Denali Health Consumer Health Data Privacy Notice

Consumer Health Data We Collect

Depending on the information you choose to provide, Denali may collect consumer health data including:

• medical conditions and diagnoses;
• symptoms;
• medications;
• treatment history;
• medical procedures;
• health-related measurements or characteristics;
• healthcare provider information;
• clinical trial history;
• answers to research-screening questions;
• demographic information relevant to research eligibility;
• research interests;
• information about potential study eligibility; and
• other health information you voluntarily provide.

We may also derive limited information from your responses, such as whether a particular type of research opportunity may potentially be relevant to you.

Sources of Consumer Health Data

We primarily collect consumer health data:

• directly from you;
• from a parent, guardian, or authorized representative when appropriate;
• from information you provide during communications with Denali; and
• from Denali personnel conducting permitted registry or research-screening activities.

Information received for a particular clinical trial may also be governed by the documents and permissions applicable to that study.

Why We Collect Consumer Health Data

We collect and use consumer health data to:

• operate the Denali Patient Registry;
• create and maintain registry profiles;
• identify current or future research opportunities that may be relevant to an individual;
• conduct preliminary research matching;
• contact individuals about potential research opportunities;
• respond to registry inquiries;
• conduct permitted preliminary screening;
• manage registry communications;
• maintain appropriate records;
• maintain security and prevent fraud; and
• comply with applicable legal, regulatory, and research requirements.

We will not materially expand these purposes without providing any additional notice or consent required by applicable law.

How We Use Consumer Health Data

Authorized Denali personnel may review consumer health data to determine whether a clinical research opportunity may be relevant to you.

A potential match does not mean that you qualify for or are enrolled in a clinical trial.

Further screening and study-specific informed consent may be required.

Service Providers

Denali uses contracted service providers that may process consumer health data on Denali's behalf, such as providers supporting:

• secure hosting and data storage;
• Patient Registry software;
• customer relationship management;
• communications;
• information technology;
• cybersecurity; and
• other registry operations.

These providers are permitted to process the information only for authorized purposes and under appropriate contractual and security requirements.

Sharing With Research Partners

Denali does not give pharmaceutical sponsors, contract research organizations, or other independent research organizations unrestricted access to the Patient Registry.

As a general registry practice, Denali does not disclose identifiable registry health information to outside research partners simply because an individual joins the registry.

If Denali proposes to share your identifiable consumer health data with an outside research organization for purposes requiring additional consent, we will obtain that consent before the sharing occurs.

Affiliates

Denali does not currently share Patient Registry consumer health data with an affiliated company for that affiliate's independent purposes.

If this practice changes, Denali will update this notice and obtain any additional consent required by applicable law before beginning the new sharing.

Consumer Health Data We Sell

None.

Denali does not sell consumer health data.

Advertising

Denali does not use Patient Registry health information to:

• create advertising audiences;
• create lookalike audiences;
• create custom audiences;
• target advertisements based on an individual's medical condition;
• enrich third-party advertising profiles; or
• allow an advertising platform to independently market products based on registry health information.

Your Consumer Health Data Rights

Depending on applicable law, you may have rights concerning your consumer health data.

For the general Denali Patient Registry, Denali provides U.S. registry users a process to request:

• confirmation of whether Denali maintains consumer health data about them;
• access to their registry information;
• correction of inaccurate registry information;
• deletion of registry information;
• withdrawal of consent to future collection and use;
• withdrawal of applicable consent to sharing;
• information about parties with whom applicable consumer health data has been shared; and
• review of a Denali decision concerning a privacy request.

Some information may be retained when permitted or required for legal, security, research-integrity, regulatory, or recordkeeping purposes.

Information associated with participation in an actual clinical trial may be governed by different requirements and is not necessarily deleted when an individual withdraws from the general Patient Registry.

Withdrawing From the Patient Registry

You can withdraw from the Denali Patient Registry at any time.

When your withdrawal becomes effective, we will stop using your Patient Registry information to identify you for new research opportunities, except as permitted or required by law.

You may also separately change your email or text-message preferences without withdrawing from the registry.

Making a Request

To exercise a consumer health data right or withdraw from the Patient Registry, contact:

Denali Health Attn: Privacy 1601 W Reynolds St., Suite 203 Plant City, FL 33564

Email: privacy@denali-health.com

We may take reasonable steps to verify your identity before providing access to, correcting, or deleting information.

We will respond within the period required by applicable law.

Changes to This Notice

We may update this notice as our Patient Registry, data practices, or legal obligations change.

If we propose to collect, use, or share consumer health data in a manner requiring additional consent, we will obtain that consent before beginning the new activity where required.