1. Introduction

Cogent Biosciences, Inc. (“Cogent”, “we”, “us”, “our”) sponsors ethically approved clinical trials (“Trial” or “Trials”). When you visit our website or participate or work in one of the Trials, we sponsor, you trust us with your personally identifiable information (“Personal Data”). We are committed to keeping that trust. That starts with helping you understand our privacy practices.

2. Identity and Contact Information

If you are an individual patient and you have any questions about this Notice or our processing of your Personal Data, or you would like to exercise your data protection rights, please first speak with your study doctor. Cogent generally only has access to key-coded data and we will be unable to identify you if we receive a request from you directly.

Please allow up to one month for us to reply.

Clinical Trial Sponsor

Legal entity name: Cogent Biosciences, Inc.
‍Address: 275 Wyman Street, 3rd floor, Waltham, MA 02451, United States of America
‍Email address: Trialinfo@cogentbio.com

Sponsor’s Data Protection Officer

For the attention of: Zia Maharaj, Senior Privacy Counsel
‍Legal entity name: VeraSafe, LLC
‍Address: 100 M Street S.E., Suite 600, Washington, D.C. 20003 USA
‍Phone: +1-617-398-7067
‍Email address: experts@verasafe.com‍‍

Sponsor’s Data Protection Representative in the EU

VeraSafe Ireland Ltd
‍Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P,
IrelandPhone: +1-617-398-7067
Contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative‍‍

Sponsor’s Data Protection Representative in the UK

VeraSafe United Kingdom Ltd.
‍37 Albert Embankment, London SE1 7TL, United Kingdom
Phone: +44 (20) 4532 2003Contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative‍‍

3. Scope of this Notice

What Is Covered by this Privacy Notice?

This Notice specifically applies to:

• individual patients and potential Trial participants in connection with our Trials and use of our experimental pharmaceutical products and/or future commercialized pharmaceutical products (if any);
• health care providers and other study site personnel, in connection with our Trials; and
• the website visitors of https://www.cogentbio.com/ , https://investors.cogentbio.com/ and https://cogentclinicaltrials.com/, including those who contact us at info@cogentbio.com or TrialInfo@cogentbio.com.

What Is Not Covered by this Privacy Notice?

Human Resources Personal Data

This Notice does not apply to Personal Data collected by any other means or in other contexts, such as the Personal Data of Cogent’s employees, job applicants, contractors, business owners, officers, directors or staff of Cogent. This means, for example, that this Notice does not describe our processing of your Personal Data nor your data protection rights when you apply to one of our job openings on our website.

Information Which Does Not Constitute Personal Data

If we maintain information in a manner that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, with a particular individual or household, such information is not considered Personal Data and this Notice will not apply to our processing of that information.

4. Controllership

Within the scope of this Notice, Cogent acts as a data controller for the PersonalData processed in the context of the Trials we sponsor and for the processing of your Personal Data that takes place when you visit our website. This means that we decide how and why Personal Data is collected and processed, or, in other words, we determine the purpose and means of the processing of your PersonalData.

In some jurisdictions, we may be considered a “joint controller” with another organization, such as the study site where the Trial is being conducted. This means that we jointly, together with the other organization, determine the purpose and means of the processing of your Personal Data. If you would like to know more about any other data controllers who might be joint controllers together with Cogent, you may ask your study doctor or the study site for further details, specifically relating to the Trial that you are participated in.

5. Categories of Personal Data

Personal Data of Individual Trial Participants

Even though we are a data controller for the Personal Data processed in the context of our Trials, Cogent itself does not have access to identifiable Personal Data, meaning that we are unable to identify you personally from the information we have access to. Personal Data is collected by our service providers like the study site (the clinic or other healthcare facility where the Trial is being run) or other third parties, such as your doctors or our clinical research organizations. When any information relating to you is shared with us by our service providers, it will first be key-coded (also known as “pseudonymized”) so that we cannot identify you by any direct personal identifier (such as your name, social security number, address, or telephone number).

‍
The following types of Personal Data of individual Trial participants may be processed in the context of our Trials:

• basic identifying information, such as your first and last name;
• contact information, such as your phone number, physical address and email address;
• location information, such as the location of your testing site and Trial location (i.e., study site);
• health care information, such as the identity and contact information of your doctors and other health care providers;
• health information, such as your medical history, current health status and reaction to the Trial drug or treatment;
• your genetic information; and/or
• images (such as photographs, scans and recordings);
• audio recordings of entry and exit interviews;
• recordings of telemedicine (virtual) consultations with health care providers; and/or
• identifiers and device information, such as IP address and associated location, operating system, and device IDs (e.g., when you visit a Trial-specific website).
‍
You can ask your study doctor if you are unsure whether or not any specific Personal Data that you are being asked to provide is required as part of your participation in the Trial.

Personal Data of Healthcare Providers

We may process the following types of Personal Data about healthcare providers in the context of our Trials:

• basic identifying information, such as your first and last name;
• contact information, such as your phone number, physical address and email address;
• professional and employment related information, such as your qualifications and job titles; and/or
• location information, such as the location of your testing site and Trial location (i.e., study site).

6. How We Receive Personal Data

We may receive your Personal Data when:

• you provide it directly to us (including when you provide your Personal Data to one of our service providers acting on our behalf);
• a study doctor (also known as an “investigator”) or other healthcare personnel at the study site provides it to us, or your healthcare provider provides it to us;
• we receive it from the clinical research organization that conducts the Trial on our behalf;
• you visit one of our Trial-specific websites or online portals; and/or
• you provide it to us, the clinical research organization, or a study doctor when you complete a pre-screening questionnaire to confirm your eligibility to participate in the Trial.

7. Purposes of Processing

We may process control the processing of your Personal Data for the purposes of:

• responding to your requests or questions (including requests to exercise your data protection rights) by using your basic identifying and contact information. This may also include reviewing other information about you that we have on record in order to respond to your requests or questions;
• managing and facilitating the Trial by using all the information set out underSection 5 above as may be necessary;
• enabling your participation in the Trial by using  some or all of the information described under Section 5 above;
• answering the research questions for the Trial and aggregating data to generate statistics relating to the Trial and/or study drug or health treatment; by   using   your   location   information,   health   care   information,   health information, and/or your genetic information;
• arranging for the delivery of drugs to you and collection of unused drugs from you in relation to the Trial by using your basic identifying and contact information and location information;
• arranging your transportation to or from the study site and overnight accommodations, as needed by   using   your   basic   identifying   and   contact information and location information;
• sending you reminders about your appointments at the study site, or to take your medication on time; by   using   your   basic   identifying   and   contact information;
• monitoring and reporting on any adverse events, such as negative side effects by using your health care information, health information, and/or your genetic information;
• developing new medicinal drugs or health treatments by using your health care information, health information, and/or your genetic information;
• complying with legislation governing Trials;
• disclosing your Personal Data to the appropriate regulatory authorities, auditors, and ethics committees, if required by law; and/or
• communicating with you on the status of the Trial. by   using   your basic identifying and contact information.

We also process your Personal Data for the specific purposes described in the by Informed Consent Form (ICF) that the  Trial personnel provided to you.

8. Bases of Processing

We may control the processing of your Personal Data on the basis of:

• Consent: We may ask for your consent to collect and process your Personal Data, including special categories of Personal Data, such as your health status and medical history.
• Contract: We may process your Personal Data to fulfill a contract we have with you.
• Legitimate Interests: We may process your Personal Data based on our legitimate interests in facilitating and managing our Trials.
• Compliance with Legal Obligations: We may need to process your Personal Data for us to comply with applicable laws or regulations, such as the laws regulating the safety and reliability of our Trials.
• Public Interest: We may process your Personal Data for reasons of public health interests to ensure adequate standards of quality and safety of the experimental pharmaceutical products or treatments we are developing.

Where we process your Personal Data based on your consent, you may withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect processing performed on other lawful grounds. If you withdraw your consent, you may be ineligible to participate in the Trial.

Where we receive your Personal Data as part of a contract we may have with you, we require such Personal Data to be able to carry out the contract. Without that necessary Personal Data, we will not be able to fulfill our contractual obligation towards you.

When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please use the contact details provided here.
‍
Since we process special categories of Personal Data, such as your health status and medical history, the EU General Data Protection Regulation (“GDPR”) requires that we must have an additional legal ground to process this type of information. Cogent may process your special categories of Personal Data on the basis of your explicit consent, or where the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

The specific grounds on which we process your Personal Data, including your health data, may vary somewhat from the above in order to comply with the requirements of local laws in jurisdictions where we sponsor Trials. If you are a participant in a Trial, please refer to the informed consent form you signed when you joined the Trial for more information about the legal grounds on which we process your Personal Data.

9. Automated Individual Decision-Making

If you participate in a Trial we sponsor, you will be assigned a unique patient identification number. For a given Trial, this number may be used as part of an automatic process that randomly determines what level dose of the experimental drug product you will receive. This number may also be used as part of an automatic process that randomly determines if you will receive the experimental drug product or treatment that is being evaluated in a given Trial, or if you will receive a placebo or different treatment. This type of automated decision-making is required in order to ensure that the applicable Trial is conducted in an ethical way, and in accordance with the pharmaceutical industry’s standards.

For decisions that may seriously impact you, you have the “right not to be subject to automatic decision-making, including profiling”. But in those cases, we will always explain to you when we might do this, why it is happening, and the potential effect on you.

10. Data Retention

We will retain your Personal Data for as long as is necessary to fulfil the purpose for which we collected your Personal Data (listed above) and any other permitted linked purpose, and in compliance with our data retention policies as applicable from time to time. For example, we will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.Once your information has been entered into the Trial records, we cannot remove it without affecting the accuracy of the Trial and the test results. Some laws require us to keep Trial records for at least 25 years after the conclusion of the Trial. We will ensure that your Personal Data is safeguarded at all times.

11. Sharing Personal Data With Third Parties

above, or as required by law. Our service providers may include parties providing the following, either currently or in the future:

• contract/clinical research organization service providers,  who  may process some or all of the information described under Section 5 above;
• patient recruitment service providers, to whom we may disclose your basic   identifying   information,   contact   information,   location   information,   healthcare information, health information, and genetic information;
• pathology laboratories  who   would   receive  your   basic   identifying   information, healthcare information, health information, and genetic information;
• clinical pharmacology service  providers, who could process    your basic identifying information, healthcare information, health information, and genetic information;
• laboratory   service   providers,   who   may   process  your   basic   identifying   information, healthcare information, health information, and genetic information;
• data management and biostatistics service providers to whom we may disclose your basic identifying information, location information, healthcare information, health information, genetic information, images and audio recordings and identifiers and device information;
• cardiac safety service providers who would process your basic identifying information, contact information, healthcare information, health information, and genetic information;
• trial oversight, imaging and digital patient services service providers who may receive  your basic identifying information, contact information, location information, healthcare information, health information, genetic information and, audio recordings of your entry or exit interviews;
• quality assurance, safety,  and pharmacovigilance software and related services service  providers who would process  your basic identifying information, contact information, location information, healthcare information, health information, and genetic information;
• data storage and archiving software and related services service providers who may be storing some or all of the information described under Section 5 above;
• data analytics and reporting software and services service providers, who would process your basic identifying information, location information, healthcare information, health information, genetic information, images and audio recordings and identifiers and device information;
• providers   of  services   related   to   the   collection,   storage,   testing,   and transportation of biological material, who will  process  your basic identifying information, location information, healthcare information, health information, and genetic information;
• providers of software that randomly decides which dose level or treatment you will receive during the Trial, to whom we may disclose your basic identifying information, healthcare information, health information, and genetic information;
• logistics and transport service providers, in pursuit of which we may share your basic identifying information, contact information, and location information; and/or
• electronic data capture software and hardware  providers  who may process some or all of the information described under Section 5 above.

12. Transfers of Personal Data from the EU/EEA

The GDPR only allows us to transfer Personal Data outside of the European Union (“EU”) or the European Economic Area (“EEA”) if the country that the data is being transferred to offers an adequate level of protection for the Personal Data which is equivalent to EU law. Cogent is situated in the United States of America (“USA”), outside the EU/EEA. We have implemented various safeguards to protect Personal Data, which enables us to receive EU Personal Data in the USA.

Some of our third party service providers described above may also be located in countries outside of the EU/EEA. We outside the EU/EEA when there are appropriate safeguards in place.These safeguards may include the Standard Contractual Clauses as approved by the European Commission under Article 46.2 of the GDPR.

13. Other Disclosure of Your Personal Data

We may disclose your Personal Data:

• with regulators or competent authorities, to the extent necessary to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws);
• to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties);
• if, in the future, we sell or transfer, or consider selling or transferring, part or all of our company, business, shares or assets to a third party, and we disclose your Personal Data to such third party in connection with the sale or transfer; and/or
• in the event that we are acquired by, or merged with, a third-party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your Personal Data in connection with the foregoing events.

If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

14. Data Integrity and Security

We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect Personal Data from unauthorized processing. This includes unauthorized access, disclosure, alteration, or destruction.

15. Your Data Protection Rights

You have specific rights regarding your Personal Data that we collect and process.

For individual patients: to exercise the rights we explain below, please first speak with your study doctor instead of contacting us directly.

To exercise your data protection rights, email TrialInfo@cogentbio.com and add DATA PROTECTION REQUEST to the subject line. Provide as much information that you consider fit to help us identify you and swiftly treat your request.

Right to Know What Happens to Your Personal Data

This is called the “right to be informed”. It means that you have the right to obtain from us all information regarding our data processing activities that concern you (or your child), such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things.

We are informing you of how we process your Personal Data with this Notice.

Right to Know What Personal Data Cogent Has About You

This is called the “right of access”. This right allows you to ask for full details of the Personal Data we hold about you.

Once we receive and confirm that the request came from you or your authorized agent, we will disclose to you:

• The categories of your Personal Data that we process;
• The categories of sources for your Personal Data;
• Our purposes for processing your Personal Data;
• Where possible, the retention period for your Personal Data, or, if not possible, the criteria used to determine the retention period;
• The categories of third parties with whom we share your Personal Data;
• If we carry out automated decision-making, including profiling, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you;
• The specific pieces of Personal Data we process about you in an easily-sharable format;
• The categories of parties that received your Personal Data from us;
• If we rely on legitimate interests as a lawful basis to process your Personal Data, the specific legitimate interests; and
• The appropriate safeguards used to transfer Personal Data from the EEA to a third country, if applicable.

Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial.

Right to Change Your Personal Data

This is called the “right to rectification”. It gives you the right to ask us to correct anything that you think is wrong with the Personal Data we have on file about you (or your child), and to complete any incomplete Personal Data.

Right to Delete Your Personal Data

This is called the “right to erasure”, “right to deletion”, or the “right to be forgotten”. This right means you can ask for your Personal Data to be deleted.

Sometimes we can delete your information, but other times it is not possible for either technical or legal reasons. If that is the case, we will consider if we can limit how we use it. We will also inform you of our reason for denying your deletion request.

Right to Ask Us to Limit How We Process Your Personal Data

This is called the “right to restrict processing”. It is the right to ask us to only use or store your Personal Data for certain purposes. You have this right in certain instances, such as where you believe the data is inaccurate or the processing activity is unlawful.

Right to Ask Us to Stop Using Your Personal Data

This is called the “right to object”. This is your right to tell us to stop using your Personal Data. You have this right where we rely on a legitimate interest of ours (or of a third party). You may also object at any time to the processing of your Personal Data for direct marketing purposes.We will stop processing the relevant Personal Data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Data to establish, exercise, or defend a legal claim.

Right to Port or Move Your Personal Data

This is called the “right to data portability”. It is the right to ask for and receive a portable copy of your Personal Data that you have given us, so that you can:

• Move it;
• Copy it;
• Keep it for yourself; and/or
• Transfer it to another organization.
‍
We will provide your Personal Data in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you a copy in electronic format.

Right Related to Automated Decision Making

We sometimes use computers to study your Personal Data. For decisions that may seriously impact you, you have the right not to be subject to automatic decision-making, including profiling. But in those cases, we will always explain to you when we might do this, why it is happening and the effect.

Right Related to Automated Decision Making

Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. If you withdraw your consent, our use of your Personal Data before you withdraw is still lawful.

As discussed above, if we requested your consent to process your Personal Data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect processing performed on other lawful grounds. If you withdraw your consent, you may be ineligible to participate in the Trial.

Right to Lodge a Complaint with a Supervisory Authority

If the GDPR applies to our processing of your Personal Data, you have the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data.

Specifically, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR.

16. Changes to this Notice

If we change this Notice, we will publish the revised Notice on our website. We will also update the “Effective” date.

17. Cookies Used on Our Website

For specific information about our use of cookies on our website, please refer to the Cookie Notice available on our website.