Third Arc Bio Website Privacy Notice

Introduction

Third Arc Bio, Inc. (referred to as “Third Arc Bio”, “the Company”, “We, “Our,” or “Us”) are committed to protecting the privacy and security of your Personal Data.

You (referred to as “You,” “Your,” “Data Subject,” or “User”) means the individual accessing, requesting or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under both UK and EU GDPR (General Data Protection Regulation), You can be referred to as the Data Subject or as the User as you are the individual using the Service.

This Third Arc Bio Website Privacy Notice may apply to you if you are:

A Third Arc Bio clinical trial participant;
The partner of a Third Arc Bio clinical trial participant;
The child of a Third Arc Bio clinical trial participant;
A healthcare professional conducting a Third Arc Bio clinical trial;
An employee, contractor, or other associated party associated with Third Arc Bio;
An employee, contractor, or other associated party contracted by Third Arc Bio’s Service Providers;
A service user of this website (https://www.Third Arc Bio.com/); or,
Any other individual with whom Third Arc Bio may conduct commercial operations.

If you are an employee or contractor of Third Arc Bio, or a candidate applying for a role at Third Arc Bio, a supplementary Privacy Notice will be provided to you to address how Third Arc Bio processes your Personal Data.

We have developed this Privacy Notice to inform you of the data we collect, what we do with your information, what we do to protect it, as well as the rights and choices you may have over your Personal Data. It is important that you read this notice so that you are aware of how and why we are using such information.

Definitions

For the purposes of this Third Arc Bio Website Privacy Notice:

Company (referred to as either “Third Arc Bio,” “the Company,” “We,” “Us,” or “Our”) refers to Third Arc Bio, Inc. of 727 Norristown Road, Building 8 Suite 320, Lower Gwynedd, PA 19002, United States.

Cookies are small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses.

Data Controller, for the purposes of both UK and EU GDPR, refers to the Company as the legal person that alone or jointly with others determines the purposes and means of the processing of Personal Data. For the purpose of both UK and EU GDPR, the Company is the Data Controller.

Data Processor, for the purposes of both UK and EU GDPR, refers to the Company’s Service Providers.

Data Protection Legislation, as defined in the Data Protection Legislation section below.

Device means any device that can access the Service such as a computer, a mobile phone, or a digital tablet.

Personal Data is any information that relates to an identified or identifiable individual. For the purposes of both UK and EU GDPR, Personal Data means any information relating to You, such as a name, an identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity.

Service means any services provided by the Company, including provision of the Website, relevant clinical trials, business-to-business dealings and handling of enquiries received by us.

Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies, Investigator Sites, or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analysing how the Service is used. For the purpose of both UK and EU GDPR, Service Providers are considered Data Processors.

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Website refers to the Third Arc Bio website, accessible from https://www.Third Arc Bio.com/.

Data Protection Legislation

Throughout this document we refer to Data Protection Legislation.

European Union

In the European Union (EU), Data Protection Legislation means the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”) and the ePrivacy Directive (Directive 2002/58/EC), as well as any local data protection implementation laws, including any replacement legislation coming into effect from time to time.

In the United Kingdom (UK), Data Protection Legislation means the Data Protection Act 2018 (“DPA 2018”), United Kingdom General Data Protection Regulation (“UK GDPR”), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and any legislation implemented in connection with the aforementioned legislation, including any replacement legislation coming into effect from time to time.

United States

In the United States of America (USA), Data Protection Legislation refers to any federal, state, sectoral, or case laws and regulations governing the privacy and security of personal data. This includes applicable state privacy legislation, including, but not limited to, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); New York’s Shield Act; and Delaware’s Online Privacy and Protection Act (DOPPA), as well as other relevant state and federal regulations. This definition also encompasses any legislation implemented under these laws and any replacement or additional legislation enacted from time to time.

Other Jurisdictions

Depending on your jurisdiction, additional Data Protection Legislation may apply. If you have any questions, you can contact our DPO using the details in the Contact Us section below.

Data Controllership

Third Arc Bio is the Data Controller (“controller”) for the Personal Data we process, unless otherwise stated.

We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. For further details on how you can contact our DPO, please see the Contact Us section below.

Your Information

We collect Personal Data in accordance with the Data Protection Legislation and/or other relevant legislation such as legislation related to clinical trials (e.g., the EU Clinical Trial Regulations (EU CTR)). The type of Personal Data that we will collect about you will depend on whether you are a clinical trial participant, the partner of a clinical trial participant, the child of a clinical trial participant, a healthcare professional, an employee or contractor of Third Arc Bio, an employee or contractor of Third Arc Bio’s Service Providers, or a user of this website.

We collect personal information in a variety of ways depending on how you interact with us. This may include through you filling out a form on our website, through your participation in one of our clinical trials (or through your partner, child, or parent's participation), or through you applying for employment with us.

Data Subject Type	Data Category	Data Fields
Clinical Trial Participant^*	Clinical Trial Participant Identification Information	Your name^† Your name^†
	Clinical Trial Participant Demographic Information	Your info* Your date of birth Your age Your gender Your ethnicity
	Clinical Trial Participant Administration Information	Your contact information Your contact information (telephone number or email address)^† Where applicable, Your financial information (e.g., bank account details)
	Clinical Trial Participant Third-Party Information	applicable info Where applicable, the name of Your legally authorized representative^† Where applicable, the name, contact details, and health information of Your partner^† Where applicable, the name, contact details, and health information of Your child^†
	Clinical Trial Participant Research Information	Your identification number Your pseudonymized unique identification number(s) Your health data, including medical records, family history, biological samples, etc. Your genetic data
Clinical Trial Participant Partner^*	Clinical Trial Participant Partner Identification Information	Your name^† Your name^†
	Clinical Trial Participant Partner Demographic Information	Your information Your date of birth Your age Your gender Your ethnicity
	Clinical Trial Participant Partner Administration Information	Your contact information Your contact information (telephone number or email address)^† Where applicable, Your financial information (e.g., bank account details)
	Clinical Trial Participant Partner Third-Party Information	applicable info Where applicable, the name of Your legally authorized representative^† Where applicable, the name, contact details, and health information of Your partner^† Where applicable, the name, contact details, and health information of Your child^†
	Clinical Trial Participant Partner Research Information	Your indentification number Your or your partner’s pseudonymized unique identification number(s) Your health data Your genetic data
Clinical Trial Participant Child^*	Clinical Trial Participant Child Identification Information	Your name^† Your name^†
	Clinical Trial Participant Child Demographic Information	Your info Your date of birth Your age Your gender Your ethnicity
	Clinical Trial Participant Child Administration Information	Your parent's contact information Your parents’ contact information (telephone number or email address)^†
	Clinical Trial Participant Child Third-Party Information	applicable info Where applicable, the name of Your legally authorized representative^† Where applicable, the name, contact details, and health information of Your parents^†
	Clinical Trial Participant Child Research Information	Your indentification Your or your parent’s pseudonymized unique identification number(s) Your health data Your genetic data
Healthcare professional (HCP)^*	Healthcare Professional Identification Information	Your name Your name
Healthcare professional (HCP)^*	Healthcare Professional Administration Information	Your contact information Your contact information (telephone number, email address, or mailing address) Your employment details Where relevant, Your financial information (e.g., bank account details)
Employees and Contractors of Third Arc Bio	Staff Identification Information	Your name Your name
Employees and Contractors of Third Arc Bio	Staff Administration Information	Your contact information Your contact information (telephone number, email address, or mailing address) Your employment details and availability Where relevant, your pseudonymized unique identification number(s) (e.g., payroll number) Where relevant, your financial information (e.g., bank information) Where relevant, your Right to Work information (e.g., nationality) Where relevant, your health data (e.g., sick leave information)
Employees and Contractors of Third Arc Bio’s Service Providers^*	Third-Party Staff Identification Information	Your name Your name
	Third-Party Staff Administration Information	Your contact information Your contact information (telephone number, email address, or mailing address) Your employment details and availability
Website User^*	Website User Identification Information	Your name Your name
	Website User Administration Information	Your contact information Your contact information (telephone number or email address) Your Contact Us form responses
	Website User Internet Information	Your usage data Your Usage Data (e.g., your IP address) Cookies and Tracking Technologies
Shareholder/Investor	Shareholder/Investor Identification Information	Your name Your name
	Shareholder/Investor Administration Information	Your contact information Your contact information (telephone number or email address) Your Contact Us form responses
	Shareholder/Investor Financial Information	Your share Where relevant, information about your shares or other pertinent financial records

^* You are under no statutory or contractual requirement or obligation to provide us with your Personal Data; however, we may require some of the information above in order for us to deal with You for the purpose requested by You.

^†This identifiable information relating to participants, and, where applicable, their partners and children, is collected by Third Arc Bio’s Research Sites, acting on their behalf as Data Controllers or Data Processors. This data may be shared with clinicians, health authorities, ethics bodies and other personnel as authorized by Third Arc Bio, but only where Third Arc Bio is legally obligated to provide this data in accordance with Clinical Trial Regulations and other applicable laws. Third Arc Bio will generally not directly receive identifiable information relating to clinical trial participants, or, where applicable, their partners and children.

Cookies

We use Cookies and similar tracking technologies to track the activity on Our Website and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyse Our Website.

You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Website.

Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close your web browser. We use both session and persistent Cookies for the purposes set out below:

Strictly Necessary Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.

Functionality Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.

Tracking and Performance Cookies
Type: Persistent Cookies
Administered by: Third Parties
Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features, or functionality of the Website to see how our users react to them.

The following cookies are used on Our Website:

Cookie Name	Cookie Description	Cookie Type
cookie_accept	Third Arc Bio	Strictly Necessary Cookies
_ga	Google Analytics; Google Tag Manager	Tracking and Performance Cookies

We use cookies and similar tracking technologies to collect Usage Data—information about your use of the Website, such as your IP address, browser type, browser version, pages viewed, time spent on pages, links clicked, and conversion information. This information may be used by us to, among other things, analyse and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on the Website and other websites, provide customer support, troubleshoot issues with and improve the operation of our Website and Services, and better understand your online activity.

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

You can opt out of having made your activity on the Website available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity. For more information on how Google collects and processes data click here. To opt out of tracking by Google Analytics, click here.

For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en.

Our Purposes

Under EU GDPR and UK GDPR, the lawful bases we rely on for processing your information are:

GDPR Article 6(1)(a) – your consent^‡;
GDPR Article 6(1)(b) – We have a contractual obligation;
GDPR Article 6(1)(c) – We have a legal obligation;
GDPR, Article 6(1)(d) – In order to protect the vital interests of You or a third party;
GDPR, Article 6(1)(e) – We have a public interest; or,
GDPR, Article 6(1)(f) – We have a legitimate interest.

^‡ Where the lawful basis for processing is consent, you are able to remove your consent at any time. You can do this by contacting our DPO using the contact details provided in the Contact Us section below.

We may use and disclose your information for the purposes described in the below table:

Data Category	Processing Activity	Lawful Basis
data category	processing activity	(Applicable where EU GDPR or UK GDPR apply)
data category Clinical Trial Participant Identification Information Clinical Trial Participant Demographic Information Clinical Trial Participant Administration Information Clinical Trial Participant Third-Party Information Clinical Trial Participant Research Information	Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of consent, to collect information from you and process your health information in order to conduct a clinical trial	Your Consent
data category Clinical Trial Participant Partner Identification Information Clinical Trial Participant Partner Demographic Information Clinical Trial Participant Partner Administration Information Clinical Trial Participant Partner Third-Party Information Clinical Trial Participant Partner Research Information	Where you are a partner of a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of consent, to collect information from you and process your health information in order to conduct a clinical trial	Your Consent
data category Clinical Trial Participant Child Identification Information Clinical Trial Participant Child Demographic Information Clinical Trial Participant Child Administration Information Clinical Trial Participant Child Third-Party Information Clinical Trial Participant Child Research Information	Where you are a child of a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of consent, to collect information from you and process your health information in order to conduct a clinical trial	Your Consent, or the Consent of Your parents or legal guardians
data category Clinical Trial Participant Identification Information Clinical Trial Participant Demographic Information Clinical Trial Participant Administration Information Clinical Trial Participant Third-Party Information Clinical Trial Participant Research Information	Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of legal obligation, to collect information from you and process your health information in order to conduct a clinical trial	Legal Obligation
data category Clinical Trial Participant Partner Identification Information Clinical Trial Participant Partner Demographic Information Clinical Trial Participant Partner Administration Information Clinical Trial Participant Partner Third-Party Information Clinical Trial Participant Partner Research Information	Where you are a partner of a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of legal obligation, to collect information from you and process your health information in order to conduct a clinical trial	Legal Obligation
data category Clinical Trial Participant Child Identification Information Clinical Trial Participant Child Demographic Information Clinical Trial Participant Child Administration Information Clinical Trial Participant Child Third-Party Information Clinical Trial Participant Child Research Information	Where you are a child of a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of legal obligation, to collect information from you and process your health information in order to conduct a clinical trial	Legal Obligation
data category Clinical Trial Participant Identification Information Clinical Trial Participant Demographic Information Clinical Trial Participant Administration Information Clinical Trial Participant Third-Party Information Clinical Trial Participant Research Information Clinical Trial Participant Partner Identification Information Clinical Trial Participant Partner Demographic Information Clinical Trial Participant Partner Administration Information Clinical Trial Participant Partner Third Party Information Clinical Trial Participant Partner Research Information Clinical Trial Participant Child Identification Information Clinical Trial Participant Child Demographic Information Clinical Trial Participant Child Administration Information Clinical Trial Participant Child Third-Party Information Clinical Trial Participant Child Research Information	Where you are a clinical trial participant, or the partner or child of a clinical trial participant, to process your information where we are legally required to do so by applicable laws, including laws pertaining to clinical trials, safety reporting, healthcare, and scientific research	Legal Obligation
data category Healthcare Professional Identification Information Healthcare Professional Administration Information	Where you are a Healthcare Professional (HCP) involved in the planning, delivery, or oversight of Third Arc Bio clinical trials, to collect information from you and process your employment information in order to conduct a clinical trial	Our Legitimate Interest in conducting clinical research
data category Healthcare Professional Identification Information Healthcare Professional Administration Information	Where you are a Healthcare Professional (HCP), to collect financial information from you and take payment from you, make a payment to you, give you a refund or request a refund	Contractual Obligation
data category Staff Identification Information Staff Administration Information	Where you are an employee of Third Arc Bio, to collect information from you and make available our Services to you	Contractual Obligation
data category Third-Party Staff Identification Information Third-Party Staff Administration Information	Where you are an employee of Third Arc Bio’s Service Providers, to collect information from you or your employer and make available our services to your employer	Our Legitimate Interest in managing Third Arc Bio’s affairs
data category Third-Party Staff Identification Information Third-Party Staff Administration Information	Where you are an employee of Third Arc Bio’s Service Providers, to collect financial information from you and take payment from you, make a payment to you, give you a refund or request a refund	Contractual Obligation
data category Third-Party Staff Identification Information Third-Party Staff Administration Information	Where you are an employee of Third Arc Bio’s Service Providers, to collect information from you or your employer and liaise with your employer about your contact details and/or the nature and performance of your work, as required	Our Legitimate Interest in managing Third Arc Bio’s affairs
data category Website User Identification Information Website User Administration Information Website User Internet Information	To collect information from you and monitor, provide and maintain our Service	Our Legitimate Interest in providing Services to you
data category Website User Identification Information Website User Administration Information	To contact you following your inquiry where you have provided your contact information and to reply to any questions, suggestions, issues, or complaints, including any Data Subject Requests, about which you have contacted us	Our Legitimate Interest in providing Services to you
data category Website User Internet Information	To collect your Usage Data in order to power our security measures and services so you can safely access our website and other Services	Our Legitimate Interest in providing a secure platform
data category Healthcare Professional Identification Information Healthcare Professional Administration Information Third-Party Staff Identification Information Third-Party Staff Administration Information Website User Identification Information Website User Administration Information Shareholder/Investor Identification Information Shareholder/Investor Administration Information	To contact you, where you have provided your contact information, about news and information relating to our Services through service messages	Our Legitimate Interest in contacting you about our Services
data category Healthcare Professional Identification Information Healthcare Professional Administration Information Third-Party Staff Identification Information Third-Party Staff Administration Information Website User Identification Information Website User Administration Information Shareholder/Investor Identification Informatio Shareholder/Investor Administration Information	B2B direct marketing to you, where you have provided your contact information, about products and services from us where you are classified as a corporate subscriber and/or the “soft opt-in” applies under UK PECR or equivalent EU ePrivacy legislation	Our Legitimate Interest in marketing our Services to you
data category Healthcare Professional Identification Information Healthcare Professional Administration Information Third-Party Staff Identification Information Third-Party Staff Administration Information Website User Identification Information Website User Administration Information Shareholder/Investor Identification Information Shareholder/Investor Administration Information	B2B direct marketing to you, where you have provided your contact information, about products and services from us where you are a sole trader, partnership, or otherwise classified as an individual subscriber and/or the “soft opt-in” does not apply under UK PECR or equivalent EU ePrivacy legislation	Your Consent
data category Healthcare Professional Identification Information Healthcare Professional Administration Information Third-Party Staff Identification Information Third-Party Staff Administration Information Shareholder/Investor Identification Information Shareholder/Investor Administration Information Shareholder/Investor Financial Information	To retain any accounting information generated during the course of our interaction for statutory accountancy retention periods	Legal Obligation
data category Shareholder/Investor Identification Information Shareholder/Investor Administration Information Shareholder/Investor Financial Information	To retain any records relating to shares or investments, to communicate with you as shareholders or investors, or take any actions necessary relating to the provision of shares or investments in our company	Legal Obligation
data category Clinical Trial Participant Demographic Information Clinical Trial Participant Demographic Information Clinical Trial Participant Administration Information Clinical Trial Participant Third-Party Information Clinical Trial Participant Research Information Clinical Trial Participant Partner Identification Information Clinical Trial Participant Partner Demographic Information Clinical Trial Participant Partner Administration Information Clinical Trial Participant Partner Third-Party Information Clinical Trial Participant Partner Research Information Clinical Trial Participant Child Identification Information Clinical Trial Participant Child Demographic Information Clinical Trial Participant Child Administration Information Clinical Trial Participant Child Third-Party Information Clinical Trial Participant Child Research Information Healthcare Professional Identification Information Healthcare Professional Administration Information Staff Identification Information Staff Administration Information Third-Party Staff Identification Information Third-Party Staff Administration Information Website User Identification Information Website User Administration Information Website User Internet Information Shareholder/Investor Identification Informatio Shareholder/Investor Administration Information Shareholder/Investor Financial Information	To take any action necessary to protect your vital interests, or the vital interests of a third party	Your Vital Interests, or the Vital Interest of a third party
data category Clinical Trial Participant Demographic Information Clinical Trial Participant Demographic Information Clinical Trial Participant Administration Information Clinical Trial Participant Third-Party Information Clinical Trial Participant Research Information Clinical Trial Participant Partner Identification Information Clinical Trial Participant Partner Demographic Information Clinical Trial Participant Partner Administration Information Clinical Trial Participant Partner Third-Party Information Clinical Trial Participant Partner Research Information Clinical Trial Participant Child Identification Information Clinical Trial Participant Child Demographic Information Clinical Trial Participant Child Administration Information Clinical Trial Participant Child Third-Party Information Clinical Trial Participant Child Research Information Healthcare Professional Identification Information Healthcare Professional Administration Information Staff Identification Information Staff Administration Information Third-Party Staff Identification Information Third-Party Staff Administration Information Website User Identification Information Website User Administration Information Website User Internet Information Shareholder/Investor Identification Information Shareholder/Investor Administration Information Shareholder/Investor Financial Information	To respond to and defend against legal claims, where you have provided us with information that may give rise to legal claims	Our Legitimate Interest in exercising, establishing, or defending against legal claims

We will use and disclose your Personal Data for the purposes for which we collected it. We may use it for another reason if that reason is compatible with the original purpose or is otherwise permitted by the Data Protection Legislation.

If we need to use and/or disclose your Personal Data for an unrelated purpose, we will, if the Data Protection Legislation requires, notify you, and we will explain the legal basis that allows us to do so.

Our Partners

We may share your personal data with other organizations in the following circumstances:

From time to time, we may need to share your Personal Data with our strategic clinical trial partners;
If the law or a public authority says we must share the Personal Data;
If we need to share Personal Data in order to establish, exercise, or defend our legal rights—this includes providing Personal Data to others for the purposes of detecting and preventing fraud;
From time to time, employ the services of other parties for dealing with certain processes necessary for the operation of our services; or
For purposes otherwise permitted under the Data Protection Legislation

We may, from time to time, expand or reduce our business, and this may involve the sale and/or the transfer of control of all or part of our business. Any personal data that you have provided may, where it is relevant to any part of our business that is being transferred, be transferred along with that part to the new owner or new controlling party.

We use Service Providers (“Data Processors”) who are third parties who provide elements of services for us. Examples of these Data Processors include, but are not limited to:

Our Contract Research Organizations (CRO);
Our Clinical Trial Data Processors,
Our IT Service Providers, such as Microsoft Corporation.

We have Data Processor Agreements in place with our data processors to help protect your Personal Data.

Our Retention Periods

We retain a record of your Personal Data in order to provide you with a high quality and consistent service. We will retain your Personal Data in accordance with the Data Protection Legislation.

Where EU GDPR and UK GDPR apply, Third Arc Bio has a Retention Schedule in place that outlines how long Third Arc Bio will retain different categories of Personal Data. Third Arc Bio considers the retention period to begin from the point at which Third Arc Bio last contacted you or otherwise reviewed your record to determine whether it was still active, unless otherwise required by law. As such, where EU GDPR and UK GDPR apply, unless otherwise required by law, your data will be retained for the period specified in the summarized table below and then securely deleted in accordance with our internal policies and procedures.

Purpose	Retention Period
Processing data in relation to You as a clinical trial participant in the EU/EEA, partner of a clinical trial participant in the EU/EEA, or child of a clinical trial participant in the EU/EEA	25 years following the conclusion of the clinical trial, as determined by the EU Clinical Trial Regulation (EU-CTR)
Processing data in relation to You as a Healthcare Professional (HCP) in the EU/EEA involved in the planning, delivery, or oversight of a Third Arc Bio’s clinical trial	25 years following the conclusion of the clinical trial, as determined by the EU Clinical Trial Regulation (EU-CTR)
Processing data in relation to You as a clinical trial participant outside of the EU/EEA, partner of a clinical trial participant outside of the EU/EEA, or child of a clinical trial participant outside of the EU/EEA	At least 5 years following the conclusion of the clinical trial
Processing data in relation to You as a Healthcare Professional (HCP) outside of the EU/EEA involved in the planning, delivery, or oversight of a Third Arc Bio’s clinical trial	At least 5 years following the conclusion of the clinical trial
Processing data in relation to You as an employee, contractor, or other associated party contracted by Third Arc Bio	6 years following the termination of your employment
Processing data in relation to You as an employee, contractor, or other associated party contracted by Third Arc Bio’s Service Providers	6 years following the termination of your employment
Processing data in relation to You as a Healthcare Professional (HCP) in the EU/EEA/UK in the context of research, academic, publication, marketing, or commercial opportunities	6 years
Processing data in relation to You as a service user of this website	1 year
Processing data in relation to You as a Shareholder/Investor	As required by applicable law, or otherwise 6 years following the termination of your shareholder agreement or investment
Processing data in relation to You as any other individual with whom Third Arc Bio may conduct commercial operations	6 years

Our Communication Channels

Where you are a clinical trial participant or a Healthcare Professional involved in the planning, delivery, or oversight of a Third Arc Bio clinical trial, we will contact you through our Contracted Research Organization (CRO) where it is necessary to do so.

Where you are an employee of Third Arc Bio, we will contact you through existing Third Arc Bio communication channels, including email, where it is appropriate to do so.

Where you are an employee of Third Arc Bio’s Service Providers, a user of this website who has provided us with your contact information, or any other business contact, we will send you relevant news about our services in a number of ways including by email, but only if we have a Legitimate Interest to do so or as otherwise permitted by law (including where we have your consent).

All email marketing communications will have an option to unsubscribe, and so if you wish to amend your marketing preferences, you can do so by following the link in the email and updating your preferences. Alternatively, you can contact our DPO using the contact details provided in the Contact Us section below.

Third-Party Links

Our Website may contain links to other sites operated by third parties. The Company does not control such other sites and is not responsible for their content, their privacy policies, or their handling of personal information. The Company’s inclusion of such links does not imply any endorsement of the content on such sites or of their owners or operators except as disclosed through the Services. Any information submitted by you directly to these third parties is subject to that third party’s privacy policy.

Security

Data security is of great importance to Third Arc Bio. We implement appropriate technical and organizational measures to help prevent your Personal Data from being accidently lost, used, accessed, altered, or disclosed in an unauthorized way.

We implement technical and organizational security measures to help protect your information including:

Limiting access to our buildings and resources to only those that we have determined are entitled to be there (by use of passes, key card access, and other related technologies);
Managing a data security breach reporting and notification system that allows us to monitor and communicate information on data breaches with you or with the applicable regulator when required to do so by law;
Regular staff training on personal information handling relevant to their role;
Implementing access controls to our information technology; and,
Deploying appropriate procedures and technical security measures (including strict encryption, anonymization, and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices, and stores.

Children's Privacy

With the exception of where we are obligated to do so by clinical trial legislation, we do not seek or knowingly collect any personal information about children under 13 years of age. If we become aware that we have unknowingly collected personal information from a child under the age of 13, we will make commercially reasonable efforts to delete such information from our database.

If you are the parent or guardian of a minor child who has provided us with personal information, you may contact us using the information below to request it be deleted.

International Transfers

Your Personal Data is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to Devices located outside of Your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. In particular, when Third Arc Bio shares clinical trials data with trusted Data Processors, your Personal Data would be stored and processed within third countries. Where you are based in the EU, EEA, or UK, Third Arc Bio will ensure that:

any Data Controller receiving your Personal Data has entered into an agreement with Third Arc Bio that contains standard data protection clauses as required by UK and/or EU GDPR, or there is an alternative appropriate safeguard in place governing the transfer; and,
any Data Processor receiving your Personal Data has entered into an agreement with Third Arc Bio that contains the required Data Processor clauses as well as standard data protection clauses as required by UK and/or EU GDPR, or there is an alternative appropriate safeguard in place governing the transfer.

Where you are based in the UK or EU and we were required to transfer your Personal Data out of the UK or EU to countries not deemed by the ICO or European Commission (as relevant) to provide an adequate level of Personal Data protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the Data Protection Legislation, such as the specific contracts containing standard data protection clauses approved by the ICO or European Commission (as relevant) providing adequate protection of Personal Data. You can obtain a copy of this documentation by contacting the EU Representative or DPO identified in the Contact Us section below.

Your Rights

European Union, European Economic Area, and the United Kingdom

Where EU GDPR and UK GDPR apply, you have the following rights over your Personal Data:

14.1.1 The Right to Be Informed About Our Collection and Use of Personal Data
You have the right to be informed about the collection and use of your personal data. We ensure we do this with our internal and external Privacy Notices (including this document). These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.

14.1.2 Right to Access Your Personal Data
You have the right to access the Personal Data that we hold about you in many circumstances, by making a request. This is sometimes termed a “Data Subject Access Request.” If we agree that we are obliged to provide Personal Data to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within 1 month from when your identity has been confirmed. We would ask for proof of identity and sufficient information about your interactions with us that we can locate your Personal Data. If you would like to exercise this right, please Contact Us as set out below.

14.1.3 Right to Rectify Your Personal Data
If any of the Personal Data we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it. If you would like to exercise this right, please Contact Us as set out below.

14.1.4 Right to Erasure
You have the right to have personal data erased. This is also known as the “right to be forgotten.” The right is not absolute and only applies in certain circumstances. For instance, the right to erasure does not apply where we have a legal obligation to retain your Personal Data. If you would like to exercise this right, please Contact Us as set out below.

14.1.5 Right to Restrict Processing
You have the right to ask us to restrict the processing of your personal data. For example, this may be because you have issues with the accuracy of the data we hold or the way we have processed your data. The right is not absolute and only applies in certain circumstances. If you would like to exercise this right, please Contact Us as set out below.

14.1.6 Right to Portability
The right to portability gives you the right to receive personal data you have provided to a controller in a structured, commonly used, and machine-readable format. It also gives them you the right to request that a controller transmits this data directly to another controller. If you would like to exercise this right, please Contact Us as set out below.

14.1.7 Right to Object
You have the right to object to our processing of some or all of the personal data that we hold about you. This is an absolute right when we use your data for direct marketing but may not apply in other circumstances where we have a compelling reason to do so, e.g., a legal obligation. If you would like to exercise this right, please Contact Us as set out below.

14.1.8 Rights Related to Automated Decision-Making
You have the right to object to our processing where a decision is made about you solely based upon automated processed and that has significant or legal effects. Third Arc Bio does not intend to conduct any automated decision-making for your Personal Data. If you would like to contact us regarding this right, please Contact Us as set out below.

14.1.9 For More Information About Your Privacy Rights
In the EU/EEA, you can find your country’s regulatory body here:https://edpb.europa.eu/about-edpb/about-edpb/members_en. If you have any questions about which supervisory authority applies in your jurisdiction, please Contact Us as set out below.

In the UK, the Information Commissioner's Office (ICO) regulates data protection and privacy matters. They make a lot of information accessible to consumers on their website, which you can access here: https://ico.org.uk/for-the-public.

You can make a complaint to any supervisory authority at any time about the way we use your information. However, we hope that you would consider raising any issue or complaint you have with us first. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have.

United States - California

14.1.10 California Data Protection Legislation
If you are a California resident, the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”) requires that we provide you with a privacy policy of our online and offline information practices and your rights under this law regarding your personal information.

We currently collect, share, disclose, and use your personal information. In the 12 months prior to the last updated date of this Privacy Notice, we have collected, shared, disclosed the personal information set out in the Your Information section above. We may collect personal information directly from California and other USA state residents, credit reporting agencies, and/or our third-party service providers. We do not collect all categories of personal information from each source.

14.1.11 California Resident Rights
California residents are afforded the following rights:

to delete your personal information, unless we:
- can prove this to be impossible;
- it involves disproportionate effort; or
- it is reasonably necessary for us to maintain records in order to fulfil the transaction(s) for which the personal information was collected;
to correct inaccurate personal information held about you;
to know what personal information is sold or shared and to whom (this right is fulfilled with the information provided within this Notice);
to request specific pieces of information from us;
to opt out of the sale or sharing of your personal information;
to limit use and disclosure of sensitive personal data; and,
to no retaliation following opt-out or exercise of other rights.

If you would like to contact us regarding this right, please Contact Us as set out below. Please note that we may need to verify your identity before processing your request. Rights requests shall be reviewed to see if an exemption allows us to retain the information. We may deny your deletion request if an exemption applies and/or if retaining the information is necessary for us or our Service Provider(s), for example to detect fraudulent activity or comply with a legal obligation. We will delete, de-identify, or limit the scope of personal information not subject to an exemption from our records and will direct our Service Providers to take similar action.

United States – Other Data Protection Legislation

14.1.12 Other USA Data Protection Legislation
If you are a USA resident, we process your personal data in accordance with applicable USA state data privacy laws, including the CCPA/CPRA described above. This section of our Privacy Notice contains information required by other USA state data privacy laws and supplements the above section on CCPA/CPRA.

Several USA states have enacted comprehensive privacy statutes, including, but not limited to Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. These laws include provisions aimed at safeguarding consumer rights and outlining business obligations. If you have relevant rights under these laws, you can exercise them by contacting us using the details provided in the Contact Us section as set out below

Our practices are designed to adhere to the highest standards set forth by these laws, ensuring that we respect the privacy rights of all individuals. As the USA privacy laws continue to evolve, we will monitor these changes, adjust our privacy practices, and update our Privacy Notice(s) accordingly.

14.1.13 We Do Not Sell Your Personal Information
You have the right to know whether your personal information is being sold. Your personal information is “sold” when it is provided to a third party for monetary or other valuable consideration for a purpose that is not a “business purpose” as set forth in the CCPA or other USA state data privacy laws.

Please note a “sale” does not include when we disclose your personal information at your direction, or when otherwise permitted under law.

14.1.14 We May Share Your Personal Information
We may “share” your personal data, as defined under California and other applicable USA state laws, for personalised advertising purposes and/or for any other purposes outlined in this Privacy Notice.

14.1.15 Do Not Track
Due to varying practices among browser providers and the lack of a market standard, we do not respond to Do Not Track signals at this time.

14.1.16 Non-Discrimination
USA state privacy laws prohibit businesses from discriminating against you for exercising your rights under the law. Such discrimination may include denying goods or services, providing a different level or quality of service, or charging different prices.

The CCPA permits businesses to provide differing levels or quality or different prices where the business can demonstrate that the difference is reasonably related to the value to the business of the consumer’s personal information.

Contact Us

If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this Privacy Notice or the way your Personal Data is processed, please contact us by one of the following means:

Third Arc Bio’s Data Protection Officer can be contacted:
By email: dpo@thirdarcbio.com
By telephone: +4402037971289
By post: FAO Third Arc Bio DPO, The DPO Centre Limited, 50 Liverpool Street, London, UK, EC2M 7PY

Third Arc Bio’s EU Representative is The DPO Centre Europe Limited, which can be contacted via email at: eurep@thirdarcbio.com.

Privacy Notice Changes

Thank you for taking the time to read our Privacy Notice. We may change this Privacy Notice from time to time (for example, if the law changes). We recommend that you check this Privacy Notice regularly to keep up-to-date.

This Notice was last updated on 2025-03-04.