About this Privacy Notice#
This privacy notice is intended to assist healthcare professionals (HCPs), investigators, clinical research staff and other medical or scientific experts who work with or otherwise interact professionally with Comanche Biopharma in understanding how we collect, use, protect and transfer your Personal Data. It also explains how you can exercise your privacy rights and contact us.
Comanche Biopharma Corp. is a clinical-stage biopharmaceutical company and clinical trial sponsor. In this Notice, Comanche Biopharma Corp. and its affiliates are collectively referred to as “Comanche Biopharma”, “we”, “our” or “us”. We are committed to protecting the privacy and security of your Personal Data. This Notice covers activities such as clinical-trial feasibility, site selection and oversight, scientific and medical engagement, advisory work, contracting, payments, events and permitted professional communications. It does not govern the processing of clinical trial participants’ Personal Data who receive separate privacy information through the relevant study or programme.
Who is the controller of your Personal Data?#
For the purposes of applicable Data Protection Legislation, Comanche Biopharma Corp. or its affiliate which has a relationship with you is the controller of your Personal Data and determines the purposes and means of the processing, including where it acts as the clinical trial sponsor.
If another Comanche Biopharma affiliate or a collaborator independently determines the purposes and means of processing for a particular activity, that organisation will be a separate controller for that activity and will be identified, where appropriate, in the relevant study documentation, contract, communication or other material provided to you.
Where the European Union (EU) GDPR applies, we process Personal Data in accordance with Regulation (EU) 2016/679 and applicable national law. Where UK law applies, we process Personal Data in accordance with the UK GDPR and Data Protection Act 2018, as amended.
What Personal Data do we collect?#
| Category | Examples |
|---|---|
| Identity and professional contact information | Name, professional title, business address, telephone number, email address and institution or practice details. |
| Professional qualifications and experience | Qualifications, licences, professional memberships, curriculum vitae, training records, specialty, role, work history and professional expertise. |
| Clinical research and site information | Study role, delegation and training records, site affiliation, feasibility responses, trial experience, research interests, publications and records needed for trial conduct and oversight. |
| Contractual and financial information | Contract details, fee arrangements, invoices, expenses, payment details and tax information where needed to make or document payments. |
| Compliance and transparency information | Conflict-of-interest information, financial disclosure information, transfers of value and other records required for legal, regulatory or industry-code compliance. |
| Scientific and professional engagement information | Advisory-board participation, event attendance, questions, feedback, survey responses, professional interests and interactions with medical or scientific teams. |
| Communications and preferences | Correspondence, requests, marketing or scientific-communication preferences and opt-out records. |
| Publicly available professional information | Information from professional registers, institutional websites, publications, conference materials and other legitimate public or professional sources. |
How do we collect your Personal Data?#
We collect Personal Data directly from you and through your professional relationship with Comanche Biopharma. We may also receive information from your institution or site, contract research organisations (CROs), service providers, professional or regulatory registers, publicly available professional sources, collaborators and other organisations involved in a clinical trial or scientific activity.
How do we use your Personal Data and what are our lawful bases?#
| Purpose | Typical lawful basis where EU/UK law applies |
|---|---|
| Assess trial feasibility, select and qualify investigators or sites, and manage trial start-up, conduct, oversight, monitoring, audit and close-out. | Legitimate interests in conducting and managing clinical research; legal obligation where binding clinical-trial or regulatory law requires the processing, including requirements concerning investigator or site suitability, monitoring, safety or essential records; performance of a contract only where you personally are party to the relevant agreement. |
| Document qualifications, training, delegation, conflicts of interest and other essential trial records. | Legal obligation where binding clinical-trial or regulatory law requires the records; otherwise legitimate interests in demonstrating appropriate and compliant trial conduct. |
| Enter into and manage consultancy, investigator, advisory or other professional agreements and make payments or reimburse expenses. | Performance of a contract where you personally are party to the relevant agreement; legal obligation for accounting, tax and financial reporting; legitimate interests for related administration where Article 6(1)(b) does not apply. |
| Respond to medical or scientific questions and manage professional relationships. | Legitimate interests in scientific exchange and professional relationship management; performance of a contract only where you personally are party to the relevant agreement and the processing is necessary for that contract. |
| Invite you to relevant scientific, educational, advisory or professional activities and obtain professional feedback. | Legitimate interests, subject to applicable professional, marketing and electronic-communications rules; performance of a contract where you personally agree to provide the relevant service. |
| Send permitted scientific, corporate or product-related communications. | Consent where required by electronic-marketing law; otherwise legitimate interests where permitted. You can opt out at any time. |
| Meet pharmacovigilance, safety, transparency, disclosure, audit, inspection and regulatory obligations. | Legal obligation and, where relevant, legitimate interests in regulatory compliance and patient safety. |
| Establish, exercise or defend legal claims; investigate misconduct; protect systems and business operations. | Legitimate interests and/or legal obligation. |
Special Category Personal Data#
We do not normally need Special Category Personal Data about HCPs for ordinary professional relationship management. In limited cases you may provide information such as health or accessibility information for an event or engagement, or other sensitive information may arise in a compliance, safety or research context. We process such information only where an Article 9 or equivalent local-law condition applies, such as explicit consent where appropriate, substantial public interest, public health, scientific research with appropriate safeguards, legal claims, or another condition permitted by applicable law.
If you report an adverse event or product complaint that contains a patient’s health information, the patient information is handled under the relevant pharmacovigilance, safety or clinical-trial process and should be limited to what is necessary.
Information about other people#
If you provide Personal Data about another person, such as a colleague, study team member or professional contact, please make sure that you are entitled to provide it and, where required, that the person has received appropriate privacy information. Please do not provide patient-identifying information unless the relevant clinical, safety or regulatory process requires it and you are authorised to do so.
Who do we share your Personal Data with?#
Where necessary and lawful, we may share HCP Personal Data with:
- other Comanche affiliates;
- CROs, clinical research vendors, study sites, laboratories and other service providers supporting a trial or programme;
- IT, cloud, communications, event, finance and payment service providers;
- regulators, ethics committees, health authorities, auditors and inspection bodies;
- professional advisers, insurers and accountants;
- research collaborators, licensees and strategic partners where relevant to the activity; and
- prospective purchasers or transaction counterparties in a corporate transaction, subject to appropriate safeguards.
International transfers#
Comanche Biopharma operates internationally and uses service providers in multiple countries. Your Personal Data may therefore be transferred to, or accessed from, a country outside the country in which it was collected.
Where EU/EEA (European Economic Area) transfer restrictions apply, we use a mechanism permitted by the EU GDPR. Depending on the destination and recipient, this may include an adequacy decision, the European Commission Standard Contractual Clauses or another lawful safeguard. Where required, we assess whether additional measures are needed to ensure an essentially equivalent level of protection.
Where UK transfer restrictions apply, we use a mechanism permitted by UK law, such as UK adequacy regulations or an appropriate safeguard including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where required, we assess the transfer against the UK statutory data protection test and apply additional protections if necessary.
You can contact our privacy contact if you would like more information about the safeguards used for a particular transfer.
How long do we keep your Personal Data?#
We apply retention periods according to the purpose and the record involved rather than applying one clinical-trial period to all HCP information.
- Essential clinical-trial records: where your Personal Data forms part of the trial master file (TMF) or other essential trial records, it is retained for the period required by the applicable clinical-trial rules. Under the EU Clinical Trials Regulation, the TMF is retained for at least 25 years after the end of the trial. In the UK, for clinical-trial applications submitted before 28 April 2026, the previous rules generally require the TMF to be retained for at least 5 years after the trial has concluded; for applications submitted on or after 28 April 2026, the new rules generally require the TMF to be retained for at least 25 years. Separate or longer requirements may apply to particular records, including participant medical files.
- Contracts, payments and tax records: retained for the period required by applicable contract, accounting, tax and limitation rules.
- General professional relationship records: retained while relevant to the professional relationship and for an appropriate period afterwards to support compliance, business continuity and legal claims.
- Marketing preferences: retained while communications continue; limited suppression information may be retained after opt-out so that we respect your preference.
How do we protect your Personal Data?#
We use appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include, as appropriate to the processing, access controls, confidentiality obligations, security awareness, encryption where technically suitable, and incident-response procedures.
Access to Personal Data is limited to people who need it for their role. Where a service provider processes Personal Data on our behalf, we require appropriate privacy and security obligations in the relevant agreement.
What are your privacy rights?#
Depending on the law that applies and the reason we use your Personal Data, you may have the right to:
- ask whether we process your Personal Data and obtain a copy;
- ask us to correct inaccurate or incomplete Personal Data;
- ask us to erase Personal Data in certain circumstances;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive or transmit certain Personal Data in a portable format where the right applies;
- withdraw consent at any time where processing is based on consent, without affecting processing already carried out; and
- lodge a complaint with a competent privacy or data protection authority at any time, however, we would appreciate the opportunity to address your concerns first, so please contact us in the first instance.
These rights are not absolute. For example, we may need to keep information where a legal or regulatory retention obligation applies. We may ask for information needed to verify your identity before responding to a request.
Where UK data-protection law applies, Comanche Biopharma will handle data-protection complaints in accordance with applicable UK requirements. You may also complain directly to the competent supervisory authority or privacy regulator. In the UK, this is the UK data-protection regulator (ICO). In the EU/EEA, you may complain to the competent supervisory authority under the EU GDPR.
Automated decision-making#
We do not currently make decisions about HCPs that have legal or similarly significant effects based solely on automated processing. If this changes, we will provide the information and safeguards required by applicable law.
Keeping your information accurate#
Please tell us or your Comanche Biopharma contact if professional or contact information relevant to our relationship changes. We may also update professional information from reliable sources where this is appropriate and lawful.
Changes to this Privacy Notice#
We may update this notice to reflect changes in our clinical, scientific or business activities or applicable law. The current version will be published in the Privacy Centre and will show its effective date.
Contact Us#
If you would like to exercise a privacy right, or you have a question or complaint about this notice or the way your Personal Data is processed, please contact our Data Protection Officer using the details below.
Data Protection Officer (DPO)
The DPO Centre Netherlands B.V.
Vijzelstraat 68, Amsterdam 1017HL, Netherlands
UK Representative (where applicable)
The DPO Centre Limited
50 Liverpool Street, London EC2M 7PY, United Kingdom
The Organisation
Comanche Biopharma Corp.
50 Beharrell Street, Unit B, Concord, MA 01742, United States