ILiAD Biotechnologies, Inc.
Healthcare Professional Privacy Notice
Last updated: June 2, 2026Introduction
ILiAD Biotechnologies, Inc. (referred to as “ILiAD Bio”, “We”, “Our” or “Us”) is committed to protecting the privacy and security of your Personal Data.
This Privacy Notice (this “Notice”) is intended for Healthcare Professionals, medical professionals, personnel and staff of healthcare institutions (altogether HCPs) with whom we engage where you are located within the European Union (EU), European Economic Area (EEA), or United Kingdom (UK). As the individual whose Personal Data is collected, you may be referred to as the “data subject” throughout this Notice.
It is important that you read this Notice, together with any other notice we may provide on specific occasions when we are collecting or processing Personal Data about you, so that you are aware of how and why we are using such information.
You have been directed to or otherwise sent a copy of this Notice because you are an HCP with whom we engage, or you are acting as a representative or contact person for a healthcare organisation (HCO). This Notice makes you aware of how and why your Personal Data will be used, and how long it will usually be retained for. It provides you with certain information that must be provided under Data Protection Legislation and explains how your Personal Data will be processed. If anything in this Notice conflicts with local law in your jurisdiction, local law prevails.
Definitions
For the purposes of this Notice:
- Aggregated Data
- Summarised data derived from your Personal Data. Examples are statistical or demographic data. It is not considered Personal Data in law as this data will not directly or indirectly reveal your identity.
- Data Controller
- For the purposes of both UK GDPR and EU GDPR, refers to ILiAD Biotechnologies, Inc. as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data. For the purpose of both UK GDPR and EU GDPR, ILiAD Bio is the Data Controller.
- Data Protection Legislation
- In the context of the United Kingdom, means the Data Protection Act 2018 (‘DPA 2018’), United Kingdom General Data Protection Regulation (‘UK GDPR’), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (‘PECR’), the Data (Use and Access) Act 2025, and any legislation implemented in connection with the aforementioned legislation. In the context of the European Union (EU), Data Protection Legislation also includes the General Data Protection Regulation (Regulation (EU) 2016/679) (‘EU GDPR’) as well as any local data protection implementation laws. This includes any replacement legislation coming into effect from time to time. Unless otherwise specified, “Controller”, “Processor”, “Processing” (and variants thereof), and “Data Subject” shall have the same meaning as under the GDPR or, as applicable, any substantially corresponding terms as defined under any other applicable Data Protection Legislation.
- Personal Data
- Any information that relates to an identified or identifiable individual. For the purposes of both UK GDPR and EU GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.
- Service Providers
- Any natural or legal person who processes the data on our behalf. It refers to third-party companies or individuals employed by ILiAD Bio to facilitate our services, to provide services on our behalf, or to assist us in analyzing how our services are used. For the purpose of both UK and EU GDPR, Service Providers are considered Data Processors.
Our role as Data Controller
We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. We have also designated an EU and UK representative. To locate the relevant contact details, please see the Contact Us section below.
The Personal Data we collect about you
The following table lists the types of Personal Data we may collect:
| Personal Data Category | Purpose for Data Processing |
|---|---|
| Contact detailsExample: your name, nationality, postal address, telephone number, e-mail address |
|
| Identity InformationExample: your name, DOB, photographs, driving licence, passport, professional licence number, or government ID number |
|
| Financial InformationExample: bank account details, financial information, salary and expenses details |
|
| Employment historyExample: job titles, location of employment/workplace, employment history, working hours |
|
| Criminal Convictions and Offences DataExample: any debarments from participation in research |
|
| Financial Disclosure InformationExample: any financial interests that you or your spouse and dependent children may have in the Sponsor or technologies adjacent to the clinical trial, the identities of your spouse and dependent children |
|
| Professional CredentialsExample: training records, qualifications and professional memberships |
|
| Research-Related DataExample: research interests and output |
|
| Details for Adverse Event Reporting |
|
We also collect, use and share Aggregated Data for various purposes. For example, your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Notice.
How we use your Personal Data
| Personal Data Category | Lawful Basis | Purpose |
|---|---|---|
|
Our Legitimate Interest in administering healthcare professionals (including contacting you to explore clinical research collaboration opportunities)GDPR, Article 6(1)(f) | Clinical Research OutreachWhere you are an HCP involved in scientific fields relevant to ILiAD Bio’s clinical research, to contact you to explore the possibility of engaging and collaborating with you further through ILiAD Bio’s clinical research. |
|
Our Legitimate Interest in conducting clinical researchGDPR, Article 6(1)(f) | Clinical ResearchWhere you are an HCP involved in the planning, delivery, or oversight of ILiAD Bio clinical trials, to collect information from you and process your information, including through the use of artificial intelligence technologies, in order to conduct a clinical trial. |
|
Legal ObligationGDPR, Article 6(1)(c) | Adverse Event ReportingWhere you are an HCP involved in the delivery, or oversight of ILiAD Bio clinical trials, to collect information from you and process your information in relation to any Adverse Events that you report during the conduct of the clinical trial. |
|
Our Legitimate Interest in seeking marketing authorisation for our productsGDPR, Article 6(1)(f) | Marketing ApprovalWhere you are an HCP involved in the delivery of and have oversight of the clinical trial, to support applications for and to comply with the conditions of any marketing approval granted in respect of any study drug and to assist with any term variations of marketing approvals. |
|
Contractual ObligationGDPR, Article 6(1)(b) | CommunicationCommunicating with you and facilitating your communication with others. |
|
Our Legitimate Interest in administering healthcare professionals (including checking your eligibility to participate in our research)GDPR, Article 6(1)(f) | Debarment and Background ScreeningWhere you are an HCP shortlisted as part of our feasibility studies, to ascertain whether you have been debarred from scientific research activities, or whether any other criminal convictions and offences may prevent you from participating in our research. |
Automated Technologies and AI Use
As part of our ongoing efforts to improve the efficiency and quality of our research and clinical trial activities, we may use artificial intelligence (AI) tools to support data analysis, communication, and system functionality. Some of these third-party software platforms and systems may process your personal data, such as the Microsoft o365 suite of applications including Connected Experiences and Microsoft Copilot, an AI tool. Other systems, such as ChatGPT and Claude.AI (Anthropic), utilised by us may also include AI features and functionalities that may process your personal data.
Throughout our professional relationship, your personal data may be processed within the Microsoft Office 365 suite of applications. This may include processing by Microsoft Copilot AI as part of Microsoft Connected Experiences, in accordance with Microsoft’s privacy and security standards. For more information about how Microsoft may process your personal data, see the Microsoft Privacy Statement. If you have any questions or concerns about this processing, please contact our Data Protection Officer at the email address set out in the Contact Us section.
Our use of AI tools for processing your personal data is carried out on the basis of our Legitimate Interests to conduct clinical research. We balance our interests against your data protection rights and apply appropriate safeguards to protect your personal data.
How we collect your Personal Data
We collect your Personal Data when you, as a Healthcare Professional:
- Engage with ILiAD Bio or our Service Providers;
- Interact directly with ILiAD Bio through our communication channels; or,
- Otherwise provide it to us.
We may also receive information about you from other sources including business partners, third parties, affiliates, and publicly available information about you from publicly accessible sources, both public or private registries, and third-party databases. This may include your professional contact details, employment details, criminal convictions and offences data, and other relevant background information.
Providing your Personal Data to ILiAD Bio is voluntary but it is necessary if you are to take part in any of our clinical trial activities. Should you choose not to provide your Personal Data to us, your interaction with us may be adversely impacted, you cannot take part in any of our clinical trial activities, and we will not be in a position to perform a contract with you.
Disclosures of your Personal Data
Where necessary to fulfil the purposes described in this Notice, ILiAD Bio may disclose your Personal Data to third parties. Not all of these parties are located in the country where the clinical trial is conducted. ILiAD Bio may therefore transfer your Personal Data to locations outside of your country of residence for the purposes described in this Notice.
Whenever ILiAD Bio shares your Personal Data with third parties, such as companies acting as our authorised agents and service providers, these companies agree to use your Personal Data only for specified purposes and upon our instructions. Furthermore, the recipient will implement and maintain reasonable security procedures and practices appropriate to the nature of your information to protect your Personal Data from unauthorised access, destruction, use, modification or disclosure.
We will transfer and disclose your Personal Data to the following categories of recipients where it is lawful to do so, and subject to the implementation of appropriate safeguards:
| Category of Third-Party | Lawful Basis | Purpose for Disclosure |
|---|---|---|
| Our subsidiaries and affiliated entities | Our Legitimate Interest in conducting clinical researchGDPR, Article 6(1)(f) |
|
| Service ProvidersThose who work for, or provide services to us (including their employees, sub-contractors and officers) — such as IT systems providers and IT contractors, payroll and HR system providers, employee expense management providers, pension administration/providers, and benefits providers. | Our Legitimate Interest in conducting clinical researchGDPR, Article 6(1)(f) |
|
| Cloud storage solutions | Our Legitimate Interest in conducting clinical researchGDPR, Article 6(1)(f) |
|
| Law enforcement, government, courts, regulators, governmental or quasi-governmental organisations, tribunals and arbitrators | Legal ObligationGDPR, Article 6(1)(c) |
|
| Professional advisors, such as insurers, accountants, auditors or lawyers | Our Legitimate Interest in conducting clinical researchGDPR, Article 6(1)(f) |
|
| Other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents | Legal ObligationGDPR, Article 6(1)(c) |
|
| Any prospective or new ILiAD Bio companies (e.g. if we restructure, or acquire or merge with other companies) or any businesses that buy part or all of ILiAD Bio (including the rights to the study drug and all related data) | Our Legitimate Interest in managing our commercial affairsGDPR, Article 6(1)(f) |
If this occurs, the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice. |
| Potential or future employers | ConsentGDPR, Article 6(1)(a) |
|
| Other researchers, research institutions, collaborators, licensees, and strategic partners | Our Legitimate Interest in conducting clinical researchGDPR, Article 6(1)(f) |
|
International cross-border data transfers
Because ILiAD Bio operates globally, your data may be transferred outside of the country in which you interact with ILiAD Bio, including to countries whose data protection laws substantially differ from the country in which you work or reside and may not provide the same level of data protection as in your country of residence. To accomplish the purposes described in this Notice, we may also disclose and transfer Personal Data to personnel and other departments throughout ILiAD Bio, or to service providers and/or collaborators, licensees and strategic partners based overseas, to the extent that your Personal Data is shared with service providers, ILiAD Bio affiliates, successors, licensees, collaborators, designees, connected companies or partners or other third parties processing Personal Data on our behalf, which are located outside your country of residence. For example, your Personal Data may be transferred to or accessed by ILiAD Bio and its affiliate entities in the United States of America.
ILiAD Bio shall seek to maintain confidentiality as required within the limits of local laws in these countries.
Whenever we are required to transfer your Personal Data out of the UK or EEA, we ensure that at least one of the following safeguards is implemented:
- Transferring your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission or the UK government, as applicable.
- Using specific contracts, data transfer mechanisms and approved safeguards which give Personal Data the same protection it has in Europe, including standard data protection clauses approved by the European Commission or the UK government, as applicable, providing adequate protection of Personal Data.
- We may also seek your consent to disclose your Personal Data to third parties and to transfer your Personal Data to a country which does not provide adequate protection equivalent to the laws of your country of residence, where required.
Please contact our DPO using the details in the Contact Us section below if you would like further information on the specific mechanism used by us when transferring your Personal Data out of the EEA or UK.
Data security
ILiAD Bio will implement appropriate technical and organizational security measures necessary to adequately safeguard your Personal Data. These safeguards will include, for example:
Security Measures
- Access to Personal Data is restricted and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need-to-know.
- All employees handling Personal Data receive security and data protection awareness training, will only process your Personal Data on our instructions, and are subject to a duty of confidentiality.
- Employees with access to Personal Data are given the least privilege required.
- We have robust procedures in place to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
- A disciplinary policy is enforced to prevent unauthorised access.
- Where technically feasible, data is encrypted in transit and at rest.
Data retention
We will only retain your Personal Data for as long as required under applicable local, state, national and/or international laws, rules and/or regulations, which may be for a period of up to 25 years after completion of the clinical trial, and to fulfil the purposes we collected it for, including for the purposes of any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event where we receive a complaint and we reasonably believe there is a prospect of litigation in respect to our relationship with you, or there is an investigation and proceedings.
To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Where we do not have a reason or legal obligation to retain your Personal Data, it will be deleted in accordance with the relevant section of our Data Protection Policy.
In some circumstances you can ask us to delete your data: see Your legal rights below for further information.
In some circumstances we will anonymise your Personal Data (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use and retain this information indefinitely without further notice to you.
Your legal rights
Subject to certain limitations and exclusions under applicable laws, you may be entitled to contact us and request to exercise your rights in respect of your Personal Data. You may have the right to request confirmation as to whether ILiAD Bio is processing your Personal Data, and if so:
- To request information relating to the categories of data involved, purposes of processing, recipients of your data, retention periods/criteria, and your rights as a Data Subject.
- To request access to your Personal Data that ILiAD Bio is processing.
- To request ILiAD Bio rectifies any inaccurate or incomplete Personal Data that ILiAD Bio is processing about you.
- To request erasure of any Personal Data that ILiAD Bio is processing about you, subject to certain exceptions.
- To request restriction of processing of any Personal Data that ILiAD Bio is processing about you, subject to certain exceptions.
- To obtain a copy of your Personal Data in a commonly-used and machine-readable format and have it ported to another data controller.
- To object to the processing of your Personal Data in certain circumstances.
- To request your information not be sold or otherwise disclosed to a third party.
- To withdraw your consent for processing your Personal Data at any time.
- To lodge a complaint with us.
- To lodge a complaint with your local Data Protection Authority or Supervisory Authority.
To exercise any of the rights described above, please email us using the details in the Contact Us section below with a description of your request or complaint.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.
Data Protection Complaints
You have the right to complain to us about how we use your personal data, known as a data protection complaint. You can do so by emailing us at DPO@iliadbiotech.com. We will acknowledge your complaint, investigate and respond in line with our legal obligations. If you are not satisfied with our response or the outcome, you may also complain to the Information Commissioner’s Office (ICO) as the UK supervisory authority for data protection at ico.org.uk.
Changes to the Notice
We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact ILiAD Bio for more information.
Your duty to inform us of changes
It is important that the Personal Data we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.
Providing us with other people’s data
If you give us any Personal Data that does not relate to you (e.g., information about your next of kin/dependants), you must ensure that you have the required legal basis to collect and share their Personal Data. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this Notice. You must also tell them how they can see what information we have about them, correct any mistakes or request copies of their information.
Change of Ownership
In the event that the ownership of our business, assets, or drug development rights is transferred to another entity, whether through merger, acquisition, sale, or licensing, we may share your personal data with the acquiring or licensing entity. This is to ensure continuity of research, regulatory obligations, and product development.
The receiving entity will be required to process your personal data in accordance with applicable data protection laws and the purposes outlined in this Privacy Notice, or as otherwise communicated to you at the time of transfer.
Where necessary, we will update this Privacy Notice and notify you of any material changes in how your personal data is handled.
Contact Us
If you have any questions about this Notice, the use of your data, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.
DPO@iliadbiotech.com
UKRep@iliadbiotech.com
Thank you for taking the time to read this Privacy Notice.