Privacy Policy

On this page we inform you of which personal data Trialtech SL, Avda. De los Charcos 19, 28860 Madrid, processes when you use this website and its offerings, and for what purpose such data are processed when you:

• Visit and register on our website (see Section 2),

• Give us your consent to receive information about current studies (see Section 3),

• Apply to participate in a study through the Un Ensayo para Mí portal (see Section 4),

• Give us additional, voluntary consent so that we may inform you about other studies related to your condition of interest (see Section 4.5), or

• Provide us with your mobile telephone number to receive text messages or WhatsApp messages related to a study (see Section 6.5).

You will also receive information about your rights in connection with the processing of your data.

We process your data in accordance with the applicable data protection laws, including:

• Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), in force since 25 May 2018.

• Brazil's General Data Protection Law (LGPD), Law No. 13,709/2018.

• Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

• Argentina's Personal Data Protection Law No. 25,326.

• Chile's Law No. 21,719 on Personal Data Protection, amending Law No. 19,628.

• Peru's Law No. 29733, Personal Data Protection Law, and its Regulations (Supreme Decree No. 016-2024-JUS).

• Colombia's Statutory Law 1581 of 2012 on Personal Data Protection and its regulatory Decree 1377 of 2013 (compiled in Decree 1074 of 2015).

• The applicable consumer privacy and consumer health data laws of the United States of America, where the user resides in that country (see Section 6.6).

Trialtech SL is hereinafter referred to as "Un Ensayo para Mí".

This Privacy Policy is supplemented by our Messaging Terms, which specifically describe our text message and WhatsApp messaging program.

1. Who is the controller of your data?

The entity responsible for the processing of your personal data as controller within the meaning of Article 4(7) GDPR, Article 5, item VI, LGPD, Article 3, section XIV, LFPDPPP, Article 2 of Law No. 25,326, Chile's Law No. 21,719, Article 2 of Peru's Law No. 29733 and Article 3(e) of Law 1581 of 2012 of Colombia is:

Trialtech SL

Avda. De los Charcos 19

28860 Madrid

2. Data protection information for visitors to the Un Ensayo para Mí websites

2.1 What data are processed when visiting the websites?

Each time you access the Un Ensayo para Mí website, the Un Ensayo para Mí servers automatically store various data about the accessing system ("server log files").

These are:

IP address (anonymized where necessary)

Browser type and version

Operating system used

Referrer URL

Time of the server request

Un Ensayo para Mí uses these data in order to make the website accessible, to identify and resolve any technical problems that may arise, and to prevent misuse of the Un Ensayo para Mí offering and, where necessary, to pursue it.

Un Ensayo para Mí also reserves the right to use the access data in anonymized form, that is, without the possibility of identifying the user, for statistical purposes and to improve the website (see also Section 5 in this regard).

The legal basis for the processing of access data as personal data of the user is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 16 LFPDPPP, Article 6 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015). The legitimate interest is that, through the processing of data, we can make the website accessible to the user and improve the services of Un Ensayo para Mí.

2.2 How are the data entered at the time of registration processed?

Certain features of the Un Ensayo para Mí website require prior registration. To register, the user must provide his or her e-mail address, as well as first name and surname ("required data"). The user makes these data available with knowledge of these data protection provisions. Without these (required) data, it is not possible to use such features.

The user may also express interest in a study through forms made available for that purpose, without the need to register beforehand. In that case, only the data provided by the user in the form are processed, for the purpose described in Section 4.

In addition to the required data, users may voluntarily provide other information (e.g., sex, date of birth, postal code, telephone number, main interests in the study) ("additional data"). The data collected in the course of registration (required and additional data) will be stored by Un Ensayo para Mí in the user's personal profile and processed to identify the user when accessing the features of the Un Ensayo para Mí website and to personalize the content of the service offering.

The legal basis for the processing of the user's data is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 12 LFPDPPP, Article 6 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015). Our legitimate interest consists in making the features of the website available to the user.

2.3 What are the consequences of the use of so-called cookies?

During your visit to the website, information in the form of so-called "cookies" will be placed in the browser of the user's computer. "Cookies" are small files containing configuration information that are stored via the browser on the computer's hard drive and facilitate the use of the website. The "cookies" used are so-called session cookies, which the browser deletes once the session is closed. Un Ensayo para Mí makes use of certain advertising partners that help make the Internet offering and the websites more interesting for you. Accordingly, during a visit to the websites, cookies from partner companies are also stored on your hard drive. These are temporary / permanent cookies that are automatically deleted after a specified period of time (lifetime of 1 month to 10 years). The cookies of our partner companies likewise do not contain any personal data. They collect data exclusively under a pseudonymous user ID. For example, these are data about the topics you have been interested in, whether you have registered for a study, which study indications you have searched for, etc. In this case, some of our advertising partners also record, via the pages, information about which page you visited previously or which products you have been interested in, in order to be able to show you the advertising that best matches your interests. These pseudonymous data are at no time linked to your personal data.

The Un Ensayo para Mí pages use re-targeting technologies such as, for example, the pixel of Facebook Ireland Limited. We use these technologies to create the Internet offering that is most interesting for you. This technique makes it possible to draw Internet users who have already shown interest in Un Ensayo para Mí and clinical studies to the websites of our partners through advertising. We are convinced that the integration of personalized advertising, targeted to the user's interests, is as a rule more interesting for the Internet user than advertising that has no personal reference. The integration of these advertising materials on our partners' pages is carried out on the basis of cookie technology and an analysis of the user's previous behavior. This form of advertising is carried out in a completely anonymous manner. No personal data are stored and no user profile is linked to your personal data. If you visit one of our websites and have accepted the placement of cookies in your browser settings, this means to us that you wish to use the products and services of Un Ensayo para Mí and that, for this purpose, you agree to the use of cookies and other technologies as described in our data protection statement.

The technologies described in this section do not under any circumstances use your mobile telephone number or your messaging consent data. Such information is excluded from any advertising purpose, as detailed in Section 6.5.

In your browser you can configure the option to accept the storage of cookies only when you agree to it. If you wish to accept the cookies of Un Ensayo para Mí but not those of our service providers and partners, then select the browser setting "Block third-party cookies". On shared computers whose settings are configured to accept cookies and flash cookies, we recommend that you always log out completely when you have finished.

The legal basis for the use of cookies is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 14 LFPDPPP, Articles 4 and 6 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015). Our legitimate interest lies in being able, through the processing of data, to carry out statistical evaluations of the use of our website and to optimize the Internet offering for users.

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of the website is generally transmitted to a Google server in the United States and stored there. The IP address transmitted by your browser within the framework of Google Analytics will not be linked to other Google data. On this website we have additionally extended Google Analytics with the "anonymizeIP" code. This guarantees the masking of your IP address, so that all data are collected anonymously. Only in exceptional cases will the full IP address be transmitted to a server in the United States and truncated there.

On behalf of the operator of this website, Google uses this information to evaluate your use of the website, to compile reports on website activity and to provide further services related to website and Internet use. You can prevent the storage of cookies through the corresponding setting in your browser. However, we point out that in this case it is possible that not all functions of this website will work to their full extent.

You can also prevent the collection by Google of the data generated by the cookie and related to your use of the website (including your IP address), as well as the processing of these data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=es. An alternative to the browser add-on, in particular on browsers of mobile devices, is to click on the following link). An opt-out cookie will be installed that will prevent the future collection of your data when you visit this website. The opt-out cookie is valid only for this browser and only for our website and will be placed on your device. If you delete the cookies in this browser, you will have to install the opt-out cookie again. [Note: Instructions for integrating the opt-out cookie can be found here: https://developers.google.com/analytics/devguides/collection/gajs/?hl=es#disable].

We also use AdWords to evaluate data for statistical purposes. If you do not wish this, you can deactivate it through the Ads Preferences Manager (http://www.google.com/settings/ads/onweb/?hl=es).

This website uses the Google Analytics reports on demographic characteristics, in which data from Google's interest-based advertising as well as visitor data from third-party providers (e.g., age, sex and interests) are used. These data cannot be traced back to a specific person and can be deactivated at any time through the ads settings.

Further information on the use of data for advertising purposes by Google, and on setting and opt-out options, can be found on Google's websites: https://www.google.com/intl/de/policies/privacy/partners/ ("Use of data by Google on your use of websites or applications of our partners"), http://www.google.com/policies/technologies/ads ("Use of data for advertising purposes"), http://www.google.de/settings/ads ("Manage information that Google uses to show you advertising") and http://www.google.com/ads/preferences/ ("Decide which advertising Google shows you").

The use of Google Analytics is carried out in accordance with the requirements agreed between the Spanish data protection authorities and Google. Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Privacy policy: http://www.google.com/analytics/learn/privacy.html

2.4 What options arise from logging in via social media and which data are then processed?

You can register quickly and easily with Un Ensayo para Mí using your Facebook or Google account. The prerequisite for this is that you are already registered with Facebook or Google or that you create a Facebook or Google account. If you wish to use this function, you will first be redirected to Facebook / Google. There you will be asked to log in with your username and password. Naturally, we do not take note of your login credentials. If you are already logged in to Facebook or Google, this step will be skipped. Facebook / Google will then inform you which data will be transmitted to us. You confirm this by clicking the "OK" button. We create your user account with the data transmitted. No permanent link is established between your user account and your Facebook / Google account beyond this. The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as your rights and setting options for protecting your privacy, can be found in the data protection notices of Facebook (https://www.facebook.com/about/privacy/) and Google (https://www.google.com/policies/privacy/). Un Ensayo para Mí processes the personal data transmitted by each of the providers (Facebook, Google) in the course of user registration (see Section 2.2 cited above).

The legal basis for the processing of these data is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 15 LFPDPPP, Article 4 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015).

2.5 For how long are personal data stored?

The required and voluntary data entered in the course of registration (see Section 2.2) will be deleted upon deletion of the account, insofar as no legal provisions require longer storage.

With regard to the deletion of cookies, reference is made to the explanations set out in Section 2.3.

The legal basis for the processing of anonymized data is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 16 LFPDPPP, Article 4 of Law No. 25,326, the provisions of Chile's Law No. 21,719, the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS) and Article 10(d) of Law 1581 of 2012 of Colombia (processing for statistical purposes). Our legitimate interest consists in the principle of data minimization established in Article 5(1)(c) GDPR, Article 6, item III, LGPD, Article 11 LFPDPPP, Article 9 of Law No. 25,326 and the principle of proportionality of Article 7 of Peru's Law No. 29733 and the principles of purpose limitation and restricted access and circulation of Article 4 of Law 1581 of 2012 of Colombia.

3. Data protection information for subscribers to Un Ensayo para Mí study communications (newsletter)

Users may subscribe to communications from Un Ensayo para Mí about a selected topic or condition, as well as about current and future studies related to that condition, either from the website or at the time of applying to participate in a study (see Section 4.5). For this purpose, the user must give his or her consent within the meaning of Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Argentina's Law No. 25,326, the consent provisions of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Articles 9 and 12 of Law 1581 of 2012 of Colombia, to the processing of his or her personal data relevant for this purpose. Where the selected topic or condition reveals information about the user's health, such consent has the character of explicit consent within the meaning of Article 9(2)(a) GDPR and of the provisions on sensitive data of the other laws cited in Section 4.

3.1 What happens when the user subscribes to a newsletter?

In the event of subscribing to the newsletter, the required and voluntary data (see Section 2.2 above) stored in the user profile are processed for sending the newsletter (e-mail address) with formal personalization (first name and surname), as well as content personalization (e.g., postal code and main study-related interests indicated by the user).

The user gives his or her consent to subscribe to the newsletter with full knowledge of these data protection provisions and the processing operations mentioned above.

3.2 Right of withdrawal at any time

The user has the right to withdraw his or her consent at any time, without this affecting the lawfulness of the processing carried out up to that point on the basis of the consent given. This declaration may be made through a link included in the newsletter; in addition, the user has available the option described in Section 8 of contacting the controller.

In the event of withdrawal, the user will no longer receive the newsletter.

The legal basis for the exercise of the right of withdrawal is found in Article 7(3) GDPR, Article 8, item V, LGPD, Article 8 LFPDPPP, Article 6 of Law No. 25,326, the provisions on withdrawal of consent of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Article 8(e) of Law 1581 of 2012 of Colombia.

4. Data protection information for the user's study applications

The Un Ensayo para Mí website can be used not only to obtain general information about clinical studies; users may also apply to participate in a study ("study application"), either from their registered account or through the forms made available for that purpose.

In order to submit a study application, explicit consent must be given to the data processing associated with the study application, within the meaning of Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Law No. 25,326, the consent provisions of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Articles 9 and 12 of Law 1581 of 2012 of Colombia. In addition, with respect to sensitive data, the consent must meet the requirements established in Article 9(2)(a) GDPR, Article 11, item I, LGPD, Article 9 LFPDPPP, Article 7 of Law No. 25,326, the provisions on the processing of sensitive data of Chile's Law No. 21,719, Article 13, paragraph 6, of Peru's Law No. 29733 (express and written consent for sensitive data) and Article 6(a) of Law 1581 of 2012 of Colombia (explicit authorization for the processing of sensitive data).

Data subjects governed by Colombian law are informed that, pursuant to Article 6 of Law 1581 of 2012 and Article 2.2.2.25.2.3 of Decree 1074 of 2015, the provision of sensitive data (including health-related data) is optional and that no activity will be conditioned upon its provision.

Specific consent must be given for each particular study. In the case of applications for several studies, separate consent must be given for each of them.

4.1 What personal data are collected in the context of the study application?

In the context of a study application, the user's personal data are requested insofar as they are relevant to the user's suitability for a specific study. As a rule, this includes data about the user's health ("special categories of personal data" within the meaning of Article 9(1) GDPR, Article 11 LGPD, Article 9 LFPDPPP, Article 2 of Law No. 25,326, the provisions on sensitive data of Chile's Law No. 21,719, Article 2, paragraph 5, of Peru's Law No. 29733 and Article 5 of Law 1581 of 2012 of Colombia).

Where the application is submitted by a family member, caregiver or legal representative on behalf of a prospective participant, both the data of the prospective participant and the contact details of the person submitting the application are processed.

The user provides Un Ensayo para Mí with the relevant data on the basis of explicit consent given voluntarily and with full knowledge of these data protection provisions. Without knowledge of the requested data, in certain circumstances Un Ensayo para Mí may be unable to offer certain services and offerings, either at all or in full.

The legal basis for the processing of the user's data is Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Law No. 25,326, the consent provisions of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Articles 9 and 12 of Law 1581 of 2012 of Colombia, in conjunction with Article 9(2)(a) GDPR, Article 11, item I, LGPD, Article 9 LFPDPPP, Article 7 of Law No. 25,326, the provisions on sensitive data of Chile's Law No. 21,719, Article 13, paragraph 6, of Peru's Law No. 29733 and Article 6(a) of Law 1581 of 2012 of Colombia.

4.2 What other processing operations are carried out?

The user data collected in the context of the study application are stored by Un Ensayo para Mí in the user's personal profile and processed to verify the user's suitability for the study in question. The data will also be used for communication between Un Ensayo para Mí and the user in the context of the application process for the study for which the user has applied, including communication by text message or WhatsApp where the user has given his or her consent to this (see Section 6.5). Un Ensayo para Mí will not use the application data to inform the user about other studies, unless the user has given the additional consent described in Section 4.5.

Finally, the user's data, where the user has given explicit consent to their disclosure and the user appears, from the point of view of Un Ensayo para Mí, to be suitable for the study, will be transmitted to one of the sites associated with the study. The disclosed data may be used by the study site to contact the user.

In addition, the data stored at Un Ensayo para Mí may be submitted for further information on the status of the application ("status information"). Un Ensayo para Mí uses this information exclusively to assist the study site staff in contacting the user and/or to evaluate the user's application, as well as to carry out statistical evaluations (see Section 5 below in this regard).

4.3 Right of withdrawal at any time

The user has the right to withdraw at any time, with effect for the future, his or her consent to the processing of personal data related to the study application, within the meaning of Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Law No. 25,326, the provisions on withdrawal of consent of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Article 8(e) of Law 1581 of 2012 of Colombia, without this affecting the lawfulness of the processing carried out up to that point on the basis of the consent given.

A declaration of withdrawal may be sent by e-mail to privacy@trialtech.es. In addition, the user has the option described in Section 8 of contacting the controller.

The user may also limit the withdrawal to certain data. However, the withdrawal, even if limited to certain data, may result in the user no longer being able to use certain services (in particular, his or her application to participate in a study can no longer be evaluated).

4.4 For how long will the personal data collected in the context of the application to participate in a study be stored?

Upon withdrawal, the data entered by the user (see Section 4.1) will be deleted, provided that no legal provisions require longer storage. If the user has limited the withdrawal to certain data, only the data affected by the withdrawal will be deleted.

If no withdrawal is made, the data will be processed for the periods specifically indicated in the context of the declaration of consent and subsequently deleted.

The legal basis for the deletion of the data is Article 6(1)(a) and (f) GDPR, Article 7, items I and IX, LGPD, Articles 8 and 11 LFPDPPP, Articles 4 and 9 of Law No. 25,326, the provisions of Chile's Law No. 21,719, Articles 5 and 20 of Peru's Law No. 29733, and Article 8(e) of Law 1581 of 2012 of Colombia and Article 2.2.2.25.2.6 of Decree 1074 of 2015 (revocation of authorization and deletion of data). Our legitimate interest consists in the principle of data minimization established in Article 5(1)(c) GDPR, Article 6, item III, LGPD, Article 13 LFPDPPP, Article 4, paragraph 1, of Law No. 25,326 and the principle of proportionality of Article 7 of Peru's Law No. 29733 and the principles of purpose limitation and restricted access and circulation of Article 4 of Law 1581 of 2012 of Colombia.

4.5 Additional consent to receive information about other studies

When applying to participate in a study, the user may give, separately and voluntarily, his or her consent for Un Ensayo para Mí to inform him or her about other clinical studies related to the condition or therapeutic area of interest, by e-mail, text message or WhatsApp. This consent is not a condition for applying or for receiving any of our services, and its absence does not in any way affect the evaluation of the application.

For this purpose, only the user's contact details, country or region, language, condition or therapeutic area of interest and the record of the consent given (date, time, text displayed, language and channel) are processed. The responses to the eligibility questionnaire and the other health data provided in the application are not used; these are retained and deleted in accordance with Section 4.4.

Receiving a communication about another study does not constitute an application to participate in that study: if the user wishes to apply, he or she must give the specific consent for that study in accordance with Section 4. Un Ensayo para Mí limits the frequency of these communications and will cease sending them if the user does not interact with them for an extended period.

The user may withdraw this consent at any time, free of charge and with effect for the future, through the link or keyword included in each communication, or by writing to privacy@trialtech.es. The withdrawal does not affect the lawfulness of the processing carried out up to that point, nor the processing of the application data for the study for which the user has applied.

The legal basis for the processing described in this section is Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Law No. 25,326, the consent provisions of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Articles 9 and 12 of Law 1581 of 2012 of Colombia, in conjunction with Article 9(2)(a) GDPR, Article 11, item I, LGPD, Article 9 LFPDPPP, Article 7 of Law No. 25,326, the provisions on sensitive data of Chile's Law No. 21,719, Article 13, paragraph 6, of Peru's Law No. 29733 and Article 6(a) of Law 1581 of 2012 of Colombia.

5. Use of anonymized data

Un Ensayo para Mí anonymizes the data collected from the user and subsequently uses them for statistical evaluations.

The legal basis for the processing of anonymized data is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 16 LFPDPPP, Article 4 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015). Our legitimate interest lies in the principle of data minimization and in our interest in optimizing inclusion criteria or the design of questionnaires for future studies, as established in Article 5(1)(c) GDPR, Article 6, item III, LGPD, Article 11 LFPDPPP, Article 9 of Law No. 25,326 and the principle of proportionality of Article 7 of Peru's Law No. 29733 and the principles of purpose limitation and restricted access and circulation of Article 4 of Law 1581 of 2012 of Colombia.

6. Transmission and disclosure of personal data to third parties

6.1. Un Ensayo para Mí is entitled to make user data available to third parties acting on behalf of Un Ensayo para Mí as processors, under the corresponding contract, for the provision of their services (e.g., hosting providers, communication platforms and other technical service providers). The disclosure of data is limited to the purpose of the collaboration, and such third parties may only use the data to the extent necessary to provide services to Un Ensayo para Mí, and never for their own purposes. Your mobile information is additionally subject to the further restriction described in Section 6.5.

The legal basis for the transmission of personal data described above is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 17 LFPDPPP, Article 11 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015). For data subjects governed by Colombian law, such third parties act as processors within the meaning of Article 3(d) of Law 1581 of 2012 and are subject to the duties set out in Article 18 of that law. Our legitimate interest consists in improving our procedures and services.

6.2. Un Ensayo para Mí may also disclose personal data to third parties,

6.2.1. Where the user has expressly given his or her consent (e.g., to a site conducting a study for which the user has registered). The legal basis is Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Law No. 25,326, the consent provisions of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Articles 9 and 12 of Law 1581 of 2012 of Colombia.

6.2.2. Where there is an enforceable or final judicial or administrative order for the publication and/or disclosure of data to third parties, or where Un Ensayo para Mí, by reason of a legal obligation, even without such an order, is required to publish and/or disclose data to third parties. The legal basis is Article 6(1)(c) and (f) GDPR, Article 7, items II and XI, LGPD, Article 17 LFPDPPP, Article 11 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719, the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS) and Article 10(a) of Law 1581 of 2012 of Colombia (information required by a public or administrative entity in the exercise of its legal functions or by court order). Our legitimate interest lies in compliance with legal obligations and justified claims.

6.2.3. Where the publication and/or disclosure is necessary to prevent misuse of the Internet offering or of individual services, in particular breaches of the terms of use, to the extent legally permitted. The legal basis is Article 6(1)(f) GDPR, Article 7, item IX, LGPD, Article 17 LFPDPPP, Article 11 of Law No. 25,326, the provisions on lawful bases for processing of Chile's Law No. 21,719 and the Regulations of Peru's Law No. 29733 (Supreme Decree No. 016-2024-JUS), and the prior, express and informed authorization of the data subject pursuant to Articles 9 and 12 of Law 1581 of 2012 of Colombia (including authorization obtained through unequivocal conduct, Article 2.2.2.25.2.4 of Decree 1074 of 2015). Our legitimate interest lies in the detection and pursuit of improper conduct.

6.3 Except in the cases set out in this data protection statement, Un Ensayo para Mí does not disclose user data to third parties without the user's explicit consent.

The legal basis for the transmission of personal data in the case of explicit consent is Article 6(1)(a) GDPR, Article 7, item I, LGPD, Article 8 LFPDPPP, Article 5 of Law No. 25,326, the consent provisions of Chile's Law No. 21,719 and Article 5 of Peru's Law No. 29733, and Articles 9 and 12 of Law 1581 of 2012 of Colombia.

6.4 International data transfers

Since the controller is established in Spain and the evaluation of the user's suitability for studies may involve the communication of his or her data to research sites, sponsors or service providers located in different countries, the processing may entail an international transfer of personal data, including special categories of data (health-related data).

Such transfers are carried out on the basis of the user's explicit consent and/or the appropriate safeguards provided for in the applicable legislation. The legal basis for the international transfer of data is Article 44 et seq. GDPR, Article 33 et seq. LGPD, Article 36 LFPDPPP, Article 12 of Law No. 25,326, the provisions on international data transfers of Chile's Law No. 21,719, the provisions on cross-border data flows of Peru's Law No. 29733 and its Regulations (Supreme Decree No. 016-2024-JUS) and Article 26 of Law 1581 of 2012 of Colombia. For data subjects governed by Colombian law, the transfer of their data to Trialtech SL, established in Spain, is covered by the adequate level of protection that the Superintendencia de Industria y Comercio (SIC), Colombia's Superintendence of Industry and Commerce, recognizes for the Member States of the European Union (External Circular 005 of 2017) and, additionally, by the express and unequivocal authorization of the data subject (Article 26(a) of Law 1581 of 2012). The user may request information about the applicable safeguards through the contact details indicated in Section 8.

6.5 Mobile information and messaging programs

Mobile telephone numbers, text messaging consent data and the consent itself will not be shared with third parties or affiliated companies for advertising or promotional purposes.

We use your mobile telephone number to communicate with you in connection with the clinical study in which you have expressed interest and, only if you have given the additional consent described in Section 4.5, to inform you about other studies related to your condition of interest. In particular:

• We do not sell, rent or transfer your mobile telephone number to third parties.

• We do not use your mobile telephone number or your messaging consent data for our own or third-party advertising purposes, nor for the creation of advertising audiences.

• When we share your information with a research site, we do so only with your explicit consent and for the sole purpose of your possible participation in that study.

• When we engage service providers acting on our behalf under contract, such providers may only use your mobile information to the extent necessary to provide services to Un Ensayo para Mí, and never for their own advertising purposes.

Your consent to receive messages is specific to each study or, where applicable, to the purpose described in Section 4.5, and never constitutes a condition for participating in a study or for receiving any of our services. You may withdraw it at any time and free of charge, as described in our Messaging Terms.

When you give your consent to receive messages, we record the date and time, the text of the consent notice that was displayed to you, the language in which it was displayed and the technical data of your submission. We retain this record for the purpose of being able to demonstrate that consent was given and to be able to respond to any request or complaint.

6.6 Users residing in the United States of America

Where the user resides in the United States of America, in addition to the provisions of the remainder of this Privacy Policy, the applicable state consumer privacy and consumer health data laws apply.

With respect to such users:

• We do not sell or share your health data or your mobile information with third parties for targeted advertising or for such third parties' own promotional purposes.

• We obtain your specific and separate consent before collecting data relating to your health.

• The user may request access to, rectification of, deletion of or a copy of his or her personal data, as well as withdraw consent, by writing to privacy@trialtech.es.

• We will respond to your request without undue delay and without the exercise of your rights resulting in any detriment or difference in treatment.

Text messages are sent to users residing in the United States in compliance with the applicable federal consumer communications laws, including the provisions on prior consent, withdrawal of consent by any reasonable means and permitted contact hours.

7. User rights

The user has the following rights. Their exercise will be processed promptly and will not result in any detriment to the user.

Right of access (Art. 15 GDPR, Art. 18 LGPD, Art. 16 LFPDPPP, Art. 14 of Law No. 25,326, Chile's Law No. 21,719, Art. 18 of Peru's Law No. 29733, Art. 8(a), (c) and (f), and Art. 14 of Law 1581 of 2012 of Colombia): The user may, free of charge, request from Un Ensayo para Mí information about which personal data are being processed, what their source is and for what purpose(s) they are being processed and, where relevant, to which recipients or categories of recipients these data are transmitted. Requests for information submitted electronically will be answered electronically.

Right to object (Art. 21 GDPR, Art. 18 LGPD, Art. 8 LFPDPPP, Art. 16 of Law No. 25,326, Chile's Law No. 21,719, Art. 22 of Peru's Law No. 29733, Art. 8(e) of Law 1581 of 2012 of Colombia): The user may object to the processing of his or her data on grounds relating to his or her particular situation, insofar as the data processing is based on the legitimate interests of Un Ensayo para Mí or of a third party (Art. 6(1)(f) GDPR, Art. 7, item IX, LGPD, Art. 11 LFPDPPP, and Art. 6 of Law No. 25,326), as well as in cases where the data processing is carried out in the public interest (Art. 6(1)(e) GDPR, Art. 7, item III, LGPD, Art. 13 LFPDPPP, and Art. 5 of Law No. 25,326). If the user lodges an objection, Un Ensayo para Mí will no longer process the data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the user, or the processing serves the establishment, exercise or defense of legal claims.

Insofar as Un Ensayo para Mí processes personal data to provide targeted information about the range of services of Un Ensayo para Mí ("advertising purposes"), the user has the right to object to the processing of his or her personal data in connection with such purposes. In the event of an objection to processing for advertising purposes, Un Ensayo para Mí will no longer process the user's personal data for these purposes.

Right to data transmission / portability (Art. 20 GDPR, Art. 18 LGPD, Art. 12 LFPDPPP, Art. 14 of Law No. 25,326, Chile's Law No. 21,719, Peru's Law No. 29733 and its Regulations; not expressly provided for in Law 1581 of 2012 of Colombia, where it will be handled within the framework of the right of access under Art. 8): The user has the right to request the personal data he or she has made available to Un Ensayo para Mí in a structured, commonly machine-readable format, insofar as the processing of the data is based on the user's consent (Art. 6(1)(a) GDPR, Art. 7, item I, LGPD, Art. 8 LFPDPPP, and Art. 5 of Law No. 25,326) or the processing is carried out for the performance of a contract entered into with the user or for the implementation of pre-contractual measures (Art. 6(1)(b) GDPR, Art. 7, item V, LGPD, and Art. 12 LFPDPPP).

Right to rectification (Art. 16 GDPR, Art. 18 LGPD, Art. 16 LFPDPPP, Art. 16 of Law No. 25,326, Chile's Law No. 21,719, Art. 20 of Peru's Law No. 29733, Art. 8(a), and Art. 15 of Law 1581 of 2012 of Colombia): In the event that personal data are inaccurate or incomplete, their rectification or completion may be requested.

Right to erasure / deletion (Art. 17 GDPR, Art. 18 LGPD, Art. 16 LFPDPPP, Art. 16 of Law No. 25,326, Chile's Law No. 21,719, Art. 20 of Peru's Law No. 29733, Art. 8(e), and Art. 15 of Law 1581 of 2012 of Colombia): The user may request the immediate erasure of his or her data where (i) the purpose of the data processing has ceased, (ii) the processing is based on the user's consent and this has been withdrawn, (iii) the user has objected to the processing and no other form of processing has taken place, or (iv) there is no legal basis for the processing of the data.

Right to restriction of processing (Art. 18 GDPR, Art. 18 LGPD, Art. 16 LFPDPPP, Art. 16 of Law No. 25,326, Chile's Law No. 21,719, Peru's Law No. 29733, Art. 15 of Law 1581 of 2012 of Colombia): The processing of personal data may be restricted in specific cases, such as (i) while a rectification of data is being verified, (ii) where the processing was unlawful from the outset, or (iii) where the data are no longer needed but the user requires them for the exercise of legal claims.

Right to lodge a complaint (Art. 77 GDPR, Art. 18 LGPD, Art. 18 LFPDPPP, Art. 14 of Law No. 25,326, Chile's Law No. 21,719, Peru's Law No. 29733, Art. 8(d), and Art. 21 of Law 1581 of 2012 of Colombia): The user has the right to contact a supervisory authority with complaints relating to the processing of his or her data.

Right to withdraw consent (Art. 7(3) GDPR, Art. 18 LGPD, Art. 8 LFPDPPP, Art. 6 of Law No. 25,326, Chile's Law No. 21,719, Art. 5 of Peru's Law No. 29733, Art. 8(e) of Law 1581 of 2012 of Colombia): The user has the right to withdraw at any time any consent given to Un Ensayo para Mí for the processing of his or her personal data. In the case of consent to receive messages, withdrawal may additionally be carried out by the means described in Section 6.5 and in our Messaging Terms. In the case of the additional consent to receive information about other studies, withdrawal may be carried out by the means described in Section 4.5.

Users governed by Chilean or Peruvian law may exercise the same rights (access, rectification, cancellation or erasure, objection and portability) in accordance with Chile's Law No. 21,719 and Peru's Law No. 29733 and its Regulations, by contacting the contacts listed in Section 8 or the supervisory authorities indicated therein.

Users governed by Colombian law may exercise the rights provided for in Article 8 of Law 1581 of 2012 (to know, update and rectify their data; to request proof of the authorization given; to be informed of the use made of their data; to file complaints with the Superintendencia de Industria y Comercio; to revoke the authorization and/or request the deletion of the data; and to access their data free of charge) by contacting the contacts listed in Section 8. Inquiries will be answered within a maximum period of ten (10) business days and complaints within a maximum period of fifteen (15) business days, in accordance with Articles 14 and 15 of Law 1581 of 2012. Data subjects may apply to the Superintendencia de Industria y Comercio once the inquiry or complaint procedure before Un Ensayo para Mí has been exhausted (Article 16 of Law 1581 of 2012).

Users residing in the United States of America may exercise the rights described in Section 6.6 by contacting the contacts indicated in Section 8.

8. Contact details of the controller

The contact details of the controller:

Trialtech SL

Avda. De los Charcos 19

28860 Madrid

E-mail: info@trialtech.es

User support e-mail: support@trialtech.es

The contact details of the controller's data protection officer:

European Union & Americas

Data Privacy Office

Espanya Industrial 7, 3° 1

08014 Barcelona

E-mail: privacy@trialtech.es

Using the contact addresses just mentioned, the rights referred to in Section 7 may be asserted both against the controller and against its data protection officer. Questions relating to data protection may also be raised and suggestions made.

Spain:

The Spanish Data Protection Agency (Agencia Española de Protección de Datos) is the competent supervisory authority. It oversees compliance with data protection law in Spain. The user may contact the supervisory authority at any time.

Contact details:

Agencia Española de Protección de Datos

C/ Jorge Juan, 6

28001-Madrid

Tel.: +34 / 900 293 183

Complaints: https://sedeagpd.gob.es/sede-electronica-web/vistas/infoSede/tramitesCiudadano.jsf

Brazil:

The Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) is the competent supervisory authority in Brazil. It oversees compliance with data protection law as established in the General Data Protection Law (LGPD). The user may contact the supervisory authority at any time.

Contact details:

Autoridade Nacional de Proteção de Dados (ANPD)

SCS, Quadra 09, Lote C

Torre C - Ed. Parque Cidade Corporate

Brasília, DF - Brasil

CEP: 70308-200

Website: https://www.gov.br/anpd

Complaints: https://www.gov.br/anpd/pt-br/canais_atendimento/cidadao-titular-de-dados/denuncia-peticao-de-titular

Mexico:

The National Institute for Transparency, Access to Information and Personal Data Protection (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, INAI) is the competent supervisory authority in Mexico. This body oversees compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and ensures that controllers and processors of personal data comply with the applicable legal provisions.

Contact details:

Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)

Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Alcaldía Coyoacán

C.P. 04530, Ciudad de México, México

Telephone: +52 (55) 5004 2400

Website: https://home.inai.org.mx

Complaints: https://www.plataformadetransparencia.org.mx

Argentina:

The Agency for Access to Public Information (Agencia de Acceso a la Información Pública, AAIP) is the competent supervisory authority in Argentina. This body oversees compliance with the Personal Data Protection Law (Law No. 25,326) and ensures that controllers and processors of personal data comply with the applicable legal provisions.

Contact details:

Agencia de Acceso a la Información Pública (AAIP)

Av. Pte. Gral. Julio A. Roca 710, Piso 3

C1067ABP, Ciudad Autónoma de Buenos Aires, Argentina

Telephone: +54 (11) 3988-3968

Website: https://www.argentina.gob.ar/aaip

Complaints: https://www.argentina.gob.ar/servicio/denunciar-incumplimientos-de-la-ley-de-proteccion-de-datos-personales

Chile:

The Personal Data Protection Agency (Agencia de Protección de Datos Personales, APDP) is the competent supervisory authority in Chile, created by Law No. 21,719, which enters into full force on 1 December 2026 and amends Law No. 19,628. This body oversees compliance with personal data protection legislation and has supervisory and sanctioning powers. The user may contact the supervisory authority at any time.

Contact details:

Agencia de Protección de Datos Personales (APDP)

Santiago de Chile

Website and complaint channels: to be confirmed in accordance with the official contact details published by the Agency.

Peru:

The National Personal Data Protection Authority (Autoridad Nacional de Protección de Datos Personales, ANPDP), under the Ministry of Justice and Human Rights, is the competent supervisory authority in Peru. This body oversees compliance with Law No. 29733, Personal Data Protection Law, and its Regulations (Supreme Decree No. 016-2024-JUS). The user may contact the supervisory authority at any time.

Contact details:

Autoridad Nacional de Protección de Datos Personales (ANPDP)

Ministerio de Justicia y Derechos Humanos

Calle Scipión Llona N° 350, Miraflores, Lima, Perú

Website: https://www.gob.pe/anpd

Complaints: through the Peruvian State Platform (https://www.gob.pe/anpd)

Colombia:

The Superintendencia de Industria y Comercio (SIC), Colombia's Superintendence of Industry and Commerce, through its Deputy Superintendence for Personal Data Protection (Delegatura para la Protección de Datos Personales), is the competent supervisory authority in Colombia. This body oversees compliance with Law 1581 of 2012 and its regulatory decrees, and has investigative and sanctioning powers. The user may contact the supervisory authority at any time, once the inquiry or complaint procedure before Un Ensayo para Mí has been exhausted.

Contact details:

Superintendencia de Industria y Comercio (SIC)

Carrera 13 N° 27-00, Bogotá D.C., Colombia

Telephone: +57 (601) 592 0400 — National toll-free line: 018000 910165

Website: https://www.sic.gov.co

Complaints: https://www.sic.gov.co/tema/proteccion-de-datos-personales

9. Links to other websites

Insofar as the website contains links to other websites, this data protection statement does not extend to those other providers. Un Ensayo para Mí has no influence over whether their operators comply with data protection provisions and, consequently, accepts no responsibility for the accuracy, currency and completeness of the information presented there.

10. Amendments to this data protection statement

Un Ensayo para Mí reserves the right to adapt this data protection statement, where necessary, to changed legal or factual circumstances. The version published on this page is the version in force.

11. Service provider and controller

Trialtech SL

Avda. De los Charcos 19

28860 Madrid

E-mail: info@trialtech.es

Tax Identification Number: ES B01808039

Last revised: September 2026