Privacy Notice

1. Who are the Business and the service provider part of the personal data processing?

Mediwound (with an office at 42 Hayarkon Street, Yavne 8122745, Israel) acts as Business owner and has a contract with Alira Health 1 Grant Street, Suite 400, Framingham MA 01702, USA a global healthcare firm whose mission is to humanize healthcare and life sciences in partnership with patients. To deliver the Dashboard (a Customer Relationship Management tool, or CRM) Alira Health has partnered with Image Bloom (a company with an office at 21750 Hardy Oak Blvd., Ste 104, San Antonio, TX 78258, United States) who have subcontracted with Realtime (8535 Wurzbach Rd #210, San Antonio, TX 78240, United States).  

Realtime through its partner Image Bloom provides a Dashboard tailored to centralize all patient information coming through the landing page for consultation by site coordinators, and to facilitate patients’ recruitment for a clinical trial. A patient concierge employed by Alira Health also has access to the CRM to ensure patient’s eligibility and follow up with the sites to ensure that patient has been properly recontacted and that a first visit is planned.

When using the Dashboard, Realtime can be qualified differently.

Realtime, in partnership with Image Bloom, acts as a Database Owner (responsible for the processing of your information) for the following activities:

• Providing and ensuring the correct functioning of the Dashboard.
• Handling requests and complaints.
• Contractual relationship management.
• Dashboard security and functionality.
• Data analysis to improve the product.

Realtime may also act as a Database manager (or sub-contractor) under the instructions of its partner (Image Bloom), for all the information processed in the context of patient’s engagement related to a clinical trial.

Realtime, as Data Owners of personal data, has committed to comply with: 

• The Privacy Act of 1974
• The Federal Trade Commission Act (FTC Act
• The Electronic Communications Privacy Act (‘ECPA’) and the Computer Fraud and Abuse Act of 1986 (‘CFAA’).
• The California Consumer Privacy Act 2018 (CCPA), The California Consumer Privacy Rights Act 2020 (CPRA), The Californian Online Privacy Protection Act 2003 (CalOPPA);
• The Virginia Consumer Data Protection Act
• The Colorado Privacy Act
• The Utah Consumer Privacy Act & Utah Protection of Personal Information Act
• The Connecticut Data Privacy Act 
• The Massachusetts General Laws c. 214, ¬ß 1B‚ÄØ
• The Oregon Consumer Privacy Act (effective 1 July 2024)
• The Texas Data Privacy and Security Act (effective 1 July 2024) 
• The Washington My Health My Data Act (MHMDA)
• And all other applicable US Federal or state laws and regulations regarding data protection.

2. Why this Notice?

The Dashboard aims to simplify and enhance  patient recruitment for clinical studies by allowing Alira Health’s patient concierge, support staff and trial site staff to access patients’ clinical information (collected through the eligibility questionnaire and a pre-screening interview) and patients’ contact details to assess their eligibility and easily contact them to participate to the clinical trial.

Insofar, as allowing you to access the Dashboard involves the processing of your personal information, Realtime makes the protection of these personal information a priority. For us, protecting your information means protecting you. This is the reason we process your personal information securely and with the utmost prudence, respecting your rights and ensuring maximum transparency.

Please read this notice carefully before you start using the Dashboard, as it is important to us that you know how we process your personal information.

3. How is my privacy protected?

We consider the careful and secure processing of your personal information to be of the highest importance and we are committed to:

• Explain to you clearly what information we process and why, before we collect it.
• Collect only the personal information which is necessary for our purposes.
• If required by law, ask your consent before collection and elaboration of your information.
• Take all appropriate security measures to protect your personal information (we demand the same commitment from suppliers who process personal information on our behalf).
• Respect your rights regarding the personal information we process.
• Comply with information protection laws.
• Answer all your questions regarding the way we process your personal information.

4. Why, how and for how long do we collect your personal information?  

Depending on the purpose for which we process your personal information, we may need to process various kinds of personal information. We will keep them for no longer than necessary to fulfill the purposes for which we collected it, including any legal requirements.  To properly enable you to monitor patients and sites through this Dashboard, we may have to collect several types of personal information from and about you including information that falls within the categories listed below.

• Full Name
• Email Address
• Direct Phone Number
• Trial Site Name
• Contact Details of the Primary Investigator at Your Trial Site
• Primary Person of Contact at your Trial Site
• Primary Phone Number of the Trial Site

Collectively, the information described above and any other personally identifying information we may collect from and about you shall be referred to as “personal information.” We may collect personal information:

• Directly from you if, and when, you provide it to us, including when you interact with the Dashboard.
• From the clinical trial sponsor or contract research organization (CRO).

In the frame of our Dashboard management, we also process:

Category	Examples
Internet or other electronic network activity	Information regarding user’s interaction with the Dashboard. At connection time: Time zone.IP Address

The personal information we collect is used to enable us to perform the following activities:

1. Providing and ensuring the correct functioning of the Dashboard

The Dashboard needs to collect some information about you to enable you to monitor patients and sites through this Dashboard. For this purpose, first, you will receive a welcome email asking you to set up your account by creating a password. Once your account is set up, you will have access to tailored content (for instance, showing you content relevant to your site(s)).

The initial information required for your login and the information collected to run the Dashboard is collected by Alira Health based on your consent to use the Dashboard and to be bound by its Terms and Conditions (T&Cs). Once your account has been set up, you can start interacting with the Dashboard.

.                       

• Handling requests and complaints

We process your information to provide you with assistance and support, to fulfill your requests, and to respond to complaints or questions you ask us via the Dashboard, by email or by other means.

We may do so based on the T&Cs, or the contract you have agreed to for using the Dashboard and based on our legitimate interest. We consider that we have a lawful interest in answering your requests. We understand that the processing of this information is also beneficial to you to the extent that it enables us to assist you adequately and answer the queries raised.

• Contractual relationship management

We use your information to notify you of changes to the T&Cs or this Privacy Notice, or changes to Dashboard functionality. We may do this based on the T&Cs, the contract, you have agreed to for the use the Dashboard.

• Data analysis to improve the product

Realtime collects and processes a large amount of information, including via third-party software to improve the Dashboard and its usability.

To do this, the Dashboard collects information such as:

• Dashboard usage data.

Your data will be previously aggregated and, therefore, you will not be identifiable.

If you have any questions about the Dashboard, you can contact Realtime.

5. How long will my data be stored for?

The data is stored only for the period necessary to achieve the purposes for which it was collected (end of clinical trial recruitment period or if you no longer have a role within the trial) and to comply with applicable laws, rules, or regulations.

The duration of the processing of data collected for the purpose of clinical trials is not established by Realtime but is specified in the information provided to you by the Sponsor or the CRO.

6. Is my data safe?

We are committed to protecting the personal information you share with us.

Therefore, we take all appropriate technical and organizational measures to prevent any destruction, loss, alteration, dissemination, interference, or unauthorized access to such data, whether accidental or unlawful.

The cybersecurity program implemented by Realtime adheres to current industry standards and is continuously updated.

Despite all our efforts, we need your help to protect your data and prevent others from accessing your information. For this reason, we recommend you never share your password with anyone and that you close the web browser at the end of each session.

7. Who do you share my personal information with?

As a principle, your personal information will not be communicated, disclosed, or sold to third parties.

However, your data may be shared only:

• To enable you to use the Dashboard: to ensure the proper functioning of the Dashboard, we may provide access to some of your personal data to suppliers who, based on a contractual relationship, provide us with essential services such as provision of IT services and technical support. These service providers process personal data only by following our instructions in accordance with the agreements we have entered to protect your information.
• For the conduct of the recruitment related to a clinical trial: Realtime will share your personal information with the Sponsor and/or the CRO to ensure that you are properly involved in the conduct of the study by performing your responsibilities.

8. Data Sharing and transfer

We do not sell or trade to outside parties your personal data.  

Your personal data is processed in the United States but may also be processed in countries where our employees and suppliers are based. This means that your data may be processed in other countries than your country of residence, which may have different data protection rules (or may not have comparable levels of protection towards personal information).

In case Realtime transfers your data outside your country of residence, this will be carried out in one of the ways permitted by applicable law, and in compliance with the Privacy Protection Authority.

9. What are my rights?

Depending on your residency in the U.S., you may have certain additional information and rights. These information and rights are entitled by U.S. States providing for a specific privacy framework, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah and Virginia.

You may contact us if you wish to exercise the following rights:

You may have the right to request access to personal information we have collected about you, and how it is used and shared, free of charge (for which we have 45 days to respond). If requested, we shall provide you with a copy of your personal information which we collected (Right to know).

Here is the information you may have access to:

• the categories of personal information collected.the categories of sensitive personal information collected. the categories of sources from which the personal information or sensitive personal information is collected. the business purpose for such collection, sharing, or selling. the categories of third parties to whom to personal information or sensitive personal information is disclosed to. the specific pieces of personal information collected. the length of time that the business intends to retain each category of personal information and sensitive personal information.
  
  

You can request from Alira Health the deletion of personal information about you under certain conditions that will be provided by the Privacy Officer.

Right to portability. You can request your personal information be disclosed in a common file format.

Right to opt out for sales/share of your personal information: We will not sell/share any personal information we collect about you.

You also have the right to opt-out of processing for profiling/targeted advertising purposes. This means that you can direct us not to treat your personal information for profiling and targeted advertising purposes.

You have the right to opt in for sensitive data processing (not applicable under Iowa Consumer Data Protection Act, California privacy laws and Utah Consumer Privacy Act). This means that we will only process your sensitive personal information with your consent.

Right against automated decision making (not applicable under Utah Consumer Privacy Act): We will not make decisions about you based solely on an automated process without human input.

Do Not Track (“DNT”) requests (only applicable under the Californian Online Privacy Protection Act and the Delaware Online Privacy and Protection Act).

Some web browsers incorporate a “do-not-track” that signals to websites with which the browser communicates that a visitor does not want to have his/her online activity tracked. As of the October 2023, not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, Alira along with many other digital service operators do not currently respond to DNT signals. Therefore, if you don’t want to be tracked, please select the refuse Button available on the Cookies Banner or select your preference under the cookie settings. For more information about DNT signals, visit allaboutdnt.com.

California additional rights

If you are a Californian resident, we shall comply with The California Consumer Privacy Act 2018 (hereinafter the “CCPA”), The California Consumer Privacy Rights Act 2020 (hereinafter “CPRA”), The Californian Online Privacy Protection Act 2003 (hereinafter the “CalOPPA”).

Under CCPA/CPRA and CalOPPA provisions, additional information and rights shall be provided as follows:

“Shine the Light “and “Eraser” Laws. 

You may request a list of all third parties to which we have disclosed certain information for those third parties’ direct marketing purposes.

The right to know.

You may have the right to request that we disclose to you the personal information we have collected about you and how it is used and shared. Here is the information you may have access to:

• the categories of personal information collected.
• the categories of sensitive personal information collected.
• the categories of sources from which the personal information or sensitive personal information is collected.
• the business purpose for such collection, sharing, or selling.
• the categories of third parties to whom to personal information or sensitive personal information is disclosed to.
• the specific pieces of personal information collected.
• the length of time that the business intends to retain each category of personal information and sensitive personal information.

The right to limit use of sensitive personal information

You have the right to direct us to limit the use of your sensitive personal information to what’s necessary or reasonably expected to perform the service or provide the goods.

The right to not be subject to discrimination (“right to equal service and price”)

You have the right not to be denied of goods or services, to be charged for different prices or rates for goods or services or provided a different level or quality of goods or services.

You can also file a complaint with the California Privacy Protection Agency and, where appropriate, the California Attorney General’s office.

10. Authorities and complaints

You also have the right to lodge a complaint if you consider that your Personal Information has not been processed in accordance with the Privacy Laws applicable in your State of

United States

California:
California Privacy Protection Agency: info@cppa.ca.gov
Attorney General Website: https://oag.ca.gov/contact

Colorado:
Attorney General website: https://complaints.coag.gov/s/contact-us

Connecticut:
Attorney General website:  https://portal.ct.gov/AG/Contact-the-Attorney-Generals-Office/Contact-the-Attorney-Generals-Office#:~:text=For%20all%20general%20inquiries%2C%20please,call%20860%2D808%2D5318.

Oregon:
Attorney General website: https://www.doj.state.or.us/consumer-protection/contact-us/

Texas:
Attorney General website:  https://www.texasattorneygeneral.gov/contact-us

Virginia:
Attorney General website: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint

Utah:
Attorney General website: https://www.attorneygeneral.utah.gov/contact/complaint-form/

11. Any additional doubts or questions? Contact us

Herein we have tried to explain to you all the most important privacy aspects regarding the Dashboard.

However, if you have any other questions or wish to exercise any of your rights, as described above, please contact us.

You may contact our Privacy Officer by e-mail at:  alirahealth.dpo@mydata-trust.info

12. Updates and changes to this Notice

We may make changes to the Dashboard and, therefore, may need to revise this Privacy Notice where necessary. If so, we will notify you through a notice on the Dashboard home page or other appropriate means of communication.

Please remember to check this page periodically to stay informed about how Alira Health uses and protects your personal data. Your continued use of the Dashboard after we make changes is deemed to be acceptance of those changes.