Accordion Content

This Privacy Notice (the “Notice”) addresses the collection, use and disclosure of Personal Data of individual patients (“Participants”), Participant’s caregiver participating in a Trial (“Care Partners”), health care personnel including clinical trial investigators and researchers (“Personnel”), and third party legally authorized representatives (“LAR”) or witnesses (“Witness”) (individually and together, “you”, “your”, “Data Subjects”) in connection with the clinical trials (“Trial” or “Trials”) sponsored by MapLight Therapeutics, Inc. (“MapLight,” “we”, “us”, “our”). This Notice also describes how we protect your Personal Data, and how you can exercise your privacy rights.  We take the protection of Personal Data very seriously.

This Notice does not apply to Personal Data collected by any other means, such as through our public website. This Notice also does not apply to Personal Data of other individuals including our employees or contractors.

Please read this Notice carefully as it contains important information. We may provide additional privacy notices to you at the time we collect your Personal Data, for example when you participate in a Trial either as a Participant, Care Partner, Personnel, LAR or Witness.

Within the scope of this Notice, MapLight generally acts as a data controller for the Personal Data processed in the context of the Trials we sponsor. This means that we alone determine the purpose and means of the processing of your Personal Data.

In some jurisdictions, we may be considered a “joint controller” with another organization, such as the study site where the Trial is being conducted. This means that we, together with the other organization, jointly determine the purpose and means of the processing of your Personal Data. If you would like to know more about any other data controllers who might be joint controllers together with MapLight, you may ask your study doctor or the study site for further details, specifically relating to the Trial that you are participating in.

Participants:
When information relating to you is sent to us including by the study site, Personnel, your doctors and our service providers such as our clinical research organizations, it will be key-coded with a randomly assigned unique identifier number (this process is called “pseudonymization”) so that we cannot identify you by any direct personal identifier (such as your name, social security number, address, or telephone number).

The following types of Personal Data may be processed in the context of our Trials:

• biographical information, such as your first and last name
• demographic information, such as your ethnicity, race, month/year of birth and sex;
• contact information, such as your phone number, physical address and email address;
• location information, such as the location of your testing site and Trial location (i.e. study site);
• health care provider information, such as the identity and contact information of your doctors and other health care providers;
• health information, such as your medical history, current health status, results from Trial test/procedure including from your biological samples, if any, and Personal Data derived from the analysis of those samples, and reaction to the Trial drug or treatment;
• your genetic information;
• trial participation eligibility and recruitment status;
• publicly available information;
• audio recordings of your responses to questionnaires;
• financial data such as payment-related information including social security number, taxpayer identification number and financial account information;
• health insurance information; and
• fingerprints, if you are unable to sign the informed consent forms.

You can ask your study doctor if you are unsure whether or not any specific Personal Data that you are being asked to provide is required as part of your participation in the Trial.

Care Partners:
The following types of Personal Data may be processed in the context of our Trials:

• biographical information, such as your first and last name and relationship to the Participant;
• contact information, such as your phone number, physical address and email address;
• Trial location (i.e. study site);
• financial data, such as payment-related information including taxpayer identification number;
• audio recordings of your responses to questionnaires; and
• other information, including information regarding burden as a Care Partner.

Personnel:
The following types of Personal Data may be processed in the context of our Trials:

• biographical information, such as your first and last name, and National Provider Identifier (NPI) number, if applicable;
• professional credentials, such as your place of professional practice, job title, the medical field in which you are active, professional qualifications and scientific activities;
• financial data, such as payment-related information;
• location information, such as the location of your Trial location (i.e. study site);
• online account information, such as username, password, and account activity, with respect to accounts you create using our service providers’ software platforms
• audio recordings if you are administering the questionnaires for Participants and Care Partners in the Trial we sponsor; and
• rater qualification and performance data, if you are administering the questionnaires to Participants and Care Partners in the Trial we sponsor.
• Legally Authorized Representative:
  The following types of Personal Data may be processed in the context of our Trials:
• biographical information, such as your first and last name and date and place of birth;
• documentation of your status as a legally authorized representative; and
• contact information, such as your physical address.

Witness:
The following types of Personal Data may be processed in the context of our Trials:

• biographical information, such as your first and last name and date and place of birth; and
• contact information, such as your physical address.

Participants, Care Partners, LAR, and Witness:
We may receive your Personal Data:

• directly from you, such as when you contact us or complete a form on our recruitment website;
• through the study sites;
• from a study doctor (also known as an “investigator”) or other healthcare personnel at the study site;
• from hospitals, clinics and other healthcare providers;
• from our service providers acting on our behalf (such as our contract research organization we engage to manage the Trial) and other business partners; or
• from government agencies or public records.

Personnel:
We may receive your Personal Data when:

• you provide it to us, to the clinical research organization, and/or to our service providers in your role as Personnel in the context of assisting in the conduct of the Trial. Where a clinical research organization or another third party collected and processed your Personal Data in its own database as a data controller, its processing is governed by its own privacy notice.

Participants:
We process your Personal Data for the purposes of:

• managing and facilitating the Trial;
• recruiting for and enabling your participation in the Trial;
• answering the research questions for the Trial and aggregating data to generate statistics relating to the Trial and/or study drug or study procedures;
• arranging for the delivery of drugs to you and the collection of unused drugs from you in relation to the Trial;
• arranging for the provision and return of devices and equipment as necessary for the Trial procedures;
• arranging reimbursement of certain study-related expenses and your transportation to or from the study site;
• arranging for a home health care provider;
• sending you reminders about your appointments at the study site, or to take your medication on time;
• monitoring and reporting on the safety and effectiveness of the study drug including any adverse events, such as negative side effects;
• developing and commercializing products including the study drug, new medicinal drugs and/or health treatments;
• complying with applicable laws and regulations;
• disclosing your Personal Data to the appropriate regulatory and/or governmental authorities, auditors, and ethics committees, if required by law;
• responding to your inquiries and requests;
• developing publications and presentations of the Trial results; and
• communicating with you on the status of the Trial.

We also process your Personal Data for the specific purposes described in the informed consent form provided to you by Trial Personnel.

Care Partners:
We process your Personal Data for the purposes of:

• managing and facilitating the Trial;
• enabling your and the Participant’s participation in the Trial;
• responding to your inquiries and requests; and
• complying with applicable laws and regulations.

Personnel:
We process your Personal Data for the purposes of:

• managing our relationship with you;
• contacting Personnel for planning and organizing the Trials;
• managing and facilitating the Trial;
• conducting the Trial; and
• complying with applicable laws and regulations.

Legally Authorized Representative:
We process your Personal Data for the purposes of:

• managing and facilitating the Trial; and
• complying with applicable laws and regulations.

Witness:
We process your Personal Data for the purposes of:

• managing and facilitating the Trial; and
• complying with applicable laws and regulations.

We must have a valid reason to process your Personal Data. This is called a “lawful basis for processing”.

Participants:
We process your Personal Data on the following lawful bases:

• Consent: Your Personal Data is processed based on your consent.
• Legitimate Interest: We process your Personal Data for scientific research purposes based on our legitimate interest in conducting Trials and performing valuable scientific and medical research.
• Compliance with Legal Obligations: We process your Personal Data for monitoring, safety and reliability purposes in order to comply with our legal obligations.
• Public Interest: We process your Personal Data for reasons of public health interests to ensure adequate standards of quality or safety of the drugs and treatments we are developing.

If we process your Personal Data for other purposes after the end of a Trial, we will do so based on lawful grounds, which could include your consent or our legitimate interest in conducting further research.

MapLight will need to process data about your health which may include genetic data in order for you to participate in a Trial. Health data and genetic data are considered sensitive Personal Data (also known as a “special category” of Personal Data) and special rules apply to processing it. When we process special categories of your Personal Data, we only do so based on your explicit consent and when the processing is necessary for reasons of public interest in the area of public health such as making sure our drugs are safe and effective, and conducting our Trials safely. 

The specific grounds on which we process your Personal Data, including your health and genetic data, may vary somewhat from the above in order to comply with the requirements of local laws in jurisdictions where we sponsor Trials. Please refer to the informed consent form you signed when you joined the Trial for more information about the legal grounds on which we process your Personal Data. If there is any conflict between any provision in this Notice and any provision in the informed consent form you signed in connection with your participation in a Trial we sponsor, the informed consent form shall supersede the conflicting provision in this Notice.

Care Partners:
We process your Personal Data on the following bases:

• Consent: Your Personal Data is processed based on your consent.
• Legitimate Interest: We process your Personal Data for scientific research purposes based on our legitimate interest in conducting Trials and performing valuable scientific and medical research.
• Compliance with Legal Obligations: We process your Personal Data for monitoring, safety and reliability purposes in order to comply with our legal obligations.

If there is any conflict between any provision in this Notice and any provision in the Care Partner informed consent form you signed in connection with your participation in a Trial we sponsor, the informed consent form shall supersede the conflicting provision in this Notice.

Personnel:
We process your Personal Data on the following bases:

• Legitimate Interest: We process your Personal Data based on our legitimate interests in facilitating the operation of our business and conducting Trials, making informed investigator-selection decisions, and improving our principal investigator and Trial staff recruiting and contracting processes.
• Contract: We process Personal Data because it is necessary for the performance of the contracts between MapLight and study sites, including by enabling us to communicate with you and other principal investigators about the performance of the relevant Trial.
• Compliance with Legal Obligations: We process Personal Data of Trial Personnel in order to comply with applicable laws and regulations, including clinical trial regulations requiring us and those acting on our behalf to collect Personal Data from individuals who participate in the conduct of a Trial.
• Consent: Personal Data is processed based on your consent.

Legally Authorized Representative:
We process your Personal Data on the following bases:

• Legitimate Interest: We process your Personal Data for scientific research purposes based on our legitimate interest in conducting Trials and performing valuable scientific and medical research.
• Compliance with Legal Obligations: We process your Personal Data in order to comply with applicable laws and regulations.

Witness:
We process your Personal Data on the following bases:

• Legitimate Interest: We process your Personal Data for scientific research purposes based on our legitimate interest in conducting Trials and performing valuable scientific and medical research.
• Compliance with Legal Obligations: We process your Personal Data in order to comply with applicable laws and regulations.

If there is any conflict between any provision in this Notice and any provision in a privacy notice provided to you separately in connection with your participation in a Trial we sponsor, the notice you are provided shall supersede any conflicting provision contained in this Notice.

Where we process Personal Data on the basis of our legitimate interests, we will always do so after a careful assessment which requires balancing your right to privacy and our legitimate interests. Where we process your Personal Data based on your consent, you may withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect processing performed on other lawful grounds. If you withdraw your consent, you may be ineligible to participate in the Trial.

Participants:
If you participate in a Trial we sponsor, you will be assigned a unique identifier number. Depending on the Trial you participate in, this number may be used as part of an automatic process that randomly determines if you will receive the investigational drug product or experimental treatment that is being evaluated in the Trial, or if you will receive a different treatment. This type of automated decision-making is required in order to ensure that the Trial is conducted in an ethical way, and in accordance with the pharmaceutical industry’s standards.

For decisions that may seriously impact you, you have the “right not to be subject to automatic decision-making, including profiling”. But in those cases, we will always explain to you when we might do this, why it is happening, and the potential effect on you.

A “cookie” is a small file stored on your device that contains information about your device. We may use cookies to provide website functionality, authentication (session management), usage analytics (web analytics), and to remember your settings, and to generally improve our websites.

For more information on how we use cookies, please refer to the cookie notice located in the footer of our website.

Participants, LARs, Witnesses and Care Partners:
We will retain your Personal Data until we fulfil the purposes for which we collected it, or for as long as we are required to keep it to comply with applicable laws or regulations.

Once your information has been entered into the Trial records, we cannot remove it without affecting the accuracy of the Trial and the research results. Some laws require us to keep Trial records for at least twenty-five (25) years after the conclusion of the Trial. Other laws may require different retention periods. The information contained in the Trial records includes your identity, the Participant’s health information and Care Partner’s health information (if any) and any adverse effects of the drug the Participant took during the Trial. We will ensure that your Personal Data is safeguarded at all times.

Personnel:
We will retain your Personal Data until we fulfil the purposes for which it was collected, or for as long as we are required to keep it to comply with applicable laws or regulations.

We may share Personal Data with certain third parties as described below including with our service providers who process Personal Data on our behalf, and who agree to use the Personal Data only to assist us in fulfilling the purposes of processing as described in Section 5 above, or as required by law. Our service providers include parties providing:

• Trial management services;
• contract/clinical research organization services;
• recruitment services;
• website hosting services;
• quality assurance, safety and pharmacovigilance software and related services;
• data storage and archiving software and related services;
• data analytics and reporting software and services;
• services related to the collection, storage, testing, and transportation of biological material;
• software that randomly decides which treatment you will receive during the Trial;
• logistics and transport service providers;
• audio recording service providers;
• electrocardiogram service providers; and
• electronic data capture software and hardware.

We will also share your Personal Data with other third parties involved in the Trials. Some of these third parties are data controllers in their own right. These third parties include clinical sites like hospitals and medical offices, and public government agencies (e.g., national health authorities, regulatory authorities, ethics committees and Data and Safety Monitoring Board) and may be located in other countries.

We may also share your Personal Data as described in Section 12 below.

Personal Data from the Trials will be transferred to the Sponsor in the United States and to third parties located in the following countries: United States, United Kingdom, the European Economic Area (EEA), Canada, Republic of Korea, India, Republic of Serbia, Ukraine, and Turkey. We will only transfer your Personal Data to third parties in those countries which are recognized as providing an adequate level of protection for Personal Data, or who provide appropriate safeguards to protect your Personal Data.

Additional information for Data Subjects in the EEA and UK
For transfers of Personal Data to third countries outside the European Economic Area (EEA) or the United Kingdom (UK), we use safeguards like the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, the European Union Standard Contractual Clauses with necessary adjustments for transfers from the UK, or use specific transfer instruments like the UK International Data Transfer Agreement.

For Data Subjects in Switzerland
For transfers of Personal Data to third countries outside Switzerland, we use safeguards like the Swiss-U.S. Data Privacy Framework and the Standard Contractual Clauses adopted by the Swiss Federal Data Protection and Information Commissioner.

Additional information for Data Subjects in the Republic of Korea
For Data Subjects located in the Republic of Korea, Personal Data is transferred to third parties located in the counties listed in Section 11 above in compliance with Article 28-8(3) of the Korean Personal Information Protection Act. You may refuse international data transfers by contacting our Data Protection Officer, VeraSafe, by sending an email to experts@verasafe.com, or by using the information in the “Contact Us” section below; however, this may limit your participation in the Trial.

We may disclose your Personal Data:

• with regulators or competent authorities, to the extent necessary to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws);
• to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations, court order, subpoenas, search warrants or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties);
• if, in the future, we sell or transfer, or consider selling or transferring, part or all of our company, business, shares or assets to a third party, and we disclose your Personal Data to such third party in connection with the sale or transfer; or
• in the event that we are acquired by, or merged with, a third-party entity, or in the event of bankruptcy or a comparable event, in which cases we reserve the right to transfer, disclose or assign your Personal Data in connection with the foregoing events.

If we have to disclose your Personal Data to regulators, competent authorities, or governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect Personal Data from unauthorized processing. These measures include the use of measures like pseudonymization and encryption, where appropriate.

You have specific rights regarding your Personal Data that we collect and process. In this section, we first describe those rights and then we explain how you can exercise them.  Please note that applicable law may permit us to deny a request from you regarding the exercise of your privacy rights. We will also inform you of our reason for denying your request.

Right to Know What Happens to Your Personal Data
This is called the right to be informed. It means that you have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things. We are informing you of how we process your Personal Data with this Notice.

Right to Know What Personal Data MapLight Has About You
This is called the right of access. This right allows you to ask for full details of the Personal Data that we have collected about you.

Right to Change Your Personal Data
This is called the right to rectification. It gives you the right to ask us to correct, without undue delay, anything that you think is wrong with the Personal Data we hold, and to complete any incomplete Personal Data.

Right to Delete Your Personal Data
This is called the right to erasure, right to deletion, or the right to be forgotten. This right means you can ask for your Personal Data to be deleted.

Right to Ask Us to Limit How We Process Your Personal Data
This is called the right to restrict processing. It is the right to ask us to only use or store your Personal Data for certain purposes. You have this right in certain instances, such as where you believe the data is inaccurate or the processing activity is unlawful.

Right to Ask Us to Stop Using Your Personal Data
This is called the right to object. This is your right to tell us to stop using your Personal Data where we rely on a legitimate interest of ours (or of a third party) as the basis for processing your Personal Data.

Right to Port or Move Your Personal Data
This is called the right to data portability. It is the right to ask for and receive a portable copy of your Personal Data, so that you can:

• Move it;
• Copy it;
• Keep it for yourself; or
• Transfer it to another organization.

Right Related to Automated Decision Making
For decisions that may seriously impact you, you have the right not to be subject to automatic decision making, including profiling. But in those cases, we will explain to you when we might do this, why it is happening and the effect.

Right to Withdraw Your Consent
Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. However, this will not affect the lawfulness of our processing of your Personal Data before you withdrew your consent. It will also not affect processing of your Personal Data performed on other lawful grounds.

How to Exercise Your Rights

Participants, Witnesses and Care Partners:
To exercise your rights, please first speak with your study doctor instead of contacting us directly, so that we can ensure that your confidentiality is preserved. Where appropriate, your study doctor will pass on your request to MapLight.

In order to correctly respond to your privacy rights requests, the study doctor may request specific information from you to confirm your identity and process your request.

If you are unable to exercise your rights through your study doctor for any reason, you may contact our Data Protection Officer, VeraSafe, by sending an email to experts@verasafe.com, or by using the information in the “Contact Us” section below. In order to preserve your confidentiality, please do not contact MapLight directly.

Personnel:
You may contact our Data Protection Officer, VeraSafe, by sending an email to experts@verasafe.com, or by using the information in the “Contact Us” section below.

In order to correctly respond to your privacy rights requests, the Data Protection Officer will need to confirm that you made the request. Consequently, they may require additional information to confirm your identity and process your request.

Participants, LARs, Witnesses, Care Partners, and Personnel:
You also have the right to lodge a complaint with a data protection regulator in your applicable jurisdiction.

Our Trials are generally not directed at, or intended for use by, children under the age of 13.

MapLight complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK Extension to the EU-U.S. DPF”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. MapLight has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of Personal Data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.  MapLight has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

MapLight is responsible for the processing of Personal Data it receives, under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF, and subsequently transfers to a third party acting as an agent on its behalf. We comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF for all onward transfers of Personal Data from the EU, UK and Switzerland, including the onward transfer liability provisions.

To learn more about the Data Privacy Framework Program- visit https://www.dataprivacyframework.gov/s/. To view MapLight’s certification, look for MapLight Therapeutics, Inc. here: https://www.dataprivacyframework.gov/s/participant-search.

Dispute Resolution
In compliance with the DPF, MapLight commits to resolve DPF Principles-related complaints about our collection and use of your Personal Data. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, should first contact MapLight using the contact details below.

If DPF-related complaints, cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/

Binding Arbitration
If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

U.S. Regulatory Oversight
MapLight is subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

Supervisory Oversight
If the EU GDPR applies to our processing of your Personal Data, you also have the right to lodge a complaint with a data protection regulator in one or more of the European Union Member States. Specifically, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR. In the UK, you can lodge a complaint with the UK Information Commissioner’s Office. In Switzerland, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner.

17.1.    MapLight

Privacy Officers: Jayson Walker and Adam Camiel
Email: DPO@MapLightRX.com
Telephone: +1 650 839 4379

17.2.    Data Protection Representative

While you may contact us at any time, our data protection representative can be contacted about matters related to the processing of your Personal Data.

17.3.Data Protection Officer

We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe
100 M Street S.E., Suite 600
Washington, D.C. 20003 USA
+1 (617) 398-7067
experts@verasafe.com
Web: https://www.verasafe.com/about-verasafe/contact-us/
Toll-free: 1-888-376-1079

Please allow up to four weeks for us to reply.

We reserve the right, at any time, to modify, alter, or update this Notice, and any such modifications, alterations, or updates will be effective upon posting on our website.