Last Updated 9 May 2023
Wave’s Privacy Policy, Notice, Statements, and Additional Information describe the details of the Personal Information Wave collects, what, why, and how that Personal Information is processed, and the rights and choices you have in relation to your Personal Information.
Effective May 21, 2020
Wave Life Sciences Ltd. and its affiliated companies (collectively, “Wave,” “we,” “us,” and “our”) are committed to respecting your privacy. This Privacy Policy explains how Wave collects and uses information from and about you as part of our business activities, including information we collect online through our websites, by email, and through other digital services and products we operate and that link to this Privacy Policy (collectively, “Wave Sites” or “Sites”), and offline, such as through trade shows and conferences, by telephone, and through other offline means.
This Privacy Policy describes the information we collect and how we collect it, how we use and share it, and the rights and choices you have in relation to your information.
Wave may also collect or receive information through special programs, such as clinical trials, that are subject to program-specific privacy notices and/or consent forms that we provide when you participate in those programs. Those notices and/or consent forms explain how any information we collect or receive through those programs will be handled. In those cases, the program-specific privacy notice and/or consent form will govern how we process the information we collect, instead of this Privacy Policy.
For more information on the Personal Information we collect, what, why, and how that Personal Information is processed, and the rights and choices you have in relation to your Personal Information see Privacy Notice
For additional information which applies specifically to Patients involved in Wave sponsored Clinical Trials see Additional Information for Patients Involved in a Wave Sponsored Clinical Trial
For additional information which applies specifically to Healthcare Professionals involved in Wave sponsored Clinical Trials see Additional Information for Healthcare Professionals Involved in a Wave Sponsored Clinical Trial
For additional information which applies specifically to Partners, Contractors, and Consultants involved in Wave sponsored Clinical Trials see Additional Information for Partners, Contractors, and Consultants Involved in a Wave Sponsored Clinical Trial
Contents
The types of personal information that Wave collects, including through the Wave Sites and offline, depends on the nature of our relationship with you and the context of your interaction with us. This Section describes the personal information we collect and how we collect it. For purposes of this Privacy Policy, “personal information” means information that identifies you or that could reasonably be used to identify you.
Wave collects personal information when you voluntarily provide it to us, such as when you submit it through the Wave Sites, email us, communicate with us by phone, or interact with us in person, such as at trade shows, conferences, and investor events. The types of personal information we collect through these methods include:
We may also receive personal information of the types listed above from third-party sources, including your company, government agencies, public records, our service providers and business partners, industry and patient groups and associations, social media or other public forums, and recruiters.
We may combine the information we receive from third-party sources with information that you provide and/or that we collect automatically when you use the Wave Sites.
We collect certain information automatically when you visit and use the Wave Sites. This information may include the following:
We may collect some of this information through tracking technologies such as cookies and web beacons. For more information please see the How We Use Cookies and Other Tracking Technologies section of this Privacy Policy.
Wave uses the information we collect for the following purposes:
To accomplish the purposes set out above, we may share your personal information with third parties. We do not sell or rent personal information to third parties for their own marketing purposes. The third parties with whom we may share your personal information include:
We may also collect information about your use of Wave Sites through tracking technologies such as cookies and web beacons. A “cookie” is a unique numeric code that is transferred to your computer to track your interests and preferences and to recognize you as a return visitor. A “Web beacon” is a transparent graphic image placed on a Web site, e-mail or advertisement that enables the monitoring of things such as user activity and site traffic. To learn more about cookies and other tracking technologies, including how to disable them, you can visit http://www.allaboutcookies.org/.
We and third-parties with whom we work use cookies and web beacons on the Wave Sites to improve user experience, to help remember your preferences and allow us to bring you the content and features that are likely to be of interest to you, including on the basis of “clickstream” data that shows your previous activities on Wave Sites, and to analyze the use of our Sites and to improve Site functionality.
One of the ways we do this is through the use of Google Analytics. For more information about how Google Analytics uses and processes data, please visit https://www.google.com/policies/privacy/partners/. In addition to the standard Google Analytics implementation, the Wave Sites may use additional Google Analytics features, including but not limited to Demographics and Interest Reporting, which may collect non-identifiable demographic information, including your age and gender, and your interests. We do not connect identifiable information with non-identifiable information collected through these means. You may opt out of the collection of this information by visiting: https://tools.google.com/dlpage/gaoptout/.
We and our third-party service providers and business partners may use cookies and web beacons to collect information about your online activities over time and across our Sites and third-party websites or online services third-party websites.
For more information about the cookies we use on the Sites, please see our Cookie Policy. You can manage the cookies set when you visit the Sites by visiting our Cookies Settings tool. Your preference selection will be stored for up to one year unless you clear your browser history or switch browsers or computers.
Wave does not knowingly collect or use any personal information directly from children on Wave Sites (Wave defines “children” as minors younger than 18). We do not knowingly collect information from children through the Wave Sites. If you are a parent and believe that your child has provided us with information, please contact us using one of the methods specified below, and we will work with you to address the issue.
We provide you with certain choices regarding your personal information. For example, you can choose not to give us the personal information we request, as described in the “Information You Provide” section of this Privacy Policy. However, in some cases, if you decide not to provide the personal information we request, we will not be able to provide the service or information you requested.
Other examples of your choices include:
The Sites are operated from the United States, and therefore if you are visiting the Sites from a country other than the United States, your interactions with the Sites and with us will necessarily result in the transfer of information across international borders. In addition, information we collect in other contexts may be shared with our affiliates and other third parties that are located in other countries in accordance with this Privacy Policy.
The level of legal protection for Personal Information is not the same in all countries, and the laws in other countries may not provide the same level of protection for personal information as those in your country. By using this Sites and providing your information to us, you understand and agree that your Personal Information will be stored and processed in the United States and in any country to which we may transfer your information in the course of our business operations.
Wave maintains information security safeguards that are reasonably designed to protect your Personal Information from unauthorized access, use, and alteration. Please note however that no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee the security of your personal information. PLEASE DO NOT SEND SENSITIVE HEALTH OTHER SIMILAR INFORMATION TO US VIA THE Wave SITES.
Wave Sites may contain links to other third-party websites. These websites are not subject to this Privacy Policy. These websites are not controlled by Wave and Wave is not responsible for their content or their privacy policies, which may differ from ours. We have not reviewed and make no representations about the accuracy of information on third-party websites, or about their information handling practices. Visits you make to these websites are at your own risk, and we encourage you to review their privacy policies.
To contact us with questions or concerns about this Privacy Policy, or to exercise any rights you may have under applicable law, please contact our Privacy Office by emailing us at [email protected]. You may also send a letter to the following address:
Wave Life Sciences USA, Inc.
Attn: Privacy Office
733 Concord Ave.
Cambridge, MA 02138
USA
Wave is committed to resolving your privacy concerns and any complaints. In all communications to Wave, please include your email address, and provide the web site address, mobile application, and/or other context in which we collected your personal information, along with a detailed explanation of your request. We may need to further confirm your identity in order to process certain requests.
This Privacy Policy covers the following Wave entities:
We reserve the right to change the terms of this Privacy Policy at any time. Any changes to this Privacy Policy will be reflected on this page with a new effective date. We will continue to use and/or disclose information in accordance with the policy in effect at the time the data was collected. Wave encourages you to review this Privacy Policy regularly for any changes. Your continued use of the Wave Sites after we post changes is deemed to be acceptance to those changes.
Effective 22 June 2022
Wave Life Sciences Ltd. and its affiliated companies, including specifically Wave Life Sciences USA, Inc., Wave Life Sciences UK Limited, Wave Life Sciences Ireland Limited, and Wave Life Sciences Japan, Inc., (collectively, “Wave,” “we,” “us,” and “our”) are committed to respecting your privacy. This Privacy Notice explains how any Personal Information we collect or receive will be handled.
This Privacy Notice describes the Personal Information we collect, what, why, and how that Personal Information is processed, and the rights and choices you have in relation to your Personal Information.
For the purpose of this Privacy Notice, Wave will often reference the General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”) for purposes of the collection and processing of Personal Information in the European Union (“EU”). This reference is intended to include the UK GDPR and UK Data Protection Act for purposes of the collection and processing of Personal Information in the United Kingdom (“UK”).
As Wave is a global organization, the Personal Information we collect, and process may come from a variety of countries, states, or municipalities. Each location may have its own specific local privacy laws or regulations. For example, to the extent it aligns when it enters into force in September 2023, the Swiss New Act called the Federal Data Protection Act (FDPA) will also be incorporated herein.
Please note that any companies in China wishing to do business with a Wave entity must comply with the Personal Information Protection Law (PIPL) and should not send any personal information to Wave unless it is necessary to enter into or perform a contract to which the individual is a party. Wave does not wish to receive any Personal Information from individuals residing in China. Contractual performance is the only basis by which Wave processes Personal Information, and it does so in line with the same provisions laid out in this Privacy Notice.
While there may be slightly different or analogous terms used in each country where Personal Information is collected and/or processed, for the purpose of this Privacy Notice, Wave will use the general terms found in the GDPR, such as Data Controller and Data Processor, for ease of review.
A Data Controller is an organisation that is responsible for making decisions and setting out the rules for how your information is collected and used by itself and other organisations it works with when processing your personal information.
Wave is the Data Controller of the personal information provided to us by you (your Personal Information).
A Data Processor is an organisation that receives your personal information from a Data Controller, but it must follow the rules given to it by the Data Controller.
Our partners, contractors and consultants may act as a controller or processor depending upon the specific relationship, we have with them. Through contractual agreements, we ensure the privacy, security, and confidentiality of your personal information.
At Wave, we recognize the importance of, and are fully committed to protecting the privacy of your Personal Information.
Wave’s Data Protection Officer (“DPO”) can be contacted at: [email protected]
Personal Information is defined by the GDPR as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
‘Personal Information’ may be defined differently in other countries or regions. The provisions here outline the general practices for processing of Personal Information by Wave.
Personal Information is any information about you that identifies you or that could reasonably be used to identify you. Personal information covers obvious information such as your name and contact details, but it may also cover less obvious information.
Personal Information collected online can come through Wave’s websites, by email, and through other digital services and products Wave may operate. Such Personal Information can include, for example, the Internet Protocol (“IP”) address of your computer, which may reveal your approximate location. Wave uses the Personal Information collected for various purposes which may include but are not limited to the following: to respond to your inquiries and otherwise communicate with you about our products and services; to provide and deliver services you request (webinars, presentations, and publications); to offer and provide information; to staff, facilitate, conduct and manage clinical trial; and comply with regulatory monitoring and reporting obligations.
For further details and more specifics on what Wave collects online and how it is used, and for information on how we use Cookies and other tracking technologies please see our Privacy Policy.
Personal Information collected by Wave through special programs, such as in connection with our sponsored clinical trials, depends on the context of your interaction with us. For additional information on what Wave collects in connection with our sponsored clinical trials please see “Additional Information.”
The Personal Information we collect depends on the nature of your interaction with Wave. In general, the types of Personal Information we may collect include but are not limited to the following:
Based on the nature of the interaction, Wave may also collect what is referred to as “sensitive” Personal Information. This type of Personal Information is treated with heightened protection due to the impact disclosure could have on a person’s livelihood, quality of life, and ability to participate in daily activities. For example, with our sponsored clinical trials, Wave would be aware of the disease state of the participants. In general, Wave does not normally collect sensitive PI outside of what is needed for our clinical trials.
The GDPR defines specific types of Personal Information as “Sensitive Personal Information,” which mean any information relating to an individual’s:
Your Personal Information is obtained for the purposes of the interaction with Wave, and is necessary under one or more of the following legal bases:
In these situations, we would take into account and balance your rights with our interests.
Under the GDPR, or other applicable privacy laws, a legal basis for collecting and using personal information should exist (for a list of these bases see The Legal Bases for Processing Your Personal Information). The legal basis may be because the data is necessary for our performance of a contract with you or one of our clients, because you have consented to our use of your personal information, because it is in our legitimate business interests to use it, or for another legal basis.
For example:
We will process information for further compatible purposes, where lawful to do so (such as for archiving, scientific or market research purposes) or when legally obliged to do so (such as reporting information for Wave’s risk management and drug safety obligations).
You provide it to us when you:
Pseudonymization is a safeguard, where Personal Information or any information which could be used to identify an individual, is replaced with a pseudonym, or, in other words, a code which does not allow the individual to be directly identified. Pseudonymization makes it almost impossible to identify the Personal Information without the necessary key. A “key” is the link between the pseudonymized or coded information and the identifiable Personal Information. The sender retains the key, to help prevent reidentification of pseudonymized information or data.
Your personal information is processed by us or by one or more organisations acting on our behalf.
We use appropriate technical and organisational measures to protect your Personal Information. When handling the information of HCPs, we take reasonable steps to protect it from loss, misuse, unauthorised access, disclosure, alteration, or destruction.
We may store or transfer some or all of your Personal Information to countries that are not part of the European Union (including the EEA Member States Norway, Iceland, and Liechtenstein). These are known as “third countries” and may not have data protection laws that are as strong as those in the EU. This means that we will take additional steps in order to ensure that your personal information is treated just as safely and securely as it would be within the EU and under the GDPR.
The confidentiality, privacy and security of your personal information is essential to us, and to protect your data, we take a number of important measures, including the following:
If any of your personal information is required by a third party, we will take steps to ensure that your personal information is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.
We may store in or transfer to some or all your personal information to countries that are not part of the EU. These countries may not have data protection laws that are as strong as those in the EU. This means that we will take additional steps to ensure that your personal information is treated just as safely and securely as it would be within the EU.
We disclose individual information where this is reasonably required to pursue our legitimate business objectives and as required by law. Information will be disclosed only in accordance with applicable laws, and appropriate safeguards will be established, where possible, to protect your information. We may disclose information within Wave and our worldwide affiliates.
In order to conduct our business, we may also disclose information to third parties such as public/regulatory authorities/governmental bodies (government, including social and benefits departments), third parties that provide services to us (such as conducting audits, IT services, assisting in our clinical trials and studies or health care compliance activities), business partners and collaborators (such as external scientists).
If Wave or substantially all of our assets are acquired by a third party, personal information held by us about individuals will be included as transferred assets.
We may also disclose information to enforce any agreements we have with you or to protect our rights or the rights, property or safety of our employees, patients or others (e.g., visitors to Wave premises).
We will not keep your personal information for any longer than is necessary consistent with the reason(s) for which it was first collected.
Under the GDPR, you have the following rights, which we will always work to uphold:
If you have a complaint, we would like to have the opportunity to address it first, this does not stop you from making a complaint to the Data Protection Supervisory Authority.
Further information about your rights can also be obtained from your national Data Protection Supervisory Authority or the Supervisory Authority in the country in the EU where Wave’s or the Data Protection Officer are based. A list can be found here: https://digital-strategy.ec.europa.eu/en/library/list-personal-data-protection-competent-authorities.
We may refuse to comply with your rights where the rights of other persons would be violated, where any other legal exemptions may apply, where your request is not legitimate or applicable, or where it is not in our legitimate interests to the extent allowed by the data protection laws applicable in the EU and your country. If we refuse to comply, we will explain to you our reasons for doing so.
We would encourage you to exhaust our complaints processes, however if you still feel that your personal information has not been handled appropriately according to the law, you can contact a Supervisory Authority and file a complaint with them.
To exercise your rights, please contact us using the information provided in the “How to Contact Us” section of Wave’s Privacy Policy.
If you want to know what personal information, we have about you, you can ask us for details of that personal information and for a copy of it (if any such personal information is held). This is known as a “subject access request”.
All subject access and other rights requests should be made in writing and sent to the Data Protection Officer at [email protected]. Click here to submit a form to make your subject access request.
There is not normally any charge for a subject access and other rights requests. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will endeavor to respond to your subject access request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal information protection. Modifications will be posted on Wave’s website, so please check back.
If there are any changes to the purposes for which we have obtained your personal information, or the legal basis used, we will contact you. The changes shall be explained to you, and your agreement or disagreement obtained.
If you are a (i) Patient involved in a Wave sponsored clinical trial; (ii) a Healthcare Professional involved in a Wave sponsored clinical trial; or (iii) a Partner, Contractor or Consultant involved in a Wave sponsored clinical trial, click one of the links below to learn more about Data Privacy.
For additional information which applies specifically to Patients involved in Wave sponsored Clinical Trials see Additional Information for Patients Involved in a Wave Sponsored Clinical Trial
For additional information which applies specifically to Healthcare Professionals involved in Wave sponsored Clinical Trials see Additional Information for Healthcare Professionals Involved in a Wave Sponsored Clinical Trial
For additional information which applies specifically to Partners, Contractors, and Consultants involved in Wave sponsored Clinical Trials see Additional Information for Partners, Contractors, and Consultants Involved in a Wave Sponsored Clinical Trial
Effective 22 June 2022
In addition to the information found in the Privacy Notice, the following additional information applies specifically to patients involved in Wave’s Clinical Trials.
While the information contained both here and in the Privacy Notice outlines the general practices and policies of Wave in relation to the processing of Personal Information, it is subordinate to the Informed Consent Form you signed as part of your enrollment in the Wave Sponsored Clinical Trial. This means that the Informed Consent Form is your primary reference for how Personal Information is processed in the Wave Sponsored Clinical Trial.
As part of participating in a Wave Sponsored Clinical Trial, you were required to sign an Informed Consent Form or ICF. The name of this document may be slightly different. For any questions on the ICF please consult the study doctor or site administrator.
In general, the types of Personal Information collected in a Wave Sponsored Clinical Trial, may include the following:
For specifics on the Personal Information to be collected in the Wave Sponsored Clinical Trial for which you are a participant, please refer to the ICF you signed and/or check with your study doctor or site administrator.
Personal Information collected by Wave as part of a Wave Sponsored Clinical Trial is pseudonymized. That means it is replaced with a pseudonym, or, in other words, a code which does not allow you, the individual, to be directly identified. This process is called pseudonymization. The pseudonymization information is provided to Wave as part of the Wave Sponsored Clinical Trial and the study doctor retains the key to help prevent reidentification of pseudonymized information or data.
Pseudonymization is a safeguard, where Personal Information or any information which could be used to identify an individual, is coded making it almost impossible to identify the Personal Information without the necessary key. A “key” is the link between the pseudonymized or coded information and the identifiable Personal Information. The sender, the study doctor in the case of Wave Sponsored Clinical Trials, retains the key to help prevent reidentification of pseudonymized information or data.
While the information contained both here and in the Privacy Notice outlines the general practices and policies of Wave in relation to the processing of Personal Information, it is subordinate to the Informed Consent Form you signed as part of your enrollment in the Wave Sponsored Clinical Trial.
We will not share any of your Personal Information, including pseudonymized information, provided to use directly or indirectly with any unauthorized third parties for any other purposes, subject to the following exceptions:
The Personal Data we collect from you may also be processed, accessed, or stored in a country outside the country where Personal Data was initially collected, which may not offer the same level of protection of Personal Data, including the US. If we transfer your Personal Data in other jurisdictions, we will make sure to protect your Personal Data by (i) applying the level of protection required under the local data protection/privacy laws applicable to the country where Personal Data was initially collected, (ii) acting in accordance with our policies and standards and, (iii) for entities located in the European Economic Area (i.e. the EU Member States plus Iceland, Liechtenstein and Norway, the “EEA”), or in the UK or Switzerland, unless otherwise specified, only transferring your Personal Data on the basis of the European Commission Standard Contractual Clauses, or another legal mechanism, as applicable. You may request additional information in relation to international transfers of Personal Data and obtain a copy of the adequate safeguard put in place by exercising your rights as described below.
For intra-group transfers of Personal Data, the Wave has adopted Standard Contractual Clauses, or another equivalent legal mechanism as applicable, in an effort to ensure effective levels of data protection relating to transfers of Personal Data outside the EEA, Switzerland and UK.
We may retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, to adhere to our policies, and for any period as legally required or permitted by applicable law. Under international and national regulations governing the research and development of medicines, we are required to keep your personal information and study coded information for the required period of time in your country (in general that is usually up to 25 years) after the end of the clinical trial and according to our Data Retention Policy. After this period, your personal information will be irreversibly destroyed or retained for a further period if required by law. Please refer to the Informed Consent Form for further details.
Please remember that when your personal information is pseudonymized we cannot identify you directly. Therefore, we recommend you contact your study doctor or healthcare institution if you wish to exercise the following rights.
You can ask us to confirm that we are processing your personal information, and to request access to that personal information including to check its accuracy and to ask us to amend any inaccurate data.
You may also ask us to restrict processing or object to the processing of your personal information. However, in a clinical trial, should you withdraw your consent to future processing, this would make it impossible for you to continue in the study. In addition, although you have the right to withdraw your consent at any time, this will not affect the lawfulness of us processing your personal information collected before your withdrawal.
Where we process your personal information under our legitimate interests, your right to erasure is limited by our legitimate interest to continue the processing, our legal obligations, our public interest (public health – high standards of quality and safety of health care and of medicinal products, or medical devices), scientific research, historical research, or statistical purposes, or for the establishment, exercise or defence of legal claims.
You can request that your personal information is provided to you or directly transmitted to another data controller nominated by you. This will be done in structured, commonly used, and machine-readable format. However, if we cannot retrieve your personal information because we cannot identify you directly or where it may infringe the privacy rights of other clinical trial subjects, we may refuse your request.
We will provide you with a response to your request within 30 days upon receipt of your request and having verified your identity. Should there be any delay we will inform you within one month of the request; if appropriate we can extend this period by two further months, and we shall explain our reasons for doing so.
In addition to the information found in the Privacy Notice and Informed Consent Form, the following additional information applies specifically to patients involved in Wave sponsored Clinical Trials.
Wave has appointed DataRep as their Data Protection Representative in the European Union so that you can contact them directly in your home country. DataRep has locations in each of the 27 EU countries, the UK, and Norway & Iceland in the European Economic Rrea (EER), so that Wave’s customers can always raise the questions they want with them.
If you want to raise a question to Wave, or otherwise exercise your rights in respect of your personal data, you may do so by:
PLEASE NOTE: when mailing inquiries, it is ESSENTIAL that you mark your letters for ‘DataRep’ and not ‘Wave Life Sciences’, or your inquiry may not reach us. Please refer clearly to Wave Life Sciences in your correspondence. On receiving your correspondence, Wave Life Sciences is likely to request evidence of your identity, to ensure your personal data and information connected with it is not provided to anyone other than you.
If you have any concerns over how Data Rep will handle the personal data, we will require to undertake our services, please refer to our privacy notice at www.datarep.com/privacy-policy.
| COUNTRY | ADDRESS | |||
| Austria | DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria | |||
| Belgium | DataRep, Place de L’Université 16, Louvain-La-Neuve, Waals Brabant, 1348, Belgium | |||
| Bulgaria | DataRep, 132 Mimi Balkanska Str., Sofia, 1540, Bulgaria | |||
| Croatia | DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia | |||
| Cyprus | DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus | |||
| Czech Republic | DataRep, IQ Ostrava Ground floor, 28. rijna 3346/91, Ostrava-mesto, Moravska, Ostrava, Czech Republic | |||
| Denmark | DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark | |||
| Estonia | DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia | |||
| Finland | DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland | |||
| France | DataRep, 72 rue de Lessard, Rouen, 76100, France | |||
| Germany | DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany | |||
| Greece | DataRep, 24 Lagoumitzi str, Athens, 17671, Greece | |||
| Hungary | DataRep, President Centre, Kálmán Imre utca 1, Budapest, 1054, Hungary | |||
| Iceland | DataRep, Kalkofnsvegur 2, 101 Reykjavík, Iceland | |||
| Ireland | DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland/td> | |||
| Italy | DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy | |||
| Latvia | DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia | |||
| Liechtenstein | DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria | |||
| Lithuania | DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania | |||
| Luxembourg | DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg | |||
| Malta | DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta | |||
| Netherlands | DataRep, Cuserstraat 93, Floor 2 and 3, Amsterdam, 1081 CN, Netherlands | |||
| Norway | DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway | |||
| Poland | DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland | |||
| Portugal | DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061,Portugal | |||
| Romania | DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania | |||
| Slovakia | DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia | |||
| Slovenia | DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia | |||
| Spain | DataRep, Calle de Manzanares 4, Madrid, 28005, Spain | |||
| Sweden | DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE – 211 46, Sweden | |||
| United Kingdom | DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom | |||
Effective 22 June 2022
In addition to the information found in the Privacy Notice, the following additional information applies specifically to Healthcare Professionals involved in Wave sponsored Clinical Trials
While the information contained both here and in the Privacy Notice outlines the general practices and policies of Wave in relation to the processing of Personal Information, it is subordinate to the Consent Form you signed as part of your involvement in the Wave Sponsored Clinical Trial.
As a healthcare professional participating in a clinical trial sponsored by Wave, we may collect some or all of the additional following personal information as a result of your participation:
The above Personal Data will be processed for the following purposes:
If applicable to a Study, your Personal Data (name and contact information) may be incorporated in subject recruitment advertisements (print media or on Internet). Any such advertisement would be approved by the Ethical Committee where required before it is made public.
We will not sell, share, or otherwise transfer your Personal Data to third parties other than those indicated in this Privacy Notice. In the course of our activities and for the purposes listed in this Privacy Notice, your Personal Data can be accessed by, or transferred to the following categories of recipients, on a need-to-know basis to achieve such purposes:
The above third parties are contractually obliged to protect the confidentiality and security of your Personal Data in compliance with applicable law.
Your Personal Data can also be accessed by or transferred to any national and/or international regulatory body, or Ethics Committee where necessary in order to fulfill the purposes outlined above.
The Personal Data we collect from you may also be processed, accessed or stored in a country outside the country where Personal Data was initially collected, which may not offer the same level of protection of Personal Data, including the US. If we transfer your Personal Data in other jurisdictions, we will make sure to protect your Personal Data by (i) applying the level of protection required under the local data protection/privacy laws applicable to the country where Personal Data was initially collected, (ii) acting in accordance with our policies and standards and, (iii) for entities located in the European Economic Area (i.e. the EU Member States plus Iceland, Liechtenstein and Norway, the “EEA”), or in the UK or Switzerland, unless otherwise specified, only transferring your Personal Data on the basis of the European Commission Standard Contractual Clauses, or another legal mechanism, as applicable. You may request additional information in relation to international transfers of Personal Data and obtain a copy of the adequate safeguard put in place by exercising your rights as described below.
For intra-group transfers of Personal Data, the Wave has adopted Standard Contractual Clauses, or another equivalent legal mechanism as applicable, in an effort to ensure effective levels of data protection relating to transfers of Personal Data outside the EEA, Switzerland and UK.
Unless we need to retain the data longer to comply with legal or regulatory requirements, or per your consent, Wave will retain your Personal Data for as long as required by local laws or regulations. For example, as part of the CSR, Wave would need to maintain this record in our TMF in compliance with country specific laws and regulations (for the majority of countries that would be for an additional 15-25 years). Furthermore, some of your Personal Data may be contained in Wave’s project management records, which we eventually archive and retain on an on-going basis. Wave and certain other third parties who receive your Personal Data as described above may retain your data for longer or shorter periods.
In addition to the information found in the Privacy Notice and Informed Consent Form, the following additional information applies specifically to patients involved in Wave sponsored Clinical Trials.
Wave has appointed DataRep as their Data Protection Representative in the European Union so that you can contact them directly in your home country. DataRep has locations in each of the 27 EU countries, the UK, and Norway & Iceland in the European Economic Rrea (EER), so that Wave’s customers can always raise the questions they want with them.
If you want to raise a question to Wave, or otherwise exercise your rights in respect of your personal data, you may do so by:
PLEASE NOTE: when mailing inquiries, it is ESSENTIAL that you mark your letters for ‘DataRep’ and not ‘Wave Life Sciences’, or your inquiry may not reach us. Please refer clearly to Wave Life Sciences in your correspondence. On receiving your correspondence, Wave Life Sciences is likely to request evidence of your identity, to ensure your personal data and information connected with it is not provided to anyone other than you.
If you have any concerns over how Data Rep will handle the personal data, we will require to undertake our services, please refer to our privacy notice at www.datarep.com/privacy-policy.
| COUNTRY | ADDRESS | |||
| Austria | DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria | |||
| Belgium | DataRep, Place de L’Université 16, Louvain-La-Neuve, Waals Brabant, 1348, Belgium | |||
| Bulgaria | DataRep, 132 Mimi Balkanska Str., Sofia, 1540, Bulgaria | |||
| Croatia | DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia | |||
| Cyprus | DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus | |||
| Czech Republic | DataRep, IQ Ostrava Ground floor, 28. rijna 3346/91, Ostrava-mesto, Moravska, Ostrava, Czech Republic | |||
| Denmark | DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark | |||
| Estonia | DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia | |||
| Finland | DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland | |||
| France | DataRep, 72 rue de Lessard, Rouen, 76100, France | |||
| Germany | DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany | |||
| Greece | DataRep, 24 Lagoumitzi str, Athens, 17671, Greece | |||
| Hungary | DataRep, President Centre, Kálmán Imre utca 1, Budapest, 1054, Hungary | |||
| Iceland | DataRep, Kalkofnsvegur 2, 101 Reykjavík, Iceland | |||
| Ireland | DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland/td> | |||
| Italy | DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy | |||
| Latvia | DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia | |||
| Liechtenstein | DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria | |||
| Lithuania | DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania | |||
| Luxembourg | DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg | |||
| Malta | DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta | |||
| Netherlands | DataRep, Cuserstraat 93, Floor 2 and 3, Amsterdam, 1081 CN, Netherlands | |||
| Norway | DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway | |||
| Poland | DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland | |||
| Portugal | DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061,Portugal | |||
| Romania | DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania | |||
| Slovakia | DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia | |||
| Slovenia | DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia | |||
| Spain | DataRep, Calle de Manzanares 4, Madrid, 28005, Spain | |||
| Sweden | DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE – 211 46, Sweden | |||
| United Kingdom | DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom | |||
Effective 22 June 2022
In addition to the information found in the Privacy Notice, the following additional information applies specifically to Wave’s Partners, Contractors and Consultants involved in Wave’s Clinical Trials.
As a partner, contractor, or consultant with whom we have a business relationship, we may collect some or all of the additional following personal information from you directly, or indirectly through our partners, contractors, or consultants (that is the legal entity you work for) for the purposes of a clinical trial:
Personal Information will be processed for the following purposes:
Wave will not sell, share, or otherwise transfer your Personal Data to third parties other than as indicated here, in your agreement with us, in the Consent Form you signed, or in the Privacy Notice.
In general, your Personal Data may be accessed by, or transferred to the following categories of recipients, on a need-to-know basis:
The above third parties are contractually obliged to protect the confidentiality and security of your Personal Information in compliance with applicable law.
Your Personal Information may also be accessed by or transferred to any national and/or international regulatory body, or Ethics Committee where necessary in order to fulfill the purposes of our interactions.
The Personal Data we collect from you may also be processed, accessed, or stored in a country outside the country where Personal Data was initially collected, which may not offer the same level of protection of Personal Data, including the US. If we transfer your Personal Data in other jurisdictions, we will make sure to protect your Personal Data by (i) applying the level of protection required under the local data protection/privacy laws applicable to the country where Personal Data was initially collected, (ii) acting in accordance with our policies and standards and, (iii) for entities located in the European Economic Area (i.e. the EU Member States plus Iceland, Liechtenstein and Norway, the “EEA”), or in the UK or Switzerland, unless otherwise specified, only transferring your Personal Data on the basis of the European Commission Standard Contractual Clauses, or another legal mechanism, as applicable. You may request additional information in relation to international transfers of Personal Data and obtain a copy of the adequate safeguard put in place by exercising your rights as described below.
For intra-group transfers of Personal Data, the Wave Life Sciences’ entities have adopted Standard Contractual Clauses, or another equivalent legal mechanism as applicable, in an effort to ensure effective levels of data protection relating to transfers of Personal Data outside the EEA, Switzerland and UK.
For personal information obtained from our partners, contractors, and consultants, Wave will generally retain personal information for a period of 10 years after discontinuation of our business relationship with you.
If you want to know what personal information, Wave has about you, you can ask us for details of that personal information and for a copy of it (if any such personal information is held). This is known as a “subject access request.”
All subject access and other rights requests should be made in writing and sent to the Data Protection Officer at [email protected]. Click here to submit a form to make your subject access request.
There is not normally any charge for a subject access and other rights requests. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will endeavor to respond to your subject access request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress
Wave, collects, holds, and processes certain Personal Data about our consultants, agents, contractors, and participants in our scientific research such as clinical trials (“data subjects”). As a data subject, you have a legal right, under EU Regulation 2016/679 General Data Protection Regulation (“GDPR”) to find out about our use of your Personal Data as follows:
No fee is payable under normal circumstances. We reserve the right to charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive. Such charges will be based only on the administrative cost that we will incur in order to respond.
Please complete the required information and return it to us in one of the four following ways:
Wave Life Sciences has appointed DataRep as their Data Protection Representative in the European Union so that you can contact them directly in your home country. DataRep has locations in each of the 27 EU countries, the UK, and Norway & Iceland in the European Economic Rrea (EER), so that Wave’s customers can always raise the questions they want with them.
If you want to raise a question to Wave, or otherwise exercise your rights in respect of your personal data, you may do so through DataRep by:
PLEASE NOTE: when mailing inquiries to DataRep, it is ESSENTIAL that you mark your letters for ‘DataRep’ and not ‘Wave Life Sciences’, or your inquiry may not reach us. Please refer clearly to Wave Life Sciences in your correspondence.
PLEASE NOTE: It is not recommended to transmit sensitive information, including sensitive personal data such as Social Security numbers, passwords, health or medical information, or financial account information, via email. Unencrypted email is not a secure way to transmit information. If email is your preferred method of submitting your request, encrypted email should be used whenever possible.
On receiving your correspondence, Wave Life Sciences is likely to request evidence of your identity, to ensure your personal data and information connected with it is not provided to anyone other than you.
After receiving your subject access request, we may contact you to request additional supporting information and/or proof of your identity and/or protected legal relationship. This helps us to safeguard your privacy and Personal Data.
We will respond to all subject access requests within one month of receipt and will aim to provide all required information to you within the same period. If we require more information from you, or if your request is unusually complicated, we may require more time and will inform you accordingly.
If you are making a subject access request on someone else’s behalf, please contact the Data Protection Officer by email before making your request.
Please note that Personal Data from participation in clinical trials is pseudonymized (i.e. we cannot identify you by name, only by your subject identification number). This makes it impossible for us to match data to you. If you still want to make a subject access request, you must contact your study doctor first and give written consent for your name and subject identification number to be matched up by your study doctor. Your study doctor should then contact the Data Protection Officer, [email protected]. We will require a copy of your consent. Even if your consent is given, we may be unable to directly identify your data or, where it is aggregated with other data subjects, we will be unable to provide it as to do so would risk the privacy of other people. If the study is ongoing, we may be delayed in disclosing the requested information until after the study has completed or until after you have withdrawn your consent to continuing to participate in the study (note, that all data collected prior to your withdrawal from the study may also not be able to be disclosed until completion of the study).
X
LinkedIn
Glassdoor