MapLight Therapeutics, Inc. (“MapLight”, “we”, “us”, “our”) sponsors ethically approved human clinical trials. We take the protection of personally identifiable information (“Personal Data”) very seriously. This Privacy Notice (the “Notice”) addresses the collection, use and disclosure of Personal Data of individual patients (“Participants”), Participant’s caregiver participating in a Trial (“Care Partners”) and health care personnel including clinical trial investigators and researchers (“Personnel”) (individually and together, “you”, “your”, “Data Subjects”) in connection with the clinical trials (“Trial” or “Trials”) we sponsor. This Notice also describes how we protect your Personal Data, and how you can exercise your privacy rights.

This Notice does not apply to Personal Data collected by any other means, such as through our public website. This Notice also does not apply to Personal Data of other individuals including our employees or contractors.

Please read this Notice carefully as it contains important information. We may provide additional privacy notices to you at the time we collect your Personal Data for example when you participate in a Trial either as a Participant, Care Partner, or Personnel.

Within the scope of this Notice, MapLight generally acts as a data controller for the Personal Data processed in the context of the Trials we sponsor. This means that we alone determine the purpose and means of the processing of your Personal Data.

In some jurisdictions, we may be considered a “joint controller” with another organization, such as the study site where the Trial is being conducted. This means that we jointly, together with the other organization, determine the purpose and means of the processing of your Personal Data. If you would like to know more about any other data controllers who might be joint controllers together with MapLight, you may ask your study doctor or the study site for further details, specifically relating to the Trial that you are participating in.

Participants:
When information relating to you is sent to us by our service providers such as the study site or other third parties such as your doctors or our clinical research organizations, it will be key-coded with a randomly assigned unique identifier number (also known as “pseudonymization”) so that we cannot identify you by any direct personal identifier (such as your name, social security number, address, or telephone number).

The following types of Personal Data may be processed in the context of our Trials:

• basic identifying information, such as your first and last name;
• demographic information, such as your ethnicity, race, month/year of birth and sex;
• contact information, such as your phone number, physical address and email address;
• location information, such as the location of your testing site and Trial location (i.e. study site);
• health care provider information, such as the identity and contact information of your doctors and other health care providers;
• health information, such as your medical history, current health status and reaction to the Trial drug or treatment;
• your genetic information;
• publicly available information;
• financial data such as payment-related information including social security number, tax payer identification number and financial account information.

You can ask your study doctor if you are unsure whether or not any specific Personal Data that you are being asked to provide is required as part of your participation in the Trial.

Care Partners:
The following types of Personal Data may be processed in the context of our Trials:

• biographical information, such as your first and last name and relationship to Participant;
• contact information, such as your phone number, physical address and email address;
• financial data, such as payment-related information;
• tax identity (or similar);
• biometric data, such as audio recordings of your responses to questionnaires;
• other information, including information regarding burden as a Care Partner.

Personnel:
The following types of Personal Data may be processed in the context of our Trials:

• basic identifying information, such as your first and last name, and National Provider Identifier (NPI) number, if applicable;
• professional information, such as your place of practice, job title, the medical field in which you are active, professional qualifications and scientific activities;
• financial data, such as payment-related information;
• location information, such as the location of your testing site and Trial location (i.e. study site);
• biometric data, if you are performing audio recordings for participants in the Trial we sponsor; and
• performance data, if you are administering the questionnaires for participants in the Trial we sponsor.

We may receive your Personal Data when:

• you provide it directly to us (including to our service providers acting on our behalf such as the clinical research organization we engage to manage the Trial);
• a study doctor (also known as an “investigator”) or other healthcare personnel at the study site or a laboratory provides it to us, or your healthcare provider provides it to us; and/or
• available from government agencies or public records;
• you provide it to us, the clinical research organization, or a study doctor when you complete a pre-screening questionnaire to confirm your eligibility to participate in the Trial.

Care Partners:
We may receive your Personal Data when:

• you provide it directly to us (including to our service providers acting on our behalf such as the clinical research organization we engage to manage the Trial);
• a study doctor (also known as an “investigator”) or other healthcare personnel provides it to us.

We may receive your Personal Data when:

• you provide it to us, to the clinical research organization, or to our service providers in your role as Personnel in the context of assisting in the conduct of the Trial.

We process your Personal Data for the purposes of:

• managing and facilitating the Trial;
• recruiting for and enabling your participation in the Trial;
• answering the research questions for the Trial and aggregating data to generate statistics relating to the Trial and/or study drug or health treatment;
• arranging for the delivery of drugs to you and the collection of unused drugs from you in relation to the Trial;
• arranging for the provision and return of devices and equipment as necessary for the Trial procedures;
• arranging reimbursement of certain study-related expenses and your transportation to or from the study site;
• arranging for a home health care provider;
• sending you reminders about your appointments at the study site, or to take your medication on time;
• monitoring and reporting on the safety and effectiveness of the study drug including any adverse events, such as negative side effects;
• developing and commercializing products including the study drug, new medicinal drugs and/or health treatments;
• complying with legislation-governing Trials;
• disclosing your Personal Data to the appropriate regulatory and/or governmental authorities, auditors, and ethics committees, if required by law;
• responding to your inquiries and requests;
• developing publications and presentations of the Trial results; and
• communicating with you on the status of the Trial.

We also process your Personal Data for the specific purposes described in the informed consent form provided to you by Trial Personnel.

Care Partners:
We process your Personal Data for the purposes of:

• managing and facilitating the Trial;
• enabling your and the Participant’s participation in the Trial;
• responding to your inquiries and requests; and
• complying with applicable laws and regulations.

Personnel:
We process your Personal Data for the purposes of:

• managing our relationship with you;
• contacting Personnel for planning and organizing the Trials;
• conducting the Trials; and
• complying with applicable laws and regulations.

We must have a valid reason to process your Personal Data. This is called a “lawful basis for processing”.

Participants:
We process your Personal Data on the following bases:

• Consent: Your Personal Data is processed based on your consent.
• Legitimate Interest: We process your Personal Data for scientific research purposes based on our legitimate interest in conducting Trials and performing valuable scientific and medical research.
• Compliance with Legal Obligations: We process your Personal Data for monitoring, safety and reliability purposes in order to comply with our legal obligations.
• Public Interest: We process your Personal Data for reasons of public health interests to ensure adequate standards of quality or safety of the drugs and treatments we are developing.

If we process your Personal Data for other purposes after the end of a Trial, we will do so based on lawful grounds, which could include your consent or our legitimate interest in conducting further research.

MapLight will need to process data about your health which may include genetic data in order for you to participate in a Trial. Health data and genetic data are considered sensitive Personal Data (also known as a “special category” of Personal Data) and special rules apply to processing it. When we process special categories of your Personal Data, we only do so based on your explicit consent and when the processing is necessary for reasons of public interest in the area of public health such as making sure our drugs are safe and effective, and conducting our Trials safely.

The specific grounds on which we process your Personal Data, including your health and genetic data, may vary somewhat from the above in order to comply with the requirements of local laws in jurisdictions where we sponsor Trials. Please refer to the informed consent form you signed when you joined the Trial for more information about the legal grounds on which we process your Personal Data. If there is any conflict between any provision in this Notice and any provision in the informed consent form you signed in connection with your participation in a Trial we sponsor, the informed consent form shall supersede the conflicting provision in this Notice.

Care Partners:
We process your Personal Data on the following bases:

• Consent: Your Personal Data is processed based on your consent.
• Legitimate Interest: We process your Personal Data for scientific research purposes based on our legitimate interest in conducting Trials and performing valuable scientific and medical research.
• Compliance with Legal Obligations: We process your Personal Data for monitoring, safety and reliability purposes in order to comply with our legal obligations.

If there is any conflict between any provision in this Notice and any provision in the Care Partner informed consent form you signed in connection with your participation in a Trial we sponsor, the informed consent form shall supersede the conflicting provision in this Notice.

Personnel:
We process your Personal Data on the following bases:

• Legitimate Interest: We process your Personal Data based on our legitimate interests in facilitating the operation of our business and conducting Trials, making informed investigator-selection decisions, and improving our principal investigator and Trial staff recruiting and contracting processes.
• Contract: We process Personal Data because it is necessary for the performance of the contracts between MapLight and Trial sites, including by enabling us to communicate with you and other principal investigators about the performance of the relevant Trial.
• Compliance with Legal Obligations: We  process Personal Data of Trial Personnel in order to comply with applicable laws and regulations, including clinical trial regulations requiring us and those acting on our behalf to collect Personal Data from individuals who participate in the conduct of a Trial.
• Consent: Personal Data is processed based on your consent.

If there is any conflict between any provision in this Notice and any provision in a privacy notice  provided to you separately in connection with your participation in a Trial we sponsor, the notice you are provided shall supersede any conflicting provision contained in this Notice.

Where we process Personal Data whether you are a Participant, Care Partner or Personnel,  on the basis of our legitimate interests, we will always do so after a careful assessment which requires balancing your right to privacy and our legitimate interests.  Where we process your Personal Data, whether you are a Participant, Care Partner or Personnel,  based on your consent, you may withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect processing performed on other lawful grounds. If you withdraw your consent, you may be ineligible to participate in the Trial.

Participants:
If you participate in a Trial we sponsor, you will be assigned a unique identifier number. Depending on the Trial you participate in, this number may be used as part of an automatic process that randomly determines if you will receive the experimental drug product or treatment that is being evaluated in the Trial, or if you will receive a different treatment. This type of automated decision-making is required in order to ensure that the Trial is conducted in an ethical way, and in accordance with the pharmaceutical industry’s standards.

For decisions that may seriously impact you, you have the “right not to be subject to automatic decision-making, including profiling”. But in those cases, we will always explain to you when we might do this, why it is happening, and the potential effect on you.

A “cookie” is a small file stored on your device that contains information about your device. We may use cookies to provide website functionality, authentication (session management), usage analytics (web analytics), and to remember your settings, and to generally improve our website.

For more information on how we use cookies, please refer to the cookie notice located in the footer of our website.

Participants and Care Partners:
We will retain your Personal Data until we fulfil the purposes for which we collected it, or for as long as we are required to keep it to comply with applicable laws or regulations.

Once your information has been entered into the Trial records, we cannot remove it without affecting the accuracy of the Trial and the research results. Some laws require us to keep Trial records for at least twenty-five (25) years after the conclusion of the Trial. Other laws may require different retention periods. The information contained in the Trial records includes your identity, the Participant’s health information and any adverse effects of the drug the Participant took during the Trial. We will ensure that your Personal Data is safeguarded at all times.

Personnel:
We will retain your Personal Data until we fulfil the purposes for which it was collected, or for as long as we are required to keep it to comply with applicable laws or regulations.

We may share Personal Data with certain third parties as described below including with our service providers who process Personal Data on our behalf, and who agree to use the Personal Data only to assist us in fulfilling the purposes of processing as described above, or as required by law. Our service providers include parties providing:

• Trial management services;
• contract/clinical research organization services;
• recruitment services;
• quality assurance, safety and pharmacovigilance software and related services;
• data storage and archiving software and related services;
• data analytics and reporting software and services;
• services related to the collection, storage, testing, and transportation of biological material;
• software that randomly decides which treatment you will receive during the Trial;
• logistics and transport service providers;
• audio recording service providers;
• electrocardiogram service providers; and
• electronic data capture software and hardware.

We will also share your Personal Data with other third parties involved in the Trials. Some of these third parties are data controllers in their own right. These third parties include clinical sites like hospitals and medical offices, and public government agencies (e.g., national health authorities, regulatory authorities, ethics committees and Data and Safety Monitoring Board) and may be located in other countries.

We may also share your Personal Data as described in Other Disclosures of Your Personal Data below.

Some of the above-mentioned third parties may be located in countries outside of the country in which you are located. We will only transfer your Personal Data to third parties in countries which are recognized as providing an adequate level of protection for Personal Data, or who provide appropriate safeguards to protect your Personal Data. For transfers of Personal Data to a third country with no adequacy decision outside the European Economic Area (EEA), or the United Kingdom (UK), we use safeguards like the European Union Standard Contractual Clauses with necessary adjustments for transfers from the UK, or use specific transfer instruments like the UK International Data Transfer Agreement.

We may disclose your Personal Data:

• with regulators or competent authorities, to the extent necessary to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws);
• to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations, court order, subpoenas, search warrants or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties);
• if, in the future, we sell or transfer, or consider selling or transferring, part or all of our company, business, shares or assets to a third party, and we disclose your Personal Data to such third party in connection with the sale or transfer; or
• in the event that we are acquired by, or merged with, a third party entity, or in the event of bankruptcy or a comparable event, in which cases we reserve the right to transfer, disclose or assign your Personal Data in connection with the foregoing events.

If we have to disclose your Personal Data to regulators, competent authorities, or  governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect Personal Data from unauthorized processing. These measures include the use of measures like pseudonymization and encryption, where appropriate.

You have specific rights regarding your Personal Data that we collect and process. In this section, we first describe those rights and then we explain how you can exercise them.  Please note that applicable law may permit us to deny a request from you regarding the exercise of your privacy rights. We will also inform you of our reason for denying your request.

Right to Know What Happens to Your Personal Data
This is called the right to be informed. It means that you have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things. We are informing you of how we process your Personal Data with this Notice.

Right to Know What Personal Data MapLight Has About You
This is called the right of access. This right allows you to ask for full details of the Personal Data that we have collected about you.

Right to Change Your Personal Data
This is called the right to rectification. It gives you the right to ask us to correct, without undue delay, anything that you think is wrong with the Personal Data we hold, and to complete any incomplete Personal Data.

Right to Delete Your Personal Data
This is called the right to erasure, right to deletion, or the right to be forgotten. This right means you can ask for your Personal Data to be deleted.

Right to Ask Us to Limit How We Process Your Personal Data
This is called the right to restrict processing. It is the right to ask us to only use or store your Personal Data for certain purposes. You have this right in certain instances, such as where you believe the data is inaccurate or the processing activity is unlawful.

Right to Ask Us to Stop Using Your Personal Data
This is called the right to object. This is your right to tell us to stop using your Personal Data where we rely on a legitimate interest of ours (or of a third party) as the basis for processing your Personal Data.

Right to Port or Move Your Personal Data
This is called the right to data portability. It is the right to ask for and receive a portable copy of your Personal Data, so that you can:

• Move it;
• Copy it;
• Keep it for yourself; or
• Transfer it to another organization.

Right Related to Automated Decision Making
For decisions that may seriously impact you, you have the right not to be subject to automatic decision making, including profiling. But in those cases, we will explain to you when we might do this, why it is happening and the effect.

Right to Withdraw Your Consent
Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. However, this will not affect the lawfulness of our processing of your Personal Data before you withdrew your consent. It will also not affect processing of your Personal Data performed on other lawful grounds.

How to Exercise Your Rights

Participants and Care Partners:
To exercise your rights, please first speak with your study doctor instead of contacting us directly, so that we can ensure that your confidentiality is preserved. Where appropriate, your study doctor will pass on your request to MapLight.

In order to correctly respond to your privacy rights requests, the study doctor may request specific information from you to confirm your identity and process your request.

If you are unable to exercise your rights through your study doctor for any reason, you may contact our Data Protection Officer, VeraSafe, by sending an email to experts@verasafe.com, or by using the information in the “Contact Us” section below. In order to preserve your confidentiality, please do not contact MapLight directly.

Personnel:
You may contact our Data Protection Officer, VeraSafe, by sending an email to experts@verasafe.com, or by using the information in the “Contact Us” section below.

In order to correctly respond to your privacy rights requests, the Data Protection Officer will need to confirm that you made the request. Consequently, they may require additional information to confirm your identity and process your request.

Participants, Care Partners, and Personnel:
You also have the right to lodge a complaint with a data protection regulator in your applicable jurisdiction.

Our Trials are generally not directed at, or intended for use by, children under the age of 13.

MapLight
Privacy Officer: Jayson Walker
Email: DPO@maplightrx.com
Telephone: +1 650 839 4379

Data Protection Representative
While you may contact us at any time, our data protection representative can be contacted about matters related to the processing of your Personal Data.

• European Union Representative
  We have appointed VeraSafe as our representative in the EU for data protection matters. To contact VeraSafe, please use this contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/.
  
  Alternatively, VeraSafe can be contacted at:
  
  VeraSafe Ireland Ltd
  Unit 3D North Point House
  North Point Business Park
  New Mallow Road
  Cork T23AT2P
  Ireland
• United Kingdom Representative
  VeraSafe has also been appointed as our representative in the United Kingdom for data protection matters. To make an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at +44 (20) 4532 2003.
  
  Alternatively, VeraSafe can be contacted at:
  
  VeraSafe United Kingdom Ltd.
  37 Albert Embankment
  London SE1 7TL
  United Kingdom

Data Protection Officer
We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe
100 M Street S.E., Suite 600
Washington, D.C. 20003 USA
+1 (617) 398-7067
experts@verasafe.com
Web: https://www.verasafe.com/about-verasafe/contact-us/
Toll-free: 1-888-376-1079
Please allow up to four weeks for us to reply.

We reserve the right, at any time, to modify, alter, or update this Notice, and any such modifications, alterations, or updates will be effective upon posting on our website.