Privacy Notice

PRIVACY NOTICE

Last updated and effective as of December 20, 2023.

This Privacy Notice explains the practices that Actuate Therapeutics, Inc. (“Actuate”, “we”, “us”, “our”) follows in connection with the personal data that we collect through this website, when you contact us directly and through our research.

We may change this Privacy Notice at any time by posting the revised Privacy Notice on this site and indicating the effective date of the revised Privacy Notice. You will be notified of any material changes to this Privacy Notice by email, if you have provided that information to us. We will not materially change the rights you may exercise under this Privacy Notice without your explicit consent.

WHAT IS PERSONAL DATA?

In the context of the work that Actuate performs, personal data refers to any information that relates to an identified or identifiable individual such as a name, email, mailing address, phone number, or any information related to an individual’s health for the purpose of healthcare research.

PERSONAL DATA COLLECTION

We collect personal data provided directly by you during direct communication with any of our representatives either through email or by phone. We collect your name, email address, phone number and the reason for your communication.

For the purpose of our research, we do not collect your personal data directly. Your personal data is collected through the partners (“Clinical Site”) that manage the clinical trials that we sponsor. They collect your personal data as a participant of the clinical trial or as a Clinical Site employee or contractor involved in the clinical trial.

PERSONAL DATA PROCESSING

For the purpose of communicating with you when you call or send us an email, we collect your contact information including name, email address and in some cases phone number in order to reply to your inquiry.

The patient data that we obtain and use from the Clinical Site is pseudonymized and managed through an identifier that we cannot link back to you. Only the Clinical Site that collected your personal data can link it with the identifier they provide to us. The data we obtain from Clinical Sites and process, with your consent, includes:

  • An identifier to track future data against;
  • Data concerning your health and how you are responding within the clinical trial;
  • Genetic and biometric data.

The employee or contractor data that we obtain from the Clinical Site is used to conduct a background check, verify the individual’s qualifications, satisfy documentation requirements for their employment or work performed on the clinical trial, and for other administrative purposes relating to their work performed in connection with the clinical trial. The personal data we require the Clinical Site to share with us regarding prospective employees, contractors or job candidates that perform work on our clinical trials include:

  • Name;
  • Address;
  • Curriculum Vitae;
  • Training records;
  • Financial disclosures;
  • Any correspondence between the Clinical Site and the employee or contractor related to their interest in performing work or being employed in connection with the clinical trial. 

PURPOSE OF PERSONAL DATA PROCESSING

Actuate will process your personal data for the following purposes:

  • To communicate with you if you request information from us;
  • To review the outcomes of the clinical trial;
  • To review the qualifications of the Clinical Site employees and contractors assigned to perform work on the clinical trial. 

LEGAL BASIS FOR PROCESSING

In order to comply with different privacy and data protection regulations around the world and specifically to comply with the General Data Protection Regulation (“GDPR”) in the EU, we require to provide a legal basis for the processing of your personal data.

Actuate will not process (i.e. which includes to disclose, share, or otherwise disseminate) your personal data unless we have a legal justification to do so. Actuate will only process your personal data if:

  • We or the Clinical Sites we partner with, have obtained your explicit consent prior to the processing of your personal data;
  • If we need your personal data to perform a contractual obligation to which you are a party or where you have requested us to complete a contractual request;
  • If we need to process your personal data to fulfill our legal and regulatory obligations;
  • If we have a legitimate interest that will not put your fundamental rights and freedoms at risk. Such legitimate interests include monitoring activity on our website to improve the functionality of such website, identification and investigation of fraud or other impermissible use activity on our website, and participation in judicial proceedings to defend or pursue a legal claim or to prosecute illegal acts. 

PERSONAL DATA DISCLOSURE

Actuate will only disclose your personal data without your consent to the following parties under specific circumstances:

  • To Actuate personnel, if required, to fulfill your request;
  • To service providers that support our systems or support the activities of the clinical trial, including the Clinical Sites that hold personal data about patients and employees or contractors;
  • To law enforcement, regulatory bodies or courts, in response to legal requests by public authorities including to meet national security or law enforcement requirements or when we are required to do so under applicable laws and regulations;
  • In connection with the sale or reorganization of all or part of our business, as permitted by applicable law. 

PERSONAL DATA SECURITY

Actuate is committed to protecting the personal data we collect, process and disclose about you. We maintain appropriate safeguards and take reasonable steps to protect your personal data, ensure that we limit its use and that we disclose it only to the parties that have a legitimate reason to have access to it.

We ensure that all the parties that we disclose your personal data to, internal and external to Actuate, have contractual obligations to protect the security and the confidentiality of your personal data.

COOKIES

Actuate uses cookies while you visit our website. Please refer to our Cookie Policy for details on the types of cookies we use.

PERSONAL DATA TRANSFERS

Your personal data will be transferred to systems that reside in the US. The data will be protected and pseudonymized in some cases to ensure that the risks to your privacy are minimized.

We have implemented Standard Contractual Clauses, where appropriate, with parties that reside in the EU and that will transfer personal data to Actuate in the US.

Actuate complies with the requirements of the EU-US Data Privacy Framework, the UK Extension to the EU-US DPF, and Swiss-US Data Privacy Framework. For more information regarding our adherence to these frameworks, refer to the EU-US – EU-UK – Swiss-US Data Privacy Framework section.

PERSONAL DATA RETENTION

Actuate will not retain your contact information after your request has been fulfilled.

Actuate and the Clinical Sites that we partner with for the purpose of clinical trials will retain your personal data for as long as necessary for the purpose of research, in the case of the clinical trial for 25 years, and to comply with legal and regulatory obligations.

RIGHTS YOU CAN EXERCISE ABOUT YOUR PERSONAL DATA

Subject to any exceptions provided by law, you have the right to request access to, update or deletion of your personal data.

You also have the right to request restriction of or object to the processing of your personal data. And you have the right to request to have your data transferred to another organization in a commonly used format.

On each particular case we will inform you of the consequences of your request and if there are any exemptions to honouring your requests based on legal or contractual requirements.

During a clinical trial your rights to access, update or delete your pseudonymized personal data may be limited as permitted by law. Specifically, we need to process your data in specific ways in order to maintain the reliability and accuracy of the research for reasons of public interest in public health and for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

HOW TO EXERCISE YOUR PERSONAL DATA RIGHTS

To submit any request to exercise your rights concerning your Personal Data you may contact us via email at privacy@actuatetherapeutics.com.

GENERAL DATA PROTECTION REGULATION (GDPR) – EU REPRESENTATIVE

Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Actuate Therapeutics has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR by:

  • Using EDPO’s online request form: https://edpo.com/gdpr-data-request/
  • Writing to EDPO at Regus Paris- Champs Elysées, 12/14 rond-point des Champs Elysées, Paris, 75008, France. 

UK GENERAL DATA PROTECTION REGULATION (GDPR) – UK REPRESENTATIVE

Pursuant to Article 27 of the UK GDPR, Actuate Therapeutics has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR by:

EU INDIVIDUALS – RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you reside in the EU and want to lodge a complaint with a Supervisory Authority (Data Protection Authority) you may do so in the Member State where you reside, where you work or where you may have experienced an issue with the processing of your personal data. You may also have the right to make a GDPR complaint to the relevant Supervisory Authority. A list of Supervisory Authorities is available here:  https://edpb.europa.eu/about-edpb/board/members_en.

CONTACT US

If you have any further questions regarding the personal data that Actuate or any of our partners collect and process or if you have feedback regarding this Privacy Notice, you may contact us at privacy@actuatetherapeutics.com.

Data Privacy Framework Compliance

Actuate complies with the EU-U.S. Data Privacy Framework program (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework program (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  Actuate has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  Actuate has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.  

The Federal Trade Commission has jurisdiction over Actuate’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Data Privacy Framework Complaint Resolution Mechanism

In compliance with the EU-US Data Privacy Framework Principles, the UK Extension to the EU-US DPF and the Swiss-US DPF, Actuate commits to resolve DPF Principles-related complaints about your privacy and our collection and use of your personal information transferred to the United States pursuant to the DPF Principles.  European Union, Swiss and United Kingdom individuals with DPF inquiries or complaints regarding our handling of personal data received in reliance on the EU-US DPF, the UK Extension to the EU-US DPF and the Swiss-US DPF should first contact Actuate at privacy@actuatetherapeutics.com. 

Actuate has further committed to refer unresolved privacy complaints under the DPF Principles concerning our handling of personal data received in reliance on the EU-US DPF, the UK Extension to the EU-US DPF and the Swiss-US DPF to an independent dispute resolution mechanism based in the United States, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers  for more information and to file a complaint. This service is provided free of charge to you.

In compliance with the EU-US Data Privacy Framework Principles, the UK Extension to the EU-US DPF and the Swiss-US DPF, Actuate commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-US DPF, the UK Extension to the EU-US DPF and the Swiss-U.S. DPF in the context of the employment relationship.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms.  See https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2

Onward Transfers to Third Parties

Actuate’s accountability for personal data that it receives in the United States under the Data Privacy Frameworks and subsequently transfers to a third party is described in the Data Privacy Framework Principles. In particular, Actuate remains responsible and liable under the Data Privacy Framework Principles if third-party agents that it engages to process personal data on its behalf do so in a manner inconsistent with the Principles, unless Actuate proves that it is not responsible for the event giving rise to the damage.

Choices and Rights Over Your Personal Data

Pursuant to the Data Privacy Frameworks, EU, UK and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the Data Privacy Frameworks, should direct their query to privacy@actuatetherapeutics.com. If requested to remove data, we will respond within a reasonable timeframe. 

We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@actuatetherapeutics.com.