Privacy Policy for CEREVASC, Inc.

Effective on: September 1, 2025

1. Introduction and Scope

CereVasc, Inc., and our affiliates (“CereVasc”, “we”, “us”, “our”) sponsor ethically approved clinical trials. We take the protection of personally identifiable information (“Personal Data”) very seriously. This Privacy Notice (the “Notice”) addresses individual participants whose Personal Data we may receive in connection with the clinical trials (“Trial” or “Trials”) we sponsor, healthcare providers, business contacts, and website visitors (“Data Subjects”).

Please read this Notice to learn what we are doing with your Personal Data, how we protect it, and how you can exercise your privacy rights under the data protection laws applicable to you such as the Personal Information Protection and Electronic Documents Act (“PIPEDA”) of Canada and the Personal Data Protection Act of Argentina (“PDPA”).

2. Controllership

Within the scope of this Notice, CereVasc generally acts as a data controller for the Personal Data processed in the context of the Trials we sponsor, and for the processing of your Personal Data that takes place when you visit our website. This means that we alone determine the purpose and means of the processing of your Personal Data.

In some jurisdictions, we are considered a “joint controller” with another organization, such as the study site where a Trial is being conducted. This means that we jointly, together with the other organization, determine the purpose and means of the processing of your Personal Data. If you would like to know more about any other data controllers who might be joint controllers together with CereVasc, you may ask your study doctor or the study site for further details, specifically relating to the Trial that you are participating in.

3. Categories of Personal Data

Personal Data of Individual Trial Participants

Even though we are a data controller for the Personal Data processed in the context of our Trials, CereVasc itself does not have access to identifiable Personal Data, meaning that we are unable to identify you personally from the information we have access to. Personal Data is collected by our service providers like the study site (the clinic or other healthcare facility where the Trial is being run) or other third parties, such as your doctors or our clinical research organizations. When any information relating to you is shared with us by our service providers, it will first be key-coded (also known as “pseudonymized”) so that we cannot identify you by any direct personal identifier (such as your name, social security number, address, or telephone number).

The following types of Personal Data may be processed in the context of our Trials:

basic identifying information, such as your first and last name;
contact information, such as your phone number, physical address, and email address;
location information, such as the location of your testing site and Trial location (i.e. study site);
healthcare information, such as the identity and contact information of your doctors and healthcare providers;
health information, such as your medical history, current health status and reaction to the Trial treatment;
your genetic information, race, and ethnic origin;
images (such as photographs and scans) and videos;
audio recordings of entry and exit interviews;
recordings of telemedicine (virtual) consultations with healthcare providers; and/or
identifiers and device information, such as IP address and associated location, operating system, and device IDs (e.g., when you visit a Trial-specific website).

You can ask your study doctor if you are unsure whether or not any specific Personal Data that you are being asked to provide is required as part of your participation in the Trial.

Personal Data of Healthcare Providers and Business Contacts

We may process the following types of Personal Data about healthcare providers in the context of our Trials:

basic identifying information, such as your first and last name;
contact information, such as your phone number, physical address, and email address;
professional and employment-related information, such as your qualifications and job titles;
location information, such as the location of your testing site and Trial location (i.e., study site); and/or
whatever additional information you may disclose to us, or which are included in documents, presentation slides, meeting minutes, memoranda and other records of business value to CereVasc.

Personal Data of Website Visitors

We may process the following types of Personal Data about website visitors who connect to us:

basic identifying information, such as your first and last name;
contact information, such as your phone number, physical address, and email address;
IP address and high-level location information; and/or
whatever information you share with us via the website or other contact points listed on the website.

In relation to all Data Subjects, we collect only as much Personal Data as is required to fulfill the purpose for which the information is collected. Some of the Personal Data may be collected on a once-off basis, and others may be collected on a continuous basis as may be necessary to achieve the purposes of the processing.

4. Consent

We collect, use, and disclose your Personal Data only with your knowledge and consent, except where otherwise permitted or required by applicable data protection laws. Generally, your consent must be express, for example, in relation to sensitive Personal Data, however in certain instances and as permitted by applicable laws, your consent may be implied depending on the context and sensitivity of the Personal Data. You may withdraw your consent at any time, subject to legal or contractual restrictions and by providing us with reasonable notice.

Depending on where you live, we may process your Personal Data on other grounds where your consent is not required for us to do so. For example, to fulfill a contract with you or to comply with legal obligations.

5. How We Receive Personal Data

We may receive your Personal Data when:

you provide it directly to us (including when you provide your Personal Data to one of our service providers acting on our behalf);
a study doctor (also known as an “investigator”) or other healthcare personnel at the study site provides it to us, or your healthcare provider provides it to us;
we receive it from the clinical research organization that conducts the Trial on our behalf;
you visit one of our Trial-specific websites or online portals;
a third party includes it in professional materials that are shared with us, such as brochures, presentation slides, invoices, memoranda, and other business documentation; and
you provide it to us, the clinical research organization, or a study doctor when you complete a pre-screening questionnaire to confirm your eligibility to participate in a Trial.

6. Purpose of Processing

We may process your Personal Data for the purposes of conducting our business, including:

responding to your requests or questions (including requests to exercise your data protection rights) by using your basic identifying and contact information. This may also include reviewing other information about you that we have on record in order to respond to your requests or questions;
facilitating your access to our website and other resources;
assessing your qualifications and suitability to assist with our Trials;
managing and facilitating the Trial by using all the information set out under Section 3 above as may be necessary;
enabling your participation in the Trial by using some or all of the information described under Section 3 above;
answering the research questions for the Trial and aggregating data to generate statistics relating to the Trial and/or investigational treatment or health treatment by using your location information, health care information, health information, and/or your genetic information;
arranging your transportation to or from the study site and overnight accommodations, as needed, by using your basic identifying and contact information and location information;
sending you reminders about your appointments at the study site, or to take your medication on time by using your basic identifying and contact information;
monitoring and reporting on any adverse events, such as negative side effects by using your health care information, health information, and/or your genetic information;
developing new medical devices or health treatments by using your health care information, health information, and/or your genetic information;
complying with legislation governing Trials;
disclosing your Personal Data to the appropriate regulatory authorities, auditors, and ethics committees, if required by law; and/or
communicating with you on the status of the Trial by using your basic identifying and contact information.

If you are a Trial participant, we also process your Personal Data for the specific purposes described in the informed consent form provided to you by Trial personnel.

In some instances, providing your Personal Data is mandatory for the purposes of processing listed above. If you choose not to provide the requested information, we will not be able to fulfill some of these purposes described above.

If we need to process your Personal Data for a new purpose, other than those listed above, we will obtain your consent to process your Personal Data for this new purpose, unless applicable laws permit otherwise.

7. Cookies

A “cookie” is a small file stored on your device that contains information about your device. We may use cookies to provide website functionality, authentication (session management), usage analytics (web analytics), and to remember your settings, and to generally improve our websites.

For more information on how we use cookies, please refer to the cookie notice available on our website.

8. Data Retention

We will retain your Personal Data until we fulfill the purposes listed above, or for as long as we are required to keep it to comply with applicable laws or regulations.

If you are a participant in a Trial, once your information has been entered into the Trial records, we cannot remove it without affecting the accuracy of the Trial and the test results. Some laws require us to keep Trial records for at least 15 years after the conclusion of the Trial. We will ensure that your Personal Data is safeguarded at all times.

9. Sharing Personal Data With Third Parties

We may share Personal Data with our service providers who process Personal Data on our behalf, and who agree to use the Personal Data only to assist us in fulfilling the purposes of processing as described in Section 5 above, or as required by law. Your Personal Data will be stored in various databases provided by our service providers described below. CereVasc remains responsible for the protection of your Personal Data housed in these databases and can be contacted at any time by the contact details listed in section 16 below.

Our service providers include parties providing:

managed information technology services, for which they may process some or all of the information described under Section 3 above;
contract/clinical research organization services, for which they may process some or all of the information described under Section 3 above;
patient recruitment services, for which your basic identifying information, contact information, location information, healthcare information, health information, and genetic information may be processed;
pathology laboratory services, for which they may receive your basic identifying information, healthcare information, health information, and genetic information;
medical device development services, for which your basic identifying information, healthcare information, health information, and genetic information may be processed;
laboratory services, for which your basic identifying information, healthcare information, health information, and genetic information may be processed;
data management and biostatistics services for which they may process your basic identifying information, location information, healthcare information, health information, genetic information, images and audio recordings and identifiers and device information;
cardiac safety services for which your basic identifying information, contact information, healthcare information, health information, and genetic information may be processed;
Trial oversight, imaging, videos and digital patient services for which they may process your basic identifying information, contact information, location information, healthcare information, health information, genetic information and, audio recordings of your entry or exit interviews;
quality assurance, and safety software and related services for which they may process your basic identifying information, contact information, location information, healthcare information, health information, and genetic information;
data storage and archiving software and related services for which some or all of the information described under Section 3 above may be processed;
data analytics and reporting software and services, for which they may process your basic identifying information, location information, healthcare information, health information, genetic information, images and audio recordings and identifiers and device information;
services related to the collection, storage, testing, and transportation of biological material, for which your basic identifying information, location information, healthcare information, health information, and genetic information may be processed;
software that randomly decides which treatment you will receive during the Trial, for which they may process your basic identifying information, healthcare information, health information, and genetic information;
logistics and transport services, in pursuit of which they may process your basic identifying information, contact information, and location information; and/or
electronic data capture software and hardware, for which some or all of the information described under Section 3 above may be processed.

10. International Transfers of Personal Data

In order to achieve the purposes of processing your Personal Data, we may need to make international transfers of your Personal Data outside of the countries you are located in. In such cases, we take steps to protect your Personal Data and we will comply with the local law requirements of these jurisdictions relating to international transfers of Personal Data.

11. Other Disclosures of Your Personal Data

We may disclose your Personal Data:

with regulators or competent authorities, to the extent necessary to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws);
to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties);
if, in the future, we sell or transfer, or consider selling or transferring, part or all of our company, business, shares or assets to a third party, and we disclose your Personal Data to such third party in connection with the sale or transfer; or
in the event that we are acquired by, or merged with, a third-party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your Personal Data in connection with the foregoing events.

If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

12. Data Integrity and Security

We have implemented and will maintain appropriate technical, administrative, organizational and physical measures that are reasonably designed to help protect Personal Data from unauthorized processing. This includes unauthorized access, disclosure, alteration, theft or destruction. Some of those measures include encryption and redaction, and we also have service providers to look after information security and privacy.

13. Your Privacy Rights

Depending on where you live, you may have specific rights regarding your Personal Data that we collect and process. Please note that you can only exercise these rights with respect to Personal Data that we process about you when we act as a data controller under the relevant data protection laws.

Right to be Informed

You have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things. Where applicable, we will aim to provide the requested information within ten calendar days of having received your request.

Right to Access

If we process your Personal Data, you will have the right to request access to that Personal Data. This means that you have the right to ask us to confirm whether or not we process your Personal Data, and, where that is the case, obtain a copy of or access to your Personal Data and other related information (such as the types of personal data we have, the purposes for which we collected your Personal Data, and the categories of third parties that we share it with). In certain limited circumstances, we may not be able to provide you with access to all the details concerning the processing of your Personal Data, and where this is the case, we will provide you with reasons for us not being able to do so.

Right to Rectification

You can also ask us to update or correct, anything that you think is wrong with the Personal Data we have about you, and to complete any incomplete Personal Data.

Right to Erasure

You can also ask us to delete inaccurate or outdated Personal Data. Sometimes we can delete your information, but other times it is not possible for either technical or legal reasons. If that is the case, we will inform you of our reason for denying your deletion request.

Right to Withdraw Consent

As discussed in Section 6 above, if we requested your consent to process your Personal Data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. If you withdraw your consent, you may be ineligible to participate in the Trial.

We will aim to respond to your request within a reasonable time, and at minimal cost, or where practical, at no cost to you.

To exercise any of your privacy rights or raise any other questions, please contact us by using the information in the “Contact Us” section below.

14. Privacy of Children

Our Trials are generally not directed at, or intended for use by, children under the age of 18.

15. Contact Us

If you are a participant in a Trial and you have any inquiries or complaints about this Notice or our processing of your Personal Data, please first speak with your study doctor if your Personal Data was collected in the context of a Trial.

If you are not a participant in a Trial, you may contact us directly by completing this form or by contacting our privacy team at [INSERT EMAIL ADDRESS] if you have any inquiries or complaints.

You may also contact our Data Protection Officer directly using the contact details listed in Section 15 below.

Please allow up to four weeks for us to reply.

16. Data Protection Officer

We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly by completing this form, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe

100 M Street S.E.
Suite 600 Washington, D.C.
20003 USA
+1 (617) 398-7067

Email: experts@verasafe.com
Web: https://www.verasafe.com/about-verasafe/contact-us/

17. Changes to this Notice

If we change this Notice, we will publish the revised Notice on our website. We will also update the “Effective” date.