Clinical Trial Privacy Policy

Nucleix Clinical Trial Privacy Notice

Last time updated: March 26, 2025

Nucleix Ltd (“Nucleix”, “we”, “us”, “our”) takes privacy seriously. This Privacy Notice (this “Notice”) describes how we use your Personal Data (as defined below) we may receive, either directly from you, or from third parties, in connection with the clinical trials we sponsor. This Notice is applicable to you if you are a clinical patient at one of our sites recruited for our studies (individually and together, “you,” “your”).

This Notice explains in general terms our commitment to comply with the UK General Data Protection Regulation (the “UK GDPR”) and the the Protection of Privacy Law, 5741 – 1981 and any regulations enacted thereunder including the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001 and Protection of Privacy Regulations (Data Security), 5777-2017, and any guidelines and/or instructions published by the Israeli Privacy Protection Authority.  

This Notice does not apply to other categories of Personal Data we collect by other means, like Personal Data that we receive directly through our public website located at https://nucleix.com/. For more information about how we process Personal Data about other types of people, please see our general Privacy Policy available here.

During the clinical trial consent process, site clinical team enrolling participants into the study provide information about the trial, explain how Personal Data will be managed and protected and share a link to this Notice. Important note: Nothing in this Notice is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement. “Personal Data” means any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as personally identifiable information by privacy laws.

1. Controllership
   • Within the scope of this Notice, Nucleix Ltd. acts as a data controller for the Personal Data collected, used and processed. This means that we determine the purposes and the means of the processing of Personal Data.
   • IMPORTANT NOTE: Please note that we do not have direct access to clinical trial patients’ Personal Data, meaning that we are typically unable to directly identify clinical trial patients. If you participate in a clinical trial, you will be assigned a unique patient identification number. Your Personal Data is collected by the clinical trial site (the doctor’s office, clinic, hospital, or other healthcare facility where the clinical trial is being conducted) and transferred to the clinical research organization (“CRO”) and Nucleix in an anonymized manner, either through manual forms or an Electronic Data Capture (EDC) system. Other third parties, such as your primary care doctors or clinical laboratories, may also be involved in this process.
   • When any information relating to clinical trial patients is shared with us, it will be key-coded so that you will not be identified by any direct personal identifier. In addition, you are not under any legal obligation to share data with us, personal or not. The decision to participate in the clinical trial and consequently share your Personal Data is entirely voluntary, reflecting your free choice.
   • There may be other organizations that jointly control the processing of your Personal Data in conjunction with us. If you would like to know more about the other data controllers that jointly determine the purposes for which we process your Personal Data, and the means by which we do so, you may ask your clinical trial doctor or the clinical trial site for further details, specific to the clinical trial you participate in. For more information, please contact privacy@nucleix.com

2. Processing activities
   • Categories Of Personal Data
     • Nucleix itself will have access to the following types of Personal Data about clinical trial patients:

1. Health care information;
2. A key-coded identifier about you, health information, such as your medical background, history, and your genetic information.
   • Purposes Of Processing
     • We will process the listed Personal Data for the purposes of:

1. Determining your eligibility for a clinical trial;
2. Conducting the clinical trial;

• Ensuring that each trial invitro-diagnostic device is safe and reliable;

1. Conducting related scientific and medical research; and
2. We also process the Personal Data of clinical trial patients for the specific purposes described in the clinical trial information provided to the clinical trial patients by the clinical trial site.
   • Legal basis
     • Before, during, and after each trial, we will process your Personal Data for various purposes. In each case, we will rely on an appropriate lawful basis for processing your Personal Data, for example your consent (e.g., when you sign the informed consent).
     • We process your Personal Data for safety and reliability purposes in order to comply with our legal obligations.
     • We process your Personal Data for scientific research purposes based on our legitimate interest in conducting clinical trials and performing valuable scientific and medical research.
     • If we process your Personal Data for other purposes after the end of a clinical trial, we will do so based on your consent or our legitimate interest in conducting further research.
     • Nucleix will need to process data about your health in order for you to participate in a clinical trial. Health data is considered sensitive Personal Data (also known as a “special category” of Personal Data) and special rules apply to working with it. When we process special categories of your Personal Data, we only do so when the processing is necessary for reasons of public interest in the area of public health. Those reasons include making sure our technology is safe and effective, and conducting our clinical trial safely. We also process your sensitive Personal Data based on your explicit consent.
     • The specific grounds on which we process your Personal Data, including your health data, may vary somewhat from the above in order to comply with the requirements of applicable local laws in jurisdictions where we sponsor clinical trials. If you are a patient in a Nucleix clinical trial, please refer to the informed consent form you signed for more information about the legal grounds on which we process your Personal Data. If there is any conflict between any provision in this Notice and any provision in the informed consent form you signed in connection with your participation in a clinical trial we sponsor, the informed consent form shall supersede the conflicting provision in this Notice.
   • Data sources
     • We receive your Personal Data when:
   • You visit one of our clinical trial-specific websites or online portals;
   • You provide it to us, to the CRO, or a clinical trial site directly when you complete a pre-screening questionnaire on one of our clinical trial-specific websites;
   • You provide it to us, to CRO, or a clinical trial site when you participate in a clinical trial;
   • Your doctors or healthcare providers provide it to us; or
   • You provide it to us in your role as clinical trial personnel in the context of assisting in the operation of a clinical trial.

In cases where providing the above Personal Data is required in order to enable your participation in the clinical trial, if you choose not to provide such data, you will not be able to participate in the clinical trial. 

3. Automated Individual Decision-Making. We do not make automatic decisions based on your Personal Data.

4. Data Retention. Data Integrity & Security
   • Nucleix will keep your Personal Data until we fulfill the purposes listed above, or for as long as required by applicable law. This means we will need to keep your Personal Data for a long time. However, in order to protect your privacy, the information of every clinical trial participant is “key-coded” before we enter it into the studies and reports. This means that we replace identifying information like your name and contact information with a code number. To the maximum extent permitted by law, once your data has been key-coded and recorded in official clinical trial documents, we cannot remove it without affecting the accuracy of the studies and test results. For example, the United Kingdom law requires us to keep Personal Data that is part of the clinical trial master file for at least ten years after the conclusion of the applicable clinical trial. Other laws may require different retention periods.
   • We have put in place technical, administrative, and physical measures that are designed to help protect your Personal Data from being accessed, disclosed, altered, or destroyed by unauthorized people. These measures include the use of measures like key-coding and encryption, where appropriate. When we use a service provider, we will use commercially reasonable efforts to require the service provider to use industry standard measures to protect the confidentiality and security of Personal Data.

5. Sharing Personal Data With Third Parties
   • We will share your Personal Data with service providers who process Personal Data on our behalf and who agree to use your Personal Data only to assist us in conducting our Trials or as required by applicable law.
   • Our service providers provide:
6. Clinical research (CRO) services;
7. Lab services;

• Medical writing services;

1. Statistical Services
2. Project management services; and
3. General consulting services.
   • We will also share your Personal Data with other third parties involved in the clinical trials. Some of these third parties are data controllers in their own right. These third parties include clinical sites like hospitals and medical offices, and public government agencies and may be located in other countries. Therefore, your Personal Data may be processed outside your jurisdiction and in countries not subject to an adequacy decision by the United Kingdom or your local legislature and/or regulator, and that may not provide for the same level of data protection as your jurisdiction.
   • We use commercially reasonable efforts to make sure that the recipient of your Personal Data offers an adequate level of protection, for instance, by entering into appropriate data protection agreements and if required, the United Kingdom-approved standard contractual data protection clauses.
   • We may disclose your Personal Data:
4. To the extent necessary, to regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
5. If, in the future, we sell or transfer, or we consider selling or transferring, part or all of our company, business, shares or assets to a third party, we will disclose your Personal Data to such third party (whether actual or potential) in connection with the foregoing events; or

• In the event that we are acquired by, or merged with, a third-party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your Personal Data in connection with the foregoing events; and/or

1. If necessary, to our group companies for business purposes, as described above.

If you want to receive the list of the current recipients of your Personal Data, please contact the relevant clinical site.

6. Transfers of Personal Data
   • Personal Data may be processed, accessed, or stored in a country outside the country where you are located, which may not offer the same level of protection, including to our affiliates and service providers, including, without limitation to Israel and the US. Therefore, your Personal Data may be processed in countries with privacy laws that are different from privacy laws in your country. Whenever we make such transfers, including outside the United Kingdom and/or Israel, we will use commercially reasonable efforts to implement an appropriate level of protection to your Personal Data by implementing at least one of the following safeguards:

1. making sure the destination country has been deemed to provide an adequate level of protection for Personal Data; and/or
2. by executing implement data onward transfer instruments such as data processing and protection agreements.

7. Your Rights
   • The following rights (which may be subject to certain exemptions or derogations) shall apply to certain individuals, based on their place of residency:
     • If we process your Personal Data, you will have the right to request access to (or to update or correct) that Personal Data. You may also have the right to ask that we limit our processing of your Personal Data, as well as the right to object to our processing of your Personal Data. You may also have the right to data portability, which means that you may have the right to ask us to provide you with a copy of your Personal Data that another company like Nucleix can process.
     • To submit these requests or raise any other questions, please contact us by using the information in the “Contact Us” section below.
     • You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
     • You have the right to request the erasure/deletion of your Personal Data (e.g. from our records), in some cases, to the extent the Data is found to be inaccurate or not updated. Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
     • You have the right to object, to or to request restriction, of the processing;
     • You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
     • You have the right to object to profiling;
     • You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. If you want to withdraw consent from the clinical trial, please contact the relevant clinical site.
     • You also have a right to request certain details of the basis on which your Personal Data is transferred outside the United Kingdom, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
     • You have a right to lodge a complaint with the Information Commissioner Officer and/or your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence.
   • You can exercise your rights by contacting the relevant clinical site. You may use an authorized agent to submit a request on your behalf if you provide the authorized agent with written permission signed by you. To protect your privacy, both we and the clinical trial site may take steps to verify your identity before fulfilling your request. Subject to legal and other permissible considerations, both we and the clinical trial site will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if further information is required to fulfill your request. When processing your request, both we and the clinical trial site may ask you for additional information to confirm or verify your identity and for security purposes before processing and/or honoring your request. Both we and the clinical trial site reserve the right to charge a fee where permitted by law, for instance, if your request is manifestly unfounded or excessive. In the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if both we and the clinical trial site are legally entitled to deal with your request in a different way than initially requested, both we and the clinical trial site will address your request to the maximum extent possible, all in accordance with applicable law.

8. Changes To This Privacy Notice. If we change this Notice, we will provide you with a copy of the revised Notice or update it on our Website. We will also update the “Effective” date.

9. Contact Us. If you have any questions about this Notice or our processing of your Personal Data, please contact privacy@nucleix.com

10. Data Protection Officer. Please contact privacy@nucleix.com on matters related to our use of your Personal Data.

Clinical trial representative: Vered Yayon, vered.y@nucleix.com