Last Modified: 27th February, 2023

These terms of use are entered into by and between you and AutoCruitment LLC (“AutoCruitment”, “we” or “us”). The following terms and conditions, together with any documents they expressly incorporate by reference (collectively, these “Terms of Use”), govern your access to and use the AutoCruitment Portal accessible through https://trials.autocruitment.com (the “Portal”), including any content, functionality and services offered on or through the Portal.

Please read and indicate your acceptance of these Terms of Use carefully before you start to use the Portal. By using the Portal or by clicking to accept or agree to the Terms of Use when this option is made available to you, you hereby accept and agree to be bound and abide by these Terms of Use. Our Privacy Policy can be found at https://www.autocruitment.com/privacypolicy, and is incorporated herein by reference. If you do not agree to these Terms of Use, then you must immediately cease accessing and using the Portal.

The Portal is offered and available to users who are eighteen (18) years of age or older and who represent, or are working in collaboration with a research organization and/or a research sponsor that utilizes AutoCruitment to help manage the patient recruitment process for one or more clinical trials or specialty procedures. By using our Portal, you represent and warrant that: (a) you are over eighteen (18) years of age and meet all of the foregoing eligibility requirements; (b) if you are accessing, using, or browsing the Portal on behalf of a third party entity, you have the full authority to bind such entity to all of the terms and conditions of these Terms of Use. If you or the entity you represent do not agree to these Terms of Use, you must not access or use the Portal and AutoCruitment will not and hereby does not grant you any right or license to access, use, browse the Portal, or to receive any information contained therein, in whole or in part. If you do not consent to, or meet each of these conditions, you must not access or use the Portal.

We may revise and update these Terms of Use from time to time at our sole and absolute discretion. All changes are effective immediately when we post them and apply to all access to, and use of the Portal thereafter.

Your continued use of the Portal following the posting of revised Terms of Use means that you accept and agree to the changes. You are expected to check this page from time to time so you are aware of any changes, as they are binding on you.

We reserve the right to withdraw or amend this Portal, and any service or material we provide on the Portal, at our sole discretion and without notice. We will not be liable if for any reason all or any part of the Portal is unavailable at any time or for any period. From time to time, we may restrict user access to the Portal, in whole or in part.

You are responsible for:

To access the Portal or some of the resources it offers, you may be asked to provide certain registration details or other information. It is a condition of your use of the Portal that all the information you provide on the Portal is correct, current and complete. You agree that all information you provide to register with this Portal or otherwise, including but not limited to, through the use of any interactive features on the Portal, is governed by our Privacy Policy. In addition, you agree that you will handle all Study Participant Information you obtain from the Portal in accordance with the Data Processing Terms and Conditions attached hereto as Exhibit 1 of these Terms of Use and incorporated herein.

If you choose, or are provided with, a username, password or any other piece of information as part of our security procedures, you must treat such information as confidential, and you must exercise commercially reasonable security practices in protecting such information, including preventing disclosure of such confidential information to any other person or entity, or sharing your login credentials with another user. You also acknowledge that your account is personal to you and agree not to provide any other person with access to this Portal or portions of it using your username, password or other security information. You must notify us immediately of any unauthorized access to or use of your username or password or any other breach of security. You must also ensure that you exit from your account at the end of each session. You should use particular caution when accessing your account from a public or shared computer so that others are not able to view or record your password or other personal information.

We have the right to disable any username, password or other identifier, whether chosen by you or provided by us, at any time in our sole discretion for any or no reason, including if, in our opinion, you have violated any provision of these Terms of Use.

All right, title and interest in and to the Portal and its entire contents, features and functionality (including but not limited to all information, software, text, displays, images, video and audio, and the design, selection and arrangement thereof), is owned by AutoCruitment, its licensors or other providers of such material, and are protected by United States and international copyright, trademark, patent, trade secret and other intellectual property or proprietary rights laws. You hereby acknowledge and agree that AutoCruitment is a Processor under these Terms of Use with respect to the processing of personal data of any potential research study participant that is selected for your research study (“Study Participant Information”) for the purposes of providing the Portal only. Separately, AutoCruitment is an independent controller with respect to the processing of Study Participant Information for AutoCruitment’s own purposes, including but not limited to the general placement of digital advertisements, the collection and processing of Study Participant Information, the storage of Study Participant Information, AutoCruitment’s compliance with its own legal and regulatory obligations, and processing of Study Participant Information by AutoCruitment that, collectively, are not activities or processing undertaken specifically on behalf of you or the sponsor.

These Terms of Use permit you to use the Portal only for use in accessing the Study Participant Information and evaluating a participant’s suitability for your research study and only in accordance with Exhibit 1 to these Terms of Use. You must not reproduce, distribute, modify, create derivative works of, publicly display, publicly perform, republish, download, store, share, disclose, process or transmit any of the material Study Participant Information on our Portal on pursuant to the Data Sharing Terms and Conditions, except as follows:

You may download the trial report and/or patient log and use them to the extent permitted by agreements with research sponsors to which your organization is a party in accordance with applicable law. Except as otherwise expressly permitted in these Terms of Use, you must not:

If you print, copy, modify, download or otherwise use or provide any other person with access to any part of the Portal in breach of the Terms of Use, or use any Study Participant Information in a manner not explicitly authorized under these Terms of Use or by AutoCruitment, your right to use the Portal will cease immediately and you must, at our option, return or destroy any copies of the materials you have made. No right, title or interest in or to the Portal or any content on the Portal is transferred to you, and all rights not expressly granted are reserved by AutoCruitment. Any use of the Portal not expressly permitted by these Terms of Use is a breach of these Terms of Use and may violate copyright, trademark and other laws.

The AutoCruitment name, and all related names, logos, product and service names, designs and slogans are trademarks of AutoCruitment or its affiliates or licensors. You must not use such marks without the prior written permission of AutoCruitment. All other names, logos, product and service names, designs and slogans on this Portal are the trademarks of their respective owners.

You may use the Portal only for lawful purposes and in accordance with these Terms of Use. You must not use the Portal or any Study Participant Information:

Additionally, you must not:

We have the right to:

Without limiting the foregoing, we have the right to fully cooperate with any law enforcement authorities or court order requesting or directing us to disclose the identity, or other information, of anyone accessing, or attempting to access, any materials on or through the Portal. We have no liability or responsibility to anyone for performance or nonperformance of the activities described in this section. YOU WAIVE AND HOLD HARMLESS AUTOCRUITMENT AND ITS AFFILIATES, LICENSEES, OTHER CUSTOMERS (INCLUDING, WITHOUT LIMITATION, STUDY SPONSORS AND OTHER RESEARCHERS), AND SERVICE PROVIDERS FROM ANY CLAIMS RESULTING FROM ANY ACTION TAKEN BY ANY OF THE FOREGOING PARTIES DURING, OR AS A RESULT, OF ITS INVESTIGATIONS AND FROM ANY ACTIONS TAKEN AS A CONSEQUENCE OF INVESTIGATIONS BY EITHER SUCH PARTIES OR LAW ENFORCEMENT AUTHORITIES.

The information presented on or through the Portal is made available solely for general information purposes. We do not warrant the accuracy, completeness or usefulness of this information. Any reliance you place on such information is strictly at your own risk. We disclaim all liability and responsibility arising from any reliance placed on such materials by you or any other visitor to the Portal, or by anyone who may be informed of any of its contents.

This Portal includes content provided by third parties, including materials provided by other users and potential research study participants. All statements and/or opinions expressed in these materials, and all articles and responses to questions and other content, other than the content provided by AutoCruitment, are solely the opinions and the responsibility of the person or entity providing those materials. These materials do not necessarily reflect the opinion of AutoCruitment. We are not responsible, or liable to you or any third party, for the content or accuracy of any materials provided by any third parties.

We may update the content on this Portal from time to time, but its content is not necessarily complete or up-to-date. Any of the material on the Portal may be out of date at any given time, and we are under no obligation to update such material.

All information we collect on this Portal is subject to our Privacy Policy.

You may link to our homepage, provided you do so in a way that is fair and legal and does not damage our reputation or take advantage of it, but you must not:

You agree to cooperate with us in causing any unauthorized framing or linking to immediately cease. We reserve the right to withdraw linking permission at any time without notice.

If the Portal contains links to other sites and resources provided by third parties, these links are provided for your convenience only. We have no control over the contents of those sites or resources, and accept no responsibility for them or for any loss or damage that may arise from your use of them. If you decide to access any of the third party websites linked to this Portal, you do so entirely at your own risk and subject to the terms and conditions of use for each such third party website.

Access to the Portal may not be legal by certain persons or in certain countries. You are responsible for compliance with all laws that apply to you regarding your access and use of the Portal.

You understand that we cannot and do not guarantee or warrant that files available for downloading from the internet or that the Portal will be free of viruses, malware or other destructive or malicious code. You are responsible for implementing commercially reasonable security procedures and checkpoints, including to satisfy your particular requirements for anti-virus protection and accuracy of data input and output, and for maintaining a means external to our site for any reconstruction of any lost data. WE WILL NOT BE LIABLE FOR ANY LOSS OR DAMAGE CAUSED BY A DISTRIBUTED DENIAL-OF-SERVICE ATTACK, VIRUSES OR OTHER TECHNOLOGICALLY HARMFUL MATERIAL THAT MAY INFECT YOUR COMPUTER EQUIPMENT, COMPUTER PROGRAMS, DATA OR OTHER PROPRIETARY MATERIAL DUE TO YOUR USE OF THE PORTAL OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE PORTAL OR TO YOUR DOWNLOADING OF ANY MATERIAL POSTED ON IT, OR ON ANY WEBSITE LINKED TO IT.

YOUR USE OF THE PORTAL, ITS CONTENT AND ANY SERVICES OR ITEMS OBTAINED THROUGH THE PORTAL IS AT YOUR OWN RISK. THE PORTAL, ITS CONTENT AND ANY SERVICES OR ITEMS OBTAINED THROUGH THE PORTAL ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, WITHOUT ANY WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. NEITHER AUTOCRUITMENT NOR ANY PERSON ASSOCIATED WITH AUTOCRUITMENT MAKES ANY WARRANTY OR REPRESENTATION WITH RESPECT TO THE COMPLETENESS, SECURITY, RELIABILITY, QUALITY, ACCURACY OR AVAILABILITY OF THE PORTAL. WITHOUT LIMITING THE FOREGOING, NEITHER AUTOCRUITMENT NOR ANYONE ASSOCIATED WITH AUTOCRUITMENT REPRESENTS OR WARRANTS THAT THE PORTAL, ITS CONTENT OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE PORTAL WILL BE ACCURATE, RELIABLE, ERROR-FREE OR UNINTERRUPTED, THAT DEFECTS WILL BE CORRECTED, THAT OUR SITE OR THE SERVER THAT MAKES IT AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS OR THAT THE PORTAL OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE PORTAL WILL OTHERWISE MEET YOUR NEEDS OR EXPECTATIONS.

AUTOCRUITMENT HEREBY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR PARTICULAR PURPOSE.

THE FOREGOING DOES NOT AFFECT ANY WARRANTIES WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.

IN NO EVENT WILL AUTOCRUITMENT, ITS AFFILIATES OR THEIR LICENSORS, SERVICE PROVIDERS, EMPLOYEES, AGENTS, OFFICERS OR DIRECTORS BE LIABLE FOR DAMAGES OF ANY KIND, UNDER ANY LEGAL THEORY, ARISING OUT OF OR IN CONNECTION WITH YOUR USE, OR INABILITY TO USE, THE PORTAL, ANY WEBSITES LINKED TO IT, ANY CONTENT ON THE PORTAL OR SUCH OTHER WEBSITES OR ANY SERVICES OR STUDY PARTICIPANT INFORMATION OBTAINED THROUGH THE PORTAL OR SUCH OTHER WEBSITES, INCLUDING ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO, PERSONAL INJURY, PAIN AND SUFFERING, EMOTIONAL DISTRESS, LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS OR ANTICIPATED SAVINGS, LOSS OF USE, LOSS OF GOODWILL, LOSS OF DATA, AND WHETHER CAUSED BY TORT (INCLUDING NEGLIGENCE), BREACH OF CONTRACT OR OTHERWISE, EVEN IF FORESEEABLE.

THE FOREGOING DOES NOT AFFECT ANY LIABILITY WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.

You agree to defend, indemnify and hold harmless AutoCruitment, its affiliates, licensors and service providers, and its and their respective officers, directors, employees, contractors, agents, licensors, suppliers, successors and assigns from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses or fees (including reasonable attorneys’ fees) arising out of or relating to your violation of these Terms of Use or your use of the Portal, including, but not limited to, any use of the Portal’s content or services (including any Study Participant Information) other than as expressly authorized in these Terms of Use or your use of any information obtained from the Portal.

All matters relating to the Portal and these Terms of Use and any dispute or claim arising therefrom or related thereto (in each case, including non-contractual disputes or claims), shall be governed by and construed in accordance with the internal laws of the State of New York without giving effect to any choice or conflict of law provision or rule (whether of the State of New York or any other jurisdiction).

Any legal suit, action or proceeding arising out of, or related to, these Terms of Use or the Portal shall be instituted exclusively in the federal courts of the United States or the courts of the State of New York in each case located in New York City and County of New York although we retain the right to bring any suit, action or proceeding against you for breach of these Terms of Use in your country of residence or any other relevant country. You waive any and all objections to the exercise of jurisdiction over you by such courts and to venue in such courts.

YOU AND AUTOCRUITMENT LLC AGREE TO GIVE UP ANY RIGHTS TO LITIGATE CLAIMS IN A COURT OR BEFORE A JURY, OR TO PARTICIPATE IN A CLASS ACTION OR REPRESENTATIVE ACTION WITH RESPECT TO A CLAIM. OTHER RIGHTS THAT YOU WOULD HAVE IF YOU WENT TO COURT MAY ALSO BE UNAVAILABLE OR MAY BE LIMITED IN ARBITRATION.

ANY CLAIM, DISPUTE OR CONTROVERSY (WHETHER IN CONTRACT, TORT OR OTHERWISE, WHETHER PRE-EXISTING, PRESENT OR FUTURE, AND INCLUDING STATUTORY, CONSUMER PROTECTION, COMMON LAW, INTENTIONAL TORT, INJUNCTIVE AND EQUITABLE CLAIMS) BETWEEN YOU AND US ARISING FROM OR RELATING IN ANY WAY TO YOUR PURCHASE OF PRODUCTS OR SERVICES THROUGH THE WEBSITE OR APPLICATIONS, WILL BE RESOLVED EXCLUSIVELY AND FINALLY BY BINDING ARBITRATION.

Arbitration uses a neutral arbitrator instead of a judge or jury, allows for more limited discovery than in court, and is subject to very limited review by courts. Arbitrators can award the same damages and relief that a court can award. The arbitration will be administered by the American Arbitration Association (“AAA”) in accordance with the Consumer Arbitration Rules (the “AAA Rules”) then in effect, except as modified by this Section 18 (The AAA Rules are available at https://www.adr.org/active-rules, by calling the AAA at 1-800-778-7879, or by contacting us at our address listed below). You agree that, by agreeing to these Terms, the Federal Arbitration Act will govern the interpretation and enforcement of this section.

The arbitrator will have exclusive authority to resolve any dispute relating to arbitrability and/or enforceability of this arbitration provision, including any unconscionability challenge or any other challenge that the arbitration provision or the agreement is void, voidable or otherwise invalid. The arbitrator will be empowered to grant whatever relief would be available in court under law or in equity. Any award of the arbitrator will be final and binding on each of the parties and may be entered as a judgment in any court of competent jurisdiction.

If you seek arbitration or elect to file a small claim court action, you must first send AutoCruitment LLC, by certified mail, a written notice of your claim (a “Notice”) to our General Counsel at the address listed below. If AutoCruitment initiates the arbitration, it will send such Notice to you at the address provided in your account (which may be updated by you from time to time). A Notice, whether sent by you or AutoCruitment, must: (a) describe the nature and basis of the claim or dispute; and (b) describe the specific relief sought (the “Demand”). If you and AutoCruitment do not reach an agreement to resolve the claim within 30 days after the Notice is received, you or AutoCruitment may commence an arbitration proceeding or file a claim in small claims court. The arbitration or small-claims court proceeding will be limited solely to your individual dispute or controversy.

You may download or copy a form to initiate arbitration at https://www.adr.org. If you are required to pay a filing fee, after AutoCruitment receives the notice at the address listed below that you have commenced arbitration, AutoCruitment will promptly reimburse you for your payment of the filing fee, unless your claim is for greater than US $10,000, in which event you will be responsible for the filing fees.

If your claim is for US $10,000 or less, we agree that you may choose whether the arbitration will be conducted solely on the basis of documents submitted to the arbitrator, through a telephonic hearing, or by an in-person hearing as established by the AAA Rules. If your claim exceeds US $10,000, the right to a hearing will be determined by the AAA Rules. Regardless of the manner in which the arbitration is conducted, the arbitrator shall issue a reasoned written decision sufficient to explain the essential findings and conclusions on which the award is based. If the arbitrator issues you an award that is greater than the value of AutoCruitment’s last written settlement offer made before an arbitrator was selected (or if AutoCruitment did not make a settlement offer before an arbitrator was selected), then AutoCruitment will pay you the amount of the award or US $1,000, whichever is greater. Except as expressly set forth herein, the payment of all filing, administration, and arbitrator fees will be governed by the AAA Rules.

You agree to an arbitration on an individual basis. IN ANY DISPUTE, NEITHER YOU NOR AUTOCRUITMENT LLC WILL BE ENTITLED TO JOIN OR CONSOLIDATE CLAIMS BY OR AGAINST OTHER CUSTOMERS IN COURT OR IN ARBITRATION OR OTHERWISE PARTICIPATE IN ANY CLAIM AS A CLASS REPRESENTATIVE, CLASS MEMBER OR IN A PRIVATE ATTORNEY GENERAL CAPACITY. The arbitral tribunal may not consolidate more than one person’s claims and may not otherwise preside over any form of a representative or class proceeding. The arbitral tribunal has no power to consider the enforceability of this class arbitration waiver and any challenge to the class arbitration waiver may only be raised in a court of competent jurisdiction.

This arbitration clause shall survive the termination of these Terms of Use. If this specific provision is found to be unenforceable, then (a) the entirety of this arbitration provision shall be null and void, but the remaining provisions of these Terms of Use shall remain in full force and effect; and (b) exclusive jurisdiction and venue for any claims will be as set forth above.

ANY CAUSE OF ACTION OR CLAIM YOU MAY HAVE ARISING OUT OF OR RELATING TO THESE TERMS OF USE OR THE WEBSITE MUST BE COMMENCED WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION ACCRUES, OTHERWISE, SUCH CAUSE OF ACTION OR CLAIM IS PERMANENTLY BARRED.

No waiver by AutoCruitment of any term or condition set forth in these Terms of Use shall be deemed a further or continuing waiver of such term or condition or a waiver of any other term or condition, and any failure of AutoCruitment to assert a right or provision under these Terms of Use shall not constitute a waiver of such right or provision.

If any provision of these Terms of Use is held by a court or other tribunal of competent jurisdiction to be invalid, illegal or unenforceable for any reason, such provision shall be eliminated or limited to the minimum extent such that the remaining provisions of the Terms of Use will continue in full force and effect.

The Terms of Use and our Privacy Policy constitute the sole and entire agreement between you and AutoCruitment LLC with respect to the Portal and supersede all prior and contemporaneous understandings, agreements, representations and warranties, both written and oral, with respect to the Portal.

This Portal is operated by AutoCruitment LLC; 101 Avenue of the Americas; 8th Floor; New York, NY 10013; (646) 876-9400.

All other feedback, comments, requests for technical support and other communications relating to the Portal should be directed to: info@autocruitment.com.

For the purposes of these Data Sharing Terms, the following terms have the following meanings:

“Data Sharing Terms” has the meaning set forth in the Preamble.

“Applicable Law” shall mean all regional, national, and international laws, rules, regulations, and standards including those imposed by any governmental or regulatory authority which apply from time to time to the party or activity in the circumstances in question.

“CCPA” means the California Consumer Privacy Act and its implementing regulations adopted by the California Attorney General, as each may be amended from time to time.

“Controller” has the meaning set forth in the GDPR.

“Controller Purposes” means the processing of Study Participant Information for AutoCruitment’s own purposes, including but not limited to the general placement of digital advertisements, the collection and processing of Study Participant Information, the storage of Study Participant Information, AutoCruitment’s compliance with its own legal and regulatory obligations, and processing of Study Participant Information by AutoCruitment that, collectively, are not activities or processing undertaken specifically on behalf of the Controller.

“Data Privacy Law” means all Applicable Laws relating to the Processing, protection, or privacy of the Personal Data, including, where applicable, the guidance, regulations, and codes of practice issued by regulatory bodies in any relevant jurisdiction. This includes, but is not limited to: (a) GDPR; (b) the UK GDPR; (c) CCPA; and (d) the Federal Trade Commission Act (FTC Act).

“Data Protection Authority” means a Supervisory Authority, as that term is defined in the GDPR or, with respect to the UK GDPR (where applicable) the UK Information Commissioner’s Office.

“Data Subject” has the meaning set forth in the GDPR.

“Data Protection Impact Assessment” means a data protection impact assessment, as described in Article 35 of the GDPR or the UK GDPR (as applicable).

“GDPR” means Regulation (EU) 2016/679, as amended, consolidated or replaced from time to time.

“Study Participant Information” means any and all Personal Data available on or through the Portal (as defined in the AutoCruitment Terms of Use to which these Data Sharing Terms are attached) related to an actual or potential participant in a research study or otherwise Processed under the Terms of Use.

“Personal Data” has the meaning set forth in the GDPR.

“Process”, Processing, or “Processed” each have the meaning set forth in the GDPR.

“Processor” has the meaning set forth in the GDPR.

“Security Incident” means a Personal Data Breach, as that term is defined in the GDPR or the UK GDPR (as applicable).

“Subprocessor” means any party engaged by Researcher to Process Study Participant Information.

“UK GDPR” means the GDPR as it forms part of domestic law in the United Kingdom by virtue of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018.

2. LICENSE

2.1. License Grant to Researcher. Subject to the terms and conditions of these Data Sharing Terms, AutoCruitment hereby grants Researcher a non-exclusive, non-sublicenseable, and non-transferable (except as may otherwise be provided for in another agreement between the parties), fully paid-up, and royalty-free license during the Term to use the Study Participant Information solely to evaluate such Data Subjects as candidates for a research study and to enroll such Data Subjects in the same, as applicable, and as otherwise permitted by Researcher’s agreement with the research sponsor (the “Permitted Use”). Subject to the terms of the Terms of Use and these Data Sharing Terms, Researcher may access and download such Study Participant Information from the Portal.

2.2. Study Participant Information Use Restrictions. Researcher shall only use the Study Participant Information for the Permitted Use and shall not disclose, release, distribute, or deliver the Study Participant Information, or any portion thereof, to any third-party other than as requested by a Data Subject or as necessary to fulfill the Permitted Use without AutoCruitment’s prior written authorization. Any purpose or use not specifically authorized herein is prohibited unless otherwise agreed to in writing by AutoCruitment. Without limiting the foregoing and except as otherwise expressly set forth in these Data Sharing Terms or as necessary to perform the Permitted Use, Researcher shall not at any time, directly or indirectly: (a) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer, share, disclose, process or otherwise make available the Study Participant Information in a manner other than as permitted pursuant to a written agreement between the parties; (b) publish, enhance, or display any compilation or directory based upon information derived from the Study Participant Information; or (c) use the Study Participant Information in any manner or for any purpose inconsistent with AutoCruitment’s Privacy Policy or that infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person (including such person’s right to privacy), or that violates any Applicable Law.

2.3. License Grant to AutoCruitment. The parties agree and acknowledge that the Personal Data provided by Researcher is anticipated by the Parties to be limited to the minimum necessary Personal Data required to setup the Researcher (and its authorized users’) accounts on the Portal and for billing and collection purposes and in no event is expected to contain sensitive or special categories of Personal Data (as such term may be construed under Data Privacy Laws) (collectively, “Researcher Personal Data”). Researcher will promptly notify AutoCruitment prior to providing any other Personal Data to AutoCruitment. Subject to the terms and conditions of these Data Sharing Terms, Researcher hereby grants AutoCruitment a non-exclusive, fully paid-up, perpetual, and royalty free license to use such Researcher Personal Data to maintain and provide access to the Portal (including for billing and collection purposes) and the information contained therein related to Data subjects and their suitability for research studies.

2.4. Researcher Personal Data Use Restrictions. AutoCruitment agrees that it shall not retain, use, or disclose any Researcher Personal Data for any purpose other than providing Researcher and its authorized users with the access and use of the Portal (and any billing, collections, or similar activity required related to the same), to provide patients and potential patients with the contact information of Researcher, or as otherwise permitted under the Data Privacy Laws. AutoCruitment agrees and acknowledges that it is prohibited from retaining, using, or disclosing any Researcher Personal Data for any purpose other than as set forth in the foregoing sentence. AutoCruitment shall ensure that its subcontractors who collect, retain, or disclose Researcher Personal Data in connection with the foregoing purpose agree in writing to the same restrictions and requirements that apply to AutoCruitment with respect to the Researcher Personal Data. AutoCruitment shall not disclose the Researcher Personal Data for any monetary or other valuable consideration such that such disclosure constitutes a “sale” under the CCPA.

2.5. Reservation of Rights. Each party reserves all rights not expressly granted to the other party in these Data Sharing Terms. Except for the limited rights and licenses expressly granted under these Data Sharing Terms, nothing in these Data Sharing Terms grants, by implication, waiver, estoppel, or otherwise, to the other party or any third-party any intellectual property rights or other right, title, or interest in or to any Personal Data.

3.1. Controller / Processor Status. The parties hereby acknowledge and agree that: (a) AutoCruitment is an independent controller with respect to the processing of Study Participant Information for the Controller Purposes; and (b) AutoCruitment is a Processor on behalf of the Controller with respect to the Processing of Study Participant Information for the purposes of providing the Portal. To the extent that AutoCruitment is a Processor of Study Participant Information, the Controller is the Researcher, unless the Researcher is a Processor on behalf of the sponsor, in which case the Controller is the sponsor.

3.2. Processor Obligations under Data Protection Laws. To the extent that AutoCruitment acts as a Processor of Study Participant Information AutoCruitment shall, in relation to such Processing:

• (A) only Process Study Participant Information: (i) to the extent necessary in connection with these Terms of Use or the Permitted Use; and (ii) in accordance with the documented instructions received from the Controller from time to time, except where required to Process any Study Participant Information in relation to any EU Member State, by the laws of the EU or an EU Member State; or in relation to the UK, by the laws applicable in the UK, in which case AutoCruitment shall inform the Controller in advance of such processing, to the maximum extent permitted by applicable law;
• (B) take reasonable steps to ensure: (i) that Study Participant Information are kept confidential; and (ii) that all relevant AutoCruitment Personnel, and any relevant Subprocessors, have committed themselves to keeping the Study Participant Information that they Process confidential;
• (C) taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, implement appropriate technical and organisational measures to protect Study Participant Information, in accordance with Articles 32-34 of the GDPR, or the UK GDPR, as applicable;
• (D) only appoint Subprocessors in accordance with the prior written authorisation of the Controller (such authorisation not to be unreasonably withheld, conditioned or delayed) noting that the Controller hereby grants AutoCruitment general written authorisation to appoint any members of and such other third parties as AutoCruitment may, from time to time, notify to the Controller as Subprocessors;
• (E) at the Controller’s request and expense, reasonably promptly provide the Controller with such reasonable assistance as may be necessary to enable the Controller to respond appropriately to requests from Data Subjects to exercise their rights;
• (F) at the Controller’s request and expense, reasonably promptly provide the Controller with such reasonable assistance as may be necessary to enable the Controller to: (i) notify relevant breaches of the GDPR, or the UK GDPR, as applicable, to the relevant Data Protection Authorities and/or affected Data Subjects; (ii) conduct Data Protection Impact Assessments; and (iii) obtain any necessary authorisations from Data Protection Authorities;
• (G) delete (or, at the election and expense of the Controller, return) all Study Participant Information in AutoCruitment’s possession, within sixty (60) days after the end of the Term, unless in relation to an EU Member State, the applicable law of the European Union or an EU Member State requires otherwise, or in relation to the UK, the laws applicable in the UK require otherwise;
• (H) at the Researcher’s request and expense: (i) reasonably promptly provide the Controller with such information as may be reasonably necessary to enable the Controller to demonstrate compliance with its obligations under the GDPR, or the UK GDPR, as applicable, to the extent that AutoCruitment is reasonably able to provide such information; and (ii) subject always to Section 3.3, allow for and contribute to audits, including inspections, conducted by the Controller or an auditor appointed by the Controller; and
• (I) notify the Controller reasonably promptly of any confirmed Security Incident affecting Study Participant Information in respect of which AutoCruitment is a Processor.

3.3. Audit Rights. The Controller shall solely exercise its audit right set out in Section 3.2(h)(ii) by instructing AutoCruitment to provide a copy of AutoCruitment’s then-current industry-standard reports (subject to any redactions necessary for confidentiality or legal compliance purposes). If the Controller desires to change this instruction regarding exercising its audit right, then the Controller has the right to request that from AutoCruitment, which request shall be in writing. Upon receipt of such request in writing, AutoCruitment shall be entitled to terminate these Terms of Use without fault, penalty or liability of any kind, and without prejudice to any rights that AutoCruitment may have under these Terms of Use.

Researcher acknowledges that, as between Researcher and AutoCruitment, AutoCruitment owns all right, title and interest, including all intellectual property rights, in and to the Study Participant Information. Researcher further acknowledges that: (a) the Study Participant Information is an original compilation protected by United States copyright laws; (b) AutoCruitment has dedicated substantial resources to collect, manage and compile such Study Participant Information; and (c) such Study Participant Information may constitute trade secrets of AutoCruitment. AutoCruitment may terminate these Data Sharing Terms without advance notice to Researcher or an opportunity for Researcher to cure and without further obligation or liability if Researcher contests any of AutoCruitment’s right, title, or interest in or to the Study Participant Information, including without limitation, in a judicial proceeding anywhere throughout the world.

EXCEPT AS EXPRESSLY STATED IN THESE DATA SHARING TERMS, THE STUDY PARTICIPANT INFORMATION IS PROVIDED “AS IS” AND AUTOCRUITMENT HEREBY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE. THE STUDY PARTICIPANT INFORMATION PROVIDED BY AUTOCRUITMENT IS ADVISORY IN NATURE AND NOT BINDING ON RESEARCHER OR ANY OTHER THIRD PARTY. AUTOCRUITMENT SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE OR TRADE PRACTICE WITH RESPECT TO SUCH STUDY PARTICIPANT INFORMATION. EXCEPT AS EXPRESSLY STATED IN THESE DATA SHARING TERMS, AUTOCRUITMENT MAKES NO WARRANTY OF ANY KIND THAT THE STUDY PARTICIPANT INFORMATION, OR ANY PRODUCTS OR RESULTS OF ITS USE, WILL MEET RESEARCHER’S OR ANY OTHER PERSON’S REQUIREMENTS, OR ACHIEVE ANY INTENDED RESULT.

6.1. Indemnification. Researcher shall indemnify, hold harmless, and, at AutoCruitment’s option, defend AutoCruitment from and against any losses, damages, liabilities, or costs (including reasonable attorneys’ fees) (“Losses”) resulting from any third-party claim, suit, action, or proceeding (“Third-Party Claim”) based on Researcher’s: (a) negligence or willful misconduct; (b) use of the Study Participant Information by Researcher or its personnel in a manner not authorized by these Data Sharing Terms; (c) use of Study Participant Information by Researcher or its personnel contrary to the instructions of the Data Subject; (d) use of the Study Participant Information in violation of any Applicable Laws; or (e) a breach of its security controls that results in a Security Incident.

6.2. By AutoCruitment. AutoCruitment shall indemnify, defend, and hold harmless Researcher from and against all Losses incurred by Researcher from any Third-Party Claim that Researcher’s Permitted Use of the Study Participant Information available on or through the Portal infringes or misappropriates such third party’s intellectual property rights. This Section 6.2 shall not apply to the extent that the alleged infringement arises from Researcher’s violation of Section 2.2.

6.3. Indemnification Procedure. The party seeking indemnification shall promptly notify the indemnifying party in writing of any Third-Party Claim for which it seeks indemnification under this Section 6 and cooperate with the indemnifying party at the indemnifying party’s sole cost and expense. The indemnifying party shall immediately take control of the defense and investigation of such Third-Party Claim and shall employ counsel of its choice to handle and defend the same, at the indemnifying party’s sole cost and expense. The indemnifying party may not settle any Third-Party Claim against the indemnified party unless such settlement completely and forever releases indemnified party from all liability with respect to such Third-Party Claim or unless the indemnified party consents to such settlement, which shall not be unreasonably withheld or delayed, and provided further that the indemnified party shall have the right, at its option, to defend itself against any such Third-Party Claim or to participate in the defense thereof at its own cost and expense with counsel of its own choice. A failure of the party seeking indemnification to perform any of the obligations under this Section 6 will not relieve the indemnifying party of its obligations under this Section 6 except to the extent that the indemnifying party can demonstrate that it has been materially prejudiced as a result of such failure.

7. LIMITATIONS OF LIABILITY

IN NO EVENT WILL AUTOCRUITMENT BE LIABLE UNDER OR IN CONNECTION WITH THESE DATA SHARING TERMS UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE, FOR ANY: (A) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED OR PUNITIVE DAMAGES; (B) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (C) LOSS OF GOODWILL OR REPUTATION; (D) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY OR RECOVERY OF ANY DATA OR BREACH OF DATA OR SYSTEM SECURITY; OR (E) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER AUTOCRUITMENT WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE. IN NO EVENT WILL AUTOCRUITMENT’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE DATA SHARING TERMS, UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY AND OTHERWISE, EXCEED THE TOTAL OF THE AMOUNTS PAID BY RESEARCHER TO AUTOCRUITMENT PURSUANT TO AN APPLICABLE SERVICES AGREEMENT FOR RESEARCHER’S ACCESS AND USE OF AUTOCRUITMENT’S SERVICES IN THE TWELVE (12) MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE CLAIM OR, IF NO SUCH AGREEMENT HAS BEEN EXECUTED, THE SUM OF ONE-HUNDRED DOLLARS ($100).

8.1. Term. The term of these Data Sharing Terms begins on the Effective Date and will continue indefinitely unless terminated pursuant to any of these Data Sharing Term’s express provisions (the “Term”).

8.2. Termination. In addition to any other express termination right set forth elsewhere in these Data Sharing Terms:

• (a) AutoCruitment may terminate these Data Sharing Terms, effective on written notice to Researcher, if Researcher: (i) breaches any of its obligations under Section 2.2 or Section 3.2; or (ii) violates any Applicable Law;
• (b) either party may terminate these Data Sharing Terms, effective on written notice to the other party, if the other party materially breaches these Data Sharing Terms, and such breach: (i) is incapable of cure; or (ii) being capable of cure, remains uncured fifteen (15) days after the non-breaching party provides the breaching party with written notice of such breach;
• (c) either party may terminate these Data Sharing Terms, effective immediately upon written notice to the other party, if the other party: (i) becomes insolvent or is generally unable to pay, or fails to pay, its debts as they become due; (ii) files or has filed against it, a petition for voluntary or involuntary bankruptcy or otherwise becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency law; (iii) makes or seeks to make a general assignment for the benefit of its creditors; or (iv) applies for or has appointed a receiver, trustee, custodian, or similar agent appointed by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business; or
• (d) these Data Sharing Terms will terminate automatically if AutoCruitment suspends or terminates Researchers access or use of the Portal for any reason.

8.3. Survival. Any rights, obligations, or required performance of the parties in these Data Sharing Terms which, by their express terms or nature and context are intended to survive termination or expiration of these Data Sharing Terms, will survive any such termination or expiration, including the rights and obligations set forth in this Section 8.3 and Sections 3, 4, 5, 6, 7, 8, and 9.

9.1. Governing Law; Submission to Jurisdiction. Any legal suit, action, or other proceeding arising out of or related to the Data Privacy Laws (each, a “Data Privacy Law Action”): (a) shall be governed by and construed in accordance with the internal laws of England and Wales without giving effect to any choice or conflict of law provisions or rule that would require or permit the application of the laws of any jurisdiction other than those of England and Wales; and (b) will be instituted exclusively in the courts of England and Wales located in the city of London, and each party irrevocably submits to the exclusive jurisdiction of such courts in any such Data Privacy Law Action. For all other legal suits, actions, or other proceedings not arising out of or related to the Data Privacy Laws (each, an “Other Action”), these Data Sharing Terms are governed by and construed in accordance with the internal laws of the State of New York without giving effect to any choice or conflict of law provision or rule that would require or permit the application of the laws of any jurisdiction other than those of the State of New York. All Other Actions will be instituted exclusively in the federal courts of the United States or the courts of the State of New York in each case located in the city of New York, and each party irrevocably submits to the exclusive jurisdiction of such courts in any such Other Action.

9.2. Third-Party Beneficiaries. Each Data Subject is an intended third-party beneficiary of these Data Sharing Terms to the extent it relates to such Data Subject’s Personal Data. In this regard, such Data Subject shall be entitled to exercise all rights available to AutoCruitment under these Data Sharing Terms, and enforce all terms and conditions of these Data Sharing Terms to the extent such rights, terms, and conditions impact or otherwise relate to such Data Subject’s Personal Data as such Data Subject would have were it a party hereto. Except as otherwise set forth in this Section 9.2, these Data Sharing Terms is for the sole benefit of AutoCruitment and Researcher and their respective successors and permitted assigns and nothing herein, express or implied, is intended to or shall confer upon any other person or entity any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of these Data Sharing Terms.

For the purposes of the clauses:

• a) “personal data”, “special categories of data/sensitive data”, “process/processing”, “controller”, “processor”, “data subject” and “supervisory authority/authority” shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby “the authority” shall mean the competent data protection authority in the territory in which the data exporter is established);
• b) “the data exporter” shall mean the controller who transfers the personal data;
• c) “the data importer” shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection;
• d) “clauses” shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

The data exporter warrants and undertakes that:

• a) The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter.
• b) It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses.
• c) It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established.
• d) It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond. Responses will be made within a reasonable time.
• e) It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required.

The data importer warrants and undertakes that:

• a) It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.
• b) It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data.
• c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.
• d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfil the undertakings set out in these clauses.
• e) It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data, and will cooperate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the data exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance with the provisions of clause I(e).
• f) At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient to fulfil its responsibilities under clause III (which may include insurance coverage).
• g) Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any independent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to by the data importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the data importer, which consent or approval the data importer will attempt to obtain in a timely fashion.
• h) It will process the personal data, at its option, in accordance with:
  • i. the data protection laws of the country in which the data exporter is established, or
  • ii. the relevant provisions of any Commission decision pursuant to Article 25(6) of Directive 95/46/EC, where the data importer complies with the relevant provisions of such an authorisation or decision and is based in a country to which such an authorisation or decision pertains, but is not covered by such authorisation or decision for the purposes of the transfer(s) of the personal data, or
  • iii. the data processing principles set forth in Annex A.
    Data importer to indicate which option it selects: (i)
    Initials of data importer: as agreed electronically upon use of the data exporter’s services;
• i) It will not disclose or transfer the personal data to a third party data controller located outside the European Economic Area (EEA) unless it notifies the data exporter about the transfer and
  • i. the third party data controller processes the personal data in accordance with a Commission decision finding that a third country provides adequate protection, or
  • ii. the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU, or
  • iii. data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or
  • iv. with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the onward transfer

• a) Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the data exporter under its data protection law.
• b) The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the data importer or the data exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the data exporter’s country of establishment. In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden to prove that it took reasonable efforts).

These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause II(h), which shall apply only if so selected by the data importer under that clause.

• a) In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.
• b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.
• c) Each party shall abide by a decision of a competent court of the data exporter’s country of establishment or of the authority which is final and against which no further appeal is possible.

• a) In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.
• b) In the event that:
  • i. the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (a);
  • ii. compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import;
  • iii. the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;
  • iv. a final decision against which no further appeal is possible of a competent court of the data exporter’s country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or
  • v. a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs
• then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses.
• c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly applicable in such country.
• d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

Dated: Electronically, upon the first date data exporter uses data importer’s goods and services.

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject.

2. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter.

4. Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.

5. Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority.

6. Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause II.

7. Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to “opt-out” from having his data used for such purposes.

8. Automated decisions: For purposes hereof “automated decision” shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to them, such as their performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when:

Data subjects
The personal data transferred concern the following categories of data subjects:
Potential patients and participant in clinical research studies conducted by data importer.

Purposes of the transfer(s)
The transfer is made for the following purposes:
To determine if data subjects meet criteria for participation in clinical research studies conducted by data exporter and to enroll data subject in such studies if the critera is met.

Categories of data
The personal data transferred concern the following categories of data:
Contact information of data subject potentially together with other information submitted by data subject to be considered for one or more clinical research studies, which may include current or past health conditions and demographic information such as age and gender.

Recipients
The personal data transferred may be disclosed only to the following recipients or categories of recipients:
Data importer and potentially clinical research sponsor in the event of an adverse event.

Sensitive data (if appropriate)
The personal data transferred concern the following categories of sensitive data:
Information related to genetic data, physical or mental health condition and, when appliable for the particular clinical research study, sexual life and/or sexual orientation.

Data protection registration information of data exporter (where applicable)

Additional useful information (storage limits and other relevant information)

N/A

Contact points for data protection enquiries