Privacy Notice
Privacy Notice for ELA026-NP001 Clinical Study
This Privacy Notice explains how Electra Therapeutics, Inc., (“Electra” or “the Sponsor” or “we”) processes the personal data collected for the clinical study ELA026-NP001 “Natural History and Real-World Outcomes with Available Therapies in Secondary Hemophagocytic Lymphohistiocytosis (sHLH)” (“NP001 Study” or “study”).
Electra, sponsor of this ELA026-NP001 Study, will indirectly obtain information about patients suffering from sHLH and their treatment, through electronic health records of selected hospitals in the Netherlands, Spain, Germany, and the United Kingdom. The data collected will then be analyzed, to understand how patients with sHLH were treated, what characteristics they had, and what their responses to treatment were.
Because the ELA026-NP001 Study relies on historical medical records, which may be old, archived, or otherwise difficult to use for contacting patients and because the study population includes deceased and severely ill patients, Electra is not able to inform individually each person whose information is collected from hospitals.
With this Privacy Notice, Electra therefore makes available to you, as one of these persons, information on how your personal information is used within ELA026-NP001 Study, in accordance with Article 14 of the EU and UK General Data Protection Regulation (GDPR).
Who is responsible for the use of your information?
The study Sponsor, Electra, whose registered headquarters are located at 230 East Grand Avenue, Suite S-100, South San Francisco, California 94080 is the data controller of your personal data and is overall responsible for the use of your information in accordance with applicable data protection laws.
The Data Protection Officer (DPO) of Electra can be contacted at electra.dpo@mydata-trust.info.
Each participating hospital is an independent data controller with respect to the medical records it maintains under applicable law. The respective roles and responsibilities of the hospital and Electra in connection with the collection and disclosure of study data are defined in written agreements in accordance with applicable laws.
Electra has appointed MyData-TRUST France (Rue de Rennes, 140b, 75006 Paris, France), to be its Data Protection Representative in the European Union (EU) pursuant to article 27 of the GDPR, and MyData-TRUST LTD (Belmont Building, Belmont Road, Uxbridge, England, UB8 1HE), to be its Data Protection Representative in the United Kingdom (UK) pursuant to Article 27 of the UK GDPR.
Why do we use your information?
Your personal information will be collected from existing medical records, checked for quality and accuracy, analyzed, and archived to achieve the study objectives described in the study protocol, for scientific research purposes.
Under Article 6 (1) (f) of the GDPR, the processing of your personal data is legally allowed because, in the context of scientific research and observational studies, the Sponsor has a legitimate interest to process your personal data to address a research gap in the understanding of the natural history of secondary hemophagocytic lymphohistiocytosis (sHLH) and characterize the demographics, treatment characteristics, and survival outcomes of sHLH subjects treated with available therapies.
Also, the authorizations to market medicines and research are ruled by strict and specific laws. Under Article 9 (2) (i) the processing of your data is necessary for the public interest in the field of public health. The study Sponsor has a legal obligation to use your information to comply with public authorities’ procedures and requests.
Which information do we use?
The information we will obtain indirectly through the selected hospitals includes:
- Demographic data: e.g., age, sex, race (if permitted);
- Health and clinical data (special category data): diagnosis and clinical history relevant to sHLH and the underlying trigger(s) of sHLH, laboratory results, therapies/treatments received and dates, hospitalizations/clinical events, and outcomes (including survival status where available);
- Administrative/record information: e.g., dates of visits/admissions/discharge, site codes,
Direct identifiers (e.g., name, full address, full contact details) are kept at the hospital/site and are not shared with Electra. The study operates using coded (pseudonymized) data. The hospital/site keeps the link between the code and your identity.
Who will have access to your data?
The study Sponsor may share your coded information with other people or organizations, in connection with the study. These may include the following:
- Service providers acting on behalf of the Sponsor (e.g., data management, statistical analysis, IT hosting), under written agreements.
- An Independent Adjudication Committee or/and any committee mentioned in the Protocol
- Competent authorities, Ethics Committees, and other regulatory bodies for oversight, inspection, or legal compliance purposes
All such recipients are subject to confidentiality and data protection obligations.
Where will your data be transferred?
Your personal data may be transferred to other countries outside the country of your residence for processing, such as the United States and Canada. Where such countries do not provide an adequate level of protection as recognized by the competent authorities, Electra will implement appropriate safeguards in accordance with Article 46 GDPR, such as Standard Contractual Clauses (SCCs) approved by the European Commission; UK International Data Transfer Agreement (IDTA) or UK Addendum, where applicable.
You have the right to ask for more information about the safeguards in place (including copies of relevant transfer mechanisms, documents, such as contractual clauses that have been put in place), by contacting our Data Protection Officer directly at electra.dpo@mydata-trust.info.
How long will your data be stored?
Electra will retain your coded study data for at least 25 years after the study completion or longer where required by applicable regulatory obligations or by law. At the end of this retention period, data will be securely destroyed or irreversibly anonymized.
What are your rights and how do you exercise them?
Subject to applicable data protection laws, you have the right to:
- Ask about what personal data concerning you is used and the purpose, and you can request a copy of all the information about you free of charge.
- You can correct or complete your information.
- Ask to limit or object to the use of your information.
- Lodge a complaint with the Supervisory Authority of your country if you consider that your information is not processed following the applicable law.
For EU Data Protection Authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-be
For UK Information Commissioner’s Office:
Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Phone: +44 (0)3 03 12 31 11 3
Website: https://ico.org.uk/global/privacy-notice/your-right-to-complain/
Please, note that certain rights may be limited where the processing is necessary for scientific research purposes and where exercising such rights would seriously impair or render impossible the achievement of the research objectives.
If you object to the processing of your information, no further data relating to you will be collected for the study. However, the information already processed up to the time of objection may need to remain in the study database to preserve scientific validity and integrity of the study, and to comply with legal obligations.
You will not be subject to decisions that will have a significant effect on you based solely on automated decision-making unless we have a justification for doing so and we have previously notified you.
If you want to know more about how we use your personal information or if you wish to exercise your rights you can contact our Data Protection Officer directly at electra.dpo@mydata-trust.info.
What security measures does Electra take to protect your personal data?
Electra processes your personal data confidentially and provides for a sufficient and adequate level of protection of your personal data. In particular, Electra takes appropriate technical and organizational security measures to protect your personal data in compliance with applicable data protection and privacy laws, which includes protection against accidental or unlawful destruction, loss, alteration, unauthorized access to, or disclosure of your personal data. Such measures include pseudonymization, access controls, encryption where appropriate, secure data hosting environments, and contractual confidentiality obligations.
When Electra retains a service provider, that provider will be carefully selected and required to use appropriate measures in accordance with applicable law to protect the confidentiality and security of personal data. That provider will only be permitted to process your data on the written instruction of Electra.
What will happen with the results of the study?
At the end of the study, a description and the results of this clinical study will be published in specialized scientific or medical journals and/or presented at scientific conferences. These publications will not include any information that directly identifies you.
Changes to this Privacy Notice
This Privacy Notice is effective from February 6, 2026. Electra may update this notice from time to time. The updated version applies from its effective date and will be made available on Electra’s website.