Privacy Policy

1 Scope and Our Role

This Policy applies to personal information processed through Beacon-controlled websites and Services, including information about patients and study participants, parents and legal guardians, caregivers, physicians and investigators, clinical and administrative personnel, companies, research sponsors, partners, vendors, and regulatory or governmental contacts.

Depending on the context, Beacon may act as:

• a business that determines why and how information is used for its own website, account administration, contracting, support, security, and business operations; or
• a service provider, data processor, or HIPAA business associate processing information according to a customer’s instructions, contract, study protocol, authorization, or Business Associate Agreement.

This Policy does not replace a clinical study consent form, HIPAA authorization, Notice of Privacy Practices issued by a healthcare provider, or contract-specific data processing notice.

2 Information We Collect

A. Patients, Study Participants, Caregivers, and Guardians

• Identifiers and contact information, such as name, date of birth, mailing address, email address, telephone number, participant or patient identifier, and account credentials.
• Demographic and eligibility information, such as age, sex, gender, race, ethnicity, language, location, and other characteristics requested by a study, registry, clinical program, or customer.
• Health and clinical information, such as diagnoses, symptoms, medical history, medications, treatments, procedures, adverse events, functional status, quality-of-life information, patient reported outcomes, caregiver-reported outcomes, laboratory or imaging references, and other information submitted through an instrument or workflow.
• Study and operational information, such as study, site, enrollment, assessment, invitation, visit, treatment, timepoint, scheduling, consent, authorization, and completion status.
• Caregiver, parent, guardian, legally authorized representative, or respondent information when another person completes a registration or assessment on the participant’s behalf.
• Communications and support records, including requests, responses, verification activity, preferences, and records showing when consent or authorization was provided or withdrawn.

B. Physicians, Investigators, and Clinical Personnel

• Name, professional contact information, job title, specialty, organization, site affiliation, and professional biography.
• Professional credentials and identifiers, such as license information, National Provider Identifier (NPI), qualifications, training, certifications, study role, delegation, and authorization status.
• Electronic acknowledgments, signatures, attestations, regulatory documents, communications, support requests, and account activity.

C. Companies, Sponsors, Partners, Vendors, and Regulatory Agencies

• Business contact information, organization details, roles, ownership or affiliation information, and authorized-user information.
• Contracts, statements of work, invoices, payment or billing details, insurance or compliance records, due-diligence materials, and vendor-management information.
• Study, product, operational, import, regulatory, quality, cybersecurity, and compliance documentation or correspondence submitted to or received from companies, partners, sponsors, sites, laboratories, consultants, and governmental or regulatory agencies.
• Publicly available professional or agency information and information received from authorized representatives.

D. Information Collected Automatically

• Internet Protocol address, browser type, device type, operating system, language, referring page, approximate location derived from IP address, and mobile carrier.
• Log, audit, diagnostic, security, and usage data, such as date and time of access, pages or features used, authentication events, changes made, error records, and system activity.
• Cookies and similar technologies used for security, session management, preferences, performance, and analytics. Beacon does not use health information or SMS opt-in data for behavioral advertising.

E. Information From Other Sources

We may receive information from a patient, participant, caregiver, physician, customer, study sponsor, research site, laboratory, service provider, business partner, regulatory agency, public database, or other source that is authorized or legally permitted to provide it. A customer that submits information to Beacon is responsible for having an appropriate legal basis, permission, consent, or authorization to do so.

3 How We Use Information

We may use personal information to:

• create, verify, authenticate, administer, and secure accounts and user access;
• register patients, participants, physicians, sites, studies, organizations, and authorized users;
• deliver assessments, invitations, forms, patient-reported outcome instruments, reminders, operational messages, reports, exports, and workflow functions;
• support clinical operations, observational research, registries, regulated activities, quality processes, and documentation requested or authorized by a customer;
• communicate about account access, registration, appointments, assessments, study or service status, support, security, policy changes, and other administrative matters;
• provide customer support, troubleshoot issues, maintain audit trails, prevent fraud or misuse, and protect the Services and users;
• perform billing, contracting, vendor management, compliance, recordkeeping, and ordinary business administration;
• comply with applicable law, legal process, contractual obligations, research requirements, and lawful requests from authorized regulatory or governmental authorities;
• perform service analytics, validation, quality assessment, and product improvement using de-identified, aggregated, or otherwise authorized information that Beacon is permitted to use for those purposes, subject to applicable law, contractual restrictions, and appropriate privacy and security safeguards; and
• carry out another purpose disclosed at the time of collection or otherwise authorized by the individual or responsible organization.

Beacon does not sell personal information. Beacon does not use personal health information, clinical assessment responses, or SMS opt-in data for third-party targeted advertising. Beacon does not use identifiable patient or participant clinical information for unrelated advertising, marketing, or product-development purposes.

4 SMS and Mobile Messaging

Beacon may send text messages to individuals who provide a mobile number and give the required consent or who affirmatively request a one-time verification message. Messages may include:

• one-time passcodes and identity-verification messages;
• registration, account, invitation, and access notifications;
• assessment, visit, appointment, or task reminders;
• study, service, workflow, support, security, and operational status updates; and
• administrative, policy, or compliance notices.

Message frequency varies based on the user’s activity and the services requested. Message and data rates may apply. Reply STOP to unsubscribe from recurring messages and HELP for help. Opting out of recurring SMS does not revoke other permissions or authorizations and does not prevent Beacon from responding to a new message or request initiated by the user. Where available, users may choose another communication method.

Consent to recurring SMS is voluntary and is not a condition of purchasing a product or service. One time verification codes are sent only when requested or initiated as part of a user-selected verification process. Beacon will maintain records of messaging consent, opt-out requests, and related compliance activity as reasonably necessary.

Mobile information non-sharing statement. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of information sharing described in this Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Beacon does not intend to place detailed diagnoses, treatment information, assessment responses, or other highly sensitive clinical content in ordinary SMS messages. Text messaging may not be encrypted end to end, and users should not use SMS for emergencies or urgent medical needs. Call 911 or the appropriate emergency service for an emergency.

5 How We Disclose Information

Subject to applicable law, authorization, consent, contract, and the mobile-information restriction above, Beacon may disclose information to:

• the customer, study sponsor, research site, physician, investigator, clinical organization, or other authorized party responsible for the relevant program or workflow;
• service providers that perform hosting, security, authentication, communications, storage, analytics, support, payment, professional, or other functions for Beacon under appropriate restrictions;
• partners, laboratories, consultants, contract research organizations, and other parties when directed or authorized by the responsible customer, protocol, consent, authorization, or agreement;
• regulatory agencies, governmental authorities, courts, law enforcement, auditors, or legal advisers when required or permitted by law, legal process, contract, or a legitimate compliance need;
• a successor or prospective successor in connection with a merger, financing, acquisition, restructuring, sale of assets, or similar transaction, subject to appropriate confidentiality and legal requirements; and
• another party with the individual’s or responsible organization’s direction or consent.

Beacon requires service providers to use personal information only for authorized services and to protect it through contractual, organizational, and technical safeguards appropriate to the information and services involved.

6 HIPAA, Clinical Research, and Regulated Data

The Health Insurance Portability and Accountability Act (HIPAA) applies only in particular circumstances and to particular entities and information. When Beacon receives or maintains protected health information (PHI) on behalf of a HIPAA covered entity or another business associate under a Business Associate Agreement (BAA), Beacon will process that PHI in accordance with the BAA and applicable HIPAA requirements.

When Beacon acts as a service provider for a sponsor, site, provider, or other customer, the customer determines the permitted purposes of processing and is responsible for its own notices, consents, authorizations, protocol obligations, and legal basis. Requests concerning customer-controlled clinical or study records may need to be directed to that customer.

This Privacy Policy is not a HIPAA Notice of Privacy Practices, an informed consent document, a clinical trial consent form, or medical advice. The Services are not an emergency service and do not replace professional medical judgment.

7 Cookies and Similar Technologies

Beacon may use necessary cookies and similar technologies for authentication, session management, security, preferences, performance, and analytics. Browser controls may allow users to reject or delete cookies, but some service functions may not work correctly without necessary cookies. Beacon does not use clinical data or SMS opt-in data for cross-context behavioral advertising.

8 Data Retention

Retention periods for clinical, research, and regulatory records vary based on applicable law, the study protocol, and the responsible customer’s or sponsor’s recordkeeping obligations, which may include FDA recordkeeping requirements, state medical record retention laws, and contractual requirements. Beacon retains such records in accordance with instructions from the responsible customer or sponsor. Where Beacon determines retention independently, it does so for a period consistent with applicable legal and regulatory requirements.

When information is no longer required, Beacon will take reasonable steps to delete, de-identify, or securely isolate it, subject to backups, legal requirements, technical limitations, and customer instructions.

9 Security

Beacon maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction. Depending on the Service, the nature of the information involved, and applicable legal or contractual requirements, these safeguards may include access controls, role-based permissions, authentication, encryption in transit and at rest, audit logging and monitoring, backups and recovery measures, vulnerability management, workforce access controls, vendor and service-provider review, and incident-response procedures.

Beacon periodically evaluates its security practices and may update its safeguards as its Services, technology, risks, and legal obligations evolve. However, no method of electronic transmission, processing, or storage is completely secure, and Beacon cannot guarantee absolute security.

Users are responsible for safeguarding their account credentials, maintaining the security of devices used to access the Services, and promptly reporting suspected unauthorized access, compromised credentials, or other security concerns.

To report suspected unauthorized access or security concerns, contact support@beaconcr.com

10 Children and Minors

Beacon does not direct or market its Services to minors, and minors are not intended to create accounts or use the Services independently.

Certain Beacon Services may be used by parents, guardians, caregivers, healthcare providers, research sites, or other authorized adults to report information about pediatric patients or participants, including pediatric outcomes, symptoms, assessments, and related clinical or research information.

Beacon processes information concerning minors only as directed or authorized by the applicable healthcare provider, research organization, sponsor, site, parent, guardian, legally authorized representative, or other authorized adult, and subject to applicable consent, authorization, assent, research, contractual, and legal requirements.

Beacon does not knowingly collect personal information directly from children under 13 through child-directed use of the Services.

A parent, guardian, legally authorized representative, or authorized organization that believes information concerning a minor was submitted without appropriate authority should contact Beacon at support@beaconcr.com.

11 Privacy Rights and Choices

Depending on applicable law, the nature of the information involved, and Beacon’s role in processing it, an individual may have the right to request access to, correction of, deletion of, restriction of, or a copy of personal information; to request information about how personal information is processed; to withdraw consent where processing is based on consent; or to appeal a denied privacy request.

These rights are not absolute and may be limited by applicable law, clinical or research recordkeeping and retention requirements, regulatory obligations, legal holds, contractual requirements, identity-verification needs, or Beacon’s obligations to a customer. Withdrawal of consent does not affect processing that occurred before the withdrawal and may not require deletion of information that Beacon or its customers are required or permitted to retain.

To exercise a privacy right concerning personal information for which Beacon is responsible, contact info@beaconcr.com. Beacon may take reasonable steps to verify the identity and authority of the person making the request before acting on it.

Where Beacon processes personal information on behalf of a customer, such as a healthcare provider, research sponsor, study site, clinical organization, or other authorized organization, the customer may be responsible for responding to the request. Beacon may refer the request to the appropriate customer or assist the customer as required by applicable law and contractual obligations.

Communication Choices. Users may opt out of recurring SMS messages by replying STOP and may request assistance by replying HELP. Users may also update available communication preferences through account settings or by contacting Beacon. Opting out of certain communications may limit Beacon’s ability to provide reminders, notifications, or other features that depend on those communications.

12 United States State Privacy Disclosures

Residents of certain U.S. states may have additional rights under state privacy laws, subject to statutory thresholds, exemptions, and exceptions. Beacon does not sell personal information and does not share personal information for cross-context behavioral advertising. Beacon does not use sensitive personal information to infer characteristics for advertising. Authorized agents may submit requests where permitted by law, subject to verification of authority.

Beacon will not discriminate against an individual for exercising a privacy right. Where an appeal is available, instructions will be provided with the response to the request.

13 International Processing

Beacon is based in the United States, and the Services are operated primarily from the United States. Clinical, research, registry, and related programs using the Services may involve study sites, healthcare professionals, caregivers, patients, or participants located outside the United States.

Accordingly, personal information, including health, clinical, or research information where applicable, may be transferred to, stored in, accessed from, or otherwise processed in the United States or other countries in connection with authorized study operations and the provision of the Services. Privacy and data protection laws in these jurisdictions may differ from those in the country where the information was originally collected.

Where applicable law requires safeguards for international or cross-border transfers of personal information, Beacon will use appropriate legal, contractual, technical, or organizational safeguards appropriate to its role and the processing involved. These safeguards may include data-processing agreements, contractual data-protection requirements, approved transfer mechanisms, or other protections required by applicable law.

Where Beacon processes study or clinical information on behalf of a customer, the customer may be responsible for determining the lawful basis for the collection and processing of that information and for providing any required study-specific notices, consents, authorizations, or other disclosures. Beacon will process such information in accordance with applicable agreements, authorized instructions, and legal obligations applicable to Beacon.

Individuals participating in a study or clinical program outside the United States should also review any privacy notice, informed-consent document, authorization, study documentation, or other information provided by the organization responsible for their study or clinical program.

14 Third-Party Services and Links

The Services may link to or integrate with websites, applications, portals, platforms, or services operated by third parties. Some third-party services may be used to support Beacon’s Services or may be integrated at the direction of a customer.

Third-party services may have their own privacy notices, terms, and security practices. Beacon is not responsible for the privacy or security practices of independently operated third-party services, except to the extent Beacon has obligations concerning those services under applicable law or contract.

Users should review the privacy notices and terms of third-party services before providing information directly to them.

15 Changes to This Policy

Beacon may update this Privacy Policy from time to time to reflect changes in its Services, business practices, technology, legal requirements, or privacy and security practices. The revised Privacy Policy will identify the date it was last updated.

When required by applicable law or when Beacon determines that a change is material, Beacon may provide additional notice through the Services, by email, SMS, account notification, or another appropriate method.

Where required, Beacon will obtain consent or authorization before applying a material change to personal information in a manner that requires such consent or authorization.

16 Contact Us

Questions, privacy requests, or concerns may be directed to:

Organization

Beacon Life Sciences LLC, operating under the name Beacon Clinical Registry

Website

https://beaconcr.com

Email

info@beaconcr.com

support@beaconcr.com for suspected security incidents or unauthorized account activity.

Phone / SMS

+1 307-285-6336

Mailing Address

30 N Gould St. # B
Sheridan, WY 82801