TUNEHEPBTRIAL.COM WEBSITE PRIVACY NOTICE
Privacy made clear
Introduction
Tune Therapeutics, Inc. (“Tune Therapeutics”, “the Company”, “we”, “our” or “us”) is committed to protecting the privacy and security of your Personal Data.
This TuneHepBTrial.com Website Privacy Notice applies to you if you are a user of this website; a healthcare professional, investigator, site employee, contractor, consultant or other individual involved in Tune Therapeutics’ clinical trial or research activities; an employee, contractor, consultant or representative of a service provider, CRO, laboratory, vendor, regulator, ethics committee, institutional review body or other organisation that works with Tune Therapeutics; a clinical trial participant, potential participant or screening subject, where this Privacy Notice or linked privacy information is relevant to your interaction with us; and/or any other individual with whom Tune Therapeutics may conduct business.
We have developed this Privacy Notice to inform you about the Personal Data we collect, how and why we use it, who we may share it with, how long we keep it, how we protect it, and the rights and choices you may have in relation to your Personal Data.
Please note that, although this Privacy Notice refers to how we process Personal Data in the context of this website, it may also apply to certain processing outside the website context, including clinical trial operations, healthcare professional engagement, vendor management, research collaboration, pharmacovigilance, regulatory submissions and broader business communications. Where we provide you with activity-specific transparency information, such as an informed consent form, participant privacy notice, healthcare professional privacy notice, country supplement or site-specific privacy wording, that more specific information will apply to the relevant processing activity.
If this Privacy Notice conflicts with local law, the provisions of local law will prevail.
Definitions
For the purposes of this Privacy Notice:
Company means Tune Therapeutics, Inc., a biotechnology and pharmaceutical research organisation with its principal office at 1930 Boren Avenue, Floor 5, Seattle, WA 98101, USA.
Data Controller means the organisation that determines the purposes and means of processing Personal Data. Where applicable under UK GDPR and EU GDPR, Tune Therapeutics is the Data Controller for the Personal Data described in this Privacy Notice, unless otherwise stated in activity-specific privacy information.
Data Processor means an organisation that processes Personal Data on behalf of a Data Controller and in accordance with that controller’s instructions. Tune Therapeutics uses service providers, CROs, laboratories, technology vendors and other partners that may act as Data Processors.
Data Protection Legislation means applicable privacy and data protection laws, including UK GDPR, EU GDPR, the Data Protection Act 2018, PECR, applicable EU Member State laws, and any other local laws that apply to the relevant processing activity.
Healthcare Professional or HCP means healthcare professionals, investigators, principal investigators, sub-investigators, pharmacists, nurses, study coordinators, site personnel, monitors and other clinical research contacts involved in Tune Therapeutics’ research or clinical trial activities.
Personal Data means any information relating to an identified or identifiable individual, including information that identifies you directly and information that could identify you indirectly when combined with other information.
Pseudonymised Data means Personal Data that can no longer be attributed to a specific individual without additional information, provided that the additional information is kept separately and protected. In clinical trials, this may include coded participant data where the participant identification code key is retained by the clinical site.
Service Provider means any third party that provides services to Tune Therapeutics, including CROs, laboratories, hosting providers, IT providers, collaboration platforms, consultants, professional advisers and other vendors.
Website means the tunehepbtrial.com website.
B. Data Protection Legislation
Throughout this Privacy Notice, we refer to Data Protection Legislation.
a) European Union and European Economic Area
In the European Union and European Economic Area, Data Protection Legislation includes the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), the ePrivacy Directive, applicable Member State implementation laws, and any replacement or supplementary legislation that applies from time to time.
b) United Kingdom
In the United Kingdom, Data Protection Legislation includes the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), the Data (Use and Access) Act 2025, and any replacement or supplementary legislation that applies from time to time.
c) Other jurisdictions
Where individuals are located outside the UK, EU or EEA, local data protection, clinical trial, health information, privacy, medical confidentiality, regulatory or telecommunications laws may also apply. For Tune Therapeutics’ current clinical trial and research activities, this may include local requirements in jurisdictions such as Hong Kong, New Zealand and Moldova. Where local requirements apply, we may provide a local supplement, participant privacy notice, healthcare professional privacy notice, informed consent form or other activity-specific privacy wording.
d) Data controllership
Where applicable under Data Protection Legislation, Tune Therapeutics acts as Data Controller for the Personal Data it processes, unless we state otherwise. In clinical trial settings, participating clinical sites may act as independent controllers for local patient records, source records, recruitment records, consent documents and the participant identification code key. Tune Therapeutics generally receives coded or pseudonymised clinical trial data for sponsor oversight, data management, safety reporting, laboratory analysis, regulatory submissions, scientific analysis and records retention.
C. The Personal Data we collect about you
We only collect Personal Data where this is lawful, necessary and proportionate for the relevant purpose. The type of Personal Data we collect depends on your relationship with us.
| Category of individual | Examples of Personal Data |
|---|---|
| Healthcare professionals and site personnel | Name, work contact details, job title, employer or site affiliation, professional qualifications, CV or résumé information, training records, GCP records, signatures, delegation records, site role, contract details, payment-related information where applicable, correspondence and study communications. |
| Clinical trial participants, potential participants and screening subjects | Direct identifiers held by clinical sites, such as name, contact details, address, date of birth, local patient identifiers and medical record numbers; coded participant ID; year of birth; sex; site and visit identifiers; diagnosis or HBV status; eligibility information; screening results; clinical assessments; adverse events; concomitant medicines; laboratory results; biomarker or genetic data where collected; pregnancy-related information where applicable; consent choices; and participant code key held by the clinical site. |
| Vendors, CRO personnel, laboratory personnel and business contacts | Name, work contact details, job title, employer, qualifications, contract information, training records, meeting metadata, comments, signatures, correspondence and other information needed to manage the business relationship. |
| Employees, contractors and consultants | Name, contact details, employment or engagement details, role information, payment or tax information where relevant, right-to-work or professional information where relevant, system access records and business communications. |
Where you are a clinical trial participant or potential participant, directly identifiable clinical information is generally collected and retained by the participating clinical site. Tune Therapeutics, CROs, laboratories and vendors should usually receive coded or pseudonymised data unless direct identifiers are required by law, regulatory requirement, safety obligation or a specifically authorised and documented purpose.
Clinical trial participant data may include special category data, such as health data, genetic or biomarker data where collected, and pregnancy-related data where applicable.
D. How we collect your Personal Data
We may collect Personal Data directly from you when you contact us by email, telephone, post or other communication channel; participate in clinical trial or research activities; provide information as a healthcare professional, investigator, site employee, CRO contact, laboratory contact, vendor contact, consultant or business partner; enter into, perform or support a contract with us; take part in meetings, document reviews, training, audits, inspections, regulatory submissions or study communications; provide consent, privacy acknowledgements, site documentation, delegation records or other study-related information; or otherwise provide Personal Data to us.
We may also collect Personal Data from other sources, including participating clinical sites and healthcare teams; CROs, laboratories, medical monitors, vendors and service providers; regulatory authorities, ethics committees, institutional review bodies and public authorities; professional advisers, consultants and business partners; publicly available professional sources, where lawful and relevant; and IT systems, collaboration platforms, email, secure file-sharing tools, EDC/eCRF systems, Trial Master File systems and audit logs.
In clinical trial contexts, participating sites may collect and retain directly identifiable Personal Data for recruitment, informed consent, clinical care, source documentation, eligibility assessment and safety follow-up. Tune Therapeutics and its authorised CROs, laboratories and vendors generally process coded or pseudonymised trial data for sponsor oversight, data management, pharmacovigilance, laboratory analysis, regulatory submissions, scientific analysis, reporting and records retention.
E. How we use your information
Where UK GDPR or EU GDPR applies, we will only process your Personal Data where there is a valid lawful basis. We will not store, process, or transfer your Personal Data unless we have an appropriate lawful reason to do so. The lawful basis we rely on will depend on the nature of the processing activity and your relationship with us.
| Processing activity | Lawful basis | Special category condition, where relevant |
|---|---|---|
| Operating, securing and improving our website. | Legitimate interests. | Not usually applicable. |
| Recruiting, screening and managing potential clinical trial participants. | Legitimate interests, legal obligation and/or public interest, depending on the activity and jurisdiction. | Public health and scientific research. |
| Providing participant information, managing informed consent and recording privacy disclosures or optional consent choices. | Legal obligation, legitimate interests and public interest. | Public health and scientific research. |
| Conducting clinical trial activities, including participant management, data management, monitoring, pharmacovigilance, laboratory analysis, statistical analysis and reporting. | Legal obligation, legitimate interests and public interest. | Public health and scientific research. |
| Managing healthcare professionals, investigators, site personnel, CROs, vendors, laboratories and other business contacts. | Contract, legal obligation and legitimate interests. | Usually not applicable unless clinical information is included. |
| Preparing regulatory and ethics submissions, responding to authorities and maintaining inspection-ready records. | Legal obligation and public interest. | Public health and scientific research where clinical data is included. |
| Retaining, archiving, retrieving and securely destroying clinical trial, GxP, research, contract and business records. | Legal obligation and legitimate interests. | Scientific research and public health where clinical data is included. |
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you where required by law and explain the legal basis which allows us to do so.
F. Who we might share your information with
We treat Personal Data with confidentiality. However, we may share Personal Data where necessary and lawful with the following categories of recipients:
· clinical sites, investigators, healthcare teams, site personnel and local laboratories;
· contract research organisations, including CRO project teams, data management teams, monitoring teams and pharmacovigilance teams;
· central and specialty laboratories, including those involved in sample analysis, safety testing, PK/PD analysis, biomarker research and permitted future research;
· technology and hosting providers, including EDC/eCRF, Trial Master File, collaboration, email, file-sharing, analysis, reporting and secure repository providers;
· medical monitors, independent committees, advisory board members and authorised clinical research consultants;
· regulatory authorities, ethics committees, institutional review bodies, public authorities, auditors and inspectors;
· professional advisers, insurers, legal advisers, consultants and other business partners; and
· actual and prospective successors, purchasers, licensees, development or commercialization partners, or other parties involved in a corporate transaction, where lawful and subject to appropriate safeguards.
Where we use Data Processors, we require appropriate contractual safeguards, including requirements to process Personal Data only on documented instructions, protect Personal Data using appropriate technical and organisational measures, support confidentiality, manage approved sub-processors and delete or return Personal Data when required.
G. How long we keep your information for
We keep Personal Data for as long as reasonably necessary for the purposes described in this Privacy Notice, to comply with legal, regulatory, clinical trial, pharmacovigilance, GxP, accounting, contractual or reporting obligations, to resolve disputes, to maintain inspection readiness, and to establish, exercise or defend legal claims.
| Purpose or record type | Indicative retention period |
|---|---|
| Clinical trial participant records, including coded clinical, safety, laboratory, analysis, consent, TMF, regulatory and essential trial records. | At least 25 years from study completion, or longer where required by applicable law, pharmacovigilance obligations, GxP requirements, local law or legal hold. |
| Healthcare professional, investigator, site personnel and CRO/vendor personnel records forming part of essential trial records. | At least 25 years from study completion, or longer where required by law, GxP obligations, regulatory requirements or legal hold. |
| Regulatory, ethics, inspection, audit and authority correspondence records. | At least 25 years from study completion or longer where required by applicable regulatory requirements. |
| General business contact records. | Only for as long as necessary for the purpose collected, legal compliance and legitimate business needs. |
| Contract, vendor, payment, finance and business administration records. | For the applicable statutory, accounting, tax, contractual or legal limitation period. |
When retention periods expire, Personal Data will be securely deleted, anonymised or archived in accordance with applicable law, trial documentation, GxP procedures, legal hold requirements and internal records-retention processes.
H. International transfers of your Personal Data
Tune Therapeutics is based in the United States and works with clinical trial partners, CROs, laboratories and vendors in multiple jurisdictions. Personal Data may be processed in, or transferred to, the United Kingdom, the European Union/European Economic Area, the United States, Australia, Taiwan, Japan, New Zealand, Hong Kong, Moldova and other study or vendor locations where necessary for clinical trial operations, sponsor oversight, data management, pharmacovigilance, laboratory analysis, regulatory submissions, scientific analysis, reporting, collaboration and records retention.
Where UK or EU/EEA Personal Data is transferred internationally, we use appropriate safeguards where required. These may include adequacy decisions, EU Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, transfer impact assessments, transfer minimisation, pseudonymisation, encryption, role-based access controls, vendor due diligence, data processing agreements and approved sub-processor controls.
Clinical trial participant data transferred to Tune Therapeutics, CROs, laboratories and authorised vendors should generally be coded or pseudonymised. The participant identification code key should remain with the relevant clinical site unless disclosure of direct identifiers is legally required, specifically authorised and documented.
How we protect your Personal Data
Data security is of great importance to Tune Therapeutics. We have put in place appropriate technical and organisational measures designed to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
· pseudonymisation and coded participant identifiers where appropriate;
· encryption at rest and in transit;
· role-based access controls and need-to-know access;
· authentication and two-factor authentication where available;
· restricted SharePoint, ShareFile, EDC/eCRF, TMF and controlled repository access;
· secure file transfer, TLS email and password-protected files where required;
· audit logging, access reviews and backup/recovery controls where available;
· vendor due diligence, data processing agreements and approved sub-processor controls;
· GCP, security, confidentiality and policy training; and
· data minimisation, aggregation or removal of participant identifiers from external reports where possible.
J. How we keep you updated on our services
Where you are a clinical trial participant or healthcare professional involved in the planning, delivery or oversight of a Tune Therapeutics clinical trial, we may contact you directly or through our clinical sites, CROs or authorised study partners where necessary for clinical trial operations, safety communications, regulatory obligations, study management, participant support or other permitted purposes.
Where you are an employee, contractor, consultant, service provider, vendor contact, investigator, site contact or other business contact, we may contact you through appropriate business communication channels, including email, telephone, collaboration tools or secure file-sharing platforms, where necessary to manage our relationship with you, provide updates, support clinical research activities, meet legal or regulatory obligations, or administer our business.
K. Giving your reviews and sharing your thoughts
When using our website or other online services, you may be able to share information through third-party services or social networks, such as LinkedIn, or otherwise interact with content made available by Tune Therapeutics. If you choose to share, like, comment on or review content through those services, your Personal Data may be visible to the provider of the relevant service and to other users of that service, depending on your privacy settings.
Please remember that third-party services are not controlled by Tune Therapeutics. You should review the privacy settings and privacy notices of those services so that you understand how your Personal Data may be used and shared.
L. Third Party websites and links
Our website may contain links to other websites, platforms, services or resources operated by third parties. Tune Therapeutics does not control those third-party websites or services and is not responsible for their content, privacy notices, security practices or use of Personal Data.
If you submit Personal Data directly to a third-party website or service, that information will be governed by the third party’s privacy notice and terms, not this Privacy Notice. We encourage you to read the privacy notices of any third-party websites or services you visit.
M. Children’s privacy
Our website is not directed at children and does not collect Personal Data from visitors, including children.
Separate from website use, clinical trial activities may involve information about children, pregnant partners or offspring where required by the applicable protocol, informed consent materials, clinical trial law, pharmacovigilance obligations, public health requirements or other applicable law. Any such processing should be described in the relevant informed consent form, participant privacy notice, country supplement or other activity-specific privacy information.
N. Your rights over your information
Where UK GDPR, EU GDPR or other applicable Data Protection Legislation applies, you may have rights in relation to your Personal Data. These rights may include the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing, rights relating to automated decision-making, the right to withdraw consent where we rely on consent, and the right to lodge a complaint with a supervisory authority.
These rights are not absolute and may be limited where we need to retain or process Personal Data to comply with clinical trial, pharmacovigilance, regulatory, public health, scientific research, legal, GxP, audit, inspection or records-retention obligations.
a) European Union, European Economic Area and United Kingdom
If you are located in the UK, EU or EEA and would like to exercise your rights, ask a question or raise a concern about how we process your Personal Data, please contact us using the details in the Contact Us section below. For your protection, and to protect the privacy of others, we may need to verify your identity before responding to your request.
You may also have the right to lodge a complaint with the Information Commissioner’s Office in the UK or with the relevant supervisory authority in the EU/EEA. We would, however, appreciate the opportunity to address your concerns first.
b) Other jurisdictions
If you are located outside the UK, EU or EEA, you may have additional or different rights under the Data Protection Legislation that applies in your jurisdiction. For clinical trial or research activities in jurisdictions such as Hong Kong, New Zealand and Moldova, further rights information may be provided in a local supplement, informed consent form, participant privacy notice, healthcare professional privacy notice or other activity-specific privacy information.
O. Contact Us
If you would like to exercise one of your rights, ask a question, or make a complaint about this Privacy Notice or the way your Personal Data is processed, please contact Tune Therapeutics using the details below.
Company: Tune Therapeutics, Inc., 1930 Boren Avenue, Floor 5, Seattle, WA 98101, USA.
Privacy contact / Data Protection Officer: DataProtection@tunetx.com
UK representative: UKrep@tunetx.com
P. Changes to Our Privacy Notice
We may update this Privacy Notice from time to time, for example if our processing activities change, our clinical trial activities develop, our website functionality changes, or applicable law or regulatory guidance changes. We recommend that you review this Privacy Notice regularly to keep up to date with how we process Personal Data.
This Privacy Notice was last updated on November 9, 2026.