, fax, mobile phone, e-mail); and 
• (Possibly) connection data (e.g., logs, IP address, and cookies). 

F. Researchers and Authors

Purpose and Legal Basis

As part of the Services of Evidinno Outcomes Research Inc. (“Evidinno”), including literature reviews, medical writing, and related AI-powered solutions, Evidinno may Process Personal Information relating to authors of, and contributors to, scientific and medical literature available in the public domain. This includes information associated with published research papers, clinical study reports, and related academic or scientific publications used to support evidence synthesis, systematic literature reviews, and AI-assisted research workflows. This Personal Information is Processed on the basis of UBC’s and Evidinno’s legitimate business interests in performing their Services and, where applicable, to fulfill contractual obligations to Clients. Where publicly available information is used, Evidinno relies on the lawful basis of legitimate interests, balanced against the reasonable expectations of individuals whose information appears in published scientific works.

Types of Personal Information

The following Personal Information may be Processed by Evidinno in support of the relevant Services:

• Full name and professional contact information (such as institutional email address and physical address), where publicly available;
• Institutional or organizational affiliation and academic credentials;
• Publication history, authorship contributions, and related bibliographic information; and
• Corresponding author details, including contact information published in connection with a research paper.

As part of our Services and operations, UBC may share your Personal Information with third-parties, including Clients, healthcare providers, and third-party suppliers, as agreed and instructed under a contract, or as provided within the appropriate informed consent.  This includes the following parties:

• Clients (and their service providers). As standard, UBC has contracts with its Clients to provide Services in assisting with their healthcare programs or clinical trials. Therefore, we will share the Personal Information necessary to perform the relevant Services, as agreed under the applicable service agreement.
• Healthcare Providers/Sites. UBC may also share information you provide us with your healthcare provider, or clinicians, when you have enrolled in a program that requires us to share your information.
• UBC Affiliates and Subsidiaries. We will share your Personal Information with other UBC group companies (such as UBC Late Stage (UK) Limited – for more details about UBC group companies visit: http://www.ubc.com/contact/locations or see Section 18 below), as necessary to provide the Services you have requested or to fulfill any of the other purposes set out above.
• Third-Party Suppliers: We may also share your Personal Information with our third-party suppliers, who may perform functions for UBC, such as processing and analyzing data, designing and maintaining systems, customer service, marketing (e.g., HubSpot and Salesforce) and promotions, and any other relevant Services contracted between a third-party supplier and UBC. These third parties include, but are not limited to: UBC customers, research consultants, information technology service providers (including customer relationship management suppliers), and email providers.
• Law Enforcement or Regulatory Authorities: In certain circumstances, we may be legally obligated to share your Personal Information with government authorities, regulatory authorities (e.g., FDA) or law enforcement officials for the purposes (i.e., Services) outlined above, if mandated by law (for example, in response to a court order, subpoena, search warrant, law, or regulation) or if required for the legal protection of our legitimate interests in compliance with relevant laws. For disclosures under HIPAA, please review Section 14 and 15 below.

As part of UBC’s Services and operations, it may be necessary to transfer your Personal Information outside of your region or country of residence. For example, UBC utilizes Microsoft Azure to host its SharePoint Online environments, and UBC utilizes data centers located within the United States. Therefore, your data may be stored in a secure data center located in the United States. Additionally, UBC employees, and our Clients’ employees, may access your data remotely from other regions required to perform the Services.

Some jurisdictions (such as EU/UK) may require specific conditions to ensure your Personal Information is secure when transferred internationally to a region that has not been considered “adequate” by the relevant data protection authority. Where a transfer occurs, UBC will ensure the protections required under relevant Data Protection Laws are implemented in alignment with relevant Client contractual obligations and as otherwise necessary to comply with the relevant Data Protection Laws. For the specific security measures used to support requirements for the European Economic Area (“EEA”), UK, and Switzerland, please see Section 16 below.

It’s important to note that specific data transfers, and disclosures, will often depend on the relevant program, project, or study that you are involved with.  If you would like to receive additional information about relevant data transfers, you may contact us at  privacy@ubc.com or request information as described under Section 8 (Your Rights) below.

If you have questions about the specific security measures used to protect data transfers, or how UBC complies with country-specific requirements, please contact us at privacy@ubc.com, or as specified under Section 18 (Contact Us).

UBC stores Personal Information as instructed by our Clients and as required by relevant laws and regulations, including as follows:

• Our Services. Except where restricted by law and subject to this Privacy Notice, we will retain and use your Personal Information for as long as it is needed to perform or provide you (or our Clients) with the relevant Services and for any required retention period, as contracted under a relevant service agreement.
• Business Relationships. We will also keep your Personal Information to document our business relationship with you, and as necessary to comply with our legal obligations, resolve disputes, and enforce our service agreements.
• When we use your Personal Information for marketing purposes, as provided with your consent (where required), we use this information until you make us aware by unsubscribing to future contact. We also keep a record of the fact that you have asked us not to send you direct marketing or to use your Personal Information so that we can respect your request in the future.
• Legal Requirements. When we use Personal Information to meet relevant legal requirements, we hold this information for as long as the relevant law requires it (for example, we may hold records to help prevent fraud and other restricted or illegal activities).

When we store your Personal Information, UBC uses data collection, storage, data minimization practices, and security measures to protect your Personal Information against unauthorized access, alteration, disclosure, or destruction.

Our Sites may contain links to other websites, services, and applications that are not owned or controlled by us (“Linked Sites”). We provide these Linked Sites’ hyperlinks to allow you to conveniently access information that may be of interest to you. This Privacy Notice does not apply to Linked Sites. If you decide to visit any Linked Sites, you will be subject to the privacy notice, terms of use, or other policies (if any) of the relevant Linked Site(s). We strongly recommend that you review the privacy policy, statements, or any other legal notices posted on any Linked Site(s).

We do not knowingly collect Personal Information from children under the age of thirteen (13) through our Sites. If you believe UBC may have any information from (or about) a child under the age of thirteen (13), please contact our data privacy office at: privacy@ubc.com.

Additional Personal Information may be collected from children as it relates to a specific program or study in accordance with a client’s instructions, the informed consent provided to a children’s parent, guardian, or caregiver, and in alignment with local requirements.

UBC complies with relevant Data Protection Laws and offers you choices concerning the Personal Information you (or Clients) share with us. Where UBC is Processing Personal Information on its Clients’ behalf, certain requests may need to be fulfilled by (or in conjunction with) UBC’s Clients (i.e., the data controllers).

Additionally, certain rights may be relevant to the region where you reside. For example, if you reside in the European Union, or within certain States in the United States, your rights may differ. In all such cases, UBC will strive to fulfill all legitimate requests, including the following (where relevant and applicable):

To exercise any of your rights, you can:

• Complete a “Data Subject Access Request” Form available here: https://forms.office.com/r/mcZjAun0Rh;
• Submit a detailed request to privacy@ubc.com;  
• Call UBC’s toll-free phone number at: +1-866-244-9625 (US) or + 44 208 834 9595 (UK); or

Additionally, requests can also come from online communication channels, from a complaint email, or as one of a few issues raised in a single communication. UBC will use all reasonable efforts to respond to these requests, but it is advisable to contact us directly as outlined in this Privacy Notice.

Complaints:

Under applicable Data Protection Laws, you may have the right to file a complaint. If you any unresolved issues, we encourage you to reach out to privacy@ubc.com. However, you may also be entitled to file a complaint with applicable authorities. Please click here to identify your relevant State Attorney General if you have any unresolved questions, or concerns, or wish to file a complaint with the relevant State Attorney General, where applicable.

This Section serves as UBC’s general notice to individuals that AI tools and technologies may be used in connection with the delivery of UBC’s Services and operations, as further described below. Where this Privacy Notice applies, individuals are hereby informed of UBC’s use of AI and the general nature of AI-assisted processing that may occur in connection with their Personal Information.

Where explicit consent is required for AI-assisted processing, whether under applicable law, regulation, or contractual obligation, such consent will be sought separately, at the point of collection or engagement.

The AI Governance Framework

Where UBC uses AI, we will do so in alignment with our AI Governance Framework, which is a collection of policies, procedures, and practices that ensure compliance with company standards and relevant laws and regulations. The core tenants of our AI Governance Framework include:

• AI Legislation and Data Protection Laws Compliance – UBC is committed to the responsible use of AI in a manner consistent with applicable AI legislation and applicable Data Protection Laws, including HIPAA, GDPR, Good Practices (“GxP”), and emerging AI-specific frameworks. UBC monitors the evolving regulatory landscape and reviews its Framework on an ongoing basis to reflect changes in law, guidance, and industry standards.
• Safety and Effectiveness – Where the use of AI may pose risks to the safety or effectiveness of UBC’s Services, UBC seeks to evaluate those tools against applicable risk and harm considerations by use of documented risk frameworks.
• Algorithm Discrimination Protections – UBC does not knowingly deploy AI tools in a manner that results in unlawful discrimination against individuals on the basis of protected characteristics. Where required, UBC evaluates AI tools it adopts for bias and discriminatory impact and takes appropriate steps to address identified concerns.
• Transparency – UBC is committed to being open about how it uses AI in connection with its operations and Services. Where AI tools are used in ways that may be material to individuals or to the Services UBC provides, UBC endeavors to provide appropriate notice. UBC does not use AI to make fully automated decisions that produce legal or similarly significant effects on individuals without human involvement.
• Human Governance and Supervision – UBC maintains human oversight over the use of AI within its operations. AI tools are used to assist and augment human judgment, not to replace it. Qualified personnel retain responsibility for reviewing and validating AI-assisted outputs, particularly in contexts involving regulated activities, or decisions with meaningful consequences.

UBC recognizes that AI technologies and the legal and regulatory frameworks governing their use are rapidly evolving. While UBC is committed to the responsible use of AI and to compliance with applicable laws and regulations, the development of AI tools, integrations, and related guidance may outpace the ability of any organization to reflect those changes in real time. UBC will endeavor to update this Privacy Notice and its AI Governance Framework as material changes occur, but individuals are encouraged to check this Privacy Notice periodically for updates.

General Use

UBC may use AI tools and technologies, including large language models (“LLMs”), from third-party providers, such as OpenAI’s ChatGPT, Anthropic’s Claude, and Microsoft Copilot (integrated within Microsoft 365 applications). These tools support internal and external business functions, including administrative, operational, and communications activities, as well as software development, and are used to increase operational efficiency for UBC’s workforce.

UBC’s use of these tools are governed by UBC’s AI Governance Framework, contractual requirements,  AI regulations, and applicable Data Protection Laws. Where the use of an AI tool may have implications for regulated services, such use is verified or validated in accordance with the Good Practices described below.

Good Practices

 Where applicable and required, UBC shall validate its AI systems and supporting technologies in accordance with applicable GxP requirements and recognized computerized system validation frameworks. UBC applies a risk-based approach to validation, proportionate to the intended use of the AI system and its potential impact on patient safety, product quality, and data integrity. UBC monitors developments in applicable regulatory guidance, including from the FDA, EMA, and MHRA, and updates its validation practices accordingly. Where such technologies are integrated into UBC Services, UBC shall provide notice and define requirements as part of its contracting practices, consistent with applicable law, regulation, and client requirements.

Evidinno

As part of its Services, Evidinno uses AI-assisted tools and technologies to support evidence synthesis, systematic literature reviews, and scientific research workflows. These tools may process publicly available scientific and medical literature, including information associated with published research, to identify, organize, and analyze relevant evidence in support of client engagements. Where such processing involves Personal Information, it is conducted in accordance with this Privacy Notice, UBC’s AI Governance Framework and related policies and procedures of UBC, and applicable Data Protection Laws.

Use of Personal Information

Any Personal Information processed through an AI system will be handled in accordance with this Privacy Notice and applicable Data Protection Laws. UBC does not use Personal Information to train AI models (or allow third parties to train AI models) unless explicit consent has been obtained or such use is otherwise permitted by applicable law.

Supplemental Disclosures

Specific AI-assisted Services or applications may be subject to supplemental disclosures or consent mechanisms. Where required, such disclosures will be provided at the point of collection or engagement and should be read together with this Privacy Notice.

For additional information about UBC’s use of AI, please contact us as outlined in Section 18 of this Privacy Notice.

If you live in the EEA, or other countries outside of the United States (e.g., UK and Switzerland), you may have additional rights given to you under the GDPR or other relevant Data Protection Laws.  The following applies:

Data Transfers

In addition to the information outlined under Section 4, above, if you live in the EEA, we may transfer your Personal Information outside the EEA to countries that do not offer the same level of protection as required by the EEA (e.g., to a UBC group company or other third-party supplier (as outlined above under Section 3) in the United States (“U.S.”).

To protect your Personal Information, we will only perform data transfers based on: (i) an adequacy decision by the EU Commission; (ii) subject to the EU Commission approved standard contractual clauses; or (iii) any other legally, allowable data transfer method.

Registration

UBC maintains office locations within the EU, UK, and Switzerland (as detailed under Section 18), and is registered as a data controller, with the local data protection authority (i.e., the Information Commissioner’s Office (“ICO”), in the UK, as required under the UK GDPR.  

Government Requests

If UBC receives a request from a government authority outside of the EEA, UK, or Switzerland to access your Personal Information, we will use reasonable, and lawful efforts, to ensure your Personal Information are protected and that disclosures meet relevant Data Protection Laws’ standards.

Complaints

If you are in the EEA, or another country that allows the rights mentioned under this Privacy Notice, and you have unresolved concerns, or at any time you do not believe that we have complied with this Privacy Notice, you have the right to file a complaint with your local data protection authority.

If you are a California resident, you may be entitled to additional rights, as defined under the CCPA and the CPRA.

In addition to the rights identified in the other sections of this Privacy Notice, you have the right, subject to certain exceptions under the CCPA, and other relevant laws and regulations, to request that companies disclose certain information to you about their collection, and use, of your Personal Information.

This includes the following:

Exercising Your Rights: If you are a California resident and wish to exercise your rights, please send your request through any of the methods noted above, under Section 8, at: “Your Rights,” including our toll-free number.  

Authorized Agent: The CCPA permits California residents to use an authorized agent to make privacy rights requests. We require the authorized agent to provide us with proof of the California resident’s written permission (for example, a power of attorney) that shows the authorized agent has the authority to submit the relevant request. An authorized agent must follow the process described under Section 8, above, to make a request (i.e., under “Your Rights”).  The authorized agent must also verify his or her own identity. We will confirm the agent’s authority with the relevant California resident related to the request that was made.

Information Exempt from the CCPA: Please note that certain information that is governed under the California Confidentiality of Medical Information Act (“CMIA”), HIPAA, or is subject to the Federal Policy for the Protection of Human Subjects, also known as the “Common Rule,” under good clinical practice guidelines (issued by the International Counsel for Harmonisation) or under human subject protection requirements of the United States Food and Drug Administration (i.e., FDA), is not considered Personal Information with respect to CCPA rights listed above.  However, additional rights might be available under those laws and standards. Please contact privacy@ubc.com for more information.

No Sharing of Personal Information for Direct Marketing Purposes: We do not share Personal Information with other people, or non-affiliated businesses, for their direct marketing purposes.

Non-Discrimination: UBC does not discriminate against any relevant treatment for exercising any of your rights.

Right to Notice of Financial Incentives: California residents have the right to information on how businesses may offer financial incentives, including payments to consumers as compensation, for the collection of Personal Information, the sale of Personal Information, or the deletion of Personal Information. Where relevant, any incentives to collect, or share, your Personal Information will be outlined in an informed consent, project-specific privacy notice, or terms of service associated with the relevant Services offered.

California (and Delaware) “Do-Not-Track” disclosures: Our Site honors your web browser’s “Do-Not-Track” settings concerning targeted advertising.  See the Cookie Policy (Section 13) for additional information.

Global Privacy Control (“GPC”): We recognize GPC as a valid opt-out signal under applicable Data Protection Laws, including the CPRA and similar state privacy statutes. Where a GPC signal is detected, UBC will treat it as a request to opt out of the sale or sharing of your Personal Information, including through Cookie Technologies, to the extent required by law. See the Cookie Policy (Section 13) for additional information.

Nevada Residents: Although UBC does not sell Personal Information, Nevada residents have the right to submit a verified request directing UBC not to sell their Personal Information.  If you are a Nevada resident and would like to submit such a request, please send your request through any of the methods noted above, under Section 8, “ Your Rights.”

This State-specific policy describes our practices for handling Consumer Health Data (as defined under Washington’s My Health My Data Act (“MHMDA”) and other similar state laws) that we may collect about you through our operations, and Services, and will prevail over any conflicting provisions in this Privacy Notice regarding Consumer Health Data.

Consumer Health Data includes information that are linked, or reasonably linkable, to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. This includes information about medical conditions, as well as non-medical information, such as biometric data, information about use of non-prescription medication, or use of health-related products. However, this does not include public, or peer-reviewed scientific, historical, or statistical research in the public interest that is overseen by an institutional review board (“IRB”), human-subjects research ethics review board, other similar independent oversight agency, or PHI as covered under HIPAA.

A. Categories of Consumer Health Data

In general, UBC Processes Personal Information for research purposes or Personal Information that may be considered PHI and regulated under HIPAA. In these instances, MHMDA may not apply. However, to the extent that UBC is collecting Consumer Health Data on individuals, such as patients, the following information may be collected:

• Product Interests: Information about your interest in certain health-related programs, such as when you visit websites, we operate on our Clients’ behalf (i.e., sponsors);
• Individual Health Conditions, Treatments, and Diseases: Information about your health history, symptoms, or treatment, such as pregnancy status.
• Bodily Function, Vital Signs and Measurements: Information about your body, such as digestion, metabolism, immune support, or height and weight.
• Reproductive and Sexual Health Information: Information about your reproductive system, or sexual well-being, collected when it is relevant to a particular study or program, such as information about your periods or pregnancy status.
• Genetic Information: Information that concerns your genetic characteristics, which may be relevant to a particular Client program.
• Biometric Data: Information such as genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data;
• Precise Location Information: that could reasonably indicate a resident’s attempt to acquire, or receive, health services or supplies;
• Research Programs: Information you provide when participating in research studies, or responding to our surveys, including any of the above categories about physical or mental health, medical history, or other health-related information.

B. Purposes

We may use your Consumer Health Data for the following purposes:

• The Services: Performing our Services for you, on our Client’s behalf, and request information from you to participate in a sponsored program.
• Patient Management: To provide you the associated Services, we may use your Personal Information for the following purposes:

• • Identifying, and authenticating, you to our different programs;
  • Administering, and maintaining, accounts and preferences, if relevant; and
  • Helping you manage our Site, or app, preferences.
• Data Subject Communications: Communications including:
  • Responding to your questions, or requests, for Personal Information;
  • Sending transactional messages (such as account statements or confirmations); and
  • Sending marketing communications about our Services (or our Clients’ products or services), surveys, or invitations.

• Quality and Safety: Ensuring our Services are safe and effective, including:
  • Quality control, training, and analytics;
  • Safety maintenance and verification; and
  • System administration and technology management, including optimizing our Sites and applications.
• Security: Detecting threats and protecting against malicious or fraudulent activity.
• Recordkeeping and Auditing:  Recordkeeping and auditing, interactions with users, including logs, and records maintained as part of transaction information.
• Legal/Compliance: Risk management, audit, investigations, reporting, and other legal and compliance reasons.

C. Sources of Consumer Health Data

We collect Consumer Health Data from the following sources:

• From you, such as when you join a Client program or volunteer the Personal Information in connection with potential of participating in a program;
• From our Clients, who provide us your Personal Information to provide you with benefits, such as patient access and affordability solutions;
• From other third-party sources, such as data brokers who provide us with consumer information that may benefit from a sponsor-related program; and
• We may also gather, or obtain, Consumer Health Data by analyzing other non-health related information we have about you or other consumers.

D. Disclosures

As outlined above under Section 3 above, UBC may share Consumer Health Data with other third-parties as necessary, this includes UBC affiliates, as further outlined under Section 18 (Contact Us).

E. Complaints

If you have any issues, or questions, we encourage you to reach out to us at privacy@ubc.com, or as specified under Section 18 (Contact Us). However, if you have any unresolved questions, or concerns, you are entitled to file a complaint with the Washington State Attorney General, at: www.atg.wa.gov/file-complaint.

What Are Cookies?

“Cookies” are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. They allow the website to recognize your device on subsequent visits and remember certain information about your preferences or actions. In addition to Cookies, we may use other similar tracking technologies on the Site, including:

• Web beacons / pixel tags: Small graphic files embedded in web pages or emails that record whether a page or email was opened and may collect your IP address and browser type.
• Local storage and session storage: Browser-based storage mechanisms that function similarly to cookies but are stored locally on your device.
• Log files: Automatically recorded files that capture information about visits to the Sites, including IP addresses, browser type, referring URLs, and pages accessed.

Cookies can be “persistent” or “session” Cookies. Persistent Cookies remain on your personal computer, or mobile device, when you go offline. Session Cookies are used to personalize your user experience, to determine ways to improve our Sites, used for Sites content, and the Services we offer. These Cookies are deleted when you close your web browser session. Persistent cookies are used to collect information, such as IP addresses, browser type, Internet Service Provider (“ISP”), referring/exit pages, platform type, date/time stamp, and the number of clicks.

Why Do We Use Cookies?

We use “Cookies” and similar tracking technologies to track the activity on our Sites (and relevant Services) and store certain information. Tracking technologies used are beacons, tags, and scripts to collect, and track, information and to improve, and analyze, our Sites, applications, and relevant Services.

We use the following general Cookies categories, which are provided in the Cookie Notice, generated by Cookiebot:

Additional Information about Necessary Cookies:

Some of the Cookies, and tracking technologies, that we use on our Sites are strictly necessary and they are there to technically enable our Sites, and its components, as well as to enable relevant security measures. Necessary Cookies are activated without a user’s consent because these are necessary for the Sites to work properly and in a secure way.  All other Cookies and tracking technologies, not classified as necessary, are subject to your consent when visiting our Sites. 

Be aware that even if you accept only “necessary cookies,” you still may see third-party trackers that are enabled for our relevant Services we use on our Sites.  Third-party trackers are enabled because these third-party services may also have Cookies, or trackers, they have classified as necessary to perform the relevant Services we requested. 

Another reason for seeing third-party trackers on your web browser is that you have already used, or accessed, a third-party service before visiting our Sites. For example, if you landed on our Sites using a search engine, such as “Google Search,” it is likely that Google’s search engine may have enabled trackers on your web browser (e.g., related to your preferences regarding Google’s own tracking technologies). You can read more details about how Google may use your Personal Information in this context by visiting Google’s Privacy Terms.  Additionally, Necessary Cookies by third parties, such as LinkedIn, may be stored to capture a user’s Cookie consent for our current Site domains.

Additional Information about Other Cookies:

We use certain third-party services on our Sites to organize, monitor, analyze log data, and may be used to perform reach out to you. Third-party services include (but are not limited to) the following:

• Google Analytics: To ensure that our Sites content remains up-to-date, user-oriented, and comprehensive, we use Google Analytics, a web-analysis tool from Google, Inc. (“Google”) that enables us to optimize our Services for you. Google Analytics uses Cookies that track your preferences during your visit to our Sites. This allows us to simplify navigation, for example, helping us to make our Sites more user-friendly. The information that is generated in this process (including your IP address) is unknown/anonymized, i.e., your log data are not identifiable. An evaluation, for our reporting purposes, is carried out after the anonymization process. You can prevent Google’s possession, and use, of this information that is generated by the Cookie and concerns your activity on our Sites (including your IP address), by visiting Google’s Privacy Controls and updating your settings. Further information about Google’s terms of use, and privacy, options are available here:
• English: https://policies.google.com/privacy?hl=en
• German: http://www.google.com/analytics/terms/de.html.
• To opt-out of being tracked by Google Analytics across all websites, you may download the Google Analytics opt-out browser, here: http://tools.google.com/dlpage/gaoptout.  

• HubSpot: We use HubSpot to report on, and manage, your activity on our Sites. This service uses Cookies for tracking activity across our Sites and to enable us to track marketing preferences. HubSpot enables us, among other things, to manage existing Clients and prospects. With HubSpot’s help, we can capture, sort, and analyze Client interactions via email, social media, or phone, across different channels. The Personal Information collected in this way can be evaluated, and used, for communication with the potential Client or for marketing measures (e.g., newsletter). In addition, HubSpot allows us functionality to allow users to opt-out of further communications.
• For additional information, you can view the privacy policy of this service provider at https://legal.hubspot.com/privacy-policy.

• LinkedIn: Our Sites incorporate LinkedIn social features, such as content sharing functionality, which may result in LinkedIn setting Cookies on your device. These Cookies support technical operations associated with LinkedIn’s platform, such as load balancing, and may allow LinkedIn to associate your visit to our Sites with your LinkedIn account if you are logged in. Personal Information collected through this functionality is processed by LinkedIn in accordance with its own privacy policy. You may manage your LinkedIn data and advertising preferences through your LinkedIn account settings.

• For additional information, you can view the privacy policy of this service provider at https://linkedin.com/legal/privacy-policy.

How Can I Adjust My Cookie Preferences?

When you first visit our Sites, you can set preferences for which Cookies you would like to enable. If you would like to modify these settings, you may do so at any time by using the following link: https://ubc.com/cookie-consent/

The Cookie Preference Center will also give you a full accounting of the specific Cookies that are collected for each category outlined above.

Alternatively, most web browsers allow some control over most Cookies through the web- browser settings. You can instruct your web browser to refuse all Cookies or to indicate when a Cookie is being sent.  However, if you do not accept Cookies, you may not be able to use some portions of our Sites or relevant Services. To find out more about Cookies, including how to see what Cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.

Do Not Track Signals:

UBC.com does respond to Do-Not-Track signals. Do-Not-Track (“DNT”) is a privacy preference that users can set in certain web browsers. When DNT is enabled, the browser sends a signal to websites, analytics providers, and other third parties indicating that the user does not wish to be tracked across websites for behavioral advertising or similar purposes. DNT is a voluntary, browser-level signal and is not universally recognized or legally required to be honored by all websites under applicable law. To find out more about “Do-Not-Track,” please visit: http://www.allaboutdnt.com.  

Global Privacy Control (“GPC”):

We recognize GPC as a valid opt-out signal under applicable Data Protection Laws, including the CPRA and similar state privacy statutes. Where a GPC signal is detected, UBC will treat it as a request to opt out of the sale or sharing of your Personal Information, including through Cookies technologies, to the extent required by law. GPC signals operate at the browser or device level and must be configured separately on each browser or device you use.

When you visit our Sites, Cookiebot, our cookie management platform, will automatically detect your preferences and indicate that your “GPC signal is honored.” If you have concerns or questions about your Cookie preferences, you may contact us at any time as outlined under Section 18 (Contact Us) below.

How Can I Learn More About Cookies?

If you have additional questions about Cookies, or how they work, we suggest consulting the “Help” section of your web browser or review the following website: https://www.aboutcookies.org, which offers guidance for all modern web browsers.

UBC provides a range of U.S.-based Services that may involve the Processing of Protected Health Information (“PHI”) as defined under HIPAA. For these Services, UBC complies with specific obligations and requirements outlined in its Clients’ service agreements, as detailed below:

• The Risk Evaluation and Mitigation Strategies (“REMS”):

REMS is a drug safety program that the U.S. Food and Drug Administration (“FDA”) can require for certain medications with serious safety concerns to help ensure the benefits of the medication outweigh its risks. UBC, along with its subsidiary Examoto, LLC, offers Services to support Clients in meeting REMS program requirements. As specified in Client service agreements, UBC does not qualify as a business associate or covered entity and Processes and uses PHI strictly in line with agreed-upon program enrollment forms. The collected PHI is used exclusively in accordance with FDA-regulated program requirements.

• Patient Access Services (“PAS”):

UBC’s PAS Services offers manufacturers assistance with reimbursement and access support, affordability solutions, and care coordination. This includes UBC’s subsidiary Market Share Movers, LLC, which offers additional assistance Services and co-pay solutions. As specified in Client service agreements, UBC does not qualify as a business associate or covered entity and Processes and uses PHI strictly in line with agreed-upon program enrollment forms. PHI will be used as specified in those enrollment forms, and as agreed under a service agreement.

• UBC Pharmacy Division:

As outlined in Section 15 below, UBC operates as a Covered Entity (as defined under HIPAA) for its pharmacy-related Services, where PHI is collected to administer health-related Services. If PHI is used or disclosed from the Pharmacy Division to other UBC subsidiaries, these subsidiaries are regarded as business associates (as defined under HIPAA) and handle such transfers according to UBC’s intercompany data transfer agreement, which includes a business associate agreement.

For all Services where UBC is Processing PHI, it ensures the security of its Processing in accordance with Section 16 (Security) below. Additionally, and where relevant, UBC will support any accounting of disclosure requirements under HIPPA as outlined below under Section 15(C), 15 (D), and 15 (E) (In relation to women’s reproductive healthcare).

Under HIPAA, the United BioSource Pharmacy, LLC subsidiary of United BioSource LLC (“Pharmacy Division”), as standard and unless contracted otherwise, is considered a Covered Entity when it collects, discloses, stores, transmits, or uses PHI and electronic PHI (“ePHI”) (together, “PHI”), for administration of health-related Services. For those activities performed by the Pharmacy Division, including PHI collection, use and disclosure, Section 14 serves as the company’s Notice of Privacy Practices.

A. Our Responsibilities

UBC’s Pharmacy Division provides Services to manufacturers in connecting the manufacturers, and specialty pharmacies, with dispensing their drug or therapeutic. For these Services, the UBC Pharmacy Division collects, and uses, PHI from participating doctor’s offices or sites, who are responsible for enrolling patients in the relevant Client program. UBC then facilitates, and discloses, PHI to relevant specialty pharmacies to dispense the drug or therapeutic.  

Where the Pharmacy Division collects, uses, or Processes PHI, it will maintain the privacy, and security, of this information, as further described in this Privacy Notice, this Section related to HIPAA, and Section 16, Security, below. Additionally, we will let you know promptly if a breach occurs that may have compromised the privacy, or security, of your PHI.

B. PHI Uses and Disclosures

The following categories describe different ways in which we may use or disclose your PHI. The examples provided under the categories below are not intended to be comprehensive, but instead, to identify some of the more common PHI uses, and disclosures, within the relevant category.

1. For the purposes of treatment, payment, or healthcare operations.

• UBC contracts with manufacturers who will share PHI with UBC to facilitate the dispensing of drugs, or therapeutics, with specialty pharmacies, in conjunction with your physicians, and other healthcare professionals, for treatment purposes. We in turn disclose PHI to authorized healthcare professionals who need access to your prescriptions, or other relevant PHI, to provide you the relative drug or therapeutic.
• UBC does not receive payments from individuals, or facilitate payments, from health insurers for its Services. All such payments are facilitated by your healthcare provider or the manufacturer.
• Healthcare Operations. We may use, and disclose, your PHI for activities necessary to support our business, such as, but not limited to: performing quality verification or internal audits; and creation of limited data sets and de-identified health information.

2. Other Permitted Uses and Disclosures Without Your Authorization

UBC may also use, or disclose, PHI without your authorization for the following purposes, where relevant to our Services:

• When Required By Law. For example: for judicial and administrative proceedings under a court or administrative order or to report information related to victims of abuse, neglect, or domestic violence, where required by law to do so. Please note that for any treatment related to women’s reproductive health, the disclosure of such information will only be shared, as described under subsection (E) below.
• For Health and Safety Purposes. For example: to avert a serious threat to your health, or safety, or any other person; to an authorized public health authority, or individual, to perform public health and safety activities, such as preventing, or controlling, disease, injury, disability; or to meet the reporting and tracking requirements of governmental agencies, such as the FDA.
• For Law Enforcement, Specialized Government, or Regulatory Functions. For example: intelligence, national security activities, security clearance activities, and protection of public officials; and health oversight agencies for audits, examinations, investigations, inspections, and licensures.
• For Lawsuits, Disputes, and Other Legal Actions. For example: in connection with lawsuits or other legal proceedings, in response to a court or administrative order, or in response to a subpoena, warrant, summons, or other lawful process when certain requirements are met.
• To Business Associates. UBC Pharmacy may share information to other individuals or third parties, called “business associates,” such as UBC affiliates, consultants, subcontractors, or auditors, who help us with our business activities. If we share your PHI with business associates, they are required to maintain your PHI privacy and security.
• For Active Members of the Military and Veterans. For example: to comply with the laws, and regulations, governing military services and veterans’ affairs.
• For Workers’ Compensation. For example: to comply with the laws which provide benefits for work-related illnesses or injuries.
• In Emergency Situations. For example: to a family member, or close, personal friend, involved in your care in the event of an emergency, or to a disaster relief entity in the event of a disaster.
• To Others Involved in Your Care. For example: under limited circumstances, to a member of your family, a relative, a close friend, or other person you identify who is directly involved in your healthcare; bill payment related to your healthcare; or if you are seriously injured and unable to make a healthcare decision for yourself, we may disclose your PHI to a family member if we determine that disclosure is in your best interest. If you do not want this information to be shared, you may request that these disclosures be restricted as outlined later in this Notice.
• To Personal Representatives. For example: to people you have authorized to act on your behalf, or people who have a legal right to act on your behalf, such as parents for un-emancipated minors and individuals who have Power of Attorney for adults.
• For Research Purposes. For example: for research purposes to the extent that certain steps required by law are taken to protect your privacy.
• To Correctional Facilities. If you are an inmate in a correctional facility, for certain purposes, such as protecting your health and safety or that of others.

3. Any Other Uses and Disclosures Require Your Express Authorization

For any other PHI uses, and disclosures, not described in this Privacy Notice, including certain marketing activities or the sale of PHI, we will obtain your written authorization.  You may revoke your authorization, in writing, at any time.  If you revoke your authorization, we will no longer use or disclose your PHI, except to the extent we have acted in reliance on your authorization.

C. Your Rights under HIPAA

In addition to your rights outlined under Section 8, above, of this Privacy Notice, you may have additional rights under HIPAA regarding your PHI use and disclosure.  Please note, that UBC may need to collaborate with its Clients, healthcare professionals, and special pharmacies, to facilitate exercising your rights, which include the following:

D. Making a Request

If you wish to exercise any of your rights under HIPAA (outlined above), you may make your request to, or by another method, as specified under Section 8, Your Rights, above.

Timing. As standard, UBC will fulfil legitimate requests within thirty (30) days from receipt of the relevant request, as outlined under Section 8, Your Rights, above. However, HIPAA allows for up to 60 days, and additional time may be warranted due to the relevant request.

Fees. For HIPAA requests, e.g., accounting of disclosures, these requests will be free of charge within a single twelve (12) month period.  For multiple requests within a twelve (12) month period, UBC reserves the right to charge a reasonable, cost-based fee for each additional request (by the same individual) made within the relevant twelve (12) month period. You will be notified before any charge is applied and can withdraw, or modify, your request.

We have implemented reasonable security measures designed to prevent Personal Information loss, misuse, unauthorized access, disclosure, or modification for any information we Process as described in this Privacy Notice. This includes, where relevant, alignment to security measures required under relevant Data Protection Laws, and other laws and regulations, including the EU Network and Information Security Directive 2 2022/2555 (“NIS2”); the EU Cyber Resilience Act (“CRA”); and the EU Critical Entities Resilience Act 2022/2557 (“CER”).

Additionally, UBC utilizes pseudonymization for many of its clinical trial Services, and for Services that are limited to the U.S. market, such as its risk evaluation and mitigation strategy (“REMS”) programs, and patient access services (“PAS”) programs, Processing activities will incorporate a tokenization process designed to replace patient participants’ identifiable, or sensitive Personal Information, with an encrypted “token” that limits the ability to reverse engineer the relevant underlying patient information or identity. 

Please keep in mind that it is not possible to achieve a perfect state of data security. Although we use reasonable security measures to protect your Personal Information from unauthorized access, we cannot absolutely guarantee the security of your Personal Information or that your Personal Information will not be accessed, disclosed, altered, or destroyed. Where relevant, we will notify you of any disclosure of a breach of your unencrypted, electronically stored Personal Information, as required by Data Protection Laws. If the country in which you reside allows us to notify you of a breach, either by email or a clear posting on our Sites, you agree to accept the notice in that format.

We use Personal Information as outlined, and described, in this Privacy Notice. However, from time-to-time, we may, at our discretion, modify this Privacy Notice, indicated by a new revision date at the top of the notice. It is important that you check this Privacy Notice when you visit our Sites. Your use of our Sites, and your continued use of our Sites after this Privacy Notice has been updated, indicates your agreement, and acceptance, of this Privacy Notice, including the modifications made as of the date of your use.

If you have a question about this Privacy Notice, UBC’s data protection practices/procedures, Personal Information use, would like to access this Privacy Notice in an alternative format, you can contact our data privacy office at: privacy@ubc.com, or write to us at:

This Notice is generally applicable to all UBC affiliates, including the following:

• United BioSource, LLC (Delaware);
• United BioSource Patient Solutions, Inc. (Delaware);
• UBC Late Stage, Inc. (Missouri);
• UBC Pharmacy, LLC (Delaware);
• United BioSource Corporation, S.L. (Spain);
• United BioSource (Italy) S.R.L.;
• UBC Late Stage (UK) Ltd. (UK);
• United BioSource GmbH (Germany);
• United BioSource (Suisse) SA (Switzerland);
• United BioSource (HCA Canada) Company;
• UBC Late Stage (UK) Limited French Branch;
• Examoto, LLC (Pennsylvania);
• Market Share Movers, LLC (Pennsylvania); and
• Evidinno Outcomes Research Inc. (British Columbia, Canada).