Alethium trial privacy policy

1. Scope

This Privacy Policy applies solely to personal data collected and processed via the Alethium Trial Platform. For our general website privacy practices, please refer to our Website Privacy Policy.

2. Data We Collect

We may collect the following categories of personal data:

• Account Information: Name, email address, organization, user role.
• Authentication Data: Login credentials, multi-factor authentication tokens.
• Clinical Operations Data: Activity logs, audit trails, form entries, consent actions.
• Participant Data: As entered by site staff or participants, including limited health-related information.
• Device and Usage Information: Browser type, IP address, time zone, and usage metrics.

3. Use of Personal Data

We process your data for the following purposes:

• Enabling access to the platform and study materials
• Facilitating informed consent workflows
• Supporting data capture, compliance, and sponsor oversight
• Generating audit logs and monitoring platform usage
• Complying with legal and regulatory obligations

4. Legal Basis for Processing

Where applicable, we process data under the following legal bases:

• Your consent (e.g., participant enrollment)
• Performance of a contract (e.g., study agreement)
• Compliance with legal obligations (e.g., GCP, 21 CFR Part 11)
• Legitimate interests (e.g., platform security, fraud prevention)

5. Sharing of Personal Data

We may share your data with:

• Study sponsors and their authorized agents
• Regulatory bodies, ethics committees, or auditors (where required)
• Trusted service providers (e.g., cloud hosting, messaging, e-signature)
• Legal authorities as required by law

We do not sell your personal data.

6. Data Transfers

If data is transferred outside your jurisdiction (e.g., EU/UK/Switzerland to the U.S.), we use legally recognized mechanisms such as:

• EU-U.S. Data Privacy Framework (DPF) and its UK/Swiss Extensions (if certified)
• Standard Contractual Clauses (SCCs)

Alethium is currently certified under the DPF. For details, visit: https://www.dataprivacyframework.gov

7. Your Rights

You may have the right to:

• Access or correct your personal data
• Request deletion or restriction of your data
• Object to processing (where applicable)
• Lodge a complaint with a supervisory authority

Contact us at privacy@alethium.health for any such requests.

8. Security and Retention

We use technical and organizational safeguards to protect data. Data is retained only as long as necessary to fulfill the purposes outlined above or as required by law or sponsor contracts.

9. Independent Dispute Resolution (If DPF Active)

In compliance with the DPF Principles, unresolved privacy complaints may be referred to JAMS, our independent dispute resolution provider. This service is free of charge. To submit a complaint, visit: https://www.jamsadr.com/dpf-dispute-resolution

10. Changes to this Policy

We may update this Privacy Policy periodically. Any material changes will be communicated via the platform or email.