OWL You Need is Privacy

We are OWL Oncology Research, LLC, registered in Oregon, United States.

In this document OWL Oncology Research may be referred to as “we”, “us”, or “our”.

OWL Oncology Research collects personal data for various purposes; with that in mind, we have created a list of the types of personal data that we may collect, either directly from yourself or from other sources to achieve those purposes.

The kinds of personal data we may collect include:

Customer / Client Name, address, telephone, email address, job title

Applicant / Temp / Volunteer / Intern Contact details, CV, Business Information

Candidate CV

Investigators Names, email address, telephone numbers, working site address, CV, medical license

Consultant Physicians, fee for service physicians and other outside professionals Names, email address, telephone numbers, working site address, CVs and medical licenses

Supplier / Trader Contact details, Company Bank details

Sub-Contractor Contact details, CVs, Company Bank details, background check authorization details

Legal Obligations OWL Oncology Research uses personal data firstly to fulfill any contractual obligations that exist between us and yourself. Where we request personal data be provided to enter into, or meet the terms of any such contract, you will be required to provide the relevant personal data, or we will not be able to deliver the goods or services you want. In such cases the lawful basis of our processing the personal data is necessity for the performance of a contract.

We are required by law to process personal data for purposes relating to our legal obligations, these include: ► To provide for our financial commitments, or to relevant financial authorities. ► To comply with regulatory requirements and any self-regulatory schemes. ► To carry out required business operations and due diligence. ► To cooperate with relevant authorities for reporting criminal activity, or to detect and prevent fraud. ► To investigate any insurance claims, claims of any kind of harassment or of discrimination, or any other claim whereby the organization may have to defend itself.

Consent OWL Oncology Research may process Personal Data for the following purposes where it has received consent to do so:

► Patients sign consent forms for participation in research. ► Investigators and their staff members may sign consent forms for us to hold their data.

You may withdraw your consent for us to process your personal data for these purposes at any time; after a withdrawal of consent request is received, we may have to contact you to verify the request. Withdrawing your consent for us to process your personal data will not affect the lawfulness of the processing beforehand.

Legitimate Interests OWL Oncology Research may process Personal Data for any of the following purposes, which are within the scope of our legitimate business interests:

► To provide goods and services where it has been requested, ► To inform people of goods and services we provide or offers that may interest them, ► To send notification on subjects to individuals who have asked to be kept informed, ► To invite people to participate in research in fields and disciplines they are interested in, ► To improve the quality of the services we offer, and to better understand customers’ needs by requesting feedback, or reviews of the services provided, or sending survey forms, ► To send notifications of any changes to the goods and/or services provided that may affect people, ► To understand the scale of the customer base; for statistical analysis and market research, ► To recognize when people re-engage with our organization, ► To facilitate the completion of research initiatives, ► To allow the organization to support and maintain our products in active service, ► To provide reference information to third party organizations when necessary, ► To enhance the security measures in place that protect data we are responsible for, ► To protect the organization’s assets

Special Category Personal Data OWL Oncology Research do not process any special category data relating to data subjects where OWL Oncology Research is the data controller.

Yes, OWL Oncology Research complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK DPF Extension”) and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. OWL Oncology Research has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to the processing of Personal Data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK DPF Extension. OWL Oncology Research has also certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. DPF Principles (together with the EU-U.S. DPF Principles, the “DPF Principles”) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Notice and the DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the EU-U.S. DPF, the UK DPF Extension and the Swiss-U.S. DPF, OWL Oncology Research commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the EU-U.S. DPF, the UK DPF Extension and the Swiss-U.S. DPF should first contact OWL Oncology Research at privacy@owloncology.com.

If we are unable to resolve your inquiry or complaint to your satisfaction, you are entitled to file a formal complaint about our handling of your personal data, and to receive appropriate recourse, free of charge.

In compliance with the EU-U.S. DPF, the UK DPF Extension and the Swiss-U.S. DPF, OWL Oncology Research commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK DPF Extension and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States, the European Union, the United Kingdom, and/or Switzerland (as applicable). The Federal Trade Commission has jurisdiction over OWL Oncology Research’s compliance with the EU-U.S. DPF, the UK DPF Extension and the Swiss-U.S DPF. Under certain conditions, you may have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, OWL Oncology Research commits to cooperate and comply respectively with the advice of the panel established by the EU Data Protection Authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of Human Resources (HR) data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of employment relationships.

To report a complaint with our handling of your personal data, not including HR data collected in the course of a potential or established employment relationship, please visit JAMS.

To report a complaint with our handling of your HR data collected in the course of a potential or established employment relationship, please visit the EU Data Protection Authorities (DPAs), the UK Information Commissioner’s Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC), whichever is most relevant to your (or the data subject’s) location.

We will collect personal data directly from you in various ways. This could include when you complete an online form, or if you provide the data directly to a representative of OWL Oncology Research. We collect some personal data from publicly accessible sources such as:

► Recruitment from social media sites, websites, and recruitment platforms. We may also gather personal data by any of the following methods: ► From technical functionality that gathers data automatically from computer equipment when people visit our online platforms. ► From platforms that make use of device settings that allow geographical location tracking, such as IP Address mapping, WiFi, GPS signals and cell tower positioning. ► From third-party organizations provided for a specific purpose.

Some of these rely on consent.

To achieve the above stated purposes for which we process your personal data, we may have to share your personal data with certain third parties.

We shall make all reasonable efforts to ensure that any third-party we share your personal data with is also compliant with data protection law. OWL Oncology Research remains liable under the EU-U.S. DPF, the UK DPF Extension and the Swiss-U.S. DPF, if that third party processes such personal information in a manner inconsistent with DPF Principles.

The kinds of third parties we may share your personal data with include: ► Other members of a group of companies to which OWL Oncology Research belongs. ► Organizations where it is necessary to provide goods or services. ► Organizations where it is necessary to setup various resources required to complete our business tasks. ► Regional and/or local government authorities, in response to lawful requests, in order to meet national security or law enforcement requirements, or if we believe in good faith such disclosure is necessary to comply with relevant laws or respond to subpoenas, warrants, or other such legal process served on us.

The specific types of third-party OWL Oncology Research may share your personal data with include: ► IT hosting organizations / for data storage

As a part of our standard business practices, we may transfer your personal data to organizations based in countries that have not been granted an adequacy decision under the General Data Protection Regulation.

We will keep your personal data only for as long as required to achieve the purposes for which it was collected, in line with this privacy notice.

The following criteria are what determine the period for which we will keep your personal data:

► Until we are no longer required to do so to comply with regulatory requirements or financial obligations. ► Until we are no longer required to do so by any law we are subject to. ► Until all purposes for which the data was originally gathered have become irrelevant or obsolete.

Any data collected in ancillary fashion, and which does not pertain to our business interests, will be retained for no longer than five years.

There are several rights granted to you immediately upon providing us with your personal information; some of these are mentioned above. We’d like you to know that at OWL Oncology Research we take your rights seriously and will always conduct ourselves in a way that is considerate of our responsibility to serve your legal rights.

The Right of Access This grants you the right to confirm whether your personal data is being processed, and to be provided with relevant details of what those processing operations are and what personal data of yours is being processed.

If you would like access to the personal data we have about you, we ask that you contact us using the details below.

The Right to Rectification This one is fairly straightforward; if you notice that the data we have about you is inaccurate or incomplete, you may request we rectify the mistake. We will make every effort to respond to requests of this type immediately.

The Right to Erasure Otherwise known as the ‘right to be forgotten’, this gives you the right to request your personal data be deleted.

This is not an absolute right; if you were to request that we erase your personal data, we would erase as much of that data as we could but may have to retain some information if it is necessary. Where we have received a request for personal data to be erased, if it is necessary for us to retain some of that information, we shall ensure that the remaining data is used only when and where it is absolutely necessary.

The Right to Objection The right to object is a basic freedom all democracies enjoy. If you wish to object to the way we use, or have used, your personal data you may do so freely.

The Right to Complain We will always try to maintain the highest standards and encourage the confidence our customers have in us as an organization. To achieve this, we request that any complaints be first brought to our attention so we can properly investigate matters. If you would like to complain about OWL Oncology Research to a regulatory body, you may do so by contacting your local data protection supervisory authority.

California Effective January 1, 2023 This notice to California residents is provided under California law. It explains your privacy rights, provides our “notice at collection,” and provides certain mandated disclosures about our treatment of California residents’ information, both online and offline.

NOTICE OF COLLECTION OF PERSONAL INFORMATION We may collect the following categories of personal information about our guests and users of our digital properties: identifiers/contact information, demographic information (such as gender and age), payment card information associated with you, commercial information, Internet, or other electronic network activity information.

We collect this information so that we can best serve you, including to fulfill your requests and to share offers that we think you may be interested in.

Disclosure/Sharing/Selling California residents also have the right to “opt out” of the “sale” or “sharing” of their “personal information” to or with “third parties” (as those terms are defined under law).

“DO NOT SELL OR SHARE MY PERSONAL INFORMATION” RIGHTS You or your authorized agent can opt out of the “sale” or “sharing” of your personal information to third parties.

Certain data collection on our sites and applications for purposes of interest-based advertising and social media tools may be a “sale” or “sharing” under California privacy law. Instructions for how you can exercise these rights are set forth below in the “California Residents’ Rights” section.

CALIFORNIA RESIDENTS’ RIGHTS Right to Access You have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use, disclose, sell, and share.

Right to Delete You have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.

Right to Correct You have the right to request that we correct inaccurate personal information that we maintain about you, subject to applicable legal exceptions.

Right to Opt Out of Sale or Sharing of Personal Information You have the right to “opt out” of the “sale” or “sharing” of your “personal information” to or with “third parties” (as those terms are defined by applicable law).

EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS Making Access, Deletion, and Correction Requests To make an access, deletion, or correction request, please contact us using the details below. Before completing your request, we may need to verify your identity. We may request additional documentation or information solely for the purpose of verifying your identity.

Instructions for Authorized Agents Making Requests You may also use an authorized agent to submit an access, deletion, or correction request on your behalf. Authorized agents may submit such requests by contacting us using the details below. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with California probate law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity.

Making Requests to “Opt Out” of the “Sale” or “Sharing” of “Personal Information” To submit a request to opt out of the sale or sharing of your personal information, you may click on the link “Do Not Sell or Share My Personal Information” on the footer of our websites or you may choose to enable online, where available, a universal tool that automatically communicates your opt-out preferences. You have the right not to receive discriminatory treatment for the exercise of your privacy rights.

CALIFORNIA MANDATORY DISCLOSURES We also make the following disclosures for purposes of compliance with California privacy law: We collected the following categories of personal information in the last 12 months: identifiers/contact information, demographic information (such as gender and age), commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.

The sources of personal information from whom we collected are: directly from our users, third-party sites or platforms that you link with your registration account, analytics tools, advertising networks, and third-party services that update or supplement information we hold about you.

The business or commercial purposes of collecting personal information are as summarized above and in our Privacy Policy.

We do not “sell” or “share” the personal information of known minors under 16 years of age.

Shine the Light Act If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by OWL Oncology Research to third parties for the third parties’ direct marketing purposes. We take great pride in the relationship of trust we have built with our users and we are dedicated to treating your personal information with care and respect.

Removal of Content If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted.

To make such a request, please send an email with a detailed description of the specific content or information to us using the details below. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested. VIRGINIA Effective January 1, 2023 This notice to Virginia residents is provided under Virginia law. It explains your privacy rights and provides certain mandated disclosures about our treatment of Virginia residents’ information, both online and offline.

VIRGINIA RESIDENTS’ RIGHTS Virginia law provides Virginia residents with the rights listed below.

Right to Access You have the right to confirm whether we are processing your personal data and to access your personal data.

Right to Correct You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing.

Right to Delete You have the right to delete personal data provided by or obtained about you.

Right to Portability You have the right to obtain a portable copy of the personal data that you provided to us.

Right to Opt Out You have the right to opt out of targeted advertising (as defined under Virginia law). We do not sell data as defined under Virginia law.

EXERCISING YOUR VIRGINIA PRIVACY RIGHTS Making Access, Deletion, and Correction Requests To make an access, deletion, or correction request, please contact us using the details below.

Chief Privacy Officer OWL Oncology Research LLC Happy Valley, OR 97086 United States +1 503-786-5948 privacy@owloncology.com

Ametros Group Ltd Lakeside Offices, Thorn Business Park Rotherwas Industrial Estate Hereford Herefordshire England HR2 6JT +44 0330 223 2246 dpo@ametrosgroup.com

Ametros Ltd Unit 3D North Point House North Point Business Park New Mallow Road Cork Ireland gdpr@ametrosgroup.com