Honeycomb Study Privacy Notice

Last updated: 25Aug2023

This Honeycomb Study Privacy Notice (“Privacy Notice”) explains how GRIN Therapeutics, Inc. (hereafter “GRIN”, “we”, or “us”) and its parent company Neurvati handle personal data that it collects in relation with the Honeycomb study (the “study”) through this specific website: “https://www.thehoneycombstudy.com/”

The data controller is GRIN Therapeutics, whose registered headquarters are located at 230 Park Avenue, Suite 2830, New York, NY 10169 United States.

This Privacy Notice sets forth our practices regarding the collection, use and disclosure of information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you and your child that you may provide when browsing the website and through the Prescreening Questionnaire available therein. GRIN as the Controller of the personal data, has committed to comply with:

  • The General Data Protection Regulation N°EU 2016/679 (hereinafter, the "GDPR"); as well as the United Kingdom General Data Protection Regulation and the Data Processing Act 2018 (both referred as the “UK GDPR”);
  • And all EU applicable laws and regulations regarding data protection that complement the GDPR;

Collectively referred as "Data Protection Laws". All terms relating to data protection must be interpreted in the light of the GDPR and UK GDPR.

With this Privacy Notice, GRIN wants to make sure that you understand what personal data is collected about you and your child, how the personal data is used and how it is kept safe.

Access to the Website and the Prescreening Questionnaire implies your full and unreserved acceptance of this Privacy Notice (hereinafter the “Notice”).

You acknowledge having read the information below and authorizes GRIN —on behalf of your child when it concerns the latter’s personal data— to process, in accordance with the provisions of the Notice, the personal data that you communicate on the Website.

This Notice is not valid for the pages hosted by third parties to which GRIN may refer and whose privacy policies may differ. GRIN cannot therefore be held responsible for any data processed on these websites or by them.

Information We Collect

GRIN Therapeutics collects the following types of information through the Website:

  • Information you provide. Personal data you provide by answering the questionnaire on the website: https://www.thehoneycombstudy.com/

How We Use Your Information

GRIN uses the information we collect for the following purposes :

Types of personal data collected

Purposes

Legal bases

Retention period

Parents/legal guardians personal data:

  • First and Last names
  • Phone number
  • Email address
  • Zip/Postal Code and country
  1. To contact you and to answer any questions you may have in relation with the study;
  2. To contact you in the future for other studies;
  3. To see if your child pre-qualifies for the study

The applicable legal bases for this processing will depend your country of establishment:

  1. When you are established in a country requiring consent as legal basis, wen commit to only rely on that legal basis for the processing of your personal data;
  2. When you are established in a country admitting Legitimate interest and the necessity for scientific research, we commit to rely on those. our legitimate interest is to perform clinical research to cure rare disease.


    We will perform an assessment to ensure that your rights will not be superseded by our interests.

We will only keep personal data as long as necessary for the fulfillment of the purposes outlined, except if otherwise required by applicable laws or legal orders.

When your child does not pre-qualify for the study, we ensures the proper deletion of all data collected about you and your child.

Child personal data (including sensitive data):

  • age range
  • diagnosis with rare genetic disorder
  • occurance of seizures

When We Share Your Information

GRIN does not sell or disclose your personal data to any individual or organization without your consent.

We may provide your personal data to the study site staff upon your consent. Your personal data may also be provided to third party service providers and suppliers who work on behalf of or with us to provide you with some of the services and features of study website (honeycomb). However, these service providers and suppliers do not have any independent right to use this Data except to help us provide our Website dedicated for study to you.

GRIN has contracted with the following Services Providers to manage the Website that may have access to your personal data:

  • Premier Research for https://www.thehoneycombstudy.com/

Sharing your personal data as explained above may involve a transfer of personal data to a country outside the European Economic Area (EEA). GRIN is therefore committed to complying with the transfer rules under applicable Data Protection Laws and therefore ensure to:

  • Transfer your data to countries where the data recipient is located that has been recognized as adequate by the competent authority; or
  • Where a country has not received an adequacy decision from the competent authority, to implement appropriate safeguards, such as the EU Standard Contractual Clauses ("SCCs") and UK addendum when UK GDPR also applies .

If you want to have more details about the mechanism supporting data transfer, you can contact our DPO at grin.dpo@mydata-trust.info

Data Security

GRIN recruited Innovative Trials (sub-processor) through Premier Research (processor) to maintain the website.

GRIN (through Premier Research) will ensure that Innovative Trials maintains appropriate controls and technical and organizational security measures to protect and secure your personal data. However, there is always some risk that an unauthorized third-party could intercept an Internet transmission, or that someone will find a way to thwart our security systems. We urge you to exercise caution when transmitting personal data over the Internet, especially any sensitive Personal Data. We cannot guarantee that unauthorized third parties may not gain access to your personal data ; caution should therefore be observed when submitting personal data to the website.

Privacy of Children

GRIN does not knowingly collect or use any personal data directly from children on the website. We do not deliberately allow children to communicate with us, or to use any of our online services. If you are a parent or legal guardian and become aware that your child has provided us with information, please contact us using one of the methods specified below, and we will work with you to address this issue.

Your rights

GRIN would like to make sure you are fully aware of all your data protection rights. You are entitled to the following:

  • The right to access. You have the right to request us for copies of your personal data or a description of the personal data categories we process or a description of the processing.
  • The right to rectification. You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.
  • The right to erasure. You have the right to request that GRIN to erase your personal data, under certain conditions.
  • The right to restrict processing. You have the right to request that GRIN restrict the processing of your personal data, under certain conditions.
  • The right to object to processing. You have the right to object to GRIN’s processing of your personal data that are based on legitimate interests, under certain conditions.
  • The right to data portability. You have the right to request that GRIN transfer the data that we have collected to another organization, or directly to you, under certain conditions.
  • Right to withdraw consent. When you have given your explicit consent for the processing of your data, you can withdraw it at any time without justification.

    Please note that all these rights are not absolute and will be assessed on a case-by-case basis by our Data Protection Officer. If you would like to exercise your rights, please let us know by contacting our DPO (see Contact Us section below).
  • You have also the right to lodge a complaint if you consider that your personal data is not processed in accordance with the GDPR or UK GDPR.

If you are an EEA resident: You have the right to lodge a complaint with the Data Protection Authority in the Member State of the European Union of your habitual residence, place of work or place of the alleged infringement.

For EU Data Protection Authorities : https://edpb.europa.eu/about-edpb/about-edpb/members_en

If you are UK resident, you have the right to lodge a complaint with the Information Commissioner’s Office : https://ico.org.uk/make-a-complaint/

Your Privacy Choices

You may contact us at any time if you have questions about this Privacy Notice or the personal data we collect about you. Please submit your privacy inquiries to our Data Protection Officer address mentioned in the “Contact Us” section.

Changes to our Privacy Notice

Check this Privacy Notice regularly, as we may change or update portions of this Privacy Notice from time to time, subject to any applicable requirements. Any changes will be promptly posted to this page and accompanied by a notification to you and a new effective date at the top of this page.

Contact Us

Data Protection Representatives

  • For EU, MyData-TRUST France, Valpark – rue Louis Duvant, 1 – 59220 Rouvignies (FRANCE) to be its Data Protection Representative in the EU as required by law.
  • For UK, MyData-TRUST LTD, Belmont Building, Belmont Road, Uxbridge, England, UB8 1HE, +44 56 0375 0073, grin.dpr.UK@mydata-trust.info to be its Data Protection Representative in the UK as required by law.

Data Protection Officer

grin.dpo@mydata-trust.info