Privacy Policy

Originally Effective: May 5, 2015
Last Updated: October 14, 2026

This “Privacy Policy” explains how we collect, use, disclose, protect, and otherwise process the personal information and user data of individuals using the Massive Bio website and its affiliated websites; the Synergy-AI Clinical Trial Finder, Trial Relay, Patient Connect and Cancer Quiz mobile applications; and our other products, applications, platforms, programs, and services, including Patient Connect, RNex (Reticulum Nexus™), NexusPulse™, Synergy-AI, Clinical Trial Matching, Patient Therapy Matching and Monitoring, Trial Relay™, Trial Vision, Patient Connect, Nexus Pulse, Virtual Tumor Board, Drug Utilization Optimizer (“DUO”), Real-World Data (“RWD”) and real-world evidence solutions, patient and healthcare-professional portals, clinical-trial finder tools and widgets, conversational and agentic AI applications, medical-record ingestion and structuring tools, analytics and reporting dashboards, referral and prescreening workflows, patient navigation and enrollment coordination services, provider and research-site engagement services, application programming interfaces, integrations, support services, and other related online and offline applications and services collectively referred to as the “Solutions.” This Privacy Policy applies to individuals whose personal information we process through the Solutions, including patients, caregivers, authorized patient representatives, oncologists and other healthcare professionals, referring physicians, principal investigators, clinical-trial site personnel, expert oncologists who review clinical information and identify potential treatment or clinical-trial options, healthcare-organization representatives, pharmaceutical and biotechnology company representatives, contract research organization personnel, research partners, service providers, business partners, and other authorized users. In this Privacy Policy, “you” and “your” refer to the individual to whom the personal information relates.

Comprehensive Scope of Solutions

“Solutions” includes Massive Bio websites and affiliated websites; public and dedicated landing pages; Reticulum Nexus™ (RNex or RNEX); SYNERGY-AI™; Radiant Core™; NexusPulse™; Trial Relay™ and its web and mobile applications; TrialRouter™; Patient Connect™ and its web and mobile applications; Trial Vision™; DrArturo AI™; Phoebe AI™; the De-identification Module; Drug Optimizer; Drug Matching; Synthetic Cohort Builder; Cohort Analyzer; Dashboards; Sentinel Agents™; Agent Studio; Provider Hub; client, sponsor, trial-performance, and operational dashboards; the Synergy-AI Clinical Trial Finder; Cancer Quiz; and all related applications, portals, widgets, application programming interfaces (APIs), webhooks, streaming interfaces and services, data feeds, connectors, integrations, dashboards, messaging features, notification services, modules, agents, and successor versions.

The “Mobile Applications” are the mobile versions of Trial Relay™ and Patient Connect™, together with the Synergy-AI Clinical Trial Finder and Cancer Quiz, and any other Massive Bio mobile application that links to or incorporates these Terms or this Privacy Policy, as applicable. Trial Relay™ and Patient Connect™ are also available as web applications and remain part of the broader Solutions across both their web and mobile versions.

The Solutions support clinical-trial and therapy matching; medical-record collection, ingestion, de-identification, abstraction, structuring, and longitudinal refresh; healthcare-provider discovery, verification, directory, engagement, referral, and network services; patient navigation, engagement, prescreening, enrollment coordination, and last-mile support; biomarker, treatment, referral, site, market, operational, real-world-data, and real-world-evidence analytics; and related support and professional services. This Privacy Policy also applies to personal information retained from renamed, replaced, predecessor, or legacy Solutions, including Clinical Network, the Clinical Trial Matching System or CTMS, and OncoMonitor, to the extent Massive Bio continues to maintain or process that information. References to a Solution include its features, modules, agents, integrations, interfaces, data-exchange mechanisms, and successor versions unless a more specific notice states otherwise.

The Solutions are operated by Massive Bio, Inc. and, where applicable to a particular Solution, Service, program, processing activity, or jurisdiction, its subsidiaries and affiliated entities worldwide. In this Privacy Policy, “Massive Bio,” the “Company,” “we,” “us,” and “our” refer collectively to those entities, except where a specific Massive Bio entity is expressly identified. The Massive Bio entity that determines the purposes and means of a particular processing activity, or that is identified in an applicable agreement, consent, authorization, program notice, or in-product notice, is responsible for that processing as controller, business, or equivalent organization under applicable law. Where no other Massive Bio entity is identified, Massive Bio, Inc. is responsible for the processing described in this Privacy Policy. Massive Bio is a healthcare technology and data analytics organization providing technology-enabled clinical-trial matching, therapy matching, patient navigation, provider engagement, healthcare and research analytics, real-world data and real-world evidence services, and related operational and support services, collectively referred to as the “Services.” The Solutions may operate as a connected ecosystem. Reticulum Nexus may provide the underlying data, workflow, registry, and orchestration foundation; other Solutions, agents, applications, integrations, and dashboards may read from, write to, or otherwise process information through that common foundation, subject to role-based access, purpose limitation, applicable agreements, and legal requirements. We may use artificial intelligence, machine learning, knowledge graphs, rules-based systems, predictive analytics, and other technologies to process and organize information, identify potentially relevant clinical trials or therapy-related opportunities, support referral and navigation workflows, detect operational or clinical-data signals, and provide analytical insights. These technologies support human users and workflows and do not independently diagnose, prescribe treatment, determine final clinical-trial eligibility, or replace the independent professional judgment of qualified healthcare professionals. This Privacy Policy supplements, but does not replace, service-specific, program-specific, or jurisdiction-specific consent forms, authorizations, agreements, and privacy notices. Use of a mobile application is also subject to the applicable Terms and Conditions and end-user license agreement presented through the application or relevant app store.

Massive Bio may identify, match, prioritize, display, present, or facilitate access to potentially relevant clinical trials, providers, programs, therapies, services, resources, or opportunities. Such information and outputs are provided for informational, analytical, navigational, and operational-support purposes only and do not constitute an endorsement, clinical direction, diagnosis, prescription, treatment decision, guarantee of eligibility, guarantee of enrollment, or medical advice. Final clinical, treatment, referral, eligibility, and enrollment decisions remain with the patient, the patient’s qualified healthcare professionals, and, where applicable, the clinical-trial investigator, sponsor, or study site.

We are not a treating healthcare provider. Unless expressly stated in a separate service-specific agreement or notice, Massive Bio does not diagnose medical conditions, prescribe or administer treatment, make treatment decisions, or establish a treating provider-patient relationship. All medical and treatment decisions remain solely with the patient and the patient’s qualified treating healthcare professionals. Final clinical-trial eligibility and enrollment decisions are made independently by the applicable clinical-trial investigator or study site. A clinical-trial match or other output provided through the Solutions does not constitute medical advice, a treatment recommendation, or confirmation of clinical-trial eligibility.

Massive Bio will share your Clinical-Trial Matching Report or related patient-specific materials with your treating healthcare professional only when you request or authorize us to do so, or when another disclosure is permitted or required by applicable law. You may withdraw your authorization for future disclosures at any time. Withdrawal will not affect disclosures lawfully made before we processed the withdrawal.

This Privacy Policy applies to personal information processed by or on behalf of Massive Bio through the Solutions. Massive Bio may engage service providers to process personal information on its behalf for authorized purposes subject to appropriate contractual, confidentiality, privacy, and security obligations. The Solutions may also link to independently operated third-party websites, applications, products, or services. This Privacy Policy does not govern the privacy practices of those independent third parties, and users should review the applicable third-party privacy notices. Personal information may be shared among Massive Bio entities worldwide where reasonably necessary to provide, administer, secure, support, improve, or comply with obligations relating to the Solutions and Services, subject to access controls, purpose limitation, applicable transfer requirements, and other safeguards required by law. By using the Solutions, you acknowledge that you have received or had an opportunity to review this Privacy Policy. Acknowledgement of this Privacy Policy does not constitute consent when applicable law requires separate affirmative consent or authorization. This Privacy Policy applies to personal information processed by or on behalf of Massive Bio through the Solutions. We may engage service providers to process personal information on our behalf for authorized purposes. We require those service providers to maintain appropriate confidentiality, privacy, security, and contractual protections.

The Solutions may also contain links to websites, applications, or services operated independently by third parties. This Privacy Policy does not govern the privacy practices of independent third parties. We encourage you to review the privacy notice of any third-party service before providing information to it.

This Privacy Policy is intended to provide transparency regarding our processing practices and to support compliance with applicable privacy and data-protection laws, which may include HIPAA, the GDPR and UK GDPR, PIPEDA and applicable Canadian provincial laws, the LGPD, and applicable US federal and state privacy laws. The laws that apply to particular information depend on the jurisdiction, source of the information, nature of the Services, relationship among the parties, and context in which the information is processed.

Controller and processor roles. Massive Bio’s role may vary depending on the Service, contractual arrangement, source of the information, and applicable law. Massive Bio may act as a controller or business responsible for determining the purposes and means of processing when individuals interact directly with Massive Bio or when Massive Bio processes information for its own independently determined purposes. Massive Bio may act as a processor, service provider, contractor, or HIPAA business associate when it processes information on behalf of a healthcare organization, clinical-trial sponsor, research organization, business partner, or other customer under applicable contractual instructions.

The applicable agreement, consent, authorization, program notice, or other service-specific documentation may provide additional information about Massive Bio’s role. Where Massive Bio acts as a processor or service provider, the relevant customer generally serves as the controller or business responsible for the applicable processing.

In sponsor-supported programs, Massive Bio does not provide identifiable patient information to a sponsor for the sponsor’s independent advertising or marketing purposes. Any other disclosure of identifiable patient information to a sponsor or research partner will occur only where legally permitted, appropriately disclosed, limited to the applicable purpose, and supported by any required consent, authorization, or contractual protection.

Massive Bio is not a treating healthcare provider and generally does not act as a healthcare provider, health plan, or healthcare clearinghouse covered entity under HIPAA. In certain engagements, however, Massive Bio may act as a business associate of a HIPAA-covered entity or another business associate. When Massive Bio creates, receives, maintains, or transmits Protected Health Information in that capacity, Massive Bio processes the information in accordance with the applicable Business Associate Agreement and the provisions of HIPAA that apply to business associates.

Health information provided directly by an individual to Massive Bio outside a HIPAA-regulated relationship may not be protected by HIPAA. Such information remains subject to this Privacy Policy and other applicable federal, state, and international privacy laws.

I. Information We Collect

1. Personally identifiable information

Our Solutions and our Service Providers only collect personally identifiable information (“PII”, also referred to as personal data or personal information in some jurisdictions) for our purposes as set out in the next section II. Collection of PII occurs if you register for an appointment on the Solutions, subscribe to a newsletter, tweet to us, or use other features and resources on the Solutions. You may visit our Site anonymously, but that may prevent We may collect personal information when you create an account, complete a form or questionnaire, request or receive Services, upload documents, communicate with us, participate in a referral or navigation process, subscribe to communications, interact with a Solution, or otherwise provide information to us.

Depending on your relationship with Massive Bio, the personal information we collect may include:

Identity and contact information: Name, address, email address, telephone number, date of birth, country, preferred language, account details, and communication preferences.

Patient and clinical information: Diagnosis, medical history, treatment history, medications, pathology information, laboratory results, medical images, imaging reports, genetic and biomarker information, health-insurance information, treating-provider information, clinical-trial preferences, and information relevant to clinical-trial matching, patient navigation, therapy matching, or related Services.

Healthcare-professional information: Name, professional contact information, NPI or other professional identifiers, credentials, specialty, licensure information, professional affiliations, institution, practice location, research activity, clinical-trial involvement, and provider-verification information.

Communications information: Emails, telephone calls, SMS and MMS messages, portal communications, chat communications, support requests, consent records, authorization records, physician-sharing preferences, and call recordings where permitted by law and after any required notice or consent.

Technical and usage information: IP address, browser, device, operating system, identifiers, log-in activity, pages viewed, features used, referral source, cookie choices, security logs, and audit information.

Business relationship information: Employer, organizational affiliation, professional role, contracting information, payment information, due-diligence information, work product, and communications associated with a business relationship.

Medical Information Released to Company:

We may receive medical or clinical information:

• Directly from you;
• From a caregiver, representative, or other person you authorize;
• From your healthcare professionals or healthcare organizations where the disclosure is legally permitted;
• Through electronic health record, electronic medical record, laboratory, imaging, or clinical systems where authorized access, technical permissions, appropriate agreements, and applicable legal requirements are in place;
• From records or secure access links you provide;
• Through emails, telephone calls, SMS or MMS messages, secure portals, approved messaging applications, and other authorized communication channels;
• From clinical-trial sites, laboratories, health plans, patient-support organizations, and other authorized partners.

2. Protected Health Information and Sensitive Personal Information

We may collect and process sensitive personal information, including health, genetic, genomic, insurance, government-identifier, account-authentication, precise-geolocation, racial or ethnic origin, and other information treated as sensitive under applicable law. We process sensitive personal information only for disclosed and authorized purposes and under an applicable legal basis. Where required, we obtain separate consent or authorization before processing such information.

3. Non-Personally Identifiable Information

Our Website, Solutions, and Service Providers may also collect non-personally identifiable (anonymous) information (“Non-PII”) from visitors, including cancer patients, health care providers, staff, clinical staff, oncology experts, data analysts, and health plan administrators. Non-personally identifiable information is any information that cannot be directly or indirectly associated with you. We may create or receive de-identified, aggregated, or anonymized information. These terms are not interchangeable. De-identified information means information processed so that it cannot reasonably be linked to an identifiable individual under the applicable legal standard. Aggregated information means information combined across multiple individuals or events and presented so that an individual is not reasonably identifiable. Anonymized information means information for which identification is not reasonably possible under the applicable legal standard. Pseudonymized information remains personal information where it can be linked to an individual using additional information.

4. Cookies and Similar Technologies (Solutions when required or needed; not applicable to Mobile Applications)

Cookies, pixels, local storage, web beacons, and similar technologies may be used on Massive Bio websites and web-based applications to operate, secure, analyze, and improve those websites. These technologies may collect information such as:

• IP address;
• Browser and device information;
• Operating system;
• Cookie and device identifiers;
• Pages viewed and features used;
• Referring and destination pages;
• Date and time of access;
• Approximate location derived from IP address; and
• Cookie-consent and privacy preferences.

Cookies and similar technologies may be used on the Solutions when required or needed, but do not apply to the mobile applications. Cookies, pixels, local storage, web beacons, and similar technologies may be used on Massive Bio websites, web applications, portals, and other web-based Solutions where they are required or useful to operate, secure, analyze, or improve those Solutions. The mobile applications do not use cookies. Mobile applications may use software development kits (SDKs), device identifiers, analytics libraries, crash-reporting tools, and similar technologies. Those mobile practices are described separately in the Mobile Applications section of this Privacy Policy and in the applicable Apple App Privacy and Google Play Data Safety disclosures.

Where required by law, non-essential analytics, preference, or marketing technologies on the websites will not be activated until you provide the applicable consent. You may reject or customize non-essential cookies through our cookie-consent tool and may later modify or withdraw your choices. Necessary technologies may operate without consent where they are required to provide a requested Service, maintain security, prevent fraud, or support essential functions. For additional information about website cookies, please review our Cookie Notice.

5. Social Media

We may collect information through our presence on social media and networking platforms. You may use social networks or other online services to sign into the Solutions. When you do so, information from those services may be made available to us. By associating a social network account with the Solutions, we may collect your PII, such as your username and email address.

5A. Mobile Applications, Analytics, and Diagnostics

When you install, access, or use a Massive Bio mobile application, we may automatically collect technical, device, usage, security, and diagnostic information needed to operate, secure, maintain, troubleshoot, and improve the application. This may include the categories described above, together with app launch and session information, feature interactions, authentication events, notification delivery status, crash reports, error logs, performance measurements, and other diagnostic events.

Massive Bio may use authorized analytics, crash-reporting, security, authentication, notification, and infrastructure providers to process limited mobile-app information on our behalf. These providers may process information only for authorized purposes and must maintain protections consistent with their contractual obligations and applicable law. The specific categories of data collected by each released mobile application and its deployed software development kits must be accurately reflected in the applicable Apple App Privacy disclosure and Google Play Data Safety form.

We do not use health, medical, clinical, genetic, genomic, biomarker, medical-record, or other sensitive health information collected through the mobile applications for third-party advertising, behavioral advertising, cross-context behavioral advertising, or marketing data-mining purposes. We also do not permit third-party advertising networks to use such information for their own advertising or marketing purposes. Service-related communications, requested notifications, patient navigation, provider engagement, and communications separately authorized by the user are not treated as third-party advertising under this paragraph.

Mobile-device permissions are optional unless a permission is technically necessary for a feature you choose to use. You may manage permissions through your device settings. Disabling a permission may prevent the related feature from operating, but will not prevent access to unrelated features where technically feasible and legally permitted.

Apple App Privacy and Google Play Data Safety. The privacy disclosures submitted for each mobile application through Apple App Store Connect (App Privacy labels) and Google Play Console (Data Safety form) are intended to describe the data practices of the applicable released version. These store disclosures and this Privacy Policy must be read together. If a store disclosure and this Privacy Policy appear inconsistent, the more specific disclosure applicable to the relevant mobile application and version will supplement this Privacy Policy, subject to applicable law. Massive Bio will update the relevant store disclosure when material data practices change.

Account deletion in mobile applications. If a Massive Bio mobile application allows you to create an account, the application provides an accessible in-app path to initiate account deletion. A web-based option is also available so that you can submit a request after uninstalling the application or losing access to it. The full account-deletion process is described in Section VI.2 of this Privacy Policy.

5B. Physician Honoraria

Massive Bio may offer healthcare professionals the opportunity to participate in surveys, roundtables, advisory activities, expert reviews, chart reviews, educational activities, research-related activities, or other approved professional activities for which an honorarium may be available. In connection with these activities, Massive Bio may collect and process information reasonably necessary to administer participation, verify eligibility, maintain records, comply with applicable legal obligations, and administer any honoraria associated with the activity.

6. Authorized Representatives

You may authorize another person to communicate with Massive Bio, submit a request, or exercise privacy rights on your behalf, subject to applicable law and appropriate verification. Depending on the request, Massive Bio may require written or electronic authorization, identity verification, guardianship documentation, power-of-attorney documentation, a court order, parental-authority documentation, or other evidence reasonably necessary to verify the representative’s authority.

Massive Bio may deny or limit a representative’s request when we cannot reasonably verify the representative’s identity or authority, when the authorization does not cover the requested action, when the requested disclosure could create a risk of harm, or when access or disclosure is restricted by applicable law.

The duration of an authorization will be determined by the terms of the authorization, the applicable Service, the individual’s instructions, and applicable law. An individual or another legally authorized person may withdraw an authorization prospectively, subject to applicable law.

7. Physician sharing (opt-in)

We will share your Clinical-Trial Matching Report or related patient-specific materials with your treating healthcare professional only when you request or authorize the disclosure, when another person legally authorized to act for you requests or authorizes it, or when the disclosure is otherwise permitted or required by applicable law.

We may record the identity of the recipient, the scope of the information shared, the date of the disclosure, and the method by which your request or authorization was received. You may withdraw your authorization for future disclosures by contacting [email protected]. Withdrawal will apply prospectively and will not affect disclosures lawfully made before we processed the withdrawal.

You may also download available reports and decide independently whether to share them.

8. Anonymous referrals / Trial Relay

A healthcare professional may submit limited anonymous or appropriately de-identified information to explore potentially relevant clinical trials without directly identifying the patient.

If a patient requests or affirmatively agrees to be contacted by Massive Bio, an authorized healthcare professional may provide the minimum contact information reasonably necessary to facilitate the referral, where legally permitted and appropriately documented.

Before Massive Bio processes additional identifiable clinical information, we will establish the applicable legal and contractual basis. Depending on the circumstances, this may include patient consent or authorization, a Business Associate Agreement, a data-processing agreement, another legally permitted basis, or a combination of these requirements.

Providing limited contact information for a patient-directed referral does not, by itself, authorize the disclosure or processing of the patient’s complete medical record. Final clinical-trial eligibility is determined independently by the applicable clinical-trial investigator or study site.

9. Information about You from Other Sources

We may obtain personal information from healthcare professionals, healthcare organizations, caregivers, authorized representatives, clinical-trial sites, research institutions, laboratories, health plans, patient-support organizations, service providers, governmental registries, professional directories, public sources, licensed data providers, and other lawful and authorized sources.

II. The Categories of PII We Collect for Our Purposes and the Applicable Legal Basis for Our Data Processing

Depending on where you live, how you interact with us, and how we may interact with certain Service Providers, we may collect personal information (PII) about you as set out below, together with the purpose of the processing and (for the EEA, UK, Canada, and other countries) the legal basis we rely on for each type of PII that we process about you.

We may combine information obtained from different sources where permitted by law and reasonably necessary to provide, secure, administer, evaluate, or improve the Services; support clinical-trial matching, referral, prescreening, and patient-navigation activities; fulfill contractual or legal responsibilities; and conduct legally permitted analytics, research, RWD, and real-world evidence activities.

Category 1 — Patient profile data

Personal information. First and last name; home address; home telephone number; cancer diagnosis; health insurance account numbers; medical history; cancer screenings; cancer history and treatments; pathology reports; your diagnostic images; your clinical information and data; physician-sharing preference (yes/no; timestamp; method collected).

Purposes. We may use patient profile information to:

1. Create, administer, and maintain patient accounts and profiles;
2. Communicate with patients, caregivers, authorized representatives, and healthcare professionals;
3. Collect, organize, structure, review, and manage clinical information;
4. Identify potentially relevant clinical trials, testing resources, patient-support programs, and navigation options;
5. Support clinical-trial matching, prescreening, referral, navigation, and enrollment coordination;
6. Provide patient-requested reports and related information;
7. Support patient-requested communications and disclosures to treating healthcare professionals;
8. Facilitate virtual tumor board, bioinformatics, molecular review, or expert-review workflows where separately requested or authorized;
9. Support reimbursement, insurance, or patient-assistance activities where included in the requested Services;
10. Improve, secure, evaluate, develop, and operate the Solutions;
11. Conduct legally permitted analytics, research, RWD, and real-world evidence activities; and
12. Comply with legal, regulatory, contractual, audit, recordkeeping, and security requirements.

Massive Bio does not independently diagnose medical conditions, prescribe treatments, determine final clinical-trial eligibility, or replace the independent judgment of qualified healthcare professionals.

Legal basis where the GDPR or UK GDPR applies. Depending on the circumstances, Massive Bio may rely on consent under Article 6(1)(a), performance of a contract or requested pre-contractual steps under Article 6(1)(b), compliance with a legal obligation under Article 6(1)(c), protection of vital interests under Article 6(1)(d), or legitimate interests under Article 6(1)(f). When processing health, genetic, or other special-category information, Massive Bio also relies on an applicable condition under Article 9, which may include explicit consent under Article 9(2)(a) or another condition permitted by applicable law. The specific legal basis depends on the Service, processing purpose, relationship among the parties, source of the information, and applicable jurisdiction.

Where HIPAA applies, Massive Bio processes PHI in accordance with the applicable Business Associate Agreement, patient authorization, or other legally permitted basis. Where Canadian privacy laws apply, Massive Bio relies on consent or another basis permitted under the applicable federal or provincial law.

Category 2 — Health provider data

Personal information. Professional name, credentials, specialty and subspecialty, NPI and other professional identifiers, professional email address, telephone number, business address, practice or employer, institutional affiliation, research and publication affiliations, licensure and certification information, professional notes, account information, Solution activity, referral activity, and verification information.

Purposes. We process healthcare-professional information to communicate with healthcare professionals, administer accounts, verify professional identity and credentials, provide provider-facing Solutions, support clinical-trial identification and referrals, facilitate patient navigation and research-site engagement, maintain provider directories, prevent fraud and misuse, support research and healthcare-network operations, improve the Solutions, and meet legal, contractual, audit, and security requirements.

Legal basis where the GDPR or UK GDPR applies. Depending on the circumstances, we may rely on performance of a contract, compliance with a legal obligation, consent where required, or Massive Bio’s legitimate interests in verifying professional users, operating provider-facing Solutions, supporting clinical-trial and referral workflows, maintaining accurate professional information, protecting the Solutions, and managing professional relationships.

Category 3 — Service Provider data

Personal information. Service Provider first and last name; Service Provider email address; Service Provider employer; Service Provider address; Service Provider telephone number; Service Provider work product.

Purposes. We use service-provider information to communicate with current and potential service providers; conduct due diligence; assess qualifications, capabilities, privacy, security, and compliance requirements; negotiate, execute, and administer agreements; manage the business relationship; process payments; monitor performance; maintain records; and comply with legal, contractual, audit, accounting, and security requirements.

Legal basis where the GDPR or UK GDPR applies. Depending on the circumstances, we may rely on performance of a contract, compliance with a legal obligation, consent where required, or Massive Bio’s legitimate interests in evaluating and managing service-provider relationships, administering agreements, maintaining business records, protecting the Solutions, and meeting audit, accounting, security, and compliance requirements.

Category 4 — Cookies (Solutions except Mobile Applications)

Personal information, purposes, and legal basis. Please see our cookie notice.

Category 5 — Social media data

Personal information. Username, email address.

Purposes. For providing access to your patient profile via your other (social media) profile(s) / account(s).

Legal basis where the GDPR or UK GDPR applies. Depending on the circumstances, we may rely on your consent, performance of a contract, or our legitimate interests in offering account-access options, authenticating users, protecting accounts, and operating the Solutions. If a social-media or third-party sign-in provider requires separate permission, the provider’s own terms and privacy notice also apply.

Please be aware that

• Unauthorized access to, disclosure, alteration, loss, or misuse of personal information may adversely affect an individual, particularly when the information is sensitive.
• You may decline to provide certain personal information. However, Massive Bio may be unable to provide a requested Service when the information is reasonably necessary to perform that Service.
• We do not intentionally use cookies or similar technologies to store medical records or detailed clinical information. Where required by law, we obtain consent before using non-essential analytics or marketing technologies.

2. SMS/MMS Mobile Messaging

If you provide a telephone number or other electronic contact information, Massive Bio and service providers acting on our behalf may use that information to send communications associated with your request, account, referral, navigation activity, or relationship with Massive Bio. Communications may include identity verification, security alerts, requested clinical-trial information, appointment and follow-up messages, service notifications, consent and authorization communications, responses to inquiries, and marketing messages where separately permitted or consented to.

Massive Bio does not sell telephone numbers or SMS or MMS consent records to third parties for their independent advertising or marketing purposes.

Where required by law, Massive Bio will obtain appropriate consent before sending marketing messages, using automated dialing technology, delivering prerecorded or artificial-voice messages, or recording a call. Consent to receive marketing communications is not a condition of receiving patient-navigation or clinical-trial matching services where applicable law prohibits such a condition.

Message and data rates may apply, and message frequency may vary. You may opt out of SMS or MMS messages by replying STOP or UNSUBSCRIBE. You may request assistance by replying HELP or calling +1 (844) 627-7246. We may send a final message confirming your opt-out. An opt-out from marketing communications will not prevent legally permitted security, transactional, account, or requested service communications.

Additional messaging terms may be presented at enrollment or opt-in. Those terms supplement this Privacy Policy and will identify any program-specific message frequency, communication purpose, and opt-out instructions.

You represent that you are authorized to provide the telephone number submitted and agree to notify Massive Bio if the number changes or is reassigned.

Wireless carriers are not responsible for delayed or undelivered messages, which may occur due to factors outside carriers’ control.

3. Links to Other Websites

The Solutions may contain links to websites, applications, products, or services operated independently by third parties. Providing a link does not necessarily constitute Massive Bio’s endorsement of the third party or its products or services. This Privacy Policy does not govern the privacy, security, or content practices of independently operated third-party services. We encourage you to review the applicable third party’s privacy notice before providing personal information or using its services.

II-A. Trial Relay Provider Information and Verification

Information About Healthcare Professionals and Organizations

In connection with Trial Relay and other provider-facing Solutions, Massive Bio may collect, receive, access, license, verify, organize, process, store, and use professional and business information concerning healthcare professionals, healthcare organizations, research institutions, clinical-trial sites, and other authorized healthcare and research participants.

Such information may include:

• National Provider Identifier (NPI) and equivalent professional identifiers;
• Professional name, credentials, specialty, subspecialty, licenses, and certifications;
• Practice, facility, and organizational affiliations;
• Business addresses, geographic locations, and service regions;
• Professional email addresses, telephone numbers, and business contact information;
• Institutional, academic, publication, and research affiliations;
• Clinical, operational, referral, and professional network information;
• Other professional and business information lawfully obtained from public, licensed, or authorized sources.

Massive Bio may obtain such information directly from users, from publicly available sources, from healthcare organizations, and from third-party data providers, including governmental registries, professional directories, healthcare data vendors, publicly available websites, mapping services, and other lawful sources.

Subject to applicable law and applicable licensing terms, these sources may include NPPES, PECOS, CMS datasets, FINESS, OpenStreetMap, Definitive Healthcare, and other governmental, public, licensed, or authorized data sources.

Use of Provider Information

Massive Bio may process provider and organization information for purposes including:

• Account creation, authentication, and identity verification;
• Professional credential verification and fraud prevention;
• Clinical trial identification and matching activities;
• Healthcare provider discovery and network development;
• Solution administration and user support;
• Research site identification and engagement;
• Regulatory, compliance, auditing, and legal obligations;
• Product development, analytics, quality assurance, and security monitoring;
• Artificial intelligence, machine learning, and algorithmic systems designed to improve platform operations, matching capabilities, referral workflows, and service delivery.

Information Obtained from Third Parties

Where provider information is obtained from third-party sources rather than directly from the individual concerned, Massive Bio may process such information in accordance with applicable laws and legitimate business interests.

Where required under applicable data protection laws, including GDPR Article 14 and similar regulations, Massive Bio may provide notice through one or more legally permissible mechanisms, including direct communications, platform notifications, publicly available privacy notices, account onboarding materials, or other appropriate channels.

Provider Directory and Network Participation

Healthcare professionals using Trial Relay acknowledge that certain professional information, including provider name, specialty, institution, geographic area, professional credentials, and business contact information, may be displayed, shared, or made available to authorized users, healthcare organizations, clinical trial sponsors, research partners, healthcare providers, and other authorized participants for purposes related to clinical trial identification, provider collaboration, referral activities, network operations, and healthcare engagement services.

Healthcare professionals may request access to or correction of professional information maintained about them by contacting [email protected]. Massive Bio may verify proposed corrections against authoritative sources and may retain historical, compliance, audit, fraud-prevention, or legal records where permitted or required.

Where applicable law provides a right to object to processing or request deletion, restriction, or suppression of professional information, Massive Bio will evaluate the request under the applicable law and circumstances. Corrections submitted to Massive Bio will not automatically change provider information maintained independently by governmental registries, public databases, licensed directories, professional organizations, or other third-party sources.

III. When Do We Share Information?

1. Service Providers and Contractors

We may disclose personal information to service providers and contractors that support cloud hosting, data storage, cybersecurity, fraud prevention, communications, patient navigation, customer support, analytics, professional verification, software development, payment processing, accounting, auditing, insurance, legal services, and other operational functions.

We require service providers and contractors to process personal information only for authorized purposes, maintain appropriate confidentiality and security measures, and comply with applicable contractual and legal requirements. Where required, we enter into Business Associate Agreements, data-processing agreements, Standard Contractual Clauses, or other legally appropriate arrangements.

2. Sharing with your treating physician (only if you request it)

At your direction, we may send your Clinical-Trial Matching Report and related materials to your treating physician via secure transmission (e.g., portal, encrypted email, fax). You may revoke this permission at any time; revocation will stop new sharing but will not affect prior lawful disclosures.

3. Legal Requirements

We may use, preserve, or disclose personal information when we reasonably believe the action is necessary to comply with applicable law, regulation, subpoena, court order, warrant, legal process, regulatory request, audit requirement, or other lawful governmental request. We may also use or disclose personal information where legally permitted to investigate or prevent fraud, misuse, security incidents, or unlawful activity; enforce our agreements; protect the rights, safety, and property of Massive Bio or others; or establish, exercise, or defend legal claims.

Where legally permitted, we will limit a disclosure to information reasonably necessary for the applicable purpose.

We take precautions to safeguard your personal information against loss, theft and misuse and unauthorized access, disclosure, alteration, and destruction through the use of appropriate technical and organizational measures including encryption technologies for data in transit and data at rest. Your personal information may be stored and processed in your region or another country where the Company and their service providers maintain servers and facilities. We take steps, including through contracts (such as the EU Commission approved Standard Contractual Clauses), to ensure that the information continues to be protected wherever it is located, in a manner consistent with the standards of protection required under applicable law.

4. Transfers of Business Assets

Personal information may be reviewed, disclosed, or transferred as part of a proposed or completed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction. Any recipient will be required to process personal information in accordance with applicable law and any continuing obligations associated with the information. We will provide notice where required by applicable law.

5. Protection of Company and Others

We reserve the right to access, read, preserve, and disclose any information that we reasonably believe is necessary to comply with law or court order; enforce or apply our conditions of use and other agreements; or protect the rights, property, or safety of our Company, employees, users, or others. This includes exchanging information with other companies and organizations for fraud protection and data breach risk reduction.

6. De-Identified, Aggregated, and Anonymized Information

We may create, use, retain, and disclose properly de-identified, aggregated, or anonymized information for analytics, research, RWD and real-world evidence activities, clinical-trial feasibility, healthcare operations, quality assurance, security, product development, service improvement, reporting, and other legally permitted purposes. Where required by law, we apply technical, organizational, and contractual measures designed to prevent re-identification and do not attempt to re-identify such information except where legally permitted for security, quality validation, or verification of the de-identification process.

7. With Consent

We may disclose personal information with your consent, authorization, or direction. Where applicable law requires separate consent or authorization, we will explain the relevant purpose, categories of information, and intended recipient or recipient category before obtaining that consent or authorization. You may withdraw consent or authorization prospectively, subject to applicable law and any limitations explained when the consent or authorization is obtained.

8. Additional Uses and Disclosures of De-Identified or Aggregated Information

Massive Bio may use or disclose properly de-identified, aggregated, or anonymized information for authorized research, analytical, scientific, healthcare, operational, product-development, quality-improvement, RWD, real-world evidence, AI enhancement and commercial purposes, subject to applicable law, contractual restrictions, and required de-identification controls.

Such information may be made available to authorized patient-support organizations, clinical laboratories, diagnostic and screening organizations, healthcare organizations, healthcare professionals, research institutions, pharmaceutical and biotechnology companies, and other authorized partners for legally permitted and disclosed purposes.

Massive Bio does not sell identifiable patient health information. In sponsor-supported programs, sponsors may receive de-identified or aggregated program information, such as referral, prescreening, engagement, operational, or enrollment metrics relevant to the applicable program.

Massive Bio does not provide identifiable patient information to a sponsor for the sponsor’s independent advertising or marketing purposes. Any other disclosure of identifiable patient information to a sponsor or research partner will occur only where legally permitted, appropriately disclosed, limited to the applicable purpose, and supported by any required consent, authorization, agreement, or other legal basis.

IV. Children’s and Minors’ Information

The Solutions are not intended to permit a minor to independently create an account, provide consent, or authorize the processing of health information unless applicable law permits the minor to do so.

Massive Bio may process information concerning a minor when the Services are requested, provided, or authorized by a parent, legal guardian, healthcare professional, healthcare organization, person legally authorized to act for the minor, or the minor where applicable law permits the minor to provide valid consent or authorization.

Before processing identifiable health information concerning a minor, Massive Bio will establish the consent, authorization, contractual arrangement, or other legal basis required for the applicable jurisdiction and Service.

Rights relating to a minor’s information may be exercised by the minor, parent, guardian, or other authorized representative depending on the minor’s age, capacity, jurisdiction, type of information, and applicable law.

If you believe that a minor’s information was provided to Massive Bio without appropriate authority, please contact [email protected].

V. How We Protect and Retain Your Information

Massive Bio maintains administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and misuse.

Depending on the applicable system, information, and risk, these safeguards may include encryption in transit and at rest, role-based access controls, least-privilege access, multi-factor authentication, logging and monitoring, secure development and change-management practices, security testing, vendor risk management, backup and recovery controls, incident-response procedures, workforce privacy and security training, confidentiality obligations, data minimization, and pseudonymization where appropriate.

Access to personal information is limited to personnel and authorized service providers that require access for legitimate and authorized purposes. Such persons are subject to applicable confidentiality, privacy, security, and contractual obligations.

No information system or transmission method is completely secure. Massive Bio therefore cannot guarantee absolute security, but we maintain safeguards designed to address the nature and sensitivity of the information processed.

Massive Bio retains personal information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, maintain required consent and authorization records, meet legal and contractual obligations, support applicable healthcare and clinical-research recordkeeping requirements, resolve disputes, maintain security, prevent fraud, respond to audits, and establish, exercise, or defend legal claims.

Retention periods may vary depending on:

• The category, source, and sensitivity of the information;
• The applicable Solution, Service, program, or contractual engagement;
• The individual’s relationship with Massive Bio;
• Sponsor, healthcare-organization, research, customer, or contractual requirements;
• Applicable healthcare, clinical-research, privacy, tax, accounting, and recordkeeping laws;
• Whether the information documents consent, authorization, disclosure, professional verification, or compliance activity; and
• Whether the information is subject to a legal hold, investigation, audit, dispute, or security requirement.

At the end of the applicable retention period, personal information will be deleted, destroyed, or de-identified in accordance with Massive Bio’s retention and disposal procedures, unless continued retention is permitted or required by law.

Properly de-identified, aggregated, or anonymized information may be retained for a longer period where permitted by law, provided that applicable de-identification and security controls are maintained.

We maintain information-security policies and procedures designed to protect personal information from unauthorized access, use, disclosure, alteration, loss, or destruction. Depending on the applicable system and risk, controls may include transport-layer security, encryption at rest and in transit, identity and access management, role-based and least-privilege access, password and authentication controls, multi-factor authentication, firewalls, network security, virtual private networks, token and session management, logging and monitoring, vulnerability management, pseudonymization, backup and recovery controls, incident response, and periodic security reviews.

Geographic Scope and Additional Jurisdictions

Massive Bio processes personal information in connection with Solutions and Services offered in the United States, Canada, the European Union, the United Kingdom, Switzerland, Australia, New Zealand, India, Israel, Türkiye, Brazil, Colombia, Argentina, Chile, Peru, Japan, South Korea, and other jurisdictions where Massive Bio lawfully offers its Solutions and Services. Additional country-specific notices, disclosures, rights, consents, or contractual requirements may apply where required by applicable law.

Massive Bio may collect, process, store, transfer, or otherwise handle personal information in additional countries and territories where the Solutions and Services are offered, supported, or made available. References in this Privacy Policy to specific countries, regions, privacy frameworks, regulators, or legal requirements are provided for transparency and do not limit the jurisdictions in which Massive Bio may operate. Where required by applicable law, Massive Bio will provide additional country-specific notices, disclosures, rights, consents, contractual provisions, or other safeguards.

Cross-border safeguards. Personal information may be processed in the United States and other countries in which Massive Bio or its authorized service providers operate. Where personal information is transferred across borders, we use transfer mechanisms and safeguards required by applicable law, which may include adequacy decisions, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, contractual privacy and security protections, or another legally recognized mechanism. Statements concerning SOC 2, HIPAA-aligned, or GDPR-aligned controls describe the scope of the applicable controls and do not constitute a guarantee that every law or certification applies to every Service or processing activity.

VI. How to Control and Correct Your Information

The Solutions may use cookies and similar technologies as described in this Privacy Policy and our Cookie Notice. Where required by law, you may accept, reject, or customize non-essential cookies through our cookie-consent tool and may later modify or withdraw your choices. Blocking certain technologies may affect the availability or operation of some features. Necessary technologies may continue to operate where they are required for security, fraud prevention, authentication, user-requested functionality, or other essential purposes.

1. Correcting Your Personal Information

To request access to, correction of, or deletion of personal information that Massive Bio maintains about you, contact [email protected] or call +1 (844) 627-7246. We may require information reasonably necessary to verify your identity, locate responsive records, protect against fraudulent or unauthorized requests, and verify the authority of any representative acting on your behalf.

Privacy rights are subject to applicable conditions and exceptions. Massive Bio may retain or continue processing information where permitted or required for legal compliance, healthcare or research obligations, security, fraud prevention, contractual responsibilities, recordkeeping, legal claims, or other lawful purposes.

2. Mobile App Account and Data Deletion

If a Massive Bio mobile application allows you to create an account, the application will provide an accessible path to initiate account deletion. The application may link directly to a Massive Bio account-deletion webpage, and a web-based option will be maintained so a person can submit a request after uninstalling or losing access to the application. Submission through the in-app or web pathway initiates a manual privacy and compliance review; it does not necessarily result in immediate automated deletion, particularly where the account or associated records concern healthcare, clinical research, referrals, payments, security, or information relating to another individual.

To protect health information, professional records, payment and tax records, and information relating to other individuals, Massive Bio may require reauthentication, identity verification, confirmation of the request, clarification of the account and data within scope, or an additional customer-service or compliance step. These steps will be limited to what is reasonably necessary to verify the requester, prevent unauthorized or fraudulent action, identify lawful retention requirements, and complete the request safely.

After receiving a complete and verified deletion request, Massive Bio will acknowledge the request and generally complete account deletion within 30 days, unless a longer period is permitted or required by applicable law or is reasonably necessary because of healthcare, clinical-research, security, fraud-prevention, contractual, litigation-hold, or regulatory obligations. If additional time is required, we will inform you of the reason and the expected completion period. We will provide confirmation when the account-deletion process is complete.

Account deletion removes or de-identifies the account and associated personal information that Massive Bio is not legally or contractually required to retain. Certain information may be retained where necessary to comply with healthcare, clinical-research, tax, accounting, audit, security, fraud-prevention, recordkeeping, contractual, or legal obligations. We may also retain a limited record of the request and the actions taken to demonstrate compliance. Information already lawfully disclosed to an independent third party may remain subject to that party’s retention obligations and privacy practices.

Deleting a mobile application from a device does not delete the user’s account or information. If an account is used across more than one Massive Bio Solution, the deletion flow or follow-up communication will explain whether the request applies to a specific application account, the related Solution account, or the individual’s broader Massive Bio account. For healthcare-professional accounts, the additional provisions under “Physician Account Closure, Deletion Requests, and Referred Patients” apply.

3. Changing physician-sharing preference

You may change your preference about whether Massive Bio sends your report to your treating physician at any time by contacting [email protected]. We will record your updated choice and stop any future sharing you decline.

4. Control: Your Choices

Depending on the applicable Solution and your relationship with Massive Bio, you may be able to choose whether to upload or retain records, view or download reports, authorize disclosures to caregivers or healthcare professionals, manage communication preferences, withdraw consent where applicable, and request deletion of an account or personal information. Some choices may be limited by applicable law, contractual requirements, healthcare or research recordkeeping obligations, security requirements, or the functionality necessary to provide a requested Service.

• To store or discard the records you provide to us, and the reports returned to you based on the results of your documents.
• Clinical Trials Matching report(s) you view or opt-in to view.
• When and with whom do you share your information, including your caregivers, family members, approved family members, health care professionals, or others outside our Services.
• To delete your Massive Bio Clinical Trial Matching account and data from the Solutions at any time.

Depending on your location and applicable law, you may have the right to:

• Confirm whether Massive Bio processes your personal information;
• Access personal information Massive Bio maintains about you;
• Correct inaccurate or incomplete personal information;
• Request deletion of personal information;
• Request restriction of processing;
• Object to certain processing;
• Withdraw consent where processing is based on consent;
• Request a portable copy of certain personal information;
• Opt out of certain sales, sharing, targeted advertising, or profiling;
• Request information concerning recipients or categories of recipients;
• Exercise rights concerning certain decisions based solely on automated processing;
• Appeal the denial of a privacy request where applicable law provides an appeal right; and
• Submit a complaint to an applicable privacy or data-protection authority.

These rights are not absolute and may be subject to legal conditions, limitations, and exceptions. To submit a request, contact [email protected] or call +1 (844) 627-7246.

5. Accountability for Onward Transfers

With respect to personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Massive Bio remains responsible under the applicable DPF Principles if it transfers such data to a third-party agent that processes the data in a manner inconsistent with the applicable DPF Principles, unless Massive Bio can show that it was not responsible for the event giving rise to the damage.

6. Data Privacy Framework Participation, Complaints, and Enforcement

Massive Bio, Inc. participates in and complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Massive Bio, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with respect to personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom and Gibraltar in reliance on the UK Extension to the EU-U.S. DPF, and that it adheres to the Swiss-U.S. DPF Principles with respect to personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between this Privacy Policy and the applicable DPF Principles, the applicable DPF Principles will govern.

To learn more about the Data Privacy Framework program and to view Massive Bio, Inc.’s certification, visit https://www.dataprivacyframework.gov/.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Massive Bio, Inc. commits to resolve DPF Principles-related complaints concerning our collection and use of personal information received in reliance on the applicable framework. Individuals in the European Union, United Kingdom, Gibraltar, or Switzerland with inquiries or complaints should first contact Massive Bio, Inc. at [email protected] or through the contact methods stated in the “Contact Us” section of this Privacy Policy. Massive Bio, Inc. will investigate and attempt to resolve qualifying complaints in accordance with the applicable DPF Principles.

Massive Bio, Inc. has selected the panel established by the EU data protection authorities (“EU DPAs”) as its independent recourse mechanism for unresolved complaints concerning personal data received from the European Union in reliance on the EU-U.S. DPF. For unresolved complaints concerning personal data received from the United Kingdom or Gibraltar in reliance on the UK Extension to the EU-U.S. DPF, Massive Bio, Inc. commits to cooperate and comply with the advice of the UK Information Commissioner’s Office (“ICO”). For unresolved complaints concerning personal data received from Switzerland in reliance on the Swiss-U.S. DPF, Massive Bio, Inc. commits to cooperate and comply with the advice of the Swiss Federal Data Protection and Information Commissioner (“FDPIC”). These independent recourse mechanisms are available at no cost to the individual.

Massive Bio, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to its participation in the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Under certain conditions described in Annex I of the DPF Principles, an individual may invoke binding arbitration to address certain residual claims concerning Massive Bio, Inc.’s compliance with the applicable DPF Principles after other available recourse mechanisms have been exhausted. Massive Bio, Inc. is obligated to arbitrate claims and follow the terms set forth in Annex I when an individual properly invokes binding arbitration in accordance with the applicable procedures and conditions.

With respect to personal information received or transferred in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, Massive Bio, Inc. remains responsible under the applicable DPF Principles if it transfers personal information to a third-party agent that processes the information in a manner inconsistent with the applicable DPF Principles, unless Massive Bio, Inc. proves that it was not responsible for the event giving rise to the damage.

Individuals may request access to personal information maintained by Massive Bio, Inc. and may request correction, amendment, or deletion of information that is inaccurate or processed in violation of the applicable DPF Principles. These rights are subject to the limitations and exceptions permitted by the applicable DPF Principles and law. Requests may be submitted to [email protected].

Massive Bio, Inc. will maintain its DPF-related representations, contact information, complaint-handling arrangements, and annual re-certification obligations in accordance with the requirements of the U.S. Department of Commerce. If Massive Bio, Inc. withdraws from or is removed from an applicable part of the DPF program, it will handle personal information previously received in reliance on that framework in accordance with the applicable DPF requirements and will cease making representations that are no longer accurate.

7. Learn More about Cookies, Web Beacons, and Other Technologies

For additional information about the cookies and similar technologies used through the Solutions, including their providers, purposes, categories, and retention periods, please review our Cookie Notice. You may also manage certain technologies through your browser settings and our cookie-consent tool. Browser controls and available choices vary by browser and device.

8. Limitation of Liability

To the maximum extent permitted by applicable law, disputes relating to the Solutions or your use of the Solutions, including disputes concerning privacy, are also subject to Massive Bio’s applicable Terms and Conditions, including provisions concerning dispute resolution, indemnification, warranties, and limitations of liability. Nothing in this Privacy Policy limits any privacy, data-protection, consumer-protection, or other right that cannot lawfully be limited or waived. If this Privacy Policy conflicts with a mandatory requirement of applicable privacy or data-protection law, the mandatory legal requirement will control to the extent of the conflict.

9. Unavailability of Solution or Services

Massive Bio may modify, suspend, restrict, or discontinue a Solution or Service, in whole or in part, where permitted by applicable law and the applicable Terms and Conditions. A Solution or Service may also be temporarily unavailable because of maintenance, security events, system failures, third-party service interruptions, legal requirements, or circumstances beyond Massive Bio’s reasonable control. Any resulting processing of personal information will remain subject to this Privacy Policy and applicable law.

VII. Agreement: Changes to This Privacy Policy

Massive Bio may update this Privacy Policy to reflect changes in our Solutions, Services, data practices, technologies, contractual requirements, or applicable laws.

We will post the revised Privacy Policy and update the “Last Updated” or “Current Version Effective” date. Where required by law, we will provide additional notice of material changes through the Solutions, by email, through an account notification, or by another appropriate method.

If a material change requires consent or authorization, we will obtain the required consent or authorization before applying the change to the relevant processing.

VIII. Local Provisions

1. Local provisions: California

If you are a California resident, the following applies in addition to the remainder of this Privacy Policy.

California privacy rights (CCPA/CPRA). Subject to applicable conditions and exceptions, California residents may have the right to:

• Know and access the personal information Massive Bio collects about you, including the categories of personal information, sources, purposes, and categories of third parties to whom information is disclosed;
• Request deletion of personal information;
• Request correction of inaccurate personal information;
• Receive certain personal information in a portable format;
• Opt out of the sale or sharing of personal information;
• Limit the use and disclosure of sensitive personal information;
• Appeal a denial of a privacy request where applicable law provides an appeal right; and
• Exercise these rights without discriminatory treatment.

Sale and sharing. Massive Bio does not sell identifiable patient medical information for monetary consideration. Where Massive Bio’s use of cookies, analytics, advertising technologies, or similar tools constitutes “selling” or “sharing” under California law, California residents may opt out by using the “Your Privacy Choices” mechanism on our website or by enabling a legally recognized opt-out preference signal, including the Global Privacy Control (GPC). We honor GPC signals where required.

Sensitive personal information. We process sensitive personal information (including health information) only for the purposes described in this Privacy Policy and as permitted by law. You may request that we limit the use and disclosure of sensitive personal information to what is necessary to provide the services you request.

How to submit a request. California residents may submit privacy requests by emailing [email protected] or calling +1 (844) 627-7246. We will verify your identity before fulfilling a request. Authorized agents may submit requests on your behalf when we can verify their authority. California residents with an established business relationship may also request information concerning certain disclosures for third parties’ direct-marketing purposes under California Civil Code Section 1798.83.

California Online Personal Privacy Act / preference signals. Massive Bio and authorized service providers may use cookies and similar technologies as explained in this Privacy Policy and our Cookie Notice. Depending on the technologies deployed, certain analytics or advertising activities may constitute “selling,” “sharing,” or targeted advertising under California law even when no money is exchanged. Where required, we provide mechanisms to opt out and we recognize legally required browser-based preference signals. Social-media platforms and other independently operated third parties may process information under their own privacy notices and settings.

2. Local provisions: European Union

If you are based in the European Union, the following applies in addition to the remainder of this Privacy Policy:

• GDPR means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• References to “personal information” in this Privacy Policy include “personal data” as defined by the GDPR and UK GDPR where those laws apply.
• If we share your personal data with our group companies or third parties located outside the European Economic Area, we take steps to ensure that appropriate safeguards are in place to guarantee the continued protection of your personal data, particularly by signing the Standard Contractual Clauses adopted by the European Commission (article 46(2)(c) GDPR).

Below, we set out your data protection rights under the GDPR in more detail and give information on how you can exercise them. Most of these rights are not absolute and are subject to exemptions in the law. We will respond to your exercise of right request within one month but have the right to extend this period in certain circumstances. If we extend the response period, we will let you know within one month from your request. If your request is clearly unfounded or excessive, we reserve the right to charge a reasonable fee or refuse to comply with it in such circumstances.

• Access your personal data. You are entitled to ask us if we are processing your personal data and, if we are, you can request access to your personal data. This enables you to receive a copy of the personal data we hold about you.
• Request the transfer of your personal data. We will provide to you or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Please note, this right applies to the personal data you have provided to us and only if we use your personal data on the basis of consent or where we used your personal data to perform a contract with you.
• Request erasure (deletion) of your personal data. You are entitled to ask us to delete or remove personal data in certain circumstances. There are certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with legal claims. When we need to rely on an exemption, we will inform you about this.
• Request correction or updating of your personal data. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Request the restriction of our processing of your personal data in some situations. If you request this, we can continue to store your personal data but are restricted from processing it while the restriction is in place.
• Object to our processing of your personal data where we are relying on legitimate interest. You also have a right to object where we are processing your personal data for the purposes of direct marketing or profiling. You can object at any time and we shall stop processing the information you have objected to, unless we can show compelling legitimate grounds to continue that processing.
• Withdraw your consent. Where you have provided your consent to our processing of your personal data you can withdraw your consent at any time. If you do withdraw consent, it will not affect the lawfulness of what we have done with your personal data before you withdrew consent.
• Lodge a complaint at a supervisory authority. We will do our best to resolve any complaint. However, if you feel we have not resolved your complaint, you have a right to lodge a complaint with a supervisory authority in the country where you live, where you work or where an alleged infringement of the applicable data protection law took place.
• EU representative. For contact details of Massive Bio’s EU representative under GDPR Article 27, please refer to our GDPR Notice linked in the site footer.
• No sponsor access to identifiable data. For sponsor-funded projects, sponsors do not receive identifiable patient data; only de-identified, aggregate study metrics are shared.

3. Local provisions: Canada

If you are based in Canada, the following applies in addition to the remainder of this Privacy Policy:

PIPEDA means the Personal Information Protection and Electronic Documents Act. Personal information processed in Canada may be governed by PIPEDA, applicable provincial private-sector privacy laws, provincial health-information laws, or a combination of those laws, depending on the province, type of information, identity and role of the organization, and context of the processing.

Personal information processed in Canada may be governed by PIPEDA, applicable provincial private-sector privacy laws, provincial health-information laws, or a combination of these laws. The applicable requirements depend on the province, nature of the information, identity and role of the organization, contractual relationship, and context in which the information is processed. Massive Bio processes personal information in accordance with the Canadian federal or provincial privacy requirements that apply to the relevant activity.

The following terms apply in respect of any personal information we may collect, use, or disclose that is not considered personal health information: If we share your personal information with our group companies or third parties located outside of Canada, we take steps to ensure that appropriate safeguards are in place to guarantee the continued protection of your personal information, particularly by signing agreements that include privacy clauses and protections. You can find more information about these safeguards by contacting us at the address provided below. Below, we set out your privacy rights under PIPEDA in more detail and give information on how you can exercise them. Most of these rights are not absolute and are subject to exemptions in the law.

We will respond to your requests within a reasonable time frame. If your request is complex, we may extend this period but will inform you accordingly. Access your personal information. You are entitled to ask us if we are processing your personal information and, if we are, you can request access to your personal information. This enables you to receive a copy of the personal information we hold about you. Request the transfer of your personal information. We will provide to you or a third party you have chosen, your personal information in a commonly used, machine-readable format. Please note, this right applies to the personal information you have provided to us and only if we use your personal information on the basis of consent or where we used your personal information to perform a contract with you. Request erasure (deletion) of your personal information. You are entitled to ask us to delete or remove personal information in certain circumstances.

There are certain exceptions where we may refuse a request for erasure, for example, where the personal information is required for compliance with law or in connection with legal claims. When we need to rely on an exemption, we will inform you about this. Request correction or updating of your personal information. This enables you to have any incomplete or inaccurate data we hold about you corrected. Request the restriction of our processing of your personal information in some situations. If you request this, we can continue to store your personal information but are restricted from processing it while the restriction is in place. Object to our processing of your personal information where we are relying on legitimate interests. You also have a right to object where we are processing your personal information for the purposes of direct marketing or profiling. You can object at any time and we shall stop processing the information you have objected to, unless we can demonstrate compelling legitimate grounds to continue that processing. Withdraw your consent.

Where you have provided your consent to our processing of your personal information, you can withdraw your consent at any time. If you do withdraw consent, it will not affect the lawfulness of what we have done with your personal information before you withdrew consent. Lodge a complaint with the Office of the Privacy Commissioner of Canada. We will do our best to resolve any complaint. However, if you feel we have not resolved your complaint, you have a right to lodge a complaint with the Office of the Privacy Commissioner of Canada. Contact details are available on their website.

• Data residency and international processing. Where Canadian law, contract, customer requirements, or program-specific commitments require Canadian data residency, Massive Bio will store the applicable information in accordance with those requirements. In other cases, personal information may be processed outside Canada, including in the United States, subject to applicable transparency requirements and appropriate contractual, privacy, and security safeguards.
• If you exercise the rights above and there is any question about who you are, we may require you to provide information from which we can satisfy ourselves as to your identity.
• You can exercise the rights above by contacting [email protected].

Contact information of the Data Protection Officer / Chief Privacy Officer

For privacy questions, requests, or complaints, please contact:

Massive Bio, Inc.
Privacy and Data Protection Office
One Park Place
621 NW 53rd Street, Suite 125
Boca Raton, Florida 33487
United States

Email: [email protected]
Telephone: +1 (844) 627-7246
Fax: +1 (844) 742-8837

Chief Privacy Officer / Data Protection Officer: Cagatay M. Culcuoglu