On this page, we inform you which personal data is processed by Clariness GmbH, Schillerstr. 44, 22767 Hamburg, Germany, when you use this ClinLife website and its offers, and for what purposes this data is used if you

• visit the ClinLife website (see section 2.1 below)
• answer an online questionnaire (online pre-screening) (see section 2.2 below)
• apply (register) for a study (see section 3 below)
• consent to being contacted and to the transmission of information outside of a study application (study registration) (Section 4)
• participate in a survey (see section 5 below)
• consent to the sending of information on current studies ("Newsletter") (see section 6 below)

You will also be informed about

• the use of cookies (see section 7 below)
• about the anonymization of data (see section 8 below)
• about the transfer and disclosure of data to other recipients (see section 9 below)
• your rights and the right of revocation in detail (see sections 10 and 11 below)
• contact details of the controller and the data protection officer (see section 12 below) as well as
• contact details of the supervisory authority (see section 13 below)
• additional information for users who are not located in the EU (see section 15 below)

Your data will be processed in accordance with the data protection provisions of the applicable version of Regulation (EU) 2016/679 (General Data Protection Regulation - "GDPR").

Clariness GmbH is hereinafter referred to as "Clariness". The ClinLife website is hereinafter referred to as "ClinLife" or the website.

1.   Who is responsible for processing your data?

The controller for the processing of your personal data within the meaning of Art. 4 No. 7 GDPR is

Clariness GmbH, Schillerstraße 44, 22767 Hamburg

Commercial register: Hamburg District Court HRB 108294

Management: Michael Stadler

Tax ID: DE248331129

In order to give the user, the opportunity to apply and register for participation in medical studies, Clariness works closely with sponsors of clinical studies and the relevant study center(s) at which the respective study is being conducted.

Clariness and the Sponsor commissioning Clariness y each jointly determine the processing of the data in the individual process stages, whereby the Sponsors's joint responsibility is limited to the fact that the Sponsor sets the occasion for the collection of the user data as part of an application/registration of the user (see also section 3 below) for a study. Otherwise, Clariness is solely responsible for the processing on the ClinLife platform. Clariness does not transmit any personal data of the user to the Sponsor.

Further information is provided via a link in the respective study description on the respective Study Page. The user can request the essential content of the agreements made with the Sponsor conducting the clinical study from Clariness using the contact details provided.

For the conduct of the study, the Sponsor of the study will designate specific study centers at which the respective study will be conducted. If the user selects a study center as part of an application/registration for a study and gives the requested consent (see sections 3 and 2.2), their personal data will be processed in accordance with the consent given. Clariness is solely responsible for the processing on the ClinLife platform.

2.   Data protection information for visitors to ClinLife

2.1  Provision of ClinLife through Clariness

Each time ClinLife is accessed, the servers of Clariness or the hosting provider of Clariness automatically store various data about the accessing system ("server log files").

2.1.1    Description and scope of data processing

The following data is collected:

• date and time of access to ClinLife
• website from which the user accesses ClinLife (e.g. previous website, hyperlink or similar)
• websites accessed by the user via ClinLife
• the access status (file transferred, file not found)
• the amount of data sent by the user
• the operating system used by the user
• the browser used by the user, including the browser version used
• the internet service provider used by the user
• the IP address assigned by the Internet service provider to the user's computer when connecting to the Internet.

The data is temporarily stored in log files on a server. This data is not stored together with other personal data of the user.

2.1.2    Purpose of data processing

Clariness uses the data described in Section 2.1.1 to make ClinLife accessible, to identify and resolve any technical problems that may arise and to prevent and, if necessary, prosecute any misuse of the Clariness offers on ClinLife.

In addition, Clariness reserves the right to use the access data in anonymized form, i.e. without the possibility of identifying the user, for

statistical purposes and to improve ClinLife (see also Section 8 below).

2.1.3    Legal basis of data processing

The legal basis for the processing of the user's personal data described in section 2.1.1 is Article 6(1)(f) GDPR. The legitimate interest of Clariness is that Clariness can make ClinLife accessible to the user and improve the services through data processing.

2.1.4    Duration of storage

The data stored in log files is deleted or anonymized after 30 days at the latest, i.e. any personal reference is removed. Further information on anonymization can be found in section 9.

2.1.5    Right of objection and removal

Since the collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website by Clariness, the user has no option to object to the processing of the data.

2.2. Data protection information for answering an online questionnaire (online pre-screening)

2.2.1 What are Clariness' goals with online pre-screening?

The data collected in the course of the online pre-screening is used by Clariness to check whether the inclusion criteria are met based on the information provided by the user. It is not the aim of the online pre-screening to make a diagnosis for the user or to replace or influence a specific medical treatment.

2.2.2 What measures are taken to protect the confidentiality of the data collected from the user?

The online pre-screening is structured in such a way that data collected from the user is provided with a combination of characters consisting of the ID of the questionnaire and an individual internal identifier (see section 2.2.4). The data collected from the user is not linked to the user's IP address.

2.2.3 What data is collected?

Which data is collected in individual cases depends on the respective indication or study and the information provided by the user. Without exception, online pre-screening aims to collect data that is considered relevant for the online pre-screening decision.

2.2.4 What further processing of the user's data takes place?

The data collected from the user is enriched by Clariness with an automatically generated study-related individual internal identifier. This individual identification number is used to assign the data collected from the user to a specific study or to a specific indication (e.g. migraine) and thus to prepare the examination of the fulfillment of the relevant online pre-screening inclusion criteria. After enrichment with the individual identification number, if the user has answered all the questions on online pre-screening and clicks the "Continue" button, their entries are evaluated. The user is then informed whether or not they meet the inclusion criteria.

If the online pre-screening shows that the user does not meet the inclusion criteria, they will be notified that they are not suitable for this study. In this case, Clariness will store their details without reference to them personally and process them for statistical purposes in order to carry out specific evaluations, for example to obtain information about the use of the online pre-screening questionnaire (e.g. to determine drop-out rates).

If the online pre-screening shows that the user meets the inclusion criteria, they are given the opportunity to enter their contact details and select the study center. If the user wishes to participate in the study, they will be asked to consent to the processing of their data. The consent contains a detailed description of the data processing (see also section 3 below).

2.2.5 Storage and deletion of the user's personal data

The data collected from the user, together with the individual identification number and the fulfillment of the online pre-screening inclusion criteria, are stored by Clariness without personal reference if the user does not give consent.

The data collected from the user is not linked to the user's IP address.

If the user grants consent, the data collected from the user will be stored for the period specified in the consent, unless the user withdraws their consent. With regard to the right to withdraw consent to data processing, reference is made in section 11. With regard to deletion, reference is made in section 10 below.

2.2.6 Processing of personal data by persons other than Clariness and, if applicable, in a third country?

In this respect, reference is made to the explanations in section 9.

2.2.7 Legal basis for the processing of data

The legal basis for the data processing described in this section 2.2, insofar as personal data is processed, is the consent of the user (Article 9(2)(a) and Article 6(1)(a) GDPR).

2.2.8   Other

With regard to the user's right to withdraw consent(s) and for further information, please refer to sections 10 and 11.

3.   Data protection information for study applications (study registration)

The user has the option of applying (registering) for the relevant study if the online pre-screening (see section 2.2) of the user shows that the inclusion criteria are met. As part of obtaining the declaration of consent, the user is provided with information on the individual processing operations based on the consent. The application is made by the user giving the requested consent to apply for the study and commissioning Clariness to arrange a contact. In this respect, the explanations in section 2.2 apply.

4.   Data protection information in the event of contact and transmission of information outside of a study registration (study application)

Clariness offers users the opportunity to contact them outside of a study registration (study application) and to transmit information to them. Clariness provides information about the data processing that takes place in this respect below.

4.1 What objectives Clariness pursues with the processing of the user's data outside of study registration

If the user so wishes, Clariness will provide information about alternative studies and other programs relating to the indication specified by the user (e.g. events on topics potentially relevant to them, patient surveys).

4.2 Processing of the data

In order to fulfill the aforementioned objectives, Clariness uses the User's data to contact the User accordingly. Apart from the service providers described in section 9.1., the User's data will not be passed on to other recipients.

4.3 Storage and deletion of your personal data in our data processing system

Clariness stores the user's personal data for the fulfillment of the aforementioned purposes until consent is withdrawn. With regard to deletion, reference is made in section 11. below.

4.4 Processing of personal data by persons other than Clariness and, if applicable, in a third country?

In this respect, the statements in section 9. apply.

4.5 Legal basis for data processing

The legal basis for data processing is the corresponding consent of the user (Article 9(2)(a) and Article 6(1)(a) GDPR).

4.6 Other

With regard to the right to withdraw consent to data processing, please refer to section 11.

5.   Data protection information, when participating in a survey on ClinLife

ClinLife offers the option of participating in surveys ("Survey"). If the user wishes to participate, the "Yes, I would like to participate" button must be clicked. In this case, the user will be forwarded to a service provider commissioned by Clariness, which will carry out the survey on behalf of Clariness as part of an order processing relationship (details of the contractual relationship between Clariness and the service provider can be found in section 9.1).

The survey is conducted anonymously. No personal data of the user (including IP address or time stamp) will be processed in the course of the survey.

6.   Data protection information for subscribers of the Clariness newsletter

6.1 Description and scope of data processing when sending newsletters

On ClinLife it is possible to subscribe to a newsletter on selected topics and current studies.

The following additional data is collected:

• E-mail address
• Consent given for e-mail delivery of information about studies and surveys (hereinafter referred to as "Newsletter")
• Key areas of interest selected by the user ("subscribed indications", "diagnosis")
• Activation time of the consent button
• IP address of the user

In this context, Clariness checks the e-mail address provided by the user in a so-called double opt-in procedure. This means that after registration, the user receives an e-mail asking for confirmation. This confirmation is necessary so that no one can register for the newsletter with a third-party e-mail address. The use of the confirmation link is logged in order to be able to prove the process is in compliance with the legal requirements. The time of confirmation and the IP address must be saved for this purpose. In order to be able to prove a previously given consent, Clariness can store the e-mail address for up to three years after deletion of the user account on the basis of legitimate interests before it is deleted. Storage in this case is only for the purpose of possible defense against claims.

6.2 Legal basis and purpose of data processing when sending newsletters

The purpose of sending the newsletter is to inform the user about studies and surveys in the indications / diagnoses to which the user has subscribed. In the case of a newsletter subscription, the necessary and voluntary information entered by the user is processed for sending the newsletter (e-mail address and its personalized content (e.g. study-related areas of interest / diagnoses specified by the user).

Newsletters are sent on the basis of consent within the meaning of Art. 6 (1) (a) GDPR to the processing of the relevant personal data by the user. If consent is withdrawn, the previously granted consent is stored together with the withdrawal for verification and documentation purposes on the basis of legitimate interest in accordance with Art. 6 (1) (f) GDPR.

6.3 Duration of storage

The user has the right to withdraw their consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. A corresponding declaration can be made by means of a link within the newsletter; furthermore, the user has the options described in section 12. for contacting the responsible body. In the event of revocation, the user will no longer receive the newsletter. In order to be able to prove a previously given consent, Clariness may store the former consent to the sending of emails for up to three years after the deletion of the user account before it is deleted. The data will only be stored for the purpose of a possible defense against claims.

6.4 Newsletter dispatch by service provider / newsletter success measurement?

The newsletter emails are currently sent purely via a service provider. We collect opening rates, click rates, "added to spam" information, "delivered" information, status information on delivery problems and newsletter unsubscribes. We use the tracking of clicks on links or the tracking of opening rates in particular to determine whether the user interacts with the content of the newsletter. If the user does not want this information to be collected, they should not subscribe to the newsletter.

7.   Cookies

7.1  General information

Cookies are used on ClinLife. Cookies are small text files that are stored in the user's Internet browser or by the Internet browser on the user's computer system. Cookies are downloaded when the user accesses ClinLife. The cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

Temporary cookies, also known as "session cookies" or "transient cookies", are cookies that are deleted after a user leaves the website and closes their browser. The login status, for example, can be stored in such a cookie. "Permanent" or "persistent" cookies are cookies that remain stored even after the browser has been closed. In this way, for example, a login status can be saved if a user visits the website after several days. User interests that are used for information purposes can also be stored in such a cookie. If the website is accessed again from the same end device, the cookie is either sent back to the website that generated it (first-party cookie) or to another website to which it belongs (third-party cookie). With the help of the cookie, the website can recognize that it has already been called up with this browser and can, among other things, improve the user experience when it is called up again. Cookies can adapt the content displayed on the website to the user's personal interests and needs.

The user can decide for himself whether the browser he uses allows cookies or not. Saved cookies can be deleted in the system settings of the browser. The functionality of websites may be restricted or even disabled if cookies are not permitted.

When ClinLife is called up for the first time, the user is informed about the use of cookies via an info banner. Various groups of cookies are used on ClinLife. If the user clicks on Details in the info banner, they are shown which cookies Clariness uses on ClinLife, and to which group this cookie belongs. If the user does not want a certain cookie or a certain group of cookies to be used, it must be ensured that the slider of the associated cookie group is set to deselect (gray) before the user clicks OK to confirm the setting. If the slider is not set to deselected (green), the user consents to Clariness using the cookie group in question. The user cannot influence the use of necessary function cookies. Only after the user has selected the cookie groups will the cookies be used on ClinLife.

7.2  Cookies used on the ClinLife website

Depending on your consent, the following types of cookies may be used on ClinLife

7.2.1    Necessary cookies

Clariness uses cookies that are necessary for the technical functionality as well as the detection of errors and security-related anomalies on ClinLife.

The legal basis for the processing of technically necessary cookies is Art. 6 para. 1 lit. f GDPR.

7.2.2    Functional cookies - Preferences

Functional cookies enable Clariness to save information already provided (such as user data or language selection) and to offer the user an improved, more personalized functions on ClinLife.

Functional cookies are only used if the user has consented to their use. The legal basis for the processing is Art. 6 para. 1 lit. a GDPR. The user has the option at any time to revoke any consent they have given at https://clinlife.us/cookies.

7.2.3    Marketing and statistics cookies

Clariness strives to continuously improve ClinLife. Cookies are used to provide Clariness with overall statistics on the number of visitors, which areas of a page are viewed the most, information on the length of the visit, etc. Web analyses can also be used as a statistical target group tool to evaluate the success of digital communication and marketing measures. These can for example be installed by external analysis providers commissioned by Clariness.

In order to better customize the ClinLife service to the interests and needs of users, Clariness evaluates data generated during the user's visit to ClinLife, provided the user has consented to the use of cookies for marketing and statistics.

Cookies for marketing as well as cookies for statistics are only used if the user has consented to their use. The legal basis for the processing is Art. 6 para. 1 lit. a GDPR. The user has the option at any time to revoke any consent they have given at https://clinlife.us/cookies.

An overview of all currently used cookies, the respective provider, the duration of use and the type can be found at https://clinlife.us/cookies.

Users can view and manage their individual cookie settings at https://clinlife.us/cookies.

8.   Data anonymization

ClinLife anonymizes data collected from the user in order to subsequently use the data (without personal reference) for statistical evaluations.

Anonymization takes place with regard to the access data collected in the course of using ClinLife and in the context of the user's application for a study. The legal basis for the processing for the anonymization of access data is Art. 6 (1) (f) GDPR. The legitimate interest lies in the principle of data minimization set out in Art. 5 (1) (c) GDPR. The legal basis for the anonymization of the user's data collected as part of the application / registration for a study is the user's consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Art. 9 (2) (a) GDPR. Art. 9 para. 2 (a) GDPR.

9.   Transfer and disclosure of personal data to other recipients and, if applicable, processing in a third country

Within the Clariness company, only those departments that need the user's data to fulfill the relevant purpose and legal obligations will receive it. Service providers commissioned by Clariness (telecommunications and IT service providers) may also receive data for these purposes. This concerns, for example, cases in which Clariness is supported in data processing by service providers employed by Clariness and acting on behalf of Clariness (so-called processors). These service providers are commissioned by Clariness, for example, to provide server capacity or to host questionnaires for us.

The legal basis for the transfer of personal data described above is Article 6(1)(f) GDPR. Our legitimate interest is to provide or improve our services.

9.1 In addition, Clariness may disclose personal data to third parties:

• With the user's consent, data will be forwarded to the study center selected by the user so that it can contact the user as part of his or her application for a study and process the application further.The legal basis is Art. 6 (1) (a) GD PR in conjunction with Art. 9 para. 2 (a) GDPR.
• If there is an enforceable court or official order to disclose and/or transfer data to third parties or if Clariness is obliged to disclose and/or transfer data to third parties due to a legal obligation even without such an order.The legal basis is Art. 6 (1) (c) and (f) GDPR. Our legitimate interest lies in the fulfillment of legitimate claims.
• If the disclosure and/or transfer is necessary to prevent misuse of the Internet offer or individual services - in particular the violation of terms of use - in a legally permissible manner.The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the detection and prosecution of abusive behavior.
• Except in the cases explained in this privacy policy, Clariness will not pass on the user's data to third parties without the user's express consent.
• The legal basis for the transfer of personal data in the case of express consent is Art. 6 (1) (a) GDPR.

9.2 Data processing in a third country?

Although Clariness takes care to only use service providers that have their registered office and server locations in a state of the European Union or the European Economic Area, there is a possibility that the User's personal data may be transferred to the parent company of the respective service provider based in a third country (i.e. in a country that is neither a member of the European Union nor the European Economic Area). Not all third countries have a level of data protection recognized as adequate by the European Commission. Clariness therefore takes care to conclude contracts that also provide for appropriate safeguards in accordance with Article 46 (2) GDPR in the event of third country transfers (e.g. standard contractual clauses or binding corporate rules); Clariness also takes additional technical and/or organizational measures where necessary to maintain adequate protection of personal data.

The User may obtain a copy of the provisions made in this respect by using the contact details of the responsible body under section 12 below.

10. User Rights

The user has the following rights. Their assertion will be processed immediately and will not lead to any disadvantages for the user.

Right to information (Art. 15 GDPR):  The user can request information from Clariness - without having to pay a fee - about which personal data is processed, the source of the data, the purpose(s) for which the data is processed and - relevantly - to which recipients or categories of recipients the data is transmitted. Requests for information that are received electronically will be answered electronically.

Right to object (Art. 21 GDPR):           The user may object to the processing of their data on grounds relating to their particular situation, insofar as the data processing is based on the legitimate interests pursued by Clariness or a third party (Art. 6 (1) (f) GDPR) and in cases where the data processing is carried out in the public interest (Art.

6 (1) (e) GDPR). If the user objects, Clariness will no longer process the personal data unless Clariness can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the user or for the establishment, exercise, or defense of legal claims.

Insofar as Clariness processes personal data in order to provide targeted information about Clariness's range of services (hereinafter “advertising purposes”), the user has the right to object at any time to the processing of personal data concerning him/her for this purpose. In the event of an objection to processing for advertising purposes, Clariness will no longer process the user's personal data for these purposes.

Right to data portability (Art. 20 GDPR):        The user has the right to request the surrender of that personal data which he or she has provided to Clariness in a structured, commonly used and machine-readable format, provided that the processing of the data is based on the user's consent (Art. 6 (1) (a) GDPR) or the processing was carried out for the performance of a contract concluded with the user or for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR).

Right to rectification (Art. 16 GDPR): If personal data is incorrect or incomplete, its rectification or completion may be requested. A rectification also triggers an obligation on Clariness to notify all recipients to whom the incorrect data has been disclosed of the rectification, unless this is exceptionally impossible or involves disproportionate effort.

Right to deletion (Art. 17 GDPR):       The user may request the deletion of their data without delay if (i) the purpose of the data processing has ceased to exist due to the passage of time or for other reasons, (ii) the processing is based on the user's consent and this has been revoked, (iii) the user has objected to the processing and further processing must then cease, or (iv) the legal basis for the processing of the data is missing or has ceased to exist. However, Clariness must comply with existing retention obligations and interests worthy of protection that conflict with deletion.

Right to restriction of processing (Art. 18 GDPR): The processing of personal data must be restricted (i) as long as a disputed accuracy of the data is verified by Clariness, (ii) the processing was unlawful from the outset, but an objection to deletion has been received

from the user, (iii) after the purpose has been achieved, if the user still needs the data to assert legal claims, and (iv) during the examination of an objection by the user. During the period of restricted processing, Clariness will only process the data (i) with the consent of the user or (ii) for the establishment, exercise, or defense of legal claims or (iii) for the protection of the rights of another person or for reasons of important public interest.

Right to lodge a complaint (Art. 77 GDPR in conjunction with Section 19 BDSG). The user has the right to lodge a complaint with a supervisory authority.

Right to withdraw consent under data protection law (Art. 7 para. 3 GDPR)

The user has the right to withdraw consent to the processing of personal data given to Clariness at any time. Further information can be found in section 12 below.

11. The user's right of revocation

Every consent is voluntary!

The user may revoke his consent to the processing of his data in whole or in part at any time without giving a reason. The revocation - even one limited to certain data - may have the consequence that the user can no longer use certain Clariness services.

A revocation always relates only to the future processing of the user's data. Data processing that has already taken place cannot be subsequently reversed. In the event of a revocation, the personal data stored on the basis of the consent will be deleted.

To revoke your consent, please contact: [email protected]

After a revocation, data processing will only continue if Clariness can base the (future) processing on a legal basis other than consent. The legal basis may be the fulfillment of a legal obligation pursuant to Article 6(1)(c) GDPR, which is the case, for example, if Clariness has to fulfill corresponding legal obligations (e.g. under commercial or tax law) or regulatory requirements. Another legal basis for the continuation of data processing is the protection of legitimate interests (Article 6(1)(f) GDPR), in particular for the assertion of legal claims and defense in legal disputes. Nevertheless, the data will not be processed to protect legitimate interests as long as and insofar as Clariness has recognizable indications that there are overriding interests worthy of protection that conflict with the processing. Before any processing of personal data for the protection of legitimate interests, the conflicting interests worthy of protection are therefore examined as part of an objectified consideration.

12. Contact details of the responsible party, contact details of the data protection officer

The contact details of the responsible body are as follows:

Clariness GmbH

Schillerstraße 44

22767 Hamburg

Telephone: +49 (40) 298 678 00

Telefax:  +49 (40) 298 678 09

E-Mail: [email protected]

The contact details of the data protection officer of the responsible body are as follows:

Clariness GmbH c/o Mein Datenschutzbeauftragter.de

Hafenstraße 1a, 23568 Lübeck

Using the above contact details, the rights mentioned in paragraphs 10 and 11 can be asserted against both the responsible body and its data protection officer, and general questions relating to data protection can be asked and suggestions made.

13. Contact details of the competent supervisory authority

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) is the responsible supervisory authority. It monitors compliance with data protection law in the non-public sector in Hamburg. The user has the option of contacting the supervisory authority at any time.

The contact details are as follows:

Freie und Hansestadt Hamburg

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

Thomas Fuchs

Ludwig-Erhard-Straße 22

20459 Hamburg

Tel.: 040 / 428 54 – 4040

Fax: 040 / 428 54 – 4000

E-Mail: [email protected]

14. Links to other websites

Insofar as the website contains links to other websites, this data protection declaration does not extend to the other providers. ClinLife has no influence on whether their operators comply with the data protection regulations and therefore accepts no responsibility for the accuracy, timeliness and completeness of the information provided there.

15. Additional information for users who are not located in the EU

Clariness is a company that has its headquarters in Germany/EU. In accordance with the location principle, Clariness must comply with the requirements of the GDPR, which means that the “Data protection information ClinLife website” applies to all users of the ClinLife website. Since our website is also aimed at users who are not located in the EU, the data protection law that applies in the place where the user is located may also apply in accordance with the market location principle.

Additional information on data protection that applies in the place where the user is located is provided, where applicable, in the respective language, on our respective country-specific website at the end of the respective “Data protection information ClinLife website”.

June 2024