Privacy Policy

To facilitate your participation in clinical research, HEKMA may share the information you voluntarily provide with authorized organizations responsible for evaluating eligibility or conducting clinical studies. Depending on the study, this may include: • Clinical Research Organizations (CROs) • Pharmaceutical companies • Biotechnology companies • Medical device companies • Clinical research sites • Hospitals • Physician investigators • Research coordinators • Healthcare providers participating in the study • Other organizations authorized to conduct or support the clinical study Your information will only be shared for purposes related to: • evaluating your eligibility, • contacting you regarding a clinical study, • scheduling study-related activities, • or conducting the clinical research. If you have consented to receive future clinical research opportunities, HEKMA may also use your information to identify studies that may be relevant to you and may share your information with the authorized sponsors, CROs, research sites, investigators, hospitals, or healthcare providers responsible for evaluating your eligibility for those studies. HEKMA does not sell your personal information. If you respond to one of our advertisements on Facebook, Instagram, Google, Microsoft Bing, or other digital advertising platforms, the information you submit through the advertisement or lead form may first be collected by the applicable platform and then shared with HEKMA to respond to your inquiry and provide information about clinical research opportunities. The advertising platform's collection and processing of your information is governed by its own privacy policy.

By submitting your information through HEKMA, you authorize HEKMA to: • Contact you by phone, email, or text message regarding the clinical study you expressed interest in. • Conduct an initial pre-screening to evaluate your potential eligibility. • Share the information you voluntarily provide with the authorized sponsor, CRO, research site, investigator, hospital, or other organizations responsible for evaluating your eligibility and conducting the clinical study. If you choose to receive future clinical research opportunities, HEKMA may also contact you regarding other clinical studies that may be relevant to you and may share your information with the authorized organizations responsible for those studies. Participation in any clinical trial is entirely voluntary. Message and data rates may apply.

If you provide your mobile telephone number, you consent to receive phone calls and text messages from HEKMA regarding the clinical study you requested information about. If you have opted in to future research opportunities, you may also receive communications regarding other clinical studies that may be relevant to you. You may opt out at any time by replying STOP to a text message or by contacting: patientvoice@hekma.ai

Our website, advertisements, or communications may contain links to websites operated by sponsors, CROs, hospitals, research sites, or other organizations. HEKMA is not responsible for the privacy practices or content of those third-party websites. We encourage you to review their privacy policies before providing personal information.

HEKMA is committed to protecting the privacy and security of the information you share with us. Our Human360® and Patient Engagement platforms are designed with administrative, technical, and physical safeguards to support compliance with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) for protected health information processed within those platforms. When you initially express interest in a clinical trial through our website, social media advertisements, online questionnaires, landing pages, or other inquiry forms, your information may be collected outside of the Human360® platform. While these initial inquiry systems are not part of our HIPAA-compliant platform, HEKMA applies appropriate administrative, technical, and organizational safeguards designed to protect your information during collection, transmission, storage, and processing. Access to your information is limited to authorized HEKMA personnel and authorized study partners who require access to perform study-related responsibilities. Although HEKMA employs commercially reasonable safeguards to protect your information, no method of electronic transmission or electronic storage can be guaranteed to be completely secure.

HEKMA retains your information only for as long as reasonably necessary to: • Respond to your inquiry. • Facilitate your participation in clinical research. • Notify you of future research opportunities you have consented to receive. • Comply with legal, contractual, and regulatory obligations. • Resolve disputes and enforce our agreements. When your information is no longer required, we will securely delete or de-identify it unless a longer retention period is required or permitted by law.

You may contact HEKMA at any time to: • Request access to the personal information we maintain about you. • Request correction of inaccurate information. • Withdraw your consent for future communications. • Withdraw your consent for future sharing of your information. • Request deletion of your personal information where permitted by applicable law. Please note that withdrawing your consent may prevent us from assisting you with current or future clinical research opportunities. To exercise any of these rights, contact: Email: patientvoice@hekma.ai

If information is submitted on behalf of a minor, the individual submitting the information represents that they are the child's parent, legal guardian, or otherwise legally authorized to provide consent on the child's behalf.

If you are located in the EEA or UK, you have the following rights under the General Data Protection Regulation (GDPR): • Right of Access: Request a copy of the personal data we hold about you. • Right to Rectification: Correct inaccurate or incomplete data. • Right to Erasure ("Right to be Forgotten"): Request deletion of your data where we have no legitimate reason to retain it. • Right to Restrict Processing: Ask us to limit how we use your data. • Right to Data Portability: Receive your data in a machine-readable format. • Right to Object: Object to processing based on legitimate interests or for direct marketing. • Rights related to Automated Decision Making: We do not make solely automated decisions with legal effects. Our legal bases for processing are: (1) performance of contract (providing the trial matching service), (2) legitimate interests (platform improvement, fraud prevention), and (3) your consent (marketing emails, optional features). To exercise any GDPR right, email us at patientvoice@hekma.ai. We will respond within 30 days.

HEKMA operates services in the UAE and complies with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and its implementing regulations. Under UAE PDPL, you have the right to: • Know what personal data we hold about you. • Request correction of inaccurate data. • Request deletion of your data (subject to legal retention requirements). • Withdraw your consent at any time. • File a complaint with the UAE Data Office. Sensitive personal data (health information) is processed only with your explicit consent, which you provide during registration. You may withdraw this consent at any time via your account settings or by contacting patientvoice@hekma.ai.

Residents of California and certain other U.S. states may have additional privacy rights under applicable law. This section explains those rights and supplements the rest of this Privacy Policy. Categories of Personal Information We Collect Depending on how you interact with HEKMA, we may collect: • Contact information (such as your name, email address, telephone number, and ZIP code) • Demographic information (such as your date of birth, age, gender, preferred language, and similar information you choose to provide) • Health-related information you voluntarily provide, including medical conditions, medications, medical history, study pre-screening responses, and patient-reported information • Human360 information that you authorize us to receive, including Electronic Health Record (EHR) information, Apple Health, Google Health Connect, wearable device data, medication adherence information, and other health-related data • Internet and device information, such as your IP address, browser type, cookies, advertising identifiers, device information, and website activity Sources of Information We collect personal information directly from you, from forms completed on our websites or advertisements, from Human360 integrations that you authorize, from healthcare providers or EHR systems with your permission where applicable, and from trusted service providers that help us operate our services. How We Use Your Information We use your information to: • Respond to your inquiries • Evaluate potential eligibility for clinical research • Connect you with authorized study teams • Operate and improve Human360 and our patient engagement services • Communicate with you regarding clinical research opportunities • Measure the effectiveness of our advertising and outreach efforts • Maintain the security and integrity of our systems • Comply with applicable legal, regulatory, and contractual obligations Who We Share Information With We may share your information with authorized sponsors, Contract Research Organizations (CROs), research sites, investigators, hospitals, healthcare providers, and trusted service providers that assist us in operating our business, including cloud hosting providers, communications providers, analytics providers, customer relationship management (CRM) providers, and technology vendors. These organizations may use your information only for the purposes authorized by HEKMA and applicable law. Your Privacy Rights Depending on your state of residence, you may have the right to: • Request access to the personal information we maintain about you • Request correction of inaccurate personal information • Request deletion of your personal information where permitted by law • Obtain a copy of your personal information • Withdraw your consent for future communications where applicable • Appeal certain privacy decisions where required by applicable law To exercise any of these rights, please contact us using the information provided below. We may take reasonable steps to verify your identity before processing your request. No Sale of Personal Information HEKMA does not sell your personal information. We share personal information only with authorized clinical research partners and trusted service providers as necessary to provide our services, facilitate clinical research, communicate with you about research opportunities, or comply with legal obligations.

We may update this Privacy Policy periodically. If we make material changes, we will update the Last Updated date at the top of this page and post the revised version on our website.

If you have questions regarding this Privacy Policy or how HEKMA handles your information, please contact: HEKMA Email: patientvoice@hekma.ai