City Therapeutics Clinical Trial Participant Privacy Notice
1. Introduction
City Therapeutics (referred to as “City Therapeutics”, “We, “Our” or “Us”) is committed to protecting the privacy and security of your personal information. City Therapeutics sponsors ethically approved clinical trials. This Privacy Notice (the “Notice”) addresses individual participants whose personal information we may receive and process in connection with the clinical trials that we sponsor.
It is important that you read this Notice, together with any other notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
This Notice does not apply to personal information collected by any other means or in any other contexts, like personal information collected through our website. This Notice also does not apply to personal information of our healthcare professionals assisting with the clinical trials.
2. Our role as controller
City Therapeutics is the controller of your personal information. We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. We have also designated a UK representative. To locate the relevant contact details, please see the “Contact Us” section below.
3. The personal information we collect about you
We only collect personal information that we know we will genuinely use and in accordance with the data protection laws applicable to us and/or legislation related to clinical trials. Even though we are a controller of the personal information processed in the context of our clinical trials, City Therapeutics itself does not have access to identifiable personal information, meaning that we are unable to identify you personally from the information we have access to. Personal information is collected by our service providers like the clinical sites, our clinical research organizations or other third parties. When any information relating to you is shared with us by our service providers, it will first be key-coded (also known as “pseudonymized”) so that we cannot identify you by any direct personal identifier (such as your name, DOB or other personal identifiers).
The following types of personal information may be processed in the context of our clinical trials:
Your DOB
Your gender*
Your contact information (telephone number or email address)*
Where applicable, the name of your legally authorized representative*
Where applicable, the name and contact details of your partner*
Your pseudonymized unique identification number(s)
Your health data
Your genetic data
Your ethnicity
This data may be shared with clinicians, health authorities, ethics bodies and other personnel as authorized by City Therapeutics, but only where City Therapeutics is legally obligated to provide this data in accordance with applicable clinical trial regulations and other applicable laws. City Therapeutics will not directly receive participant identifiable information and will not instruct its processors to process or share this information other than where the law requires.
4. How we use your personal information
We will only process your personal information when the law allows us to do so. We will have provided you with our lawful basis for processing your personal information at the point the information was initially collected from you. We will not store, process, or transfer your data unless we have an appropriate lawful reason to do so.
We may use your information for the following purposes:
| Processing Activity | Lawful Basis |
|---|---|
| Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of Legitimate Interest, to collect information from you and process your health information in order to conduct a clinical trial | Legitimate Interest in conducting clinical research |
| Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of Consent, to collect information from you and process your health information in order to conduct a clinical trial | Consent |
| Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of Legal Obligation, to collect information from you and process your health information in order to conduct a clinical trial | Legal Obligation |
| Answering the research questions for the clinical trial and aggregating data to generate statistics relating to the clinical trial | Legitimate Interest in conducting scientific research to ensure the effective design, operation, and oversight of our clinical trials carrying out research for the effective conduct of our clinical trials |
| To contact you following your inquiry where you have provided your contact information and to reply to any questions, suggestions, issues, or complaints, including any data subject requests, about which you have contacted us | Legitimate Interest in responding to inquiries |
| To contact you, where you have provided your contact information, about news and information relating to our clinical trials | Legitimate Interest in contacting you about our clinical trials |
| To present or publish the results of the clinical trials | Legitimate Interest in disseminating results of our clinical trials and promoting understanding. We may use personal information, in a de-identified or aggregated form, to share and publish the results of our clinical trials. |
| To retain any accounting information generated during the course of our interaction for statutory accountancy retention periods | Legal Obligation |
| To respond to and defend against legal claims, where you have provided us with information which may give rise to legal claims | Legal Obligation |
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
The specific grounds on which we process your personal information, including your health data, may vary somewhat from the above to comply with the requirements of local laws in jurisdictions where we sponsor clinical trials. For more information about the specific grounds on which we process your personal information, please refer to the Informed Consent Form relevant to your clinical trial. Please contact our Data Protection Officer for more information about the legal grounds on which we process your personal information using the contact details provided below.
5. Automated Technologies and AI Use
As part of our ongoing efforts to improve the efficiency, quality of our research and clinical trial activities, we may use artificial intelligence (AI) tools to support data analysis, communication, and system functionality. Some of these third-party software platforms, systems may process your personal information, such as Microsoft o365 suite of applications including Connected Experiences and Microsoft Copilot, an AI tool. Other systems, such as ChatGPT, utilised by us may also include AI features and functionalities that may process your personal information.
Throughout our professional relationship, your personal information may be processed within the Microsoft office 365 suite of applications. This may include processing by Microsoft Copilot AI as part of Microsoft Connected Experiences, in accordance with Microsoft’s privacy and security standards. For more information about how Microsoft may process your personal information, see the Microsoft privacy statement which can be accessed here: https://www.microsoft.com/en-gb/privacy/privacystatement. If you have any questions or concerns about this processing, please contact our Data Protection Officer on the contact email address set out in the ‘Contact us’ section.
Our use of AI tools for processing your personal information is carried out on the basis of our Legitimate Interests to conduct clinical research. We balance our interests against your data protection rights and apply appropriate safeguards to protect your personal information.
6. Disclosures of your personal information
We may share your personal information with the following parties and as otherwise described in this Notice or at the time of collection.
Affiliates. Our affiliates, for purposes consistent with this Notice.
Service providers. Third parties (such as companies and individuals) that provide services on our behalf or help us operate our business, such as clinical research organizations, our UK data protection representative, hosting, information technology, email delivery, marketing, and website analytics.
Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for compliance and protection purposes.
Business transferees. Acquirers and other relevant participants in business transactions (or negotiations and due diligence for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganisation, sale or other disposition of all or any portion of the business or assets of, or equity interests in, City Therapeutics or our affiliates (including, in connection with a bankruptcy or similar proceedings).
7. International cross-border data transfers
Some of the third parties we contract with to operate our business are based outside the United Kingdom, European Economic Area and Switzerland. Please note these third countries (such as the United States) may not provide the same protections as the data protection laws where you are based. We will ensure that relevant safeguards are in place to afford adequate protection for your personal information (for example, if you reside in the European Economic Area or the UK, we may rely on an EU Commission or UK government adequacy decision or contractual protections for the transfer of your personal information). For more information about how we transfer personal information internationally, please contact us as set out in the “Contact Us” section below.
8. Data security
City Therapeutics will implement appropriate technical and organisational security measures necessary to adequately safeguard your personal information. These safeguards will include, for example:
Security Measures
Access to personal information is restricted and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need-to-know.
All employees handling personal information receive security and data protection awareness training, will only process your personal information on our instructions and are subject to a duty of confidentiality.
Employees with access to personal information are given the least privilege required.
We have robust procedures in place to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
A disciplinary policy is enforced to prevent unauthorised access.
Where technically feasible, data is encrypted in transit and at rest.
9. Data retention
We will only retain your personal information for as long as required under applicable local, state, national and/or international laws, rules and/or regulations, which may be for a period of at least 25 years after completion of the clinical trial and to fulfil the purposes we collected it for, including for the purposes any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event where we receive a complaint and we reasonably believe there is a prospect of litigation in respect to our relationship with you, or there is an investigation and proceedings.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we will anonymise your personal information (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use and retain this information indefinitely without further notice to you.
10. Your legal rights
Subject to certain limitations and exclusions under applicable laws, you may be entitled to contact us and request to exercise your rights in respect of your personal information. You may have the right to request confirmation as to whether City Therapeutics is processing your personal information, and if so:
To request access to your personal information that City Therapeutics is processing and details about how we process your personal information.
To request City Therapeutics rectifies any inaccurate or incomplete personal information that City Therapeutics is processing about you.
To request erasure of any personal information that City Therapeutics is processing about you, subject to certain exceptions.
To request restriction of processing of any personal information that City Therapeutics is processing about you, subject to certain exceptions.
To obtain a copy of your personal information in a commonly-used and machine-readable format and have it ported to another controller.
To object to the processing of your personal information in certain circumstances.
If applicable, to withdraw your consent for processing your personal information at any time.
To lodge a complaint with us.
To lodge a complaint with your local data protection authority.
To exercise any of the rights described above, please email us using the details in the “Contact Us” section below with a description of your request.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.
11. Changes to the Notice
We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact City Therapeutics for more information.
12. Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.
13. Change of Ownership
In the event that the ownership of our business, assets, or drug development rights is transferred to another entity, whether through merger, acquisition, sale, or licensing, we may share your personal information with the acquiring or licensing entity. This is to ensure continuity of research, regulatory obligations, and product development.
The receiving entity will be required to process your personal information in accordance with applicable data protection laws and the purposes outlined in this Notice, or as otherwise communicated to you at the time of transfer.
Where necessary, we will update this Notice and notify you of any material changes in how your personal information is handled.
14. Contact Us
If you have any questions about this Notice, the use of your personal information, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.
City Therapeutics’ Data Protection Officer (DPO):
The DPO Centre
Katarzyna Wieckowska
Email: dpo@citytx.com
Our UK Representative:
The DPO Centre
Email: ukrep@citytx.com
Thank you for taking time to read this Notice.