GDPR and Informed Consent Forms

Informed Consent Forms and GDPR

Last update: 11/10/2025

Informed Consent

By signing and submitting this document, I request the Services from Massive Bio. I consent to Massive Bio providing the Services to me and, as required, to my healthcare provider. I acknowledge that my electronic signature results in a legally binding contract under applicable state, federal, and local laws where the Services are provided.

To Health Professionals:

I understand that filling in and signing this form permits you to give copies of all my health records, including complete general practitioner records (information about medicine, allergies, vaccinations, previous illnesses and test results), hospital discharge summaries, appointment letters, referral letters, and any hospital records relating to my cancer diagnosis, to Massive Bio for continuity of care and clinical-trial matching.

I acknowledge that any personal information used or disclosed as part of this agreement may be subject to further processing by the recipient. All such processing remains subject to the provisions and protections of the GDPR, which require that my data continue to be handled in a lawful, fair, and transparent manner, ensuring its security and confidentiality. The recipient of this information is also obligated under GDPR to uphold these data-protection standards.

Authorization Duration:

This authorization for Massive Bio to access and process my medical records is based on my explicit consent under GDPR Article 9(2)(a). The authorization remains valid for ten (10) years or until the purpose for which the data is processed has been fulfilled, unless longer retention is legally required for anonymized research data. I have the right to withdraw my consent at any time by providing written notice to Massive Bio; withdrawal halts new processing of identifiable data but does not affect processing already performed.

Sensitive Data:

The information released and used for these Services may include sensitive categories of data, such as mental health records/psychotherapy notes; alcohol or substance abuse; HIV or AIDS; sexually transmitted diseases; and genetic testing results. My explicit consent under GDPR Article 9(2)(a) is required for processing these data.

Data Use and Recipients:

I request that Massive Bio be provided with copies of my health records in accordance with my rights as a data subject under the GDPR. I understand that this transfer is subject to data processing policies and consent protocols of the originating organization, and I expect it to be fulfilled within 30 calendar days from the date of this request.

The following individuals or entities may receive the information collected about me:

• Massive Bio team members to properly provide Services
• Massive Bio partners, vendors, subcontractors, next generation sequencing vendors, contract research organizations, pharmaceutical, diagnostic, real-world evidence, and data companies, subject to Business Associate Agreements or equivalent contracts
• Clinical trial sites

De-Identification and Commercial Use:

Anonymized and aggregated data may be used for commercial, academic, or regulatory real-world evidence purposes to improve clinical-trial matching, diagnostics, therapeutics, and algorithm training. Such anonymized data are no longer subject to data-protection laws.

Cross-Border Data Transfer:

Personal Data collected within the EU/EEA may be transferred to our offices in the United States. Transfers rely on Standard Contractual Clauses or other recognized adequacy mechanisms to ensure equivalent data protection.

Withdrawal:

My consent is voluntary, and I may refuse to sign without affecting my ability to obtain treatment, payment, or benefits from my healthcare provider. I may withdraw my consent at any time by submitting a written or electronic request to [email protected]. Withdrawal becomes effective within 30 days of acknowledgment and halts new processing of identifiable data; data already anonymized or required for legal or scientific integrity may continue to be used.

Arbitration Clause:

This consent is governed by the laws of the United States and the State of Delaware. All disputes shall be resolved by binding arbitration held in New York City, United States of America. Nothing herein limits mandatory EU data-subject rights or access to supervisory authorities.

Contact Information:

Data Protection Officer: Cagatay Culcuoglu

Email: [email protected]

Phone: +1-844-627-7246 (International callers: dial +1 or contact [email protected])

Fax: +1-844-742-8837

Disclosure of Sponsor Support:

In certain situations, the sponsor of a clinical trial (for example, a pharmaceutical or biotechnology company) may provide financial support to Massive Bio, Inc. to cover certain concierge, navigation, or last-mile coordination services that assist you and/or your treating physician once a decision has been made to pursue participation in a specific eligible trial.

This financial support is provided directly to Massive Bio to enable these logistical and administrative services. It does not affect your rights, the cost of your care, or your eligibility for any clinical trial.

Massive Bio remains an independent organization, and your treating physician retains full clinical responsibility and decision-making authority. These services are offered solely to facilitate access, coordination, and communication related to trial participation.

By signing below, I authorize my healthcare provider to disclose my protected health information to Massive Bio and its subcontractor(s) for clinical-trial eligibility analysis, diagnostic options, and therapeutic optimization.