Scout Privacy Policy

Thank you for choosing to be part of our community at Meeting Protocol Worldwide, LLC, doing business as Scout (“Meeting Protocol”, “we”, “us”, or “our”). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy or our practices with regards to your personal information, please contact us at dataprivacyofficer@scoutclinical.com.

When you visit our website, Scout Portal, or use our mobile app to make use of our services, you trust us with your personal information. We take your privacy very seriously. In this privacy notice, we describe our privacy policy. We seek to explain to you in the clearest way possible what information we collect, how we use it and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important. If there are any terms in this privacy policy that you do not agree with, please discontinue use of our mobile app, websites, and our services.

This privacy policy applies to applies to the handling of your personal data as an employee, former employee, candidate, external user, or client whenever such personal data is collected through our website (https://www.scoutclinical.com), Scout Portal (https://portal.scoutclinical.com/) and mobile app, and/or any related services, sales, marketing, or events (the preceding referred to collectively in this privacy policy as the "websites").

We are committed to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) and to the rights of EU and UK individuals and Swiss individuals.

Please read this privacy policy carefully as it will help you make informed decisions about sharing your personal information with us.

Personal information you disclose to us.

In Short: We collect personal information that you provide to us such as name, address, contact information, passwords, and security data (for authenticating logins).

We collect personal information that you voluntarily provide to us when expressing an interest in obtaining information about us or our products and services, when participating in activities on the websites or otherwise contacting us.

The personal information that we collect depends on the context of your interactions with us and the mobile app and websites, the choices you make and the products and features you use. The personal information we collect can include the following:

• Name and Contact Data. We collect your first and last name, email address, postal address, phone number, and other similar contact data.

• Demographic Data. We may collect your date of birth and gender (special category data).

• National Identifiers. We may collect National ID, passport, and tax identification number.

• Credentials. We collect passwords, password hints, and similar security information used for authentication and account access.

• Payment Data. We collect data necessary to process payments to you, if applicable. This information may include tax identification number and payment method information, such as bank transfer instructions and/or PayPal Account name.

If you are an employee, we process personal data about you for the purpose of managing our employment relationship. The personal information collected in addition to the above, related to the employment relationship, can include the following:

• Employment Details. Title, position, job history, educational background, employment contract/agreement, performance metrics, location.

• Workplace device, usage, and content data such as from Microsoft Office 365 tools, emails and messages.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Cookies

Cookies are small pieces of data stored on your device by websites that you visit. We use cookies to recognize your device and remember your preferences or actions.

You can set or amend your web browser to allow or refuse cookies. You may also opt-in or opt-out of cookies through our cookie policy. If you opt-out of cookies, you may still use our website.

In Short: We process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

We use personal information collected via our websites for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests ("Business Purposes"), in order to enter into or perform a contract with you ("Contractual Reasons”), with your consent (“Consent”), and/or for compliance with our legal obligations (“Legal Reasons”). We indicate the specific processing grounds we rely on next to each purpose listed below.

We use the information we collect or receive:

• To send administrative information to you for Business Purposes, Legal Reasons and/or possibly for Contractual Reasons. With your Consent, we may use your personal information to send you product, service, and new feature information and/or information about changes to our terms, conditions, and policies.

• To fulfill and manage your services. With your Consent, we may use your information to fulfill and manage any services you request, or that are requested on your behalf, through the websites.

• To enforce our terms, conditions and policies for Business Purposes, Legal Reasons and/or possibly Contractual Reasons.

• To respond to legal requests and prevent harm for Legal Reasons. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.

In Short: We only share information with your consent, to comply with laws, to protect your rights, or to fulfill business obligations.

We only share and disclose your information in the following situations:

• Compliance with Laws. We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a subpoena (including in response to public authorities to meet national security or law enforcement requirements). We are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

• Vital Interests and Legal Rights. We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.

• Business Partners. We may share your information with our business partners to fulfill services you have requested, or that have been requested on your behalf, via our websites. Scout will remain liable for your information in cases of onward transfers to third parties.

• With your Consent. We may disclose your personal information for any other purpose with your consent.

In Short: We may transfer, store, and process your information in countries other than your own.

Our cloud servers are located in the United States, Europe, Australia, Japan, China, and South Korea. If you are accessing our websites from outside those regions, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information (see "Will Your Information Be Shared with Anyone?" above) in United States and other countries.

If you are a resident in the European Economic Area, then these countries may not have data protection or other laws as comprehensive as those in your country. We will, however, take all necessary measures to protect your personal information in accordance with this privacy policy and all applicable laws and regulations in effect at the time of processing. This may include one or more of the following:

European Commission's Standard Contractual Clauses:

Contractual measures implementing the European Commission's Standard Contractual Clauses for transfers of personal information have been entered into between our group companies and between us and our third-party providers, which require all such recipients to protect personal information that they process from the EEA in accordance with European data protection laws. Our Standard Contractual Clauses can be provided upon request. We have implemented similar appropriate safeguards with our third-party service providers and partners and further details can be provided upon request.

EU-U.S. Data Privacy Framework/UK Extension/Swiss-U.S. Data Privacy Framework:

We comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Meeting Protocol Worldwide, LLC d/b/a Scout commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, we commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

Under certain conditions, you have the right to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. You can use this link to view Annex I of the DPF for additional information: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf.

Swiss FADP

If you transfer any of your Personal Data to us that is subject to the Swiss FADP, the following modifications shall apply to the Standard Contractual Clauses governing such transfer to the extent that the Swiss FADP applies to that transfer: (a) the term “member state” as used in the Standard Contractual Clauses shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from suing for their rights in their place of habitual residence in accordance with Clause 18(c) of the Standard Contractual Clauses; (b) the Standard Contractual Clauses shall also protect the data of legal entities until the entry into force of the revised Swiss FADP; (c) references to the GDPR or other governing law contained in the Standard Contractual Clauses shall also be interpreted to include the Swiss FADP; and (d) the supervisory authority as indicated in Annex I.C of the Standard Contractual Clauses shall be the Swiss Federal Data Protection and Information Commissioner (FDPIC).

China Personal Data Protection

Personal Data subject to the Applicable Data Protection Laws of China ("China Personal Data") is processed by Scout on behalf of third parties that determine the purposes and means of the processing ("Data Controllers"). Scout is a "Data Processor" that processes the China Personal Data as being authorized by the Data Controllers and for the purpose providing Scout services to the Data Controllers. In particular, the Data Controllers have granted authorization to Scout to transfer the China Personal Data outside of China and have agreed to take all the necessary actions to legitimize the transfer and Scout's processing of the China Personal Data. The sections of this Privacy Policy that describe how Scout processes Personal Data in the role of a Data Controller do not apply to Scout's processing of China Personal Data. Please contact us via at dataprivacyofficer@scoutclinical.com if you would like to know further information about the relevant Data Controllers.

Brazil Standard Contractual Clauses

Should Scout transfer certain personal data of individuals in Brazil to parties located outside Brazil, such transfers are governed by the Standard Contractual Clauses approved by the ANPD, which guarantee a level of protection compatible with the LGPD. Data subjects retain all rights under the LGPD (access, correction, deletion, portability, objection, etc.) and may exercise those rights via dataprivacyofficer@scoutclinical.com. Upon request, we will provide a copy of the full Standard Contractual Clauses applicable to your data transfer, free of charge (subject to applicable trade‐secret safeguards).

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy policy unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our websites is at your own risk. You should only access the services within a secure environment.

In Short: In some regions, such as the European Economic Area, United Kingdom, and Switzerland, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions (like the European Economic Area, United Kingdom, and Switzerland), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal.

If you are resident in the European Economic Area, United Kingdom, and Switzerland, and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

In Short: Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.

The California Consumer Privacy Act of 2020 (as amended “CCPA”) is a state law that regulates the collection, use, and disclosure of personal information by businesses operating in California. Under the CCPA, California residents have certain rights regarding their personal information, including the right to know what personal information is being collected about them, the right to request deletion of their personal information, and the right to opt-out of the sale of their personal information.

We may collect personal information from California residents who use our websites, mobile app, or otherwise make use of our services. This information may include that listed under Section 1: What information do we collect.

• We use this information to provide our services, communicate with our users, and improve our website, mobile app, and services.

If you are a California resident, you have the right to request access to, correction, or deletion of your personal information, as well as the right to opt-out of the sale of your personal information. To exercise these rights, you can contact us using the contact information provided below.

We do not sell personal information to third parties, except as necessary to provide our services or as required by law. As such, in the last 12 months Scout has not sold your personal information.

If you have any questions or concerns about our privacy practices or your rights under the CCPA, please contact us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the websites, you have the right to request removal of unwanted data that you publicly post on the websites. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the websites, but please be aware that the data may not be completely or comprehensively removed from our systems.

Only you or an authorized representative that you authorize to act on your behalf may make a request to access, correct, or delete your personal information.

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this privacy policy from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

If you have questions or comments about this policy, you may contact our Data Protection Officer (DPO) by email at dataprivacyofficer@scoutclinical.com or by post to:

Meeting Protocol Worldwide, LLC d/b/a Scout
Data Protection Officer
15770 Dallas Parkway, Suite 1075
Dallas, TX 75248
United States
Phone: 1-972-503-6119

When you access our websites and provide personal data for which we are not already acting as the “Data Processor,” then we are the data controller. If you are a resident in the European Economic Area, the "data controller" of your personal information is Meeting Protocol Worldwide, LLC d/b/a Scout. Meeting Protocol Worldwide, LLC has appointed Meeting Protocol Ireland Limited to be its representative in the EEA.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Meeting Protocol commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF should first contact Meeting Protocol Worldwide, LLC d/b/a Scout, by email at dataprivacyofficer@scoutclinical.com, by phone at 44-207-307-9900, or by post to:

Scout Clinical
104 Lower Baggot Street
Dublin 2
Ireland D02 Y940

If you have any further questions or comments about us or our policies, contact us by email at dataprivacyofficer@scoutclinical.com or by post to:

Meeting Protocol Worldwide, LLC d/b/a Scout
Data Protection Officer
15770 Dallas Parkway, Suite 1075
Dallas, TX 75248
United States
Phone: 1-972-503-6119