Participant information

This information on data privacy is being given to you because you are taking part in the “INVOKE” study (referred to in this document as the “Study”) that is sponsored by Epkin. Epkin is a French company located at 14-16 Boulevard Poissonnière, 75009 Paris, France (referred to in this document as “we” or “Epkin” or the “Sponsor“). As explained in the Participant Information Sheet and Consent Form of the Study, the goal of this Study is to test a new treatment called OKN4395 for cancer.

Even if you do not live within the European Union, because Epkin’s head office is located in France, we must follow the European General Data Protection Regulation (“GDPR”) on how we handle your personal data that we collect through the Study. As a result, Epkin, as Sponsor and data controller of the personal data collected and processed in the framework of the Study, needs to give you the following extra information on data privacy so that you are aware of it. 

1. Legal Basis

Personal data being processed requires a legal basis, which is the lawful reason for why this is being done. Your personal data will be processed by Epkin in accordance with GDPR and the legal basis for such processing is:

• Epkin’s legitimate interest to develop a new drug.
• Compliance with legal obligations applicable to Epkin, in particular when the processing is related to reliability and safety purposes of the Study. 

The processing of the health and genetic data is justified by the public interest in the field of public health (meaning it could provide benefit to the public’s healthcare in the future), as the Study will guarantee high quality and safety standards are upheld for healthcare and medicinal products. It is also necessary for scientific research purposes.

Your data will be processed in accordance with Reference Methodology 001 issued by the French Data Protection Authority (hereinafter, referred to as “CNIL”).

2. Personal Data being Processed

As noted in the Participant Information Sheet and Consent Form, the following data will be processed as part of the Study:

• Directly identifying data about you, such as contact details, your age, your gender, or the site responsible for your medical treatment;
• Sensitive data about you, such as health data (medical history, medical condition, treatments, test results, sample analysis, potential side effects, etc.) and genetic data collected during the Study.

3. Recipients of Data

Your data directly identifying you will only be directly accessible by:

• Your Study doctor and members of his/her team (Study team)
• Contract research organizations conducting the Study on Epkin’s behalf to monitor the progress and quality of the Study
• Employees from Epkin or affiliated companies of Epkin (Owkin) or its service provider with the specific role of monitoring the progress and quality of the Study (the number of employees with this role is restricted and limited, but is required by clinical trial regulations)
• Service providers selected by Epkin to organize the travel to your appointment at the Study site (if you have agreed to this service).

With the exception of the employees of Epkin and affiliated company of Epkin (Owkin) in charge of monitoring the process and the quality of the Study, your personal data is pseudonymised (using a unique Study identity number) before it is transmitted to Epkin, to ensure your privacy. Only the Study site where you are treated keeps a list to link the unique Study numbers to the participants. In this way, the data no longer includes any information that could directly identify you.

Pseudonymized data about you will be shared with Epkin and the organizations working with Epkin on the Study. This includes Epkin’s affiliated companies (Owkin France or Owkin UK Ltd) and Epkin’s service providers helping with the Study.

4. Transfer of Data to Other Countries

Data about you may be transferred to or handled in countries outside of the country you are being treated in for this Study or the European Economic Area. This includes the Study contract research organizations, Epkin affiliated companies (Owkin UK Ltd), and other Study service providers. This may include sending pseudonymized data to countries whose data protection level has not been confirmed as adequate by the European Commission. In such cases, we will take appropriate safeguards required by GDPR to protect your data privacy rights. For example this could be by entering into standard contractual clauses approved by the European Commission. For more detailed information on the safeguards, please contact Epkin’s data protection officer with the details provided below.

5. Storage and Anonymization of Data

Epkin will process your personal data for the time needed to conduct the Study, as noted in the Participant Information Sheet and Consent Form. After the Study has finished, Epkin needs to store your data for at least twenty five (25) years in order to comply with the law. This period may be longer if needed for compliance with Epkin’s legal responsibilities.

At the end of this period, the data will be made completely anonymous. Once anonymised, your data is not seen as personal data anymore and then the GDPR rules do not need to be followed. This means that there is no longer any possible link between you and the data that Epkin has collected. As such, Epkin will no longer be able to respond to your requests to exercise your rights as described below in Section 7 “Your Rights on Data Privacy”.