Privacy Policy (United States)

Evrima Technologies Pty Limited ABN 78 631 919 698 ("we", "us" or "our") understands that protecting your personal information is important. We are the owner, operator and licensor of the Website (Website). This Privacy Policy sets out our commitment to protecting the privacy of personal information provided to us, or otherwise collected by us when providing our Website and patient recruitment services (Services) to you or when otherwise interacting with you.

This Privacy Policy takes into account the requirements of the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles, the New Zealand Privacy Act 2020 and the New Zealand Health Information Privacy Code 2020.

The information we collect

The general categories of personal information we collect from Candidates, Clients and Website visitors — and how, and why — mirror our global Privacy Policy: identifiers and contact details, sensitive/health information you provide when interacting with our Services, and browsing and device data collected through the Website. Unless otherwise permitted by law, we will not collect sensitive information about you without first obtaining your consent. See "Our disclosures of personal information to third parties" and "Overseas disclosure" below for how that information is shared and transferred.

Additional Information for United States Residents

If you are a resident of the United States, or if your personal information is collected or processed in the United States, this section provides additional disclosures and rights for personal information that Evrima collects or processes in connection with the Website, Services and clinical trial recruitment activities. It supplements, and should be read together with, the other sections of this Privacy Policy. Depending on factors such as your state of residence, the volume of information we process in a particular state, or other jurisdictional thresholds, one or more U.S. state privacy laws may apply to our processing of your personal information. Where there is a conflict between this section and another section of this Privacy Policy, this section applies to the extent required by applicable U.S. law.

HIPAA and provider information

In some cases, Evrima processes protected health information on behalf of a HIPAA-covered health care provider, research site, academic medical center, sponsor or other customer, acting as a business associate (or subcontractor of one). That information is governed by HIPAA, the customer's Notice of Privacy Practices and our contractual obligations, rather than this U.S. section, except as required by law. Information you provide directly to Evrima — for example by visiting our Website, completing a screening form, or communicating with us about clinical trial opportunities — is not covered by HIPAA. Instead, it is governed by this Privacy Policy and applicable state consumer privacy, sensitive data and consumer health data laws.

Categories of personal information we collect

Depending on how you interact with us, we may collect: identifiers and contact information (name, date of birth, email, address, phone, account credentials, IP address, device identifiers, driver's license, Medicare card or other ID); commercial, professional and transaction information (services requested, support requests, client organisation and study parameters, billing and payment information); internet or other electronic network activity (browser and device data, pages viewed, search queries, links clicked, session times, referring sources, cookies, pixels); general or precise geolocation, where enabled and permitted; health-related and other sensitive information (below); and inferences and derived data (preferences, interests, potential trial eligibility, matching results, aggregated information). Not every category applies to every person.

Sensitive personal information and sensitive data

Depending on the service and information you provide, we may collect or generate: health information (medical history, conditions, diagnoses, symptoms, treatments, medications, allergies, test and survey results, physical, physiological or mental health information); biometric information or identifiers, including from documents or images uploaded for identification or another legally covered purpose; genetic information; precise geolocation; information about a known child, where knowingly provided for the Services; and inferences revealing health, characteristics, preferences or potential trial eligibility.

We process sensitive personal information and sensitive data only for disclosed purposes and as permitted by law. Where applicable law requires opt-in consent or other authorization — including for sensitive data or information about a known child — we obtain affirmative consent or authorization before processing, including verifiable parental or guardian consent where required, and provide a way to withdraw consent for future processing.

Purposes of collection and use

We may collect, use and disclose personal information to: provide, operate, administer and improve the Website and Services; create and manage accounts, verify identity and communicate with you; support clinical trial recruitment, pre-screening, eligibility assessment, matching, referral, enrollment communications and patient support; provide services to Clients and clinical research partners; create derived, de-identified or aggregated information for search, matching, service monitoring, quality improvement, security and responsible algorithmic or AI improvements, where permitted by law and consistent with applicable consent choices; protect security, prevent fraud, debug and maintain system integrity; conduct analytics, measurement, research, administration, billing and business operations; comply with legal, regulatory, research, audit, record-retention, good clinical practice and safety obligations and enforce our rights; and advertise or market our Services, with consent or an opt-out opportunity where required by applicable law.

Disclosure and sharing

We may disclose personal information to Clients and clinical research parties (sponsors, sites, academic medical centers, health care providers, CROs, investigators, study teams); our employees, related entities, contractors and service providers (hosting, storage, IT, security, identity verification, communications, analytics, customer support, service administration); professional advisers, auditors, insurers and consultants; regulators, courts, law enforcement and government authorities where required or permitted by law; parties involved in a merger, financing, acquisition, reorganization or transfer of our business or assets; and other parties at your direction or with your consent.

When we match you to a trial, we limit information provided to Clients and research parties to what is reasonably necessary for that purpose. We do not sell personal information. However, we may disclose online identifiers, device information, internet activity, conversion information or similar data to analytics and advertising platforms for measurement, attribution, campaign optimization or cross-context behavioral advertising. Under some state laws these disclosures may be considered "sharing" or targeted advertising even though they are not a sale; the opt-out rights and preference signals below apply.

Consumer health data (Washington and Nevada)

If you are a Washington or Nevada resident, or your consumer health data is collected or processed there, see our separate Consumer Health Data Privacy Policy for additional disclosures and rights, including under the Washington My Health My Data Act and Nevada consumer health data law. Evrima does not sell consumer health data, and does not knowingly use geofencing around facilities that provide in-person health care services to identify or track individuals, collect consumer health data, or send health-related messages or advertisements. Where consent is required, we obtain it before the relevant processing, and you may withdraw it for future processing as described in that policy.

Trial matching and automated decision-making

We may use matching tools, algorithms, machine learning or other technologies to compare information you provide with clinical trial eligibility criteria and identify potentially relevant studies, referrals or communications. Matching results are preliminary and do not by themselves determine final eligibility, enrollment, medical suitability or access to health care. Where required by law, we will not make a decision based solely on automated processing that produces legal or similarly significant effects about you without human review, and we maintain human oversight and provide any required explanation, correction or review process. Where applicable law provides a right to opt out of profiling used in such decisions, you may exercise it using the methods below; opting out may limit our ability to identify or communicate potentially relevant trials.

Privacy preference signals and U.S. advertising choices

Where required by applicable U.S. state privacy law, we honor legally recognized opt-out preference signals, such as Global Privacy Control (GPC), as a valid opt-out from sale, sharing or targeted advertising for the browser or device sending the signal. We provide the choices, or obtain the consent, required before using cookies, pixels, analytics tools, advertising technologies, conversion APIs or similar tools for targeted advertising, cross-context behavioral advertising, sale or sharing, or processing sensitive personal information, sensitive data or consumer health data. Where such recognition is not legally required, our Website may not respond to Do Not Track (DNT) or similar browser signals. We do not knowingly use health-related interactions or inferences to build or enrich individual advertising profiles except as permitted by law and consistent with your choices.

U.S. state privacy rights

Subject to applicable law, verification requirements, legal exceptions and our processing role, residents of states with comprehensive privacy laws may have rights to: know the categories, purposes, sources and third-party recipients of personal information we process; confirm and access it; correct inaccuracies; delete it; receive it in a portable format and, where feasible, have it transmitted elsewhere; opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling; limit or opt out of processing sensitive personal information or sensitive data; withdraw consent where processing is consent-based; for consumer health data, request confirmation, access, deletion, consent withdrawal and a list of third parties it was shared with or sold to; and appeal a denied request. These rights may not apply in every state or to every type of information, and may be subject to statutory exceptions.

How to exercise your rights

Contact us at enquiries@evrima.com.au, or use any consumer rights request webform we make available, identifying the right you wish to exercise and your state of residence. We may verify your identity and authority, including requiring proof of authority for an authorized agent, and may require parental or guardian authorization for a request made on behalf of a child. We will respond as required by applicable law. Where a right to appeal applies, you may appeal a denied request through the same method, stating that you are appealing the decision; if unsuccessful, you may contact your state Attorney General or other applicable regulator.

Non-discrimination

We will not discriminate against you for exercising any privacy rights, though we may be unable to provide certain Services if they require information you choose not to provide, or processing you've opted out of — only as permitted by law and without retaliatory treatment.

Data retention

We retain personal information for as long as reasonably necessary to provide the Website and Services, support clinical trial recruitment, satisfy legal, contractual, research, audit, record-retention, good clinical practice and regulatory obligations, maintain security, resolve disputes and enforce our rights, and delete, de-identify or anonymize it when no longer needed, subject to applicable retention requirements.

Your rights and controlling your personal information

• Your choice: you do not have to provide personal information to us, but doing so may affect our ability to provide the Services.
• Information from third parties: if you provide personal information about somebody else, you represent that you have their consent to do so.
• Anonymity: where practicable, you may deal with us without identifying yourself or using a pseudonym.
• Restrict and unsubscribe: contact us using the details below, or use the opt-out facilities in our communications.
• Access: you may request access to the personal information we hold about you (an administrative fee may apply).
• Correction: contact us if you believe information we hold is inaccurate, out of date, incomplete, irrelevant or misleading.
• Complaints: contact us with full details; if unsatisfied with our response, you may contact the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Storage and security

We maintain physical, electronic and managerial safeguards to protect personal information, restricting access to those who need it. We commit to the record and reports retention requirements in the ICH Guideline for Good Clinical Practice, incorporated by reference in Australian and New Zealand regulation, and — in the United States — reflected in applicable FDA regulations governing clinical investigations, including 21 CFR Parts 50, 56 and 312, and FDA good clinical practice guidance.

We cannot guarantee the security of information transmitted over the Internet, and will respond to any security incident in accordance with applicable data protection laws.

Cookies

We may use cookies to store your preferences and recognise you on return visits, including for retargeting via third parties such as Google and Facebook. You can manage cookies through your browser settings and, where available, our cookie consent preferences tool. See "Privacy preference signals and U.S. advertising choices" above for opt-out preference signals.

Links to other websites

Our Website may link to other parties' websites. We have no control over, and are not responsible for, the privacy practices of those websites.

Artificial Intelligence (AI) Technologies

We use AI and machine learning technologies, including third-party AI tools, only when legally permitted and necessary for our business — including to match patients with clinical trials, conduct analysis and data processing, generate and modify content and code, and improve and personalise our Services. Information generated or inferred by AI about you is treated as personal information, carrying all the rights in this policy, and we commit to transparency and human oversight of significant AI-generated decisions, staff training on AI limitations, output verification, appropriate security measures, and ongoing risk assessment — consistent with the commitments in our global Privacy Policy.

Amendments

We may vary this Privacy Policy at any time by publishing the amended version on our Website. We recommend checking our Website regularly. Continued use of our Services indicates acceptance of any amendments.

Contact us

Australia — Evrima Technologies Pty Limited ABN 78 631 919 698. Email: enquiries@evrima.com.au

Last update: November 2025