GCT3017-01

GCT3017-01 - International Trial of DuoBody®-CD3xCD30

For the �Ǻ�� clinical trial; “A Phase 1/2a, Open-Label, Dose Escalation Trial of GEN3017 With Expansion Cohorts in Relapsed or Refractory CD30+ Classical Hodgkin Lymphoma and CD30+ Non-Hodgkin Lymphoma” (as further described in the Main Participant Information Sheet/Consent Form/ Pregnancy Follow Up Participant Information Sheet/Consent Form provided to you as trial participant or partner to a trial participant).

This Privacy Notice explains how �Ǻ�� (“We”, “Us”) processes your/your child´s personal data where “you” are a clinical trial participant in the trial or a partner to a trial participant.

1) DATA CONTROLLER

The entity responsible for the processing of your and your child´s personal data is:

�Ǻ�� (CVR no. 21023884)

Carl Jacobsens Vej 30

DK-2500 Valby, Denmark

www.genmab.com

Please note, We recommend that you liaise with the study doctor or research staff at the clinic if you have any questions to the processing of your and your child´s data. The study doctor or research staff at the clinic will direct your requests as needed by using your/your partner´s participant ID to Us. It is recommended to use this approach as this will ensure that your request will be dealt with in the most confidential way and your and your child´s identity does not need to be revealed to Us. If you feel that the study doctor or research staff at the clinic are unable to address any question you have about the processing of your and your child´s data and your and your child´s rights, you can contact our Data Protection Officer at: privacy@genmab.com. You also have the right to lodge a complaint with the data protection regulator if you think that any of your and your child´s rights have been violated.

Information on �Ǻ�� use of your and your child´s data

As mentioned in the Main Participant Information Sheet/Consent Form/ Pregnancy Follow Up Participant Information Sheet/Consent Form, your and your child´s data will be disclosed to �Ǻ��’s parent company �Ǻ��. �Ǻ�� will take all reasonable steps to keep your and your child´s data and identity confidential. Your and your child´s data and your and your child´s identity will never be made public.

�Ǻ�� will ensure that your and your child´s data is handled according to the Danish law and the European Union data protection law. The following explains:

which data �Ǻ�� will receive
how �Ǻ�� will use this data and for what purpose
your rights when �Ǻ�� handles your and your child´s data

The collection and use of your and your child´s data

�Ǻ�� will collect and store the following data about you and your child (as applicable):

sex, age, year of birth, body weight, and height.
race and ethnicity
medical data including your medical history, scans, blood samples, biopsies and genetic data
health status
Information about your use of the trial medicine
Information about the effect the trial medicine has on you and your child and its potential side effects
Details of pregnancy and delivery date

Only the study doctor will collect your and your child´s name and contact details. The information will be stored in the clinic and will never be sent to �Ǻ�� or any third parties.

For trial participants:

The purpose of collecting and processing your data is to provide safety information about GEN3017 and find out how well GEN3017 acts against cHL or TCL, an advanced stage of blood cancer for which you previously have received treatment, but the disease is worsening or has not responded well to previous treatment, or your disease has come back, and currently no standard approved therapeutic treatment options are available to you. The results of this trial may be used to apply for a license to market GEN3017. You can read more about the purpose of the trial in this Participant Information under the section “What is the purpose of this research?”

For pregnant partners to trial participants:

The purpose of collecting and processing your and your child’s data is to monitor your and your child’s safety after being potentially exposed to GEN3017.

The processing of your and your child´s data is needed in order for �Ǻ�� to comply with legal obligations. These obligations include notifications to the regulatory authorities and archiving, for example to ensure your and your child´s safety. The legal basis for such processing of your and your child´s data is described in art. 6 (1) (c) and art. 9 (2) (i) of “GDPR.” ^[1] Further, �Ǻ�� has a legitimate purpose in collecting and using your and your child´s data for scientific research purposes. The legal basis for such processing of your and your child´s data is described in art. 6 (1) (f) and art. 9 (2) (j) of the “GDPR.” ¹

Disclosure of your and your child´s information to third parties

�Ǻ�� may share your and your child´s data with other companies and organisations subject to confidentiality. This includes the following categories of data processors: contract research organisations, such as IQVIA, laboratories, and IT suppliers. Such companies and organisations work for or with �Ǻ��/�Ǻ�� to develop GEN3017 and may only use your and your child´s data for the purposes described in the Participant Information Sheet/Consent Form/ Pregnancy Follow Up Participant Information Sheet/Consent Form and will only receive your and your child´s data in a coded form.

�Ǻ��’s authorised representatives, such as auditors and monitors may review your and your child´s data including your medical record to verify that the trial is being run correctly. �Ǻ��’s Genomic Data Review Committee will review the genomic data generated throughout the trial. In some situations, it may be required to access data remotely where it is not feasible for auditors and monitors to travel to or access the study centre in person to verify the data. By signing and dating the consent form, you accept such remote access if allowed by local regulations. In addition, members of the HREC and representatives of the regulatory authorities from your country of residence or from other countries may review your and your child´s data including your medical record to verify that the trial is being run according to the protocol and your and your child´s rights and safety are protected.

�Ǻ�� may also share your and your child´s data with third parties if required by law. An example would be if �Ǻ�� must disclose your and your child´s data to comply with any legal obligation or to establish, exercise or defend �Ǻ��’s legal rights.

For trial participants:

Your family doctor will be informed of your participation in this trial.

Information about this trial can be found on public websites around the world. This corresponds with �Ǻ��’s commitment for transparency of our clinical research and with applicable laws and regulations.

A description of this clinical trial will be available on , as required by U.S. Law. This Web site will not include information that can identify you and your child´s. At most, the Web site will include a summary of the results. You can search this Web site at any time.

Information about the trial can also be found on with the ID number 2023-503348-15-00. When the trial has ended and has been analysed, a summary of the results will be made available irrespective of the outcome of the trial. The overall results will be presented in scientific language and as a summary understandable for non-scientists.

The trial may also be registered on a local website in accordance with national laws.

None of the public websites will include information that can identify you and your child´s.

Transfer of your and your child´s data outside of the European Economic Area (‘EEA’)

Your and your child´s data may be transferred within the EEA or to countries outside the EEA, such as Australia, China, Japan, South Korea, Israel, United Kingdom and United States. The data protection laws in countries outside of EEA may not be as strict as in the EEA. However, �Ǻ�� will ensure compliance with EU data protection law; �Ǻ�� will ensure that the recipient country is an adequate country (i.e. that the country in question is recognised as having an equivalent level of protection). If the country is not an adequate country, �Ǻ�� will ensure to put appropriate safeguards in place when transferring your and your child´s data e.g. in accordance with Chapter V art. 46, (2) (c) of the GDPR. �Ǻ�� uses EU standard contractual clauses to safeguard such transfer.

Retention of data

�Ǻ�� will save your and your child´s data in accordance with the regulation (EU) 2014/536 of 16 April 2014 (on clinical trials on medicinal products for human use) unless other EU law requires archiving for a longer period. �Ǻ�� will archive the content from the clinical trial master file for at least 25 years after the end of the clinical trial.

Your rights

In accordance with relevant Australian regulations, you and your child have a number of legal rights in relation to the data that �Ǻ�� holds about you and your child´s. These rights include:

You are entitled to ask for up-to-date information on:
- which data have been recorded
- how the data has been recorded
- to see data relating to you and your child
- to have data relating to you and your child corrected if it is inaccurate
Your participation in the trial is voluntary. Your choice will not affect your present or future treatment.
The right to receive the data collected about you in a structured, commonly used, and machine-readable format
The right to request that �Ǻ�� provides those data to a third party where this is technically feasible
The right to strict confidentiality when your and your child´s data is used/processed.
The right to request that �Ǻ�� erases your and your child´s data in certain circumstances.
The right to request that the processing of your and your child´s data is restricted in certain circumstances.
The right to lodge a complaint with the data protection regulator if you think that any of your and your child´s rights have been violated.

Please note there may be conditions or limitations on these rights. You may for example not have the right to restricted use of your and your child´s data if �Ǻ�� needs to manage your and your child´s information in specific ways in order for the research to be reliable and accurate.

If you have any questions about this information, please contact your/your partner´s study doctor via the information given in the Participant Information/Pregnancy Follow Up Participant Information Sheet/Consent Form. The study doctor will direct your requests as needed by using your/your partner´s trial participant ID to �Ǻ��. This approach is recommended to ensure that your request will be dealt with in the most confidential way as your and your child´s identity does not need to be revealed to �Ǻ�� or �Ǻ��.

You can always contact �Ǻ��’s Data Protection Officer at: privacy@genmab.com �Ǻ��, (CVR no. 21023884); Carl Jacobsens Vej 30, DK-2500 Valby; Denmark); www.genmab.com if you feel that the study doctor is unable to address any question you have about �Ǻ��’s processing of your and your child´s data and your and your child´s rights, or if you want to file a complaint regarding �Ǻ��’s processing of your and your child´s data. You also have the right to lodge a complaint with the data protection regulator if you think that any of your and your child´s rights have been violated.

_{1. Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016 referred to as the GDPR;}

Last updated: September 2023

�Ǻ�����

GCT3017-01 - International Trial of DuoBody®-CD3xCD30

�Ǻ��