CTI Biopharma Privacy Notice

Effective on: October 14, 2021

Introduction and Scope

CTI BioPharma Corp. (“CTI,” “our,” “us”) takes the protection of your personal data very seriously. This Privacy Notice (this “Notice”) describes how we collect, use, disclose, and otherwise process personal data of individuals (“data subjects,” “you,” “your”) in connection with:

  • conducting clinical trials of drug substances (“Trial” or “Trials”);
  • your use or consumption of our products; and
  • your use of our website(s).

We will provide specific terms, privacy notices, and consent forms to you at the time we collect your personal data in connection with our Trials. Such notices will govern how we process your personal data in that context.

Controllership

In the context of this Notice, CTI acts as a data controller for the data we process. This means that we decide how and why personal data is collected and processed, or, in other words, we determine the purpose and means of the processing of your personal data.

In some jurisdictions, for purposes of our Trials, we may be considered a “joint controller” with another organization, such as the study site (i.e. the hospital, clinic or other healthcare facility) where the Trial is being conducted. This means that we jointly, together with the other organization, determine the purpose and means of the processing of your personal data. If you would like to know more about any other data controllers who might be joint controllers together with CTI, you may ask your study doctor or the study site for further details, specifically relating to the Trial that you participated in.

Categories of Data Subjects,

We process personal data about the following types of individuals:

  • clinical trial participants;
  • compassionate-use patients;
  • physicians and other health care professionals, including clinical trial investigators;
  • researchers;
  • pharmacists;
  • contractors;
  • consultants;
  • consumers of our products; and
  • website visitors.

Categories of Personal Data

Even though we are a data controller for the personal data processed in the context of our Trials, CTI itself does not have access to identifiable personal data of Trial participants, meaning that we are unable to identify you personally from the information we have access to. Personal data is collected by our service providers (like the study site or our clinical research organizations) or other third parties, such as your doctors. When any information relating to you is shared with us by our service providers, it will first be key-coded (also known as “pseudonymized”) so that we cannot identify you by any direct personal identifier (such as your name, social security number, address, or telephone number).

The following types of personal data may be processed about individual Trial participants (in the context of our Trials) and consumers of our products:

  • basic identifying information, such as your first and last name;
  • contact information, such as your phone number, physical address and email address;
  • location information, such as the location of your testing site and Trial location (i.e. study site);
  • health care information, such as the identity and contact information of your doctors and other health care providers;
  • health information, such as your medical history, current health status and reaction to the product/Trial drug or health treatment;
  • your genetic information; and
  • identifiers and device information, such as IP address and associated location, operating system, and device IDs (e.g. when you visit a CTI website).

You can ask your study doctor if you are unsure whether or not any specific personal data that you are being asked to provide is required as part of your participation in a Trial.

We may process the following types of personal data about healthcare providers in the context of our Trials and in the context of adverse event reporting:

  • basic identifying information, such as your first and last name;
  • contact information, such as your phone number, physical address and email address;
  • professional and employment related information, such as your qualifications and job titles;
  • location information, such as the location of your medical practice.

We may process the following types of personal data about website visitors:

  • basic identifying information, such as your first and last name;
  • contact information, such as your phone number, physical address and email address;
  • identifiers and device information, such as IP address and associated location, operating system, and device IDs;
  • whatever information the individual shares with us in the contact form on our website; and
  • data gathered via cookies, if any.

A “cookie” is a small file stored on your device or browser that contains information about your device or browser. We may use cookies to provide website functionality, authentication (session management), usage analytics (web analytics), and to remember your settings, and to generally improve our websites.

How We Receive Personal Data

We may receive your personal data directly from you or third parties with whom we contract.

Basis of Processing

Within the scope of this Notice, we process your personal data on several different legal bases, depending on the purpose of processing.

  • Consent. In some situations, we may ask for your consent to collect and process your personal data, including Sensitive Information. These situations will be governed by specific terms, privacy notices, or consent forms that provide additional information about how we will use your personal data. We strongly recommend that you review such additional terms prior to participating in such programs. However, if you withdraw your consent it will not affect any processing of personal data that has already occurred.
  • Compliance with legal obligations. In some situations, we may need to process your personal data in order to comply with applicable laws or regulations, such as with reporting adverse events. In such situations, it is unlikely that you will be permitted to object. However, you will usually have the right to access or review this information, unless it would impede our legal obligations or is otherwise prohibited by law. We may also process your personal data as permitted by applicable legal requirements, such as laws and regulations that authorize us to process your personal data for purposes of clinical trials.
  • Our legitimate interests. In some cases, we process your personal data based on our legitimate interests in facilitating and managing clinical trials. In addition to the other rights you may have (described below), you have the right to object to such processing of your personal data. You can register your objection by contacting us as described in the “Contact Us” section below.
  • Ensuring high standards of quality and safety of medicinal products. In some cases, we may process your personal data for reasons of public interest in the area of public health, namely ensuring high standards of quality and safety of the medicinal products we are developing. In such cases, the processing of your personal data will be conducted on the basis of European Union or Member State law that provide for specific measures to safeguard your rights and freedoms.
  • Scientific research. In some situations, we may process your personal data in order to conduct scientific research. In these situations, the processing of your personal data will be conducted in accordance with European Union or Member State law and shall: (1) be proportionate to the aim pursued; (2) respect the essence of the right to data protection; and (3) provide for suitable and specific measures to safeguard your fundamental rights and the interests.

Since we process special categories of personal data, such as your health status and medical history, the EU General Data Protection Regulation (“GDPR”) requires that we must have an additional legal ground to process this type of information. CTI may process your special categories of personal data on the basis of your explicit consent, or where the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

The specific grounds on which we process your personal data, including your health data, may vary somewhat from the above in order to comply with the requirements of local laws in jurisdictions where we sponsor Trials. If you are a participant in a Trial, please refer to the informed consent form you signed when you joined the Trial for more information about the legal grounds on which we process your personal data.

Purpose of Processing

We may process your personal data for the purposes of:

    • staffing, facilitating, and managing clinical trials;
    • enabling your participation in a Trial;
    • arranging for the delivery of drugs to you and collection of unused drugs from you in relation to the Trial;
    • complying with legal or regulatory obligations, such as reporting of adverse events/negative side effects;
    • complying with company policies;
    • facilitating and cooperating with legal proceedings and government investigations;
    • answering the research questions for the Trial and aggregating data to generate statistics relating to the Trial and/or study drug, CTI products, or your health treatment;
    • communicating about our clinical trials, the products we offer, and responding to requests, inquiries, comments, and suggestions;
    • developing new medicinal drugs or health treatments; and

disclosing your personal data to the appropriate regulatory authorities, auditors, and ethics committees, if required by law.

Data Retention

When the purposes of processing are satisfied, we will delete your personal data within six months unless applicable law prescribes a longer retention period for your data.

Cookies

Some of the information systems included within the scope of this Notice may use session cookies, which are used to enable basic functionality. However, within the scope of this Notice, we do not use cookies for monitoring or tracking your behavior online.

Sharing Personal Data with Third Parties

We share personal data with our service providers, who process personal data on behalf of CTI. Such third parties may include:

  • business partners, such as contract research organizations and study sites, with whom we contract to carry out services on our behalf, including those providing:
    • contract/clinical research organization services;
    • patient recruitment services;
    • pathology laboratories;
    • clinical pharmacology services;
    • laboratory services;
    • data management and biostatistics services;
    • trial oversight, imaging and digital patient services;
    • quality assurance, safety and pharmacovigilance software and related services;
    • data storage and archiving software and related services;
    • data analytics and reporting software and services;
    • services related to the collection, storage, testing, and transportation of biological material;
    • logistics and transport service providers; and
    • electronic data capture software and hardware;
  • other service providers providing IT systems and infrastructure; and
  • government agencies, auditors, and authorities.

International Transfers

We may store and process your personal data in any country or area where we have facilities, are conducting clinical trials, or where we engage service providers. Your personal data may be transferred to countries other than the country where you reside, including but not limited to the United States. In some cases, the European Commission may not have determined that the legal environment in those countries provides a level of data protection that is essentially equivalent to the level of protection provided under European law. You can see here the list of countries that the European Commission has recognized as providing an adequate level of protection to personal data. We will only transfer your Personal Data to third parties in countries not recognized as providing an adequate level of protection to personal data when there are appropriate safeguards in place. These safeguards may include the Standard Contractual Clauses as approved by the European Commission under Article 46.2 of the GDPR.

Other Disclosure of Your Personal Data

We may disclose your personal data (i) to the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with applicable laws or regulations, official investigations, or legal proceedings initiated by governmental and/or law enforcement officials, or private parties, including but not limited to: in response to subpoenas, search warrants, or court orders, or (ii) if we sell or transfer all or a portion of our company’s business interests, assets, or both, or in connection with a corporate merger, consolidation, restructuring, or other company change, or (iii) to our subsidiaries or affiliates only if necessary for business and operational purposes as described in the “Purpose of Processing” section above.

If we must disclose your personal data in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, we may not be able to ensure that such recipients of your personal data will maintain the privacy or security of your personal data.

Data Integrity & Security

CTI has implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your personal data from unauthorized processing such as unauthorized access, disclosure, alteration, or destruction.

Access & Review

If you have participated in one of our clinical trials, you may have the right to see and copy your health records related to the trial, as well as correct any errors, for as long as this information is held by your trial physician. You might not be able to view or reproduce your trial records until the trial has been completed by all trial participants.

You can withdraw your consent to have your information analyzed for a trial at any time. If you decide to do so, please tell your study investigator about your decision. However, if you withdraw your consent, you will not be able to continue to participate in the trial. If you withdraw your consent, no more information about you will be collected after your withdrawal. However, the information that was collected before your withdrawal will be used for the trial.

Please note that even if you stop sharing your information for a trial, the study investigator may still need to contact you to ask questions about your health if you have taken the trial medication.

If you are a resident of the EU or EEA, you may have the right to request that we delete your information that we process or that our processing be restricted.

If you would like to withdraw (1) from a trial or (2) your permission to have your information analyzed or would like to assert other rights to which you may be entitled to under applicable laws, you may contact us using the information provided below under the heading “Data Protection Officer.” Our Data Protection Officer will coordinate with our EU Representative to respond to your inquiry. You should also contact your study investigator.

Privacy of Children

We do not knowingly collect personal data from anyone under 18. In the event that we learn that we have processed personal data from a child under age 13, we will delete the information we have stored as quickly as possible. If you believe that we might have any information from or about a child under 13, please contact us as described in the “Contact Us” section below.

Changes to this Privacy Notice

If we make any material change to this Notice, we will post the revised Notice to this web page and update the “Effective on” date to reflect the date on which the new Notice became effective.

Contact Us

If you are an individual patient and you have any questions about this Notice or our processing of your personal data in connection with a Trial you participated in, or you would like to exercise your data protection rights, please first speak with your study doctor. CTI generally only has access to key-coded data about Trial participants and we will be unable to identify you if we receive a request from you directly.

Otherwise, if you are not a Trial participant but you have any questions about this Notice or our processing of your personal data, please contact us via email at [email protected]. Alternatively, you may also contact us by postal mail at:

CTI BioPharma Corp.

Attn: Data Privacy Team
3101 Western Ave., Suite #800
Seattle, WA 98121
U.S.A.

Please allow up to four weeks for us to reply.

EU Representative

CTI Life Sciences Deutschland GmbH has been appointed as CTI’s representative in the EU for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union. To make an inquiry, please contact CTI Life Sciences Deutschland GmbH via email at [email protected]. Alternatively, you may also contact CTI Life Sciences Deutschland GmbH by postal mail at:

CTI Life Sciences Deutschland GmbH

c/o CTI BioPharma Corp.
Attn: Data Privacy Team

Universitätsstraße 71
50931 Köln, Germany

On matters related to the processing of personal data, in addition to CTI, you may also contact VeraSafe. VeraSafe may be reached by email at [email protected].
Please allow up to four weeks for a reply.

Data Protection Officer

We have appointed Jim Cormier of VeraSafe as our data protection officer. He may be contacted as follows:

Jim Cormier
Senior Counsel
VeraSafe

22 Essex Way #8203
Essex, VT 05451
U.S.A.
Email: [email protected]

Please allow up to four weeks for us to reply.

Supervisory Authority Oversight

If you are a data subject whose personal data we process, you may also have the right to lodge a complaint with a data protection regulator in one or more of the European Union member states.