GDPR Privacy Notice

University of Southern California Alzheimer’s Therapeutic Research Institute Privacy Notice

Identification of Data Controller

During the AHEAD 3-45 Study (the “Study”), the University of Southern California (“USC”, “we”, and “us”)—including the Alzheimer’s Therapeutic Research Institute (“ATRI”), which is a part of USC’s Keck School of Medicine and has partnered with Eisai, the sponsor of the Study—is a controller of your personal data and responsible for its processing for the purposes of research and analysis performed in connection with the Study, publication of the Study results, and future scientific research related to Alzheimer’s disease and related conditions involving your personal data collected in connection with the Study (as described in the informed consent forms for the Study). Eisai is also a controller of your personal data collected for the purposes of the Study; this Privacy Notice only describes USC’s data processing as controller, and not Eisai’s. USC is located at 3720 South Flower Street, Los Angeles, California, United States.

Types of Personal Data

You are receiving this privacy notice because USC will receive your personal data from the clinic/hospital that records your personal data and collects samples from you in connection with the Study (as described in the informed consent forms).The personal data we will obtain includes your study code, your gender, ethnic origin, height, weight, medical history, procedures, test results, genetic data, imaging, biological samples and other health data collected about your taking part in the Study. For more information about the types of personal data and the way it will be collected from you, please refer to Section 19 of the informed consent form (however, not all types of data collected by the clinic/hospital will be shared with USC).

The Purposes of the Processing

USC will process and store your personal data for the following purposes:

• In connection with the Study. In partnership with Eisai, USC will process your personal data to carry out and monitor the Study, to conduct and analyze test results, and for study auditing purposes.

• In connection with publication of Study results. USC will also use your personal data in connection with its publication of the Study results. However, you will not be identified in any publication resulting from the Study without your permission.

• For future research. Consistent with your informed consent, USC may use your personal data for future scientific research including analysis of test results and publication of results.

The legal bases for the processing of your personal data as described in this Section are: USC’s legitimate interests in advancing research related to Alzheimer’s disease and related conditions, including testing and developing methods of early detection of and treatments for Alzheimer’s disease and related conditions; for scientific research purposes; and as is necessary for reasons of public interest in the area of public health.

The Way Your Personal Data is Used and Shared

The personal data you provide will become part of the clinical trial databases and paper files as needed to carry out the processing purposes described above.

Personal data may be shared with the following categories of recipients:

• The regulatory sponsor of the Study (Eisai). This includes authorized persons from Eisai Inc. in the United States, Eisai Ltd. in the United Kingdom, Eisai Co., Ltd. in Japan, and any third-party service providers acting on the sponsor’s behalf.

• Your Study doctor and associated medical staff.

• Monitors, auditors, representatives from laboratories, and other third-party service providers acting on behalf of USC.

• Representatives from health/regulatory authorities such as the Medicines and Healthcare Products Regulatory Agency (MHRA) and United States Food and Drug Administration (FDA).

• Ethics committees or institutional review boards, to check that the Study is being carried out correctly.

• Research partners involved in the Study.

• Other researchers, for future scientific research related to Alzheimer’s disease and related conditions if, in the informed consent form, you agreed to the use of your personal data or samples for such future research.

For more information about how information is shared in the context of the Study, please refer to Section 18 of the informed consent form.

Please note that USC and some of the entities mentioned above are based outside the European Economic Area (EEA). For example, USC is located in the United States; the regulatory sponsor of the Study (Eisai) is located in the United States, the United Kingdom, and Japan; and our research partners and other researchers who may receive your personal data may be located in other countries. Your samples will also be transferred to these countries for analysis.

You should be aware that the laws of the United States are not currently considered by the European Commission to provide the same level of data protection as are provided under the laws of the EEA. USC will, however, take reasonable steps and have agreements in place to ensure that any personal data transferred to jurisdictions not considered to provide an adequate level of data protection are treated securely and subject to appropriate safeguards, such as standard contractual clauses.

The Way Your Personal Data is Secured

USC and those acting on its behalf maintain appropriate technical and organizational measures designed to protect your personal data against loss or accidental, unlawful or unauthorized alteration, access, disclosure or use.

Your personal data will be stored by USC for 25 years and may be stored for longer if you agree to the use of your personal data for future scientific research, or where required by applicable law. This retention period may also be extended if USC is required to preserve your personal data in connection with litigation, investigations or other proceedings.

As described in the informed consent form, your samples may be stored for testing in connection with the Study for up to 15 years after the completion of the Study, or until the samples are gone (if before). Your samples may be retained for longer than 15 years if (1) you agree in the informed consent form to donate your samples for future research; or (2) a health authority or other relevant regulator has questions about the Study, in which case samples will be stored until those questions have been addressed. Any samples retained for over 15 years (including samples retained in connection with the Study and any samples donated for future research) will remain coded and the storage, use, and confidentiality will be handled in the same way as described in the informed consent form.

Your Rights as a Data Subject

You have a number of rights concerning the processing of your data, including the rights to:

– Request additional information about the processing of your data;

– Request access to the data kept about you as long as this does not impede the scientific integrity of any study or clinical trial. To guarantee the scientific integrity of the clinical trial or study, it is possible that you will not be permitted to access certain data before the end of the clinical trial or study. Although you will not be allowed to see the clinical trial or study information, you may be given access to your health care records by contacting your health care provider;

– Request corrections if the data are incorrect or incomplete. During the assessment of this request you have the right to restrict the processing of your data;

– Request the transfer of your data by a reasonable format and method to yourself or to someone else;

– Request that your data be erased, where applicable under law.

You also have the right to withdraw from the Study at any time by informing your study doctor in writing, as described in the informed consent form. You should be aware that results and information obtained prior to your decision to withdraw from the Study as well as the data/results generated from your samples that have already been provided for the Study purposes cannot be erased.

In addition, if at any time you decide that you do not want your personal data or samples used or processed by USC for future/secondary research, you have the right to opt out of our use of that personal data and samples by notifying your study doctor in writing. However, if any research has already been conducted using your personal data or samples, the data will be kept and analyzed as part of that research.

If you wish to submit a request to exercise your rights, please first contact your Study doctor and then the trial sponsor (at Data_Protection_EMEA@Eisai.net), who will work with USC as appropriate to facilitate your request. If you have general questions or concerns about the Study or our privacy practices, please contact us at: compliance@usc.edu. (Please note that personal data and samples held by USC are not identified by patient names, and USC cannot fulfill rights requests unless they are first submitted to your Study doctor.)

How Your Dispute or Complaint May Be Resolved

Any questions, concerns or complaints regarding the use of your personal data should be directed to USC using the contact information above. If you are located in the EEA and have a complaint about the collection or use of your personal data and would like to seek an independent recourse mechanism, you may contact your local Data Protection Authority (DPA). A listing of each EEA country’s DPA may be found here: https://edpb.europa.eu/about-edpb/board/members_en

EFFECTIVE DATE: 08 JUL 2021