Patient Information Safeguards

1. Overview

KCLEAGENICS MEDICAL INC. recognises that patients, caregivers, and research participants share sensitive personal and health information with us in a position of trust. This page describes the specific safeguards we have in place to protect that information — distinct from and in addition to our general Privacy Policy.

These safeguards apply to two categories of individuals:

• Clinical trial participants — individuals enrolled in or screened for a KCLEAGENICS MEDICAL-sponsored or managed clinical trial
• Cancer Care Navigation patients — individuals and caregivers who have engaged our patient-facing navigation service

We take our obligations under HIPAA, 21 CFR Part 50 (Protection of Human Subjects), GCP/ICH E6(R3), and applicable state law seriously, and we train all staff accordingly.

2. Clinical Trial Participant Data

What data is collected

Participation in a clinical trial involves the collection of health-related information necessary to conduct the study safely and in accordance with the approved protocol. This may include:

• Name, date of birth, contact details, and demographic information
• Medical history, diagnosis, and prior treatment records
• Clinical assessments, laboratory results, and imaging data
• Biospecimen samples (blood, tissue, urine) and derived data (genomic, proteomic)
• Adverse event and concomitant medication records
• Patient-reported outcome (PRO) questionnaire responses

Legal basis and informed consent

No health-related data is collected from a clinical trial participant without their prior written informed consent, obtained in accordance with 21 CFR Part 50 and the applicable IRB-approved Informed Consent Form (ICF). Consent is voluntary. You may withdraw from a study at any time without penalty or loss of medical care, in accordance with your ICF.

How trial data is used

• To conduct the study safely and per protocol
• To report adverse events to the study sponsor, IRB, and regulatory authorities as required by law
• For statistical analysis and preparation of the clinical study report
• For regulatory submissions (e.g., FDA IND, NDA/BLA) — in pseudonymised or coded form
• For scientific publication — in aggregate, de-identified form only

Data pseudonymisation and coding

All clinical trial data is coded at source: your personal identifiers are replaced with a study code. Only authorised site staff with a legitimate need have access to the code-breaking key. Data shared with sponsors, contract research organisations, and regulatory authorities is transmitted in coded form.

3. Cancer Care Navigation Patient Data

If you have contacted us through our Cancer Care Navigation service — either directly or through a referring clinician — we collect only the information necessary to assist you. This typically includes:

• Your name, contact details, and caregiver information (if applicable)
• Your cancer diagnosis, stage, and treatment history (as provided by you or your clinician)
• Your geographic location (to identify relevant specialist centres and active trials)
• Any specific questions or preferences you have shared with us

This information is used only to provide navigation support. We do not share it with third parties without your explicit consent, except where required to make a referral on your behalf (in which case you will be informed in advance).

Navigation data is retained for 3 years from your last contact with us, unless you request earlier deletion.

4. HIPAA Compliance

Where applicable under the Health Insurance Portability and Accountability Act (HIPAA), KCLEAGENICS MEDICAL complies with all requirements of the Privacy Rule (45 CFR Part 164) and the Security Rule. Specifically:

• Protected Health Information (PHI) is accessed on a strict need-to-know basis
• PHI is transmitted using encrypted channels; no PHI is communicated via unsecured email
• All staff with access to PHI complete HIPAA training at onboarding and annually thereafter
• Business Associate Agreements (BAAs) are in place with all third-party service providers who may access PHI
• A HIPAA breach notification procedure is in place; affected individuals and the US Department of Health & Human Services are notified as required by law in the event of a breach

5. IRB Oversight and Ethics

All clinical research conducted by KCLEAGENICS MEDICAL is reviewed and approved by an Institutional Review Board (IRB) before it begins. The IRB provides independent ethical oversight throughout the study, including review of:

• The study protocol and any amendments
• The Informed Consent Form and all participant-facing materials
• Any serious adverse events or unanticipated problems reported during the study
• Continuing review at intervals not exceeding 12 months

IRB approval documentation is available to study participants on request.

6. Data Security Measures

We apply the following technical and organisational safeguards to protect patient and participant data:

Physical access to clinical records and biospecimen systems is restricted to authorised personnel only. Our systems undergo regular security assessments.

7. Your Rights as a Research Participant or Patient

8. Data Retention

• Clinical trial participant data: retained for a minimum of 15 years from study completion, or longer as required by the protocol, FDA regulations, or sponsor requirements
• Biospecimen samples: retained for the duration specified in the ICF and protocol; residual samples are destroyed or anonymised per the ICF terms
• Cancer Care Navigation data: retained for 3 years from last contact, unless earlier deletion is requested

9. Paediatric and Vulnerable Populations

Where a clinical trial enrolls participants under 18 years of age, or participants who may have diminished decision-making capacity, additional safeguards apply:

• Parental or legal guardian consent is obtained in addition to the minor's assent, as required by 21 CFR Part 50 Subpart D
• Age-appropriate consent/assent documents are used
• IRB review includes specific attention to risks and protections for vulnerable populations
• A legally authorised representative provides consent for participants unable to do so themselves