Last updated: November 2022

The sponsor ("Customer") of this study, registry, or activity (noted as "study" below) has engaged Definitive Media, Corp. (doing business as THREAD) to collect the personal data you elect to provide using this application, web portal, recruitment website, or via inVibe (via web or phone-based submission). THREAD collects personal data for a number of reasons to support our Customer’s which may include: (i) to determine whether you qualify to participate in the study and to assist in facilitating study activities, (ii) to supply study results to the Customer’s researchers (the "study team") or regulators, (iii) to join a disease registry, (iv) to provide you with help desk or other support.

THREAD and its Customers have entered into a legal agreement that addresses the appropriate and confidential handling of your personal data. As part of this agreement, THREAD takes reasonable security and organizational measures necessary to ensure the security of your personal data in compliance with the data protection laws in your country.

As an example, only, THREAD complies with one of the strictest data protection standards, known as the European General Data Protection Regulation (“GDPR”), as well as its obligations under the laws of Australia, Brazil, Canada, China, India, Mexico, United Kingdom and the United States, among many others. Please be assured that THREAD takes the measures necessary in all the countries in which this application is offered, including yours.

When you register, THREAD collects information from you to open an account and may ask for information to determine whether an individual does, or does not, qualify to participate in the study or to join a registry.

When you become a study participant, THREAD maintains the study application that gathers the personal data and information necessary to the research associated with the study or registry. THREAD processes personal direct identifiers associated with your account (such as name and email address) in a de-identified (sometimes called “coded” or “pseudonymized” identifiers), tokenized and encrypted format.Indirect identifiers (such as participant ID or study results) are segregated from the direct identifiers.

The notice below provides important information about how we protect the personal data we process and collect through the registration process, study application, and web portal. For more information about THREAD’s data practices, please see our full privacy policy here.

What We Collect and How We Use It

The type of personal data we collect depends on whether you are registering or participating in a study and using one of the study applications.

Registration Website

THREAD collects personal data necessary to determine whether you qualify for the study. You submit this personal data in response to the questions asked on the registration website. The study team (not THREAD) determines what data it needs to qualify candidates and the questions to be asked. THREAD only provides the study team with the results of the registration process and the personal data of qualifying individuals. The information that may be collected includes, but is not necessarily limited to: name, signature, pass or fail outcome to the verification questions, and responses to qualification criteria determined by the study team. This data is used by the study team to place prospective participants in research studies.

Once qualified, you may be asked to provide contact information in order to ship study supplies or devices to you. This information may include, but is not necessarily limited to: your name, mailing address, phone number, and email address.We reserve the right to use your contact information to send alerts or notifications about our services such as, but not limited to, changes to this notice, support alerts or system status.

Study Application (the THREAD Platform)

Your study team uses an application to collect personal data from you to facilitate the research study. THREAD requires you to provide contact details (i.e., email address or phone number) to enable sign-on and retrieval of forgotten passwords.We reserve the right to use your contact information to send alerts or notifications about our services such as, but not limited to, changes to this notice, support alerts or system status.

This application may be used to collect certain types of information, including, but not necessarily limited to:

• Data generated or collected by mobile device sensors, including accelerometer, gyroscope, proximity sensor, ambient light sensor, camera, compass, and barometer.
• Data obtained through the study application, such as your responses to surveys and questions.
• Data generated or collected by a third-party FDA-listed medical device, wearable device, health application or similar device, wearable or tool that collects data and information from the participant.
• Images and audio or video recordings provided for the above services

How We Share Personal Data with Third Parties

THREAD may share your personal data in the following ways:

1. Upon instructions from the Customer, data may be shared with the study team (including site personnel and Customer) when you ask us to share certain information. One example includes submitting your application and information to join or support a study. Separately, pseudonymized data may also be shared with Customers upon their request, for study reports and research
2. In order to satisfy a legal or regulatory requirement. THREAD reserves the right to disclose personal data to public authorities for security or law enforcement purposes when legally required to do so.

Your information may also be shared with THREAD sub-processor service providers (only for the purposes outlined in this policy). For more information and the latest information on this, please see our full privacy policy here.

How Long We Keep Your Information

THREAD maintains data about you only for as long as we have a legitimate business need or for as long as the study team may require, which may be as long as 25 years if you qualify as a study participant.

Information About Children

Study applications are not intended for, nor designed to attract, individuals under the age of 18. We do not collect personally identifiable information from any person we know to be under the age of 18 without explicit consent from their parent or guardian. We require individuals under 18 to obtain such consent prior to using our study applications. For more information on this, please see our full privacy policy here.

Cross-Border Transfers of Data and Where We Store Your Information

THREAD may store, transfer, and process your information on servers primarily located in the United States and in other locations that THREAD deems necessary or convenient to provide you with efficient and effective service. While such locations have protections for personal data which may be different than that in your home country, THREAD operationally and contractually handles your information with appropriate care.

THREAD follows local laws regarding the appropriate operational and contractual measures needed to ensure data is transferred legally. For example, we have put in place between our own legal entities, as well as sponsors and our sub-processes, the appropriate contracts to safeguard your data after transfer. This includes data protection agreements and the updated European Commission and UK standard contractual clauses. Where required, your consent will be obtained prior to such transfers.

Our storage service providers and other sub-processors are only permitted to store your personal information, and are not otherwise authorized to collect, use or disclose your personal information, except in accordance with the purposes set out in this privacy policy or as required by applicable law.

To obtain copy of our standard data processing agreement or Standard Contractual Clauses, contact us via privacy@threadresearch.com.

Cookies and Tracking

THREAD utilizes minimal cookies and tracking technologies within the study application and related web portal, and is limited to the Firebase SDK for the purposes of enabling push notifications when you provide an opt-in.

Please be aware, however, that if you visit our THREAD general website (www.threadresearch.com), that cookies are used on that site. For full details on cookies and tracking technologies used, please see our full privacy policy here.

Exercising Your Data Rights

For Residents of the European Union, EEA, Switzerland, the United Kingdom, and Brazil

The General Data Protection Regulation (GDPR), and the national equivalents in the EEA, Switzerland, and the United Kingdom, and the Lei Geral da Protecao de Dados (LGPD) provide residents of those countries with certain rights in their data. You have the right to access your data, and in some circumstances to correct or erase it.

To exercise these rights, you can contact THREAD at privacy@threadresearch.com or, if you are in the EU or the UK our representative in the EU may be contacted at thread@gdprrepresentative.eu, or in the UK at thread@privacyrep.co.uk. You will need to go through a verification process to ensure that we are providing the correct data to you. For such requests, THREAD will also be required to obtain authorization from the Customer where required by law.

In some instances, because we store certain data on a deidentified basis, we may not be able to associate particular data to you. THREAD is unable to remove some information that is deidentified or tokenized upon collection as THREAD will not reidentify the information for individual users.

For California Residents

We are currently not required to comply with the California Consumer Protection Act (CCPA). At its discretion, THREAD may respond to California residents regarding their data with respect to the following:

The categories of data we have collected and the categories of sources.

The business purposes for sharing the data.

The categories of third parties with whom we have shared data.

The ability to access the specific pieces of data we process and the right to delete your data.

For Nevada Residents

Nevada law provides residents with the right to review, correct or update their personal information and/or opt out of the sale of personal information. If you are a Nevada resident and would like to review, correct, or update your personal information, you or your authorized representative may submit your request to privacy@threadresearch.com. We will respond to your verified request as soon as reasonably practicable, but no later than sixty (60) days after receipt. If circumstances cause any delay in our response, you will be promptly notified and provided a date for our response.

We generally do not disclose or share personal information for profit. Under Nevada law, residents have the right to direct us to not sell or license your personal information to third parties. To exercise this right, if applicable, you or your authorized representative may submit a request to privacy@threadresearch.com. We will respond to your verified request as soon as reasonably practicable, but no later than sixty (60) days after receipt. If circumstances cause any delay in our response, you will be promptly notified and provided a date for our response.

For Residents in Other Jurisdictions

If the laws of your country are not mentioned above, you may also have rights under your home jurisdiction’s laws to access, erase, correct, and move your personal data. For more information, please contact us at privacy@threadresearch.com if you wish to exercise your rights.

You may have rights to file a complaint with a regulator in your jurisdiction if we do not adequately address your requests or concerns. Here is a list of various data protection authorities who you may contact about enforcing your data rights https://www.threadresearch.com/privacy-policy.

Third-Party Mobile Applications and Services

The THREAD mobile applications may contain links or references to third-party mobile applications, products, or services. Information collected by third parties is governed by their privacy practices, not THREAD We encourage you to learn about the privacy practices of those third parties.

Changes to Our Business & Notices.

We reserve the right to transfer information to a third-party in the event of a sale, merger, dissolution, or other transfer of all or substantially all of the assets of THREAD, or in the event that we discontinue our business or file a petition, or have filed against us a petition in bankruptcy, reorganization, or similar proceeding, provided that the third-party agrees to adhere to the terms of this Privacy Statement.

From time to time, we may use your email address to send important notices related to the services we provide to you or to your account, or for our internal purposes such as auditing, data analysis and research.

How to Contact Us

Should you have other questions or concerns about these privacy policies or procedures, or any other privacy related concerns or complaints, or if you'd like to contact our Data Protection Officer, please email us at: privacy@threadresearch.com

You may also contact us by mail at:

THREAD

2000 Centregreen Way
Suite 300
Cary, NC 27513

This Privacy Policy was last updated on October 10 2022, and is effective as of that date.

If you are in the EU, then you may contact our representative in Europe at: thread@gdprrepresentative.eu.

California and Nevada residents may contact our DPO, as above, or email us at: privacy@threadresearch.com.