Privacy Policy

This Privacy Policy describes how Care Access Research LLC, together with its parent company Reify Health, Inc., and their affiliates (collectively, "Care Access," "we," "us," or "our"), collects, uses, and discloses personal information through the StudyTeam by Care Access website located at https://www.StudyTeam.com (“Website”), the StudyTeam platform, and any related services that we provide (together, the “Services”).

The Services are designed primarily for use by organizations such as clinical trial sponsors and sites, including their authorized representatives (“Customers”). In the event of a conflict between this Privacy Policy and the terms of any written agreement(s) between StudyTeam (Reify Health Inc.) and a Customer, the terms of those agreement(s) will control to the extent of the conflict.

StudyTeam's Role

Our role with respect to personal data depends on several factors, including ourCustomer agreements. The following table identifies StudyTeam by Care Access data processing role in the various scenarios in which we interact with our customers’ or patients’ personal data.

2. Personal Data Collected

StudyTeam as Data Controller. When we are the Data Controller, we collect personal data through our Website, the StudyTeam application, through our interactions with you, or through other legally permissible channels (with your consent wherever required). Examples of this data include the login credentials used to access the Services, user contact information, and analytics associated with data entered or actions taken when interacting with the Website or Services.

StudyTeam's Use of Cookies. Cookies are small text, image or data files or tag code snippets placed on your device by websites that you visit or access. They are widely used to make websites work and function with greater efficiency, and to provide customization and to improve website performance. Some Cookies stay on your device only for the duration of your web session and expire when you exit your browser; other Cookies remain longer than your web session, including after you exit your browser, for example to remember you when you return to the website. Cookies are important in provisioning many online services. Cookies collect certain standard information from your browser, such as your Internet Protocol (“IP”) address, browser type, operating system, cookie data, access times, user-agent string, and click-stream behavior. We use this information to monitor the usage of our Website and Services and to understand how to serve our users better. Nonetheless, their use requires that users are properly informed about how they operate and the consequences deriving from their installation, so that users have the choice to refuse them, if feasible.

If you prefer StudyTeam not to use cookies when you interact with our Website or the Services, you may decline to provide consent when prompted.

For additional information regarding our usage of cookies, please see our Cookie Policy.

StudyTeam as Data Processor. When we arethe Data Processor, we process personal data that our Customers have provided to the Services in order for us to deliver those Services. This may include information about individuals who are candidates for, or participants in, clinical trials. When we are the Data Processor, we comply with our contractual obligations to our Customers as well as with the terms of this Privacy Policy.

3. Use of Personal Data

StudyTeam does not process personal data without a valid legal basis. Here is more information about how and why we may process personal data:

To Facilitate the Use of our Services. Subject to our Customer agreements, we may use personal data to communicate with Customers (including Customer users) about user accounts, respond to Customer inquiries, comply with Customer instructions, and provide the Services. For example, we may use personal data to send critical updates and notifications to Customer users to ensure security and to prevent fraudulent activity.

To Operate, Secure, and Improve our Services. We may use personal data to operate, secure, and improve our Services. For example, we may use aggregated data for business or research purposes such as to ascertain industry trends, to analyze privacy and security patterns, for internal record management and reporting, to perform statistical analyses, and to monitor compliance with our Customer agreements.

For Marketing and Promotional Purposes. We may use personal data, with prior consent where needed, to communicate relevant marketing and promotional content. If you would like to discontinue receiving this information from us, you may update your preferences by using the link found in the bottom of the email communications you receive, or you may contact privacyofficer@reifyhealth.com.

For Recruitment and Hiring Purposes. For more information about our recruitment and hiring activities as they relate to your personal data, please refer to the Recruiting and Hiring section of this policy. [1]

Machine Learning and AI-Assisted Functionality

We may use machine learning and AI-assisted functionality as part of the Services to support Customer directed workflows, improve operational efficiency, and help Customers manage clinical research activities at scale. These capabilities are designed to be assistive in nature and do not operate autonomously.

AI-assisted functionality may support activities such as document analysis and summarization, matching, ranking, or recommendation features, scheduling, and workflow assistance or operational insights. Outputs generated by these tools are intended to support, not replace, human decision-making and are reviewed, validated, or actioned by authorized users of the Services.

AI-assisted functionality is not used to make decisions that are based solely on automated processing and that produce legal or similarly significant effects on individuals. Final responsibility for decisions informed by AI-assisted functionality rests with authorized users of the Services.

Personal data processed in connection with AI-assisted functionality is handled in accordance with this Privacy Policy, applicable law, and our agreements with Customers. We process such personal data only to provide and support the Services and consistent with our role as a data controller or data processor, as applicable and described above.

To Comply with Law. We may use personal data as required to comply with applicable law.

4. Sharing of Personal Data

We require all third-party subprocessors to meet our privacy and security standards, which include entering into written agreements to safeguard the confidentiality, security, and integrity of personal data. We take precautions to ensure that any onward transfer of personal data is under terms that are consistent with this Privacy Policy.

We may share personal data with third parties for purposes of providing the Services, for example to facilitate communications with our Customers, to monitor the security of our application, and to provide our cloud computing infrastructure. For a current list of these subprocessors, please https://www.studyteamapp.com/Subprocessors.html.

We also use third parties to communicate marketing and promotional content. Additionally, we may disclose personal data to the extent necessary to comply with law including in response to a lawful request by public authorities, such as to meet national security or law enforcement requirements.

5. International Data Transfers

Although we are based in the United States, we operate globally. Our Services are supported by regional data centers worldwide, including within the European Union, Japan, and the United States.

Personal data may be transferred from the country of origin to one of the regional data centers used by us. For example, personal data collected at European sites may be transferred to Ireland.In such cases, we take the necessary measures to ensure that personal data transferred receives adequate levels of protection as required by Privacy Laws. As appropriate, we require third parties to sign international data transfer agreements to facilitate these transfers. We comply with laws governing the transfer of personal data between countries to help ensure that your personal data is protected.

Data Privacy Framework.

Reify Health complies with the EU-U.S. Data Privacy Framework (DPF), the UK extension to the DPF and Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, United Kingdom, and Switzerland to the United States. We have certified to the U.S. Department of Commerce that we adhere to the Data Privacy Framework. If there is any conflict between the terms in this Privacy Policy and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern. We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Consistent with the Data Privacy Framework and in compliance with this Privacy Policy, We may transfer personal data to third parties across national borders. To the extent required under the Data Privacy Framework, we remain liable if a third party engaged by us to process personal data on our behalf does so in a manner inconsistent with the principles of the Data Privacy Framework, unless we prove that it is not responsible for the matter giving rise to the damage.

You may have the option to select binding arbitration under the Data Privacy Framework for the resolution of your complaint under certain circumstances. For more information about binding arbitration under the Data Privacy Framework, to learn more about the Data Privacy Framework program, or to view our certification, please visit https://www.dataprivacyframework.gov/s/ (note our certification is filed under our company’s legal name, Reify Health, Inc.)

Please note that we protects all cross-border transfers of personal data in accordance with current legal requirements including, where appropriate, with the use of standard contractual clauses approved by the European Commission.

6. Individual Rights to Personal Data

Our Privacy Policy is designed to meet or exceed the requirements of global privacy laws. In relation to the personal data for which we act as the data controller, individuals are invited to exercise their rights as established by applicable data protection law. Our use of AI-assisted functionality does not limit or alter individuals’ rights under such laws. The rights described below apply regardless of whether personal data is processed using AI-assisted tools.These rights may include:

• Right to Access. Individuals may have the right to request confirmation of whether we are processing their personal data. Individuals may also have the right to request access and obtain copies of their personal data.
• Right to Rectification. Individuals may have the right to amend or correct their personal data, as permitted by law.
• Right to Erasure. Individuals may have the right to request erasure of their personal data, as permitted by law.
• Right to Restrict Processing. Individuals may have the right to request a restriction or limitation of Reify’s processing of their personal data, as permitted by law.
• Right to Withdraw Consent. Where our processing activity is based on consent, individuals have the right to revoke their consent to our further processing of their personal data, as permitted by law.
• Right to Data Portability. Individuals may have the right to receive their personal data, in a structured, commonly used, and machine-readable format, and to have that information transmitted to another organization under certain circumstances.
• Right to Object. Where our processing activity is based on consent, individuals have the right to revoke their consent to further processing of their personal data, as permitted by law.
• Rights in Relation to Automated Decision Making and Profiling. Individuals may have the right to object to being subject to a decision based solely on automated processing and profiling that legally or significantly affects them.
• Right to Lodge a Complaint. Individuals always have the right to lodge complaints relating to the processing of their personal data with the relevant data protection supervisory authority.

To exercise these rights or for additional information or clarification, please email us at privacyofficer@refiyhealth.com

7. Recruiting and Hiring

If you apply for employment or a contract role, we may collect and use applicant information to process your application, evaluate qualifications and fit, conduct background checks where permitted by law, support recruiting operations, and comply with legal obligations.

This section applies only to personal data collected in connection with your candidacy for employment or, as applicable, engagement as a contractor or for other roles with us.

We may use recruiting, applicant-management, verification, screening, and review technologies, including AI-assisted tools, to support recruiting operations. Where required by applicable law, applicants will receive any notices relating to the use of automated employment-related decision technologies.

We may collect and process applicant information directly from you, through recruiting platforms, from professional recruiters, from references, from publicly available sources, and from service providers supporting recruiting activities.

Applicant information may include:

• identification and contact information;
• resume, curriculum vitae, cover letter, references, and interview information;
• educational and professional background information;
• work authorization and eligibility information;
• national identifiers where permitted by law and necessary for recruitment, licensure checks, or onboarding;
• background check information where permitted by law;
• accommodation-related information where relevant and permitted by law; and
• other information relevant to recruitment and hiring.

We may use applicant information to:

• process your application;
• communicate with you about your candidacy;
• evaluate you in the recruitment and hiring process, including assessing your qualifications and potential fit for current and future opportunities, with support from recruiting, applicant-management, and review tools and service providers where appropriate;
• conduct background checks or verification steps where authorized or permitted by law;
• detect potentially fraudulent or spam submissions;
• manage recruiting operations; and
• comply with legal obligations.

We may disclose applicant information to:

• internal personnel involved in recruiting and hiring;
• service providers supporting recruiting, background screening, staffing, or applicant management;
• affiliates for recruiting and internal business operations;
• regulators, authorities, or others where required by law; and
• parties involved in a corporate transaction.

If you become employed or engaged by Reify Health, relevant applicant information may become part of your personnel or contractor record and will be handled in accordance with applicable law and our records internal policies. If your application is unsuccessful, we may retain your information for a reasonable period consistent with law, our records practices, and any consent you provide for future opportunities.

8. Children's Privacy

Our Website and Services are not intended for children, and we do not knowingly collect personal data from children under the age of 16. Children under the age of 16 are not invited to access, use, or submit, any personal data through our Website or Services. In jurisdictions where age is defined differently, we will comply with the laws of that jurisdiction.

If a child has provided us with personal data, a parent or guardian of that child may contact us at privacyofficer@reifyhealth.com with “Request for Child Information Removal” in the subject line. Upon verification, we will remove the child’s personal data from our databases.

9. Third Party Privacy Policies

Once you navigate away from our Website or the Services, the privacy policies of the site(s) to which you navigate will apply. This Privacy Policy applies solely to your interactions with, and information collected through, our Website and Services.

10. Data Retention

We retain personal data only for so long as necessary to fulfill the purposes for which it was collected, including as described in this Privacy Policy, Customer agreements, or as required by law.

11. Safeguards

We take reasonable precautions and follow standard industry practices to make sure your personal data is not impermissibly accessed, used, or disclosed. While we have reasonable safeguards in place to protect your personal data, and although we frequently review and try to improve the security of our Website and Services, we cannot guarantee that a third party will not impermissibly gain access to any information provided to or collected through our Website or Services.

If you have any questions about the security of personal data, please contact us at support@reifyhealth.com.

12. Changes To This Policy

We may modify this Privacy Policy from time to time without prior notice by publishing a new version of this Privacy Policy on our Website and Services. Any changes to the Privacy Policy will become effective immediately upon publication. We encourage you to periodically review this Privacy Policy to stay informed about how we are protecting the personal data we collect. Please check the date on which this Privacy Policy was last updated to determine if there have been any changes since you last reviewed this Privacy Policy.

13. Contact Us

If you have any questions, comments, or requests regarding this Privacy Policy, please contact our Privacy Officer directly at:

Reify Health, Inc.
Attn: Privacy Officer
33 Arch Street
17th Floor
Boston, MA
02110
USA
Email: privacyofficer@reifyhealth.com
Toll-free telephone (US & Canada): 855-222-4892

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our third-party dispute resolution provider by clicking here.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Reify Health commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

14. Local Appendices

(a) Australia

This section applies only to residents of Australia. For purposes of this section, “Personal Information” has the meaning given to it in the Privacy Act of 1988. You have the right to correct your Personal Information if it is inaccurate, out-of-date, incomplete, irrelevant, or misleading. You also have the right to request access and obtain copies of your Personal Information in the form and format of your choosing, so long as the form and format is reasonable. Because of the global nature of OneStudyTeam’s operations, OneStudyTeam may transfer Personal Information that originates in Australia to a location outside of Australia. For more information about data transfers, to exercise any of the above mentioned rights, or to request additional information or clarification, please email us at privacyofficer@reifyhealth.com.

For information on how to file a privacy complaint, please click here.

(b) California

This section applies only to residents of California, United States. For purposes of this section, “Personal Information” has the meaning given to it in the California Consumer Protection Act (“CCPA”), as modified by the California Privacy Rights Act (“CPRA”) (together, we refer to these as the “California Privacy Rules”).

For the purposes described in this Privacy Policy, we may process the following categories of Personal Information recognized by the California Privacy Rules:

• Identifiers
• Internet or other electronic network activity information
• Geolocation data
• Professional information

As a California resident, you have the right to knowledge, access, and deletion, of your Personal Information. Additionally, you also have the right to opt out of the sale of your Personal Information, and the right not to be discriminated against for exercising a right granted by the California Privacy Rules.

We do not sell Personal Information and do not discriminate in response to privacy rights requests.

You have the right to submit a request to us and receive the following information within 30 days of our receipt of your request: (a) categories of Personal Information disclosed to third parties during the past year; (b) the names and address of the third parties with whom we shared Personal Information; and (c) if the nature of the third party’s business cannot be reasonably determined from the third party’s name, examples of its products and services. You also have the right to request information regarding any third parties with whom we have shared your Personal Information for direct marketing purposes in the preceding 12 months.

To exercise your rights under the California Privacy Rules or for additional information or clarification, please email us at privacyofficer@reifyhealth.com.

[1]This should change more substantially as we no longer have a Candidate Privacy Statement