Privacy Statement

This Privacy Statement provides an important legal notice on how myTomorrows processes your personal data when using our services. Please read it carefully before using our services.

If you have any questions, concerns or complaints, feel free to contact our Data Protection Officer at dataprotection@mytomorrows.com or at contact details in the Privacy Statement.

Questions? Get in touch.

Last updated: 20-12-2024

1) General information

Your privacy is important to us. This Privacy Statement informs you about how Impatients N.V., trading under the name “myTomorrows” (referred to in this Privacy Statement as “myTomorrows”, “we”, “our” or “us”) processes your personal data and informs you about your privacy rights. This Privacy Statement relates to the processing of personal data about individuals (referred to in this Privacy Statement as “you” and/or “your”) who visit our website, apply for a position at myTomorrows, use our search engine, or use our platform and referral services as a patient, caregiver or a physician. myTomorrows acts as data controller of the personal data processed in the contexts described in this policy. You may find our contact information and the way(s) in which you may exercise your rights under applicable data protection laws, such as the right to be forgotten or the right to rectify the data we hold about you, in sections 9, 10 and 11 below.

Download a PDF version of this Privacy Statement here.

2) Who is responsible for processing your personal data?

Depending on the use of our services, myTomorrows is a “controller” or a “processor” within the meaning of the General Data Protection Regulation[1] (“GDPR”). This means that we are sometimes responsible for processing your personal data in accordance with the applicable data protection laws, including the GDPR, UK GDPR and U.S. state privacy laws, including the California Consumer Privacy Act[2] (“CCPA”).

In other cases, we may process personal data on behalf of a client. This is the case when we provide support to you and/or your treating physician in accessing a pre-approval treatment you selected, and we perform pre-screening or other verifications regarding your health on behalf of the biopharma company to assess your eligibility for the treatment. In that case the biopharma company (our client) is responsible for the processing of your personal data, not us. We will make reasonable efforts to inform you if we collect or process your personal data on behalf of a client.

This policy describes myTomorrows’ handling of your personal data as a data controller.

[1] The General Data Protection Regulation refers to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)

[2] The California Consumer Privacy Act refers to Cal. Civ. Code § 1798.100, available here.

3) Which personal data do we process and for what purpose(s)?

We process your personal data. By processing, we mean that myTomorrows may for instance collect, store, use and transfer your personal data, depending on the specific circumstances and context. You can read more about which personal data we process below.

3.1 Website-visitors

myTomorrows processes personal data for providing, maintaining, and improving our website. This may also include responding to your queries when you contact us via the website. For specific information on the cookies and similar technologies used in this respect, please also refer to our Cookie Statement.

The individuals involved. Website-visitors: individuals who visit our website.
The purpose(s) of processing. When a website-visitor visits our website and / or contacts us via a chat functionality on our website or contacts us in another way, we will process your information for the following purposes:
- For maintenance, administration and network and security purposes;
- For internal control and business operations;
- For analyzing and improving our products;
- For handling any requests, complaints and disputes;
- For determining, exercising and defending our rights; and
- For complying with legal obligations (incl. fraud prevention) and requests of authorized governmental institutions
The personal data that is processed. When a website-visitor visits our website or contacts us, we may process the following information:
- IP-address;
- Browser type;
- Browser (language) settings;
- Other technical information we may collect via cookies, such as regarding the interaction between the website-visitor’s device and our website. For instance, the web pages that were visited, new or returning visitors, frequency of visitation, time spent on the website and what pages have been read; and
- Information provided to us when you reach out to us via the contact form on our website, including: your full name, email, country of residence, and your message to us.

Special categories of personal data and sensitive information:
In principle we do not process special categories of personal data in the context of our website.

Legal grounds for processing. We may only process your personal data if we have (a) legal ground(s) to do so. If you are a website-visitor, we will process your personal data based on our in offering and securing our website and pursuing the other processing purposes as listed above or based on your consent for collecting certain categories of personal data with the usage of cookies and other technologies. For more information about the types of cookies we use on our website, please be referred to our Cookie Statement.

3.2 Job Applicants

myTomorrows processes personal data about job applicants in order to consider the application in the context of hiring new employees.

Individual involved. job applicant: individual who applies for a position at myTomorrows.
The purpose(s) of processing. Assessment of the applicant’s suitability for a position that is or may become vacant at myTomorrows (recruitment).
The personal data that is processed. When you apply for a position at myTomorrows, we may process the following information:
- Full name;
- Email;
- Telephone number;
- Address;
- Photograph;
- Gender;
- Education;
- Experience; and
- Other job-related information.

Special categories of personal data and sensitive information:
In principle we do not process special categories of personal data from job applicants in the context of recruitment.

Legal grounds for processing. We may only process your personal data if we have (a) legal ground(s) to do so. If you are a job applicant, we will process your personal data based on our legitimate interest in selecting the best candidates for myTomorrows and in order to take steps at the request of the job applicant prior to entering into a contract or when processing is necessary in order to comply with legal obligations. We may also process your personal data based on consent.

3.3 Patient-users

myTomorrows processes personal data about patient-users to provide information on possible treatment options. We do this, for instance, when you fill out search criteria by using the search engine, when you decide to upload personal data on the platform, or when you request a Treatment Search Report.

The individuals involved. Patient-users: individuals who use our search engine and myTomorrows’ platform.
The purpose(s) of processing. We will process your personal data for the following purposes:
- To provide access to our platform and support from our Patient Navigators;
- To provide and optimize information on possible treatment options from Clinical Trial Databases worldwide;
- To match patient-users to treatment options, such as Clinical Trials (CTs) and Early-Access-Programs (EAPs) via our search engine and/or the patient portal;
- Assess eligibility for treatment options (CTs and EAPs);
- Provide a customized Treatment Search Report based on your search criteria, listing all possible treatment options;
- Refer patient-users to CTs;
- Analyse the search data form in the search engine to improve our algorithms;
- Provide insights from aggregated data on the use of our platform and the search engine to our clients.

The personal data that is processed:

a) Search Engine. We may process the following information to provide and optimize search results via our treatment search engine:

Gender;
Disease condition;
Country of residence.

b) myTomorrows for Patients. We may process the following information to provide access to our platform and support from our Patient Navigators:

Username;
Password;
Full name;
Contact details;
Date of birth;
Gender;
City/country of residence;

If required for your request to us, we may also process the following information:

Weight;
Height;
Ethnic origin;
Treating physician;
Health data;
Treatment data; and
Other relevant medical information (if necessary).

c) Search Report. We may process the following information to provide a search reports to match patient-users to possible treatment options and assess eligibility for treatment options:

Date of birth;
Gender;
City/country of residence;

If, and where applicable for your request, we may also process the following information:

Weight;
Height;
Ethnic origin;
Treating physician;
Health data;
Treatment data; and
Other relevant medical data (if necessary).

Special categories of personal data and sensitive information:
myTomorrows processes health data to provide our products and services. Health data is only processed based on your consent as permitted by article 9(2)(a) GDPR.

Legal grounds for processing. We may only process your personal data if we have (a) legal ground(s) to do so. If you are a patient-user, we will process your personal data based on your consent. In addition, we may also process personal data required to fulfil a contract with you in relation to non-sensitive data, for instance to provide you with access to our platform and to request personalized information.

3.4 Patient-participants

myTomorrows processes personal data to assess eligibility for treatment options (e.g. CTs and EAPs) and to provide support to patients in accessing treatment options. Please note that if you choose to participate in a program managed by myTomorrows on behalf of one of its clients, often myTomorrows acts as data processor and is not ultimately responsible for the protection of your personal data. The processing of your personal data in such context goes beyond the scope of this privacy statement.

- The individuals involved. Patient-participants: individuals who decide to pursue one of the treatments in the personalized Treatment Search Report and enroll in a program to gain access.
- The purpose(s) of processing. We will process your personal data for the following purposes:
  - To support referral and enrolment in clinical trials;
  - To obtain aggregate, de-identified insights about the performance of our Services.
  - To run EAPs and to provide patients with access to treatment options;
  - To obtain approval from regulatory authorities to provide access to treatment options;
  - To collect safety information and report adverse events with regard to EAPs;
  - To assess the safety and effectiveness of EAP treatment and collect research data for EAP studies;
- The personal data that is processed.

a) Clinical trial referral. We may process the following information to determine your potential eligibility for a clinical trial.

Name;
Contact details;
Date of birth;
Gender;
City/country of residence;

If applicable, we may also process the following information:

Weight;
Health data;
Treatment data;
Genetic data;
Medical documents (if necessary);
Other medical information (if necessary).

b) Expanded/Early Access Programs. We may process the following information to run EAPs and provide patients with access to treatment options.

Full name;
Initials;
Contact details;
Date of birth;
Gender;
City/country of residence;

If applicable, we may also process the following information:

Weight;
Ethnic origin
Treating physician;
Health data;
Treatment data;

c) Regulatory approval. We may process the following information to obtain approval from regulatory authorities to provide access and traceability for treatment options.

Weight;
Ethnic origin
Treating physician;
Health data;
Treatment data;
Genetic data; and
Other medical information (if necessary).

d) Safety reporting. We may process the following information to collect safety information and report adverse events about EAP treatments.

Initials;
E-mail;
Data of birth
Gender;
City/country of residence;
Adverse event;
Outcome of the event;
Effect of treatment;
Laboratory data;
Other medication
EAP number;
Prescribed treatment;
Quantity of treatment;
Pharmacy location.

If applicable, we may also process the following information:

Weight;
Ethnic origin
Treating physician;
Health data;
Treatment data;
Genetic data; and
Other medical information (if necessary).

e) Real-World Data (RWD). We may process the following information to assess the safety and effectiveness of EAP treatment and collect research data for EAP studies.

Full name;
Initials;
Contact details;
Date of birth;
Gender;
City/country of residence;

If applicable, we may also process the following information:

Weight;
Ethnic origin
Treating physician;
Health data;
Treatment data;
Genetic data; and
Other medical information (if necessary).

Special categories of personal data and sensitive information:

myTomorrows processes health data to provide our products and services. Health data is only processed based on an exception to the processing prohibition as set out in article 9 of the GDPR.

Legal grounds for processing. We may only process your personal data if we have (a) legal ground(s) to do so. If you are a patient-participant, we will process your personal data based on your consent. In addition, we may also process personal data required to fulfil a contract with you in relation to non-sensitive data, for instance to provide you with access to our platform to upload the requested (medical) file(s).

3.5 Healthcare professionals.

myTomorrows processes personal data about healthcare professionals. For instance, to provide access to our search engine and our platform, respond to questions when you contact us directly or to reach out to you for general inquiries.

Individuals involved. Physicians: treating and non-treating physicians.
The purpose(s) of processing.
- Healthcare professional administration for the referral and pre-screening of patients who are being referred to a clinical trial;
- Healthcare professional administration for patients that are enrolled in an EAP;
- Management of EAP treatment;
- Engagement activities to further interest for our services, develop a community of physicians, and encourage the development of our platform;
- Ensuring quality of customers;
- Delivery of products and services to customer;
The personal data that is processed.
- Full name;
- Email;
- Telephone number;
- Function;
- (Medical) specialization; and
- Registration number.

Special categories of personal data and sensitive information:

In principle we do not process special categories of personal data about health care professionals in the context of our products and services.

Legal grounds for processing. We may only process your personal data if we have (a) legal ground(s) to do so. If you are a physician, we will process your personal data based on consent, based on our legitimate interest(s), for the performance of a contract related to the performance of our Services, or to take steps at your request prior to entering into a contract. We may also process your personal data based on legal obligations, for instance to comply with tax obligations.

3.6 Legitimate interests

In addition to the specific interests per purpose as specified above, we may process your personal data based on our legitimate interest for the following purposes:

For determining, exercising and defending our rights;
For complying with legal obligations (incl. fraud prevention) and requests of authorized governmental institutions; and
In the context of mergers and acquisitions, including due diligence projects.

Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of the notice.

3.7 Deidentified and aggregated data

In addition to the specific purposes we have listed above, we may process personal data to create aggregated and deidentified data sets, which we use to analyse and improve our services, develop new offerings, and generate insights about the trends in the market we operate in.

Aggregated data is created by combining information in a way that does not identify any individual. Before using personal data for these purposes, we ensure it is irreversibly deidentified in accordance with applicable laws and best practices. We implement appropriate technical and organizational measures to prevent any unauthorized reidentification of individuals. This deidentified data is used solely for lawful purposes that align with the purposes for which you have provided us your consent. We will not sell any identifiable information about you to third parties.

4) How do we obtain your personal data?

We obtain your personal data in various ways:

Provided by you. Some data we receive directly from you, for example information you provided during your application for a position at myTomorrows, questionnaires you completed to receive information on possible treatment options, files you uploaded to access a treatment or from correspondence with you, such as with our medical liaisons or through the chat functionality on our website.
Obtained from third parties. We could also obtain personal data about you from other people or external parties. Examples include your references (if you’re a job applicant) or your treating physician (if you’re a patient-participant) or other parties who are involved with our mutual relationship, such as other healthcare professionals or pharma companies that use our platform. We may also obtain information from public registers of company directors and participating interests.
Automatically obtained. Some personal data we obtain automatically, for example by using cookies and similar techniques. For more information about cookies and similar techniques, go to our Cookie Statement.
Derived. Certain personal data we do not receive directly, but can be derived from the information we already have about you.

If you do not provide personal information:

In principle you are under no obligation to provide any information about yourself to us. However, refusal to supply certain information could have a negative influence on, for example, your job application, our service provision to you or the functionality of the services that you use from us.

If the provision of certain personal data is a legal obligation or an essential contractual requirement for concluding an agreement with us, we will separately provide additional information about this for where this is not clear in advance. In this case we will also inform you about the possible consequences if this information is not provided to us.

5) Who do we share your data with?

We have implemented policies and procedures to ensure that within myTomorrows, only employees who have a need to access your information to perform the Services we provide you, or to perform their tasks, have access to your data. For example, only our employees who are involved in medical operations have full access to medical data. Other employees will only have access on an absolute-need-to-know basis, for instance the engineers working on our systems to resolve bugs.

Due to myTomorrows’ internal organization and international dimension, it is possible that employees located outside our Amsterdam headquarters have access to your information. For instance, some of our Patient Navigators are located outside of Europe to ensure we can provide the best possible services to patients worldwide. This means that in some circumstances, your data may be accessed outside of the European Economic Area where it is located.

We only share your personal data with third parties, if:

This is necessary for the provision of a service or the involvement of the third party. Sub-contractors, for example, will in principle only get access to the personal data that they require for their part of the service provision and will not be allowed to process the data for their own purposes.
The persons within the third party that have access to the personal data are under an obligation to treat this data confidentially. Where necessary this is also contractually agreed on.
The third party is obliged to comply with the applicable data protection laws. We have concluded an agreement with this party that stipulates that the party is obliged to implement and maintain appropriate technical and organizational measures to ensure protection of personal data and the rights of Individuals, and that any transfer of personal data to countries outside the EEA is only legitimized on the basis of an adequacy decision or other appropriate measures.

We may share your personal data on a need-to-know basis with the parties mentioned below. In this context, “need-to-know” means that a party is only granted access to personal data if and insofar as this is required for the services provided by this party.

Authorized persons, employed or engaged by myTomorrows, who are involved with the processing activity concerned, such as the members of our team you are in contact with, for instance HR for recruitment or medical liaisons for information on treatment options.
Authorized persons, employed or engaged by affiliated companies and/or parties in the private sector with whom we work and may share certain personal data, such as accountants, payroll agencies and healthcare professionals.
Authorized persons, employed or engaged by service providers / sub-contractors engaged by myTomorrows, who are involved with the processing activity concerned, such as cloud hosting providers.
Authorized government institutions. Such as, courts, police, and other law enforcement agencies. We may release information about Individuals when legally required to do so, at the request of governmental institutions conducting an investigation or to verify or enforce compliance with myTomorrows’ policies and the applicable laws. We may also disclose information in this regard whenever we believe disclosure is necessary to protect the rights, property or safety of myTomorrows, or any of our respective business relations.
Aggregate Information. We may also disclose non-identifying, aggregated statistical information to third parties and / or myTomorrows’ affiliates for a variety of purposes, including work-flow management.

6) How do we secure your personal data?

Protecting the Individuals’ privacy and personal data is very important to us. Therefore, myTomorrows has implemented appropriate technical and organizational measures to protect and secure your personal data against violations of the confidentiality, integrity, and availability of data.

MyTomorrows is ISO27001 and is in the process of obtaining the SOC II type I certification. These are international standards for information security that guarantee the implementation of a high level of technical and organizational measures.

Additionally, we have internal policies and procedures in place that describe how we safeguard an appropriate level of technical and organizational security. For instance, a data breach procedure is applicable within myTomorrows, in which is explained how to deal with (potential) data breaches. We will, for example, inform the competent supervisory authority and involved Individuals when this is required based on the applicable law. In addition, we have back-up and restore systems in place for the recovery of your personal data when necessary.

You can contact us if you want additional information about how we protect your personal data. Our contact details are stated at the end of this Privacy Statement.

7) To which countries will we transfer your personal data?

myTomorrows will in principle not process your personal data in countries outside the European Economic Area (EEA) or UK. In case your data is processed outside the EEA or UK, the transfer is legitimized in the manner described below. You can find an overview of the EEA countries here.

Transfers outside the EEA or UK

The transfer of your personal data to a third party outside the EEA or UK, can in the first place be legitimized based on an adequacy decision adopted by the European Commission or UK Government, in which it decided that the (part within the) third country in question offers an adequate level of data protection. You can find an overview of the adequacy decisions that have been taken here, or here for the UK.

If your personal data is transferred to a country outside the EEA or UK for which there is no adequacy decision in place, we implement the relevant version of the Standard Contractual Clauses (SCCs) in the (prospective) contract with the party involved in the transfer. This is a standard contract approved by the European Commission or UK Government to safeguard the protection of your personal data and in which the parties fill out the appendices to provide relevant information about the processing. Where appropriate, additional safeguards are taken.

You can contact us if you want additional information about the way in which we legitimize the transfer of your personal data to countries outside the EEA or UK. Our contact details are stated at the end of this Privacy Statement.

8) How do we determine how long we retain your personal data?

8.1 Main rule

In general, myTomorrows does not keep personal data for longer than is necessary in relation to the purposes for which we process your personal data. For example, we erase data about job applicants four weeks after the end of the selection procedure, unless the applicant is subsequently employed by us or consents to an extended retention period of one year. We may apply (longer) standard retention periods if this is required to comply with minimum statutory retention periods. For example, data required for pharmacovigilance is retained for 10 years after termination of a treatment.

8.2 Exception: longer retention period.

In certain situations, we process your personal data for a longer period of time than is necessary for the purpose of the processing. This is for instance the case when we process your personal data for a longer period of time due to:

A retention obligation. To comply with a minimum retention period or other legal obligation to which myTomorrows is subject based on EU law or the law of an EU member state.
A procedure. Personal data which is necessary in relation to legal procedures.
The right to freedom of expression. When further processing of personal data is necessary to exercise the right to freedom of expression and information.
Your (explicit) consent. Where you have given us your consent to keep your personal data for longer, for example for unsuccessful job applicants so that we can Inform you of future vacancies.

You can contact us if you want more information about why and how long we process your personal data. Our contact details are stated at the end of this Privacy Statement.

9) What are your privacy rights?

Your privacy rights may be different depending on the country where you live. For Individuals in the EU and the UK, you will have the following rights under GDPR and the UK GDPR with respect to myTomorrows’ processing of your personal data. Even if you do not live in the EU or the UK, you may still benefit from some of the rights described below. For privacy rights under the CCPA, please see the “Are you located in California (U.S.)?” section.

To what extent you can exercise these rights could depend on the circumstances of the processing, such as the way myTomorrows processes your personal data and the applicable legal ground. For more information about your privacy rights, you can visit the website of the European Commission here. We have included a summary of your privacy rights under the GDPR and UK GDPR below.

9.1 Applicable privacy rights.

In relation to our processing of your personal data, the below privacy rights may apply.

- Right of access. This concerns the right to request access to your personal data. This enables you (or your legal representation) to receive a copy of the data we hold about you (but not necessarily the files themselves). We will then also provide further information concerning our processing of your personal data. For example, the purposes for which we process the data, how we obtained it, and with whom we may share it.
- Right to rectification. This concerns the right to request rectification of the personal data that we hold about you. This enables you (or your legal representation) to have any incomplete or inaccurate data corrected.
- Right to erasure. This concerns the right to request erasure of your personal data. This enables you (or your legal representation) to ask us to delete or remove personal data where: (i) the data is no longer necessary, (ii) the processing activities have been objected to, (ii) the data has been unlawfully processed, (iv) the data has to be erased on the basis of a legal requirement, or (v) where the data has been collected in relation to the offering of information society services. However, we do not have to honor such requests in all cases.
- Right to object.This concerns the right to object to the processing of personal data where we are relying on our legitimate interest as processing ground (see above). Insofar as the processing of the data takes place for direct marketing purposes, we will always honor an objection. For processing for other purposes, we will also cease and desist processing, unless we have compelling legitimate grounds for the processing which override the Individual’s interests, rights and freedoms or that are – for example – related to the institution, exercise or substantiation of a legal claim. If such is the case, we will inform you about our compelling interests and the balance of interests made.
- Right to restriction.The right to restriction of processing means that myTomorrows will continue to store personal data at the request of you (or your legal representation) but may in principle not do anything further with it. In short, this right can be exercised when myTomorrows does not have (or no longer has) any processing grounds for the processing of your personal data or if this is under discussion.
- Right to portability. Where our processing is based on your consent or is necessary to fulfill a contract with you, this right enables you to request us to transmit personal data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible.
- Automated decision-making. This concerns the right not to be subject to a decision based solely on automated processing, which significantly impacts the Individual involved. In this respect, please be informed that when processing your personal data, we do not make use of automated decision-making.
- Right to withdraw consent. This concerns the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Right to complaint. This concerns the right to lodge a complaint with a supervisory authority, in the EU Member State of the Individual’s habitual residence, place of work or where an alleged infringement took place. Please be referred to the website of the European Data Protection Board (EDPB) for an overview of the supervisory authorities and their contact details, for the UK the supervisory authority is the Information Commissioner’s Office (ico.org.uk). However, we would appreciate the chance to deal with any concerns before the supervisory authority is approached, so please contact us beforehand.
- Do not sell my personal information. myTomorrows will never sell your personal information to third parties.

9.2 How can you exercise your privacy rights?

You (or your legal representative) can exercise your privacy rights free of charge, by submitting your request to our Data Protection Officer by email at dataprotection@mytomorrows.com or by contacting us on the contact details provided at the bottom of this Privacy Notice.

9.3 Verification of your identity.

If we deem it necessary, we may request specific information, such as a copy of your identification, to help us confirm your identity (or that of your legal representation) before we further respond to your privacy request.

9.4 Follow-up on your request(s).

If we cannot respond positively to your request, we will inform you and provide more information as soon as reasonably practicable. Depending on the complexity of the request and on the number of requests, this period can be extended by another two months.

10) How can you contact us?

If you have any questions, concerns, or complaints, feel free to contact our Data Protection Officer at dataprotection@mytomorrows.com or at the contact details below.

Impatients N.V.
Attn: Data Protection Officer
Anthony Fokkerweg 61
1059 CP Amsterdam
The Netherlands

In addition, you may file a complaint with the Netherlands Data Protection Authority (DPA) if you believe that the processing of your personal data is unlawful. More information about filing a complaint with the Dutch Data Protection Authority (DPA) can be found here.

11) Are you located in the United Kingdom?

We provide Services to data subjects located in the United Kingdom and as such, we have taken steps to ensure compliance with the data protection laws applicable in the United Kingdom.

Pursuant to Article 27 of the UK GDPR, myTomorrows has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

– by using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/
– by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom

MyTomorrows is registered with the Information Commissionner’s Office (ICO) under the reference ZB728879.

12) Are you located in California (U.S.)?

This section contains disclosures required by the California Consumer Privacy Act (“CCPA”) and applies only to “personal information” that is subject to the CCPA.

Please note that this section is not applicable if you are subject to HIPAA. If you are, you should refer to our terms of use and business associate agreement to understand our respective roles and the measures we have in place to comply with HIPAA[3].

Personal Information We Collect. In the preceding 12 months, we collected the following categories of personal information about California consumers. We do not sell personal information.

· Personal and online identifiers (such as full name, email address, or unique online identifiers);

· Characteristics of protected classifications under California or federal law (such as race or gender);

· Medical information, such as medical condition, treatment history and any information relevant to provide our direct-to-patient services, but excluding protected health information as such term is defined under HIPAA;

· Internet or other electronic network activity information (such as browsing history, search history, interactions with a website, email, application, or advertisement);

· Professional or employment-related information;

· Education information;

· Inferences drawn from the above information about your predicted characteristics and preferences;

· Other information about you that is linked to the personal information above.

Categories of Sources. We collect personal information from the categories of sources described in the “4. How do we obtain your personal data?” section above.

Why We Collect, Use, and Share California Information. We use and disclose the personal information we collect on website visitors, job applicants, patient-users, patient-participants and healthcare professionals, for our commercial and business purposes, as described in the “3. Which personal data do we process and for what purpose(s)?” section above.

We may use or share information that has been de-identified or aggregated without limitation.

Retention of California Personal Information. In general, myTomorrows does not keep personal data for longer than is necessary in relation to the purposes for which we process your personal data. We may apply (longer) standard retention periods if this is required to comply with minimum statutory retention periods.

Recipients of California Personal Information. We share the categories of personal information described in this Privacy Statement to the categories of third parties described in the “5. Who do we share your data with?” section above.

Your Rights Regarding Personal Information. California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

a. The right to know the categories and specific pieces of personal information we collect, use, and disclose about you; the categories of sources from which we collected personal information about you; our purposes for collecting or sharing personal information about you; the categories of personal information about you that we have either sold or disclosed for a business purpose; and the categories of third parties with which we have shared personal information.

a. The right to request that we delete the personal information we have collected from you.

b. The right to request correction of inaccurate personal information we maintain about you.

c. The right to opt out of our sale(s) or sharing of your personal information: myTomorrows will not share your personal information with third parties without your explicit consent as provided in the cookie banner.

d. The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

To exercise any of the above rights, please contact us using the following information and submit the required verifying information, as further described below:

Online at – webform.

California (U.S.A.) Privacy Rights Request Webform

You may have rights with respect to the personal data maintained by myTomorrows, if you are a California resident. You may use this webform to submit a privacy request as further described in our Privacy Statement.

We will respond after you have submitted this form and may request additional information needed to verify your identity and complete your request if needed.

If you wish to exercise certain opt-out rights available to you, please refer to our privacy and cookie statement. If you are an authorized third party acting on behalf of an individual, please submit a written, signed permission from the individual to dataprotection@mytomorrows.com to confirm your authorization.

For more information about how we collect, use, and disclose personal data, please review our Privacy Policy.

Please provide the following information about the individual who is the subject of the request.

Please enable JavaScript in your browser to complete this form.

First name

Last name

Zip Code

Phone number

the Phone personal

I would like to submit the following request

Request to opt-out of the sale or sharing of personal information
Request to delete personal information
Request to know categories of personal information
Request to obtain specific pieces of personal information

For the "Request to obtain specific pieces of personal information" please specify:

· By email at dataprotection@mytomorrows.com

Verification Process and Required Information. Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide, at a minimum, a copy of your Identification, to help us confirm your Identity (or that of your legal representation) before we further respond to your privacy request.

Authorized Agent. You may designate a third party to make a CCPA request on your behalf by designating such a person in writing or through a power of attorney. We will require the agent to provide us with proof that you have authorized the third party to make requests on your behalf prior to accepting requests from the third party.

Minors’ Rights. We do not have actual knowledge that we sell the personal information of minors under 16 years of age.

Contact for More Information. For questions or concerns about myTomorrows’s Privacy Statement or practices, please contact us by using the information below.

Email: Dataprotection@mytomorrows.com

Mailing address:

Impatients N.V.

Attn: Data Protection Officer

Anthony Fokkerweg 61

1059 CP Amsterdam

The Netherlands

[3] « HIPAA » refers to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the related standards issued by the U.S. Department of Health and Human Services. More information about HIPAA can be found here : https://www.hhs.gov/hipaa/index.html

13) Changes

We may change this Privacy Statement from time to time to accommodate new technologies, industry practices, regulatory requirements or for other purposes. The latest version can always be consulted on our website. We may also notify you in other ways from time to time about the processing of your personal information.