This privacy notice (“Notice”) describes how Bristol-Myers Squibb Company and its affiliates (“BMS”, “we”, “us” or “our”) will use Information about you (“Personal Information” or “Personal Data”) in the context of a decentralized clinical trial or studies (DCT) that involve the use of digital means and remote capabilities. BMS as the sponsor offers digital solutions to research participants, healthcare organizations and investigators (“you” or “your”) to run remote clinical studies. This means that, where needed, we may use third party platforms and devices to provide tools, features, capabilities and remote access to your study doctor. Depending on the setup of the study, we may combine remote means and devices and on-site visits.

Our studies will be conducted in accordance with all applicable laws.  This means we will obtain prior approval before the study by submitting appropriate documentation, such as informed consent forms (ICF) and study protocols to health authorities and ethics committees.

• Research participant. If you are a research participant in a BMS decentralized study, your physician will inform you so that you can agree to participate to such a study, from a public health perspective, via the paper or electronic ICF (e-consent or e-ICF) and you may withdraw from your agreement to participate at any time by contacting the physician responsible to conduct the study with you.
• Healthcare professionals (“HCP”, “healthcare professional” or “investigator”). If you are a healthcare professional or an investigator involved in a BMS decentralized study, BMS will access limited information about you to conduct the study and to communicate with you in this context. You can read more information about how BMS uses your Personal Information here: https://www.bms.com/privacy-policy.html#hcp.

Decentralized studies are part of the wider BMS digital strategy. It aims to bring digital innovation to you as a research participant or as a healthcare professional / investigator. Subject to applicable regulations and in conformity with them, this will include the use of remote digital capabilities to support research participants in patients’ journey before, during and after using BMS products as candidate or approved medicines. This also enables investigators to facilitate communication and centralize information about their research participants through a single platform. As sponsor, BMS may collect key information that can support the launch of new medicines or conduct research obtained digitally.

Bristol-Myers Squibb Company (BMS) and, where applicable, its affiliates, will be the sponsor of decentralized studies that you may participate in when sharing your information and connecting to our digital platforms and devices. In this context, BMS will act as controller together with its affiliates of your Personal Information. The name of the sponsor will appear in the protocol and the informed consent form that you will receive before you decide to participate in the study.

When conducting decentralized studies, BMS can enable you to:

As a research participant:

• Share your contact and pre-screening information with an investigator: If you entered your details through a BMS website or a third-party website that provides locations and details about available BMS or third-party studies, you may decide to share such information by digital means or during a phone conversation with a healthcare professional or the study doctor to include you in a decentralized study. Sharing this information may involve passing a pre-screening test about your medical history that you can send to the investigator of the BMS sponsored study. In case you apply to third-party study, BMS will no longer be involved in the use of your Personal Data.
• Connect to a digital platform and devices for the study and create your account: When connecting to a BMS or third-party platform as part of your involvement in a study, you may agree in advance to create an account, which the physician may pre-populate with information that you have already provided. You will then receive a link to create an account and access various functionalities available on the digital platform. Unless required by a specific law, such as for pharmacovigilance, safety follow-up purposes or in case of product quality issues, BMS as sponsor of the study will not have access to your Personal Information included in your dashboard nor your user account.
• Sign digitally: When considering participating in the decentralized clinical study using digital technologies, you may use electronic signatures or other validated identification mechanisms to agree to your participation in the study.
• Receive information and communicate with your physician or the investigator: When using the digital platform for the decentralized study, you will use certain technologies, such as tele-visits, to exchange information securely with your investigator or physician through the platform. BMS, physicians or the investigator, will make documentation available to you through the platform for the purpose of the study. This information will not be shared with you outside of the platform and will be made accessible in compliance with all applicable laws.
• Answer to questionnaires: From time to time, BMS may develop questionnaires to understand how you feel or deal with your treatment, your disease or your quality of life. Your responses will allow BMS to conduct research or to prepare evidence for submissions to regulatory and health authorities for efficacy and safety of candidate treatments. These questionnaires usually refer to e-COA (electronic clinical outcome assessments) or e-PRO (electronic patient reported outcomes) and BMS will only access anonymized or key-coded information about you so that we cannot identify you.

As a healthcare professional:

• Create an account: When you create your account, BMS and the vendor managing the platform will access information about you to manage your user account and to respond to questions that you may have about your use of the platform.
• Use your HCP dashboard: As a healthcare professional or investigator in a decentralized study you can access your study dashboard, which is not accessible by BMS.
• Share pharmacovigilance and medical information: BMS may use platforms and third-party systems we make available to you to allow you to contact us and provide your contact information and details where necessary, for example to report adverse events to BMS, ask for medical information from our specialized teams, report product quality issues or for safety follow-up when using medicines approved by authorities of your country. You may also contact us by accessing the official BMS website of your country of residence.

Our use of your data. Unless permitted by applicable law, whether you are a research participant or a healthcare professional, we will only use Personal Information about you necessary for the purpose of conducting scientific research, which includes further use of your data for a secondary scientific research purpose as described in your ICF. To better understand for what purposes BMS will use your Personal Information, please refer to your ICF, the terms of which shall prevail on the terms set out in this privacy notice.

Depending on the law of your country, we may make available to you some documentation that relates to the study to keep you informed about the development of your treatment or study journey, for example when participating in a long-term follow-up study.

We exclude other uses of your data by our suppliers. Data derived from the study may be used for scientific research by BMS, for example in the context of public health. Personal Information about patients or HCPs used within decentralized studies will not be used for any business nor commercial activity, unless we have your prior permission or with prior notice to you. When we use third parties’ platform and websites, we prohibit and restrict the use of your Personal Information by third parties for their benefit, except that they may use it to ensure your safety using BMS products or devices, the security of the platform, to manage user accounts, obtain statistics or metrics about the study or the use of the platform, comply with applicable laws, or bug fixing and troubleshooting.

This depends on the study. Depending on the setup of the study, participants may continue the study outside of the platform with the investigator. In other situations, the design of certain studies will only work via the platform.

• As a research participant, you may decide to delete your account, leave the platform and, where possible, continue to participate in the study. Note that depending on the nature of the study, continuing the study without using the platform may not be possible. In such a case, if you request to delete your Personal Data from the platform, you will have to discontinue participating in the study. Please contact your investigator for more information.
• As an investigator, you may decide at any time not to use the platform anymore and continue to conduct the study through traditional means with your study participants. In such case, you should contact us to delete your user account and, where you have such right, use your right to portability to extract the data out of the platform in order to continue the study outside of the platform.

Like in any other clinical trial, BMS teams will only access information about you that has a code and without your name (key-coded data), unless needed for the purpose of the study. If BMS does receive patient Personal Data that is not protected by a code (key-coded), it would be only for the purposes of pharmacovigilance, drug safety, risk management programs, safety follow-up or product quality issues to comply with a legal obligation or where permitted by applicable laws.

The categories of Personal Information about you that BMS, HCPs and third-party service providers may access, will include:

This table may be updated from time to time to reflect new functionalities that may become available to you in a DCT study.

BMS may access the following information about you when using digital platforms

1. As research participants

• Key-coded data to comply with applicable laws, such as to report adverse events;
• Submission data that supports evidence for submissions to health authorities, in particular clinical outcome assessments (COA) and patient reported outcomes (PRO);
• E-consent where needed, limited information for evidence purposes about your electronic ICF;
• Statistics and aggregate information about the use of the platform; and
• Other information, such as results of questionnaires that you fill in to and to improve how we conduct current or future decentralized trials or studies.

Please contact the investigator to learn more about what data is collected and stored about you as part of the study, as BMS will not access this information.

Note: You are responsible for ensuring that your profile on the platform is up-to-date and accurate.

2. As healthcare professionals

• Contact details: as an HCP or investigator, you may exchange information or contact us for pharmacovigilance, risk management or to request medical information with us;
• User account information: any other Personal Information that you may share with BMS as part of the study or include in your user account and profile, if needed for the purpose of the study.

Note: You are responsible for ensuring that your profile on the platform is up-to-date and accurate.

Authorized service providers

When BMS uses authorized third parties, such service providers act on our behalf and upon our instructions. In very limited and restricted cases, when conducting DCT studies through a third-party platform, services providers are acting as controllers (under their own responsibility) of your Personal Information related to the management of your user account, the security of the platform and for bug fixing and troubleshooting. This includes collecting your:

• Login and user account data: in particular your login credentials, including your full name, e-mail address phone number, email and password to support your use of the platform;
• Contact details: Name, e-mail address, or other contact details if needed for technical support and security purposes. In certain instances, this will require to provide caregiver or relatives names, e-mail address, and phone number.

Healthcare professionals / Investigator

As an investigator using the platform, you may receive and input research participant data into the platform and enable you to access research participant information through a dashboard to manage the study. As an investigator, you are responsible for the medical records and any other information relating to the study. As an HCP or an investigator, you may also use means of video-conferencing tools or file sharing software to exchange information about the study with participants to the study under your own responsibility. BMS will not have access to such information.

1. Before the study starts

As a research participant:

• In preparation for the study, you share or submit your Personal Information to a physician or an authorized third party either by phone or through digital means, who may pre-load information about you into the digital platform.
• Specifically, this may include sharing your contact details (including name, phone number, address, date of birth, and e-mail address), your login data and other data to create a reference between the study number and your specific account.
• All information requested is needed to give you access to the platform, so that you can decide to participate in the decentralized trial.

As an investigator:

• Before creating your user account in the platform, BMS and its authorized service provider, will ask or access certain Personal Information, such as the study that you will run, your contact details and other professional information necessary to run the study with you as an investigator in a BMS sponsored study. When entering your credentials into the platform you understand that the information is needed in order to run the study remotely.

2. During the study:

• e-ICF – electronic Informed Consent Form. To start the study, participants will receive an email from the third-party platform. It will ask to read this notice and to confirm that you agree to participate into the study.
• Account creation. After you agree to participate in the study, you will create an account within the platform to gain access. When you opt in within the Platform, you will formally confirm your participation in this study.
• Upload certain profile data. When you first login to the vendor platform, you will be asked to upload your information that is needed by the investigator.
• Investigator access. By uploading your information, all Personal Information that can be found on the platform will be accessible by the physician and medical staff from the institution working as investigator.
• BMS access. BMS will not access research participant information through the platform, unless permitted or needed to comply with applicable data protection laws or regulatory requirements – for example, if we need access to key-coded data for pharmacovigilance, clinical evidence or research purposes.
• Your profile will not be made visible to other study participants.

3. After the study has ended or after you leave the study

• At the end of the study, BMS will erase all your Personal Information collected related to your user account, except where the law of your country requires BMS to keep it for a longer period, such as to comply with international standards or applicable laws and regulatory requirements.
• When the setup of the study allows it, you may continue the study outside the platform. Please contact the investigator to learn if this possible in your particular study.

BMS has dedicated study teams and (where applicable) site coordinators, and Contract Research Organizations (CRO), collaborating to execute this study. When we share your data, we will limit the number of individuals who have access to your Personal Information to those who need to know it, in particular for the purpose of your study.

BMS will make your Personal Information available to the following recipients:

• Investigators: Physicians will have access to the outputs of this study. This will be limited to a small group of people that are dedicated to the study, including sub-investigators and study staff.
• Authorized service providers: For the purpose of managing your user account and the security of the platform. Also, in the context of decentralized studies, we may partially or wholly outsource the management of the study to CROs who will act as our subcontractors and will follow BMS instructions.
• Study teams: These teams are made up of BMS employees and, where BMS uses outsourcing organizations, CRO employees.

If as research participant you are a minor participating or considering participating in a BMS decentralized study, depending on the law of your country, we may be required to request parental or tutor or your equivalent legal representative agreement and signature.

Your participation as a research participant

By volunteering to participate in this study, you agree to the participation in this study, from a public health standpoint, through the ICF that you will sign or have already signed and that will be provided to you separately by the study team or through the platform, apps or devices. You also understand that BMS will use your Personal Information for the purpose as set out in this privacy notice, under one or several lawful grounds.

Research participant withdrawal from the study

As your participation is voluntary, you can decide to discontinue your participation in the study at any time by contacting us directly. You may also decide to continue the study outside of the platform. You have the right to withdraw your consent from the study at any time by contacting your study doctor or investigator. 

BMS has implemented reasonable and appropriate legal and security measures to protect the confidentiality of your information from unauthorized access, use or disclosure including, but not limited to, maintaining binding contracts that require appropriate protection of Personal Information about you. Where appropriate, we use methods such as encryption, pseudonymization, de-identification and other technologies that can assist us in securing the information you provide to us for this study, including measures to restore access to your information. We also require our approved third-parties and business partners accessing and hosting the platform to comply with strict data privacy and security requirements.

Where BMS processes your Personal Information outside of our systems, we will take necessary steps to ensure that adequate safeguards are implemented to protect your Personal Information. We have also entered into agreements with the Vendors for the processing of your Personal Information so that such processing is carried out in accordance with our instructions, in a confidential, secure, and transparent manner in order to protect your privacy rights.

For participants outside the United States

If you are a participant based outside of the United States (such as Canada, Asia Pacific, countries of the European Economic Area, Switzerland or United Kingdom), please be aware that, unless required by applicable law, BMS may transfer your Personal Data to third countries. Therefore, your data may be transferred outside your country of residence, in particular to the United States, where BMS headquarters are located.

By participating in the study, you understand that your data will be shared with the investigator and once in the system, accessible by BMS teams when it is transferred to the United States which is a country that may not provide an adequate level of protection compared to the law of your country. To ensure that any transfer respect your right to privacy in the country of destination, we use arrangements such as binding corporate rules for transfers inside our group of companies and standard contractual clauses when sharing such information with third parties and suppliers.

For more information about how BMS transfers your Personal Information, you can access our https://www.bms.com/privacy-policy.html.

DCT studies may use cookies when using a third-party solution. When connecting to a third-party platform, the technology used may place cookies or similar tracking technologies on your browser or device. To read more about how vendor may use cookies or further use data through tracking technologies, you may read their cookie policy available on the platform.

BMS will not retain your Personal Data for longer than necessary for the purpose of evaluating and closing the study.  For example, BMS legal retention periods may go up to 25 years. However, your Personal Information may be retained for a longer or shorter duration where applicable laws or regulations require it, or allow us to do so, for example for conducting further research purposes.  

If your participation in the DCT study stops for any reason, Personal Data about you collected prior to your withdrawal may still be processed along with other data collected as part of the study. Normally, no new information will be collected for the study database unless you specifically consent to that as part of participating to a follow-up study, except where this is required by law (e.g. the law of your country may require that we document any side-effects you may suffer). To complete the study findings, we may also verify your long-term health status with information accessible in publicly available records (unless you have objected to this to your study contact point).

BMS will keep anonymized or aggregated information about the study to learn about how our company may benefit from this study and how to further use such information for improving how we operate and how we manufacture medicines. 

As a research participant or an HCP, depending on the country where you reside, you have the right to access, rectify, restrict, or request the deletion of your Personal Information.

As a research participant, your primary point of contact shall remain your study doctor. However, to exercise your rights, including your right to access, rectify or delete your information, if you are resident in the United States, Canada, Brazil, Turkey, Thailand, Asia, North Africa or Latin America, you can contact us at dpo@bms.com. If you are located in the EEA, Switzerland and the UK, you can contact us at eudpo@bms.com.

In some countries, you may have the right (i) to instruct us about how to use your personal data in case of your death and (ii) to lodge a complaint to the relevant data protection authority of country of residence if you believe that we use your Personal Information unlawfully or are violating your rights. For example, in the European Union,  you can access the list of competent data protection authorities, including the authority in your country of residence by visiting: https://edpb.europa.eu/about-edpb/board/members_en.

BMS may update this notice from time to time by posting any revisions on this website. Where any material revisions are made, BMS may place a prominent notice on this website and when legally required to do so, will directly notify you.

You confirm that prior to participating in this study and sharing your information:

• You have read and understood the terms of the platform that we use for decentralized studies and in particular how BMS and third parties will use your Personal Information for this study;
• You understand that, BMS may have to keep certain information about you for regulatory, drug safety and healthcare compliance purposes;
• You understand that, for certain studies, the setup of the study will only work remotely and if you want to leave the platform, you may not be able to continue participating in the study; and
• You understand that BMS will share in a secure way with, and make this information available to, its affiliates and approved third-parties that may be located outside your residence, including in countries with less protection than the law of your country.