Privacy Statement

Privacy Statement

Privacy Policies

Applicants
Clinical Trials Policy
General Privacy Policy
Parents and Patients Policy

Privacy Policy for Clinical Trials

Y-mAbs Therapeutics, Inc., is established in the EU through our wholly-owned subsidiary, Y-mAbs Therapeutics A/S located in Denmark. In relation to personal information in clinical trials, Y-mAbs Therapeutics Inc. and Y-mAbs Therapeutics A/S are joint data controllers and must comply with US as well as EU privacy legislation, including the Health Insurance Portability and Accountability Act (“HIPPA”) and General Data Protection Regulation (“GDPR”), and other national privacy laws and regulations. Y-mAbs will always comply with the most restrictive privacy laws and regulations.

Y-mAbs conduct several clinical trials with the primary purpose of supporting marketing authorization applications and promote our medical products in a number of territories, alone and through our business and licensing partners.

Subjects participating in Clinical Trials

1) Use of personal information
We use personal information generated as part of the clinical trial for the purpose of investigating the safety and efficacy (how well our trial drug works) and how well the study drug is tolerated in the subjects participating in the clinical trials. Moreover, we will use the personal information generated as part of the clinical trial to support our marketing authorization applications.

2) Categories of personal information
We may collect the following categories of personal information about you:
a) Ordinary personal information: Gender, data of birth, body weight and height.
b) Special categories of personal information: Race and ethnicity, medical data, including medical history,
scans, biological samples (blood, tissue, urine), genetic data, health status, and your use of the study
drug, the effect it has on you and possible side effects.

We will only receive personal information in a pseudonymized form, which means that personal information such as name, contact details and social security number are replaced with a unique code. Only the clinical trial sites will have direct contact with subjects participating in the clinical trial and will store name, contact details and social security number in the medical file at the clinical trial site. Neither Y-mAbs nor any third-party will not have access to your name, contact details and social security number.

3) Sources
We will collect your personal information in a pseudonymized form (as described above) from the Principal Investigator as part of the clinical trial.

4) Legal basis
In most of our clinical trials, Y-mAbs’s is processing the personal information of subjects participating in clinical trials based on the subjects’ consent, see GDPR article 6(1)(a) in conjunction with article 9(2)(a).
In other of our clinical trials, the legal basis of processing the personal information of subjects participating in clinical trials is Y-mAbs’ legitimate interest in developing safe and efficacious medical products and supporting marketing authorization applications, see GDPR article 6(1)(f) in conjunction with GDPR article 9(2)(i).

For all our clinical trials, additionally we process personal information in order to comply with applicable legislation related to the conduct of clinical trials such as safety reporting, retention, inspections from authorities, see GDPR article 6(1)(c) and 9(2)(i).

5) Sharing of your personal information
Your personal information may be shared with regulatory authorities and ethics committees. This will only happen if requested and needed according to the applicable clinical trial legislation.
There may also be a need to share your personal information with Y-mAbs’ service providers, e.g., fully serviced Clinical Research Organizations, Laboratory Service Providers, etc., for the clinical trial, members of Y-mAbs groups of companies, service providers, third-party suppliers, or business partners, including our licensees. The personal information must be kept confidential and may only be used for the purpose of the clinical trial.

6) Transferring of personal information to other countries
Y-mAbs service providers, Y-mAbs groups of companies, third-party suppliers, or business partners, including our licensees, as well as public authorities to which we report data, may be located outside your country of residence, including the US and countries in and outside the European Economic Area (“EEA”). This means that your personal information may be processed in countries with a lower data protection standard than your country of residence. We will ensure that if personal information is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place and in case of transfer from EU/EEA to the US by use of EU Standard Contractual Clauses for data transfer.

7) Retention of your personal information
Once the clinical trial has been concluded, your personal data will be kept in accordance with regulatory requirement for clinical trial, e.g., two (2) years after the last marketing application which may happen more than twenty-five (25) years from collection of such personal information.

8) Your rights
You have several rights in relation to the personal information regarding you that we process. However, there may be conditions or limitation to these rights:

  • You have a right of access to, and, if needed, you have the right to correct your data.
  • You have the right to request erasure of your personal data, to request that the processing of your personal data is restricted in some certain circumstances, to object to processing, and to receive personal data provided to Y-mAbs for transfer to a third party (i.e., right to data portability). However, certain personal information collected before you make such a request may need to be processed by Y-mAbs in order to comply with applicable regulations governing clinical research and cannot, therefore, be erased.
  • You also have the right to withdraw your consent to the processing of your personal data at any time. However,if you withdraw your consent to the processing of your personal data after you have started your participation in the clinical trial, this will result in your withdrawal from the clinical trial. Please note that personal information collected before you remove your consent is still legally allowed to be used.

Principal Investigator and research staff at clinical trial sites


We will process personal information of Principal Investigator (“PI”) and research staff conducting the clinical trials.

1) Use of personal information for the following purpose:
The purpose of collecting, using, and retaining your personal information is to support marketing authorization applications.

2) Categories of personal information – ordinary personal information

  • Name, Institution, Institution address, work e-mail, work phone number, job title;
  • Resume; and
  • Financial disclosure information.

3) The purposes of collecting the personal information from PI and research staff:

  • To confirm your experience and qualifications to conduct the clinical trial;
  • To communicate with you;
  • To manage delegated tasks and roles of the research staff involved in the clinical trial;
  • To seek approval of the clinical trial and/or trial product by governmental or regulatory authorities;
  • To comply with financial reporting requirements under the US Sunshine Act and other local laws and regulations in respect of the payments made for the services provided under the clinical trial;
  • To comply with the retention demands of this personal information required under the clinical trial laws and regulations in the applicable country;
  • To publish information on www.clinicaltrials.gov or www.clinicaltrials.eu and other websites and databases that serve a comparable purpose; and
  • To report adverse events and comply with applicable pharmacovigilance obligations.

4) Legal basis
We will process the personal information of PI and research staff for the purpose of fulfilling a contract as well as complying with clinical trial legislation, transparency laws and regulations, see GDPR 6(1)(c). In relation to other staff at the clinical trial site, we do not engage directly with in the Clinical Trial Agreement, we process their personal information for the purpose of management and administration of the clinical trial, see GDPR article 6(1)(f).

5) Sharing of your personal data
We will disclose personal information of PI and research staff to regulatory authorities, auditors, ethics committees, if Y-mAbs are required to do so. In addition, we will share personal information of research staff with members of Y-mAbs groups of companies, services providers, third-party suppliers or business partners, including our licensees. The personal information must be kept confidential and may only be used for the purpose of the clinical trial.

6) Transferring of personal information to other countries
Y-mAbs service providers, Y-mAbs groups of companies, third-party suppliers, or business partners, including our licensees, as well as public authorities to which we report data, may be located outside your country of residence, including the US and countries in and outside the European Economic Area (“EEA”). This means that your personal information may be processed in countries with a lower data protection standard than your country of residence. We will ensure that if personal information is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place and in case of transfer from EU/EEA to the US by use of EU Standard Contractual Clauses for data transfer.

7) Retention of your personal data
Once the clinical trial has been concluded, your personal data will be kept in accordance with regulatory requirement for clinical trial, e.g., two (2) years after the last marketing application which may happen more than twenty-five (25) years from collection of such personal information.

8) Your rights
You will have right to access, rectification, erasure, objection, restriction of processing and data portability in relation to your personal data by sending a written communication to [email protected]

If you believe that we have not complied with applicable data protection laws, you can also lodge a complaint with a data protection supervisory authority. A listing of each EU (European Union) country’s data protection supervisory authority may be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

Updated: November 1, 2021

GENERAL PRIVACY POLICY

INTRODUCTION

We take your privacy seriously and want you to understand our practices with respect to the handling of your personal data when you interact with Y-mAbs Therapeutics, Inc. and its group of companies (“Y-mAbs,” “we,” “us” and “our”) through this website (the “Website”). This privacy policy explains how we do this.

We may change this privacy policy from time to time and we advise you to review this privacy policy periodically to see the latest version.

WHAT PERSONAL INFORMATION DO WE COLLECT? We collect personal information that you voluntarily provide to us when expressing an interest in obtaining information about us or our business, when participating in activities on this Website or otherwise contacting us.

The personal information that we collect depends on the context of your interactions with us and this Website, the choices you make and the features you use.

The personal information we collect can include the following:

  • Name and Contact Data. We may collect your first and last name, email address, phone number, and other similar contact data when you subscribe to our newsletter or use our online contact form.

We do not collect or retain sensitive personal data relating to your health, ethnic origin, religious beliefs or political conviction etc. at this Website unless you submit such information to us which we will only be willing to accept through use of a specially designed contact form or other written indication of your agreement thereto. In the rare cases where we do seek to collect sensitive data we will do so in strict compliance with local data privacy law and you will be asked to actively consent to our processing.

INFORMATION AUTOMATICALLY COLLECTED. We automatically collect certain information when you visit, use or navigate this Website. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use this Website and other technical information. This information is primarily needed to maintain the security and operation of our Site, and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies.

Web log data. When you use this Website, we may automatically receive and record certain information from your computer (or other device) and your browser. This may include such data as the pages you visit on this Website, the date and time of your visit, the files that you download, the URLs from the websites you visit before and after navigating to this Website, your software and hardware attributes (including device IDs), your general geographic location (e.g., your country, city, state, or metropolitan region), and certain cookie information. To obtain such information, we may use web logs or applications that recognize your computer and gather information about its online activity.

Cookies. We or our service providers may use cookies on this Website. Cookies are small files that are stored on your computer by your web browser. A cookie allows this Website to recognize whether you have visited before and may store user preferences and other information. For example, cookies can be used to collect information about your use of this Website during your current session and over time (including the pages you view and the files you download), your computer’s operating system and browser type, your Internet service provider, your domain name and IP address, your general geographic location, the website that you visited before this Website, and the link you used to leave this Website. If you are concerned about having cookies on your computer, you can set your browser to refuse all cookies or to indicate when a cookie is being set, allowing you to decide whether to accept it. You can also delete cookies from your computer. However, if you choose to block or delete cookies, certain features of this Website may not operate correctly.

Web beacons. This Website or the emails that you receive from Y-mAbs may use an application known as a “web beacon” (also known as a “clear gif” or “web bug”). A web beacon is an electronic file that usually consists of a single-pixel image. It can be embedded in a web page or in an email to transmit information, which could include personal information. For example, it allows an email sender to determine whether a user has opened a particular email.

Third party analytics. We also may partner with certain third parties to collect, analyze, and use some of the information described in this section. For example, we may allow these third parties to set cookies or use web beacons on this Website or in email communications from Y-mAbs.

HOW DO WE USE YOUR PERSONAL INFORMATION? We may use your personal information to:

  • improve your experience when using our websites;
  • communicate with you, for example to respond to your request and process it;
  • provide you with information, about our product candidates;
  • comply with our business, regulatory and legal obligations.

ON WHAT BASIS DO WE USE YOUR PERSONAL INFORMATION? We use personal information for:

Legitimate business purposes: We use your personal information to make our communications with you more relevant and personalized to you. It also helps us to operate and improve our business and minimize any disruption to the services that we may offer to you. We use the personal information that we collect automatically when you visit this Website for such purposes as: counting and recognizing visitors to this Website; analyzing how visitors use this Website and various Site features; improving this Website and enhancing users’ experiences with this Website; creating new products and services or improving our existing products and services; enabling additional website analytics and research concerning this Website; and managing our business. Y-mAbs may link non-personal information gathered using cookies and web beacons with personal information. But in that event, we will treat the combined information as personal information.

To comply with our legal obligations and other demands for information: It is important to us that we are able to comply with laws, regulations and guidance, as well as the other requests or demands for data as set out here. They affect the way in which we run our business and help us to make our products and services as safe as we can.

You may have given your consent: At times we may need to get your consent to allow us to use your personal information for one or more of the purposes set out above.

SHARING YOUR PERSONAL INFORMATION WITH THIRD PARTIES. We may share your personal information with:

  • members of the Y-mAbs group of companies; and
  • certain trusted third parties, including our agents and suppliers, including those who provide us with technology services such as data analytics, hosting and technical support; our professional advisors, auditors and business partners; regulators, governments and law enforcement authorities; and other third parties in connection with running or re-organizing all or any part of our business.

We do not sell or rent the personal information we collect from you.

HOW LONG WILL WE KEEP YOUR PERSONAL INFORMATION? We keep your personal information for no longer than is necessary for the purpose for which the information is collected and to manage our relationship with you. Where personal information is kept, that period will be determined based on applicable local law.

PROTECTING YOUR PERSONAL INFORMATION. We will take appropriate legal, organizational, and technical measures to protect your personal data consistent with applicable privacy and data security laws. When Y-mAbs uses a third-party service provider, that provider will be required to use appropriate measures to protect the confidentiality and security of personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. Although we will do our best to protect your personal data, we cannot guarantee the security of the personal data you transmit to us. While we cannot guarantee that loss, misuse, or alteration to data will not occur, once we have received your data, we will employ appropriate technical security measures to prevent such unfortunate occurrences.

Personal data collected may be transferred to, stored, and processed in your country of residence or any other country in which Y-mAbs (including its affiliates) maintain facilities, including the United States and countries in or outside the European Economic Area (EEA). This means that your data may be processed in countries with lower data protection standards than your country of residence.  We will ensure that if data is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place, in the case of transfer from the EU/EEA to the US by use of EU Model Clauses for data transfer, a copy of which can be obtained by contacting us.

WEBSITES THAT WE DO NOT OWN OR CONTROL. Our website may contain links to third-party sites. This privacy policy does not apply to those third-party sites. We recommend that you read the privacy statements of any other sites that you visit as we cannot accept responsibility for the privacy practices of these sites, which may be different to ours.

YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION. We set out below the rights that we will respect in relation to your personal data.

You may be entitled to:

  • ask Y-mAbs for access to the personal information Y-mAbs holds about you;
  • request the correction and/or deletion of your personal information;
  • request the restriction of the processing of your personal information, or object to that processing;
  • (if applicable) withdraw your consent to the processing of your personal information (where Y-mAbs is processing your personal information based on your consent);
  • request for the receipt or the transfer to another organization of the personal information that you have provided to Y-mAbs; and
  • complain to your local data protection authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information.

If you would like to exercise your rights, please let us know by getting in touch with us as set out in the “Contact us” section below.

WHAT IF YOU DO NOT WANT TO PROVIDE US WITH YOUR PERSONAL INFORMATION? The provision of your personal information is voluntary for you and not required by law. Therefore, where you are given the option to share your personal information with us, you can always choose not to do so.

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. This could mean that we may not be able to perform the actions necessary to achieve the purposes for which the information was collected.

DATA CONTROLLER. Y-mAbs Therapeutics Inc. is data controller of the personal data provided. We are established in the EU through our wholly-owned subsidiary Y-mAbs Therapeutics A/S located in Denmark.

QUESTIONS/CONTACT US

If you have any questions about this privacy policy, please email us at [email protected] or at:

In the US:
Y-mAbs Therapeutics, Inc.
230 Park Avenue,
Suite 3350
New York, NY 10169, USA
Telephone: 1 646 885 8505
 
Y-mAbs Laboratories
340 Kingsland Street
Building 102
Nutley, NJ 07110
Telephone: 1 646 885 8478
In the EU:
Y-mAbs Therapeutics A/S
Agern Allé 11
2970 Hørsholm
Denmark
Telephone: +45 70 26 14 14

Updated: October 1, 2020

PRIVACY STATEMENT (PARENTS & PATIENTS PORTAL)

INTRODUCTION. We regularly receive questions from parents to children affected with cancer about treatment possibilities.

We understand the difficult position and the worries of parents and we have, therefore, decided to establish the contact form to handle and respond to requests in a structured and efficient manner.

By providing us with personal data you consent to our processing of the data provided to us as outlined below. When you provide information about a child you at the same time declare that you have custody of the child and authority to give the consent on your child’s behalf also.

You have the right to withdraw your consent to our processing of the personal data you provide at any time, without reason and without losing any rights.

WHY WE PROCESS DATA AND THE LEGAL BASIS. We process the personal data that you provide only to handle and respond to your request. This means that we use the data to assess if you/your child could be eligible for enrollment in clinical trials that are conducted with our involvement. The processing is based solely on the consent that you have provided and no other legal basis.

TYPES OF PERSONAL DATA PROCESSED. We process the personal data that you yourself provide to us. We do not collect any other data about you or your child. The data includes: Name, address, telephone number, E-mail address, age and the specifics regarding the diagnosis or illness that you provide.

To reduce any unnecessary data processing we kindly ask that data provided initially is kept to a minimum as necessary for an assessment of eligibility.

RECIPIENTS OR CATEGORIES OF RECIPIENTS. Where we are engaged in clinical trials that covers the disease described, we share the personal data with principal investigators (medical professionals) at the medical sites that we engage with in order for them to assess whether you/your child could be eligible for enrollment in a particular clinical study. These persons may thereafter contact you directly without our involvement. We ourselves do not decide on eligibility – we facilitate a contact to the relevant investigator and we are not involved in the discussions on treatment that you may have.

We use selected third parties to provide IT support services in the normal course of business. These parties may, from time to time, have access to your personal data to enable them to provide those services to us. We require all companies providing such support services to meet the same standards of data protection as our own. They are prohibited from using the personal data for their own purposes.

HOW WE PROTECT THE PERSONAL DATA. We will take appropriate legal, organizational, and technical measures to protect your personal data consistent with applicable privacy and data security laws. When Y-mAbs uses a third-party service provider, that provider will be required to use appropriate measures to protect the confidentiality and security of personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. Although we will do our best to protect your personal data, we cannot guarantee the security of the personal data you transmit to us. While we cannot guarantee that loss, misuse, or alteration to data will not occur, once we have received your data, we will employ appropriate technical security measures to prevent such unfortunate occurrences.

Personal data collected may be transferred to, stored, and processed in your country of residence or any other country in which Y-mAbs (including its affiliates) maintain facilities, including the United States and countries in or outside the European Economic Area (EEA). This means that your data may be processed in countries with lower data protection standards than your country of residence. You consent to any transfer, processing, or storing of data outside of your country of residence and outside the EEA. We will ensure that if data is transferred outside your country of residence, it will still be treated in accordance with this Privacy Statement. Additionally, such transfer will only be made if appropriate safeguards are in place, in the case of transfer from the EU/EEA to the US by use of EU Model Clauses for data transfer, a copy of which can be obtained by contacting us.

SOURCES OF PERSONAL DATA. We only process the personal data that you yourself provide to us using the form. We do not collect any other data about you or your child.

RETENTION PERIOD. We retain the personal data received only until the data is no longer needed to assess eligibility in a clinical trial.

AUTOMATED DECISION MAKING, PROFILING. Personal data is not used in automated decision making or profiling.

RIGHT TO WITHDRAW CONSENT. You have the right to withdraw your consent to our processing of personal data at any time, without reason and without losing any rights. You can do so by simply sending us an e-mail at: [email protected] or by contacting us at +1 646 885 8505 or by ordinary mail.

YOUR RIGHTS. You have the right to review, modify and/or delete the personal data collected in the event that the collected personal data is incorrect and to restrict and/or object to any further processing and storage of the personal data. You also have the right to be informed about any personal data about you/your child held by Y-mAbs and you have the right to get the personal data you have provided to Y-mAbs in a structured and machine-readable way (data portability). You have the right to complain about the collection and processing of personal data to the relevant data protection supervisory authority.

DATA CONTROLLER. Y-mAbs Therapeutics Inc. is data controller of the personal data provided. We are established in the EU through our wholly-owned subsidiary Y-mAbs Therapeutics A/S located in Denmark.

QUESTIONS/CONTACT US.  If you have any questions about this privacy policy, please email us at [email protected] or at:

Y-mAbs Therapeutics, Inc.

In the US:
Y-mAbs Therapeutics, Inc.
230 Park Avenue,
Suite 3350
New York, NY 10169, USA
Telephone: 1 646 885 8505
 
Y-mAbs Laboratories
340 Kingsland Street
Building 102
Nutley, NJ 07110
Telephone: 1 646 885 8478
In the EU:
Y-mAbs Therapeutics A/S
Agern Allé 11
2970 Hørsholm
Denmark
Telephone: +45 70 26 14 14

Updated: October 1, 2020