Version 3.0 – 14th September 2026

1. Introduction and Background

Emeritus Research Ltd (ACN 091 996 575) is committed to managing personal information in
accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and in
accordance with other applicable privacy laws.

This document sets out our policies for managing your personal and sensitive information and should, if you are a clinical trial participant, be read together with any Participant Informed Consent Form (PICF) signed by you in connection with a Clinical Trial.

In some circumstances, the European Union General Data Protection Regulation (GDPR) provides additional protection to individuals located in Europe. Our services are not specifically directed to individuals located in the European Union and Emeritus Research does not monitor the behaviour of individuals in the European Union, and accordingly the GDPR may not apply.

In this Privacy Policy, “you” refers to any individual about whom Emeritus Research collect personal information and “Clinical Trial” means a clinical trial or clinical research conducted or proposed to be conducted by Emeritus Research on behalf of a Clinical Trial Sponsor.

2. Scope

This Policy outlines how Emeritus Research collects, uses, stores, protects, retains and discloses personal information in connection with its business operations, clinical trial activities and services. It also describes the rights available to individuals regarding their personal information, including how to access or correct information and how to raise privacy-related enquiries or complaints.

3. Ownership and Responsibility

The Chief Executive Officer will be responsible for the management of Emeritus Research's Privacy Policy companywide. It is the responsibility of all staff at Emeritus Research to operate within the parameters stipulated in the document.

‍

‍4. Glossary of Terms‍

‍

5. Policy

5.1 What Personal Information Is Collected

Emeritus Research collects personal information that it considers necessary to provide its range of products and services, including medical research and Clinical Trial activities.

This may include both personal information and sensitive information, including health information and other information afforded additional protection under applicable privacy legislation.

Personal and Sensitive Information collected by Emeritus Research may include:

• Name, date of birth, address, sex/gender, contact details.
• Medical information including medical history, medications, notes, allergies, adverse events, immunisations, ethnic, social and family history, risk factors, physiological measurements together with Clinical Trial specific notes and related information.

• Personal information that is required, or reasonably necessary, for the conduct of a Clinical Trial in which you participate or may participate. Clinical samples and images.
• Your referring Health Service Practitioner, if applicable.
• Bank account and other payment details
• Products or Services provided to you.
• Records of communications with Emeritus Research.

When applying for or working with Emeritus Research, information may include your education and work history, skills and capabilities. Other personal information including bank account and credit account details may be collected in order to enable your agreed expenses to be reimbursed.

5.2 How Is Personal Information Collected

Emeritus Research collects personal information from you when you:

• Sign a consent form before taking part in a Clinical Trial.
• Use Emeritus Research Products and Services.
• Participate in a Clinical Trial.
• Visit the Emeritus Research website, send an email or SMS, text, telephone or communicate with Emeritus Research using social media or other like platforms.
• Fill in questionnaires and forms.
• Apply for or work with Emeritus Research as an employee, contractor, or volunteer.
• Apply for or provide services to Emeritus Research as a vendor.

In some circumstances, personal information about you may also be collected from other sources. This may include information from:

• Any person who assists Emeritus Research to recruit potential Clinical Trial participants.
• Any person responsible for any part of a Clinical Trial in which you participate.
• Your guardian or responsible person.
• Your Health Service Practitioner and other healthcare providers.
• Persons identified or described under the heading “With Whom is Your Personal Information Shared”.
• When applying to work for or with Emeritus Research, third parties including referees.

5.3 How Is Personal Information Used

Emeritus Research collects personal information primarily for the purposes of medical research and Clinical Trial activities, to comply with Clinical Trial protocols, laws and regulatory and other guidelines relating to the conduct of Clinical Trials.

By providing your personal information, you agree that it may be used for the following purposes:

• In connection with your recruitment and participation in current or future Clinical Trials.
• To keep a history of your participation in a Clinical Trial.
• To enable Emeritus Research to offer you participation in future Clinical Trials.
• Manage the products and services provided to you including reimbursement of agreed expenses.
• To research, develop and improve Emeritus Research services, products and business operations.
• To conduct surveys to determine your satisfaction.
• To promote Emeritus Research products, services, capabilities and therapeutic areas of interest.
• For business related activities, such as audits, accreditations, training and to comply with
• Emeritus Research legal obligations.
• To engage with you as an employee, contractor, or volunteer.
• To verify your identity to prevent payment fraud and error.
• For purposes in connection with above that we consider to be within your reasonable expectations.

5.4 How is Sensitive Information Used

Sensitive information is defined in the Privacy Act to include, amongst other things, health information. When you contact us to express interest in participating, or when you participate in a clinical trial, we may request or collect health information from or about you.

Sensitive information will be used by us only:

• For the primary purpose for which it was obtained
• For a secondary purpose that is directly related to the primary purpose
• With your consent; or where required or authorised by law.

Sensitive information may be used to determine your suitability for future Clinical Trials and to seek your interest in participating.

5.5 With Whom is Your Personal Information Shared

Emeritus Research sometimes shares personal information with the following individuals and organisations:

• Any person who assists Emeritus Research to recruit potential Clinical Trial participants.
• With third parties who work with Emeritus Research to conduct a Clinical Trial, such as
• Sponsors, Investigators and the Human Research Ethics Committee engaged in connection with any Clinical Trial you participate in. These third parties are required to comply with this policy and relevant laws.
• Health care providers.
• Emeritus Research staff and related bodies corporate.
• Outsourced service providers who assist Emeritus Research to provide products/services and are required to comply with this policy and relevant laws including information technology providers; and professional advisers.
• With third parties who provide systems that assist Emeritus Research to verify your identity to prevent payment fraud and error. Personal information provided to such providers may be used by other users of their system to verify your identity to prevent payment fraud and error.
• Organisations involved in a sale/transfer of Emeritus Research’s assets, business or shares.
• Government and regulatory authorities as required by law.
• Companies within the Clinical Trials Group (CTG) network – parent company to Emeritus Research – such as Clinibase, Veritus Research and CTG itself.

Only people that need to access your personal information will be able to do so. Other than as set out in this policy, Emeritus Research will not share your personal information with any third party without your consent. Where practicable, before personal information is provided to a third party it will be de-identified so as to no longer be capable of identifying you.

5.6 How Is Your Personal Information Stored and Protected

Your personal information may be stored in physical and electronic form. Emeritus Research uses its best endeavours to ensure personal information is stored securely by Emeritus Research or its outsourced service providers and protected from unauthorised access.

Some of the ways Emeritus Research does this include:

• Requiring our staff and outsourced service providers to maintain confidentiality.
• Implementing physical and electronic document storage security including security measures for access to Emeritus Research computer systems.

Please note, it is not possible to guarantee that data transmission over the internet or via email, either to or from Emeritus Research, will be completely secure.

5.7 Use of Artificial Intelligence (AI) Systems

Emeritus Research may use AI systems (including decision support tools and data analysis systems) to process, generate or infer personal information. For example, study doctors may use AI to transcribe study visits.

The use of AI systems in connection with Personal Information is subject to the Australian Privacy Principles including:

• It is reasonably necessary for our business operations.
• It complies with lawful and fair collection practices.
• It is used for the primary purpose for which it was collected, a directly-related secondary purpose, or with your consent.

5.8 Cookies, pixels and other third-party online tracking technologies

Our website uses cookies, tracking pixels and similar technologies (“Data Tools”). Some of the information these collect, such as your IP address, device information, and the pages you visit, how long you spent on a page and form inputs may be personal information.

Emeritus Research will not use Data Tools that permit inferences about your sensitive information without your consent.

You can manage cookies and tracking pixels and other Data Tools through your web browser settings. If Data Tools are disabled, Emeritus Research may not be able to provide you with the full range of services.

Emeritus Research’s website may feature links to and from external sites and can interface with social media platforms including Facebook, LinkedIn, Instagram and others. These third parties and their associated websites have their own privacy policies that operate independently of Emeritus Research. As such, Emeritus Research cannot be held responsible for the content, operations or privacy practices of these organisations, either individually or collectively.

5.9 How to Access Your Personal Information

You generally have a right to access and correct your personal information. If you wish to access your personal information or believe any information is incorrect or requires updating, please click on the “contact us” link at the bottom of this page. Please remember to provide as much detail as you can as this will help Emeritus Research to find the information.

5.10 What If You Don’t Provide Personal Information

When you visit Emeritus Research’s website, you can elect to remain anonymous. You are not required to disclose your name or any personal information that could be used to reasonably ascertain your identity.

Should you wish to register your interest in participating in current or future Clinical Trials, or if you would like to understand more about Emeritus Research service offerings or potential opportunities for collaboration, only the personal information that you voluntarily provide to facilitate this will be collected.

Please be aware that if you choose not to provide personal information, you may not be able to participate in or continue to participate in a Clinical Trial.

5.11 Cross Border Disclosure

Emeritus Research may access or use information we collect, including personal information outside Australia, in order to provide the services, medical research and Clinical Trial activities.

Personal Information may be:

• Disclosed to third parties in connection with Clinical Trials. This includes foreign organisations who engage Sponsors to undertake Clinical Trials on their behalf.
• Stored on servers located outside Australia.

5.12 Group Disclosure

Emeritus Research is a member of the Clinical Trial Group comprising Clinical Trials Group Pty Ltd, Emeritus Research Pty Ltd, Veritus Research Pty Ltd, Veritus Research QLD Pty Ltd, Clinibase Pty Ltd and such entities controlled by Clinical Trials Group Pty Ltd from time to time.

We may disclose and use your personal information (including sensitive information) to members of the Clinical Trials Group for the purposes set out in this policy.

5.13 Privacy Incidents and Data Breaches

If we become aware of a data breach may have occurred, we will immediately take steps to assess the suspected breach and take action to limit any breach, as per Emeritus Research's Data Breach Management Policy.

If there are reasonable grounds to believe that a data breach has occurred which is likely to result in serious harm to any individual to whom the information relates, we will notify you if you are affected and, if required, the Office of the Australian Information Commissioner as soon as practicable.

5.14 Retention and Disposal of Personal Information

Emeritus Research retains personal information only for as long as it is required to fulfil the purpose for which it was collected, to meet applicable legal, regulatory, contractual and business requirements, or as otherwise permitted or required by law. When personal information is no longer required, Emeritus Research will take reasonable steps to securely destroy, de-identify or dispose of the information in accordance with applicable record retention requirements and internal document management processes.

5.15 Complaints Management

If you have a question, concern or complaint regarding the handling of your personal information, you may contact Emeritus Research using the details provided below.

Melbourne

• Postal: Ground Floor, 1096 Toorak Rd Camberwell VIC 3124 AUSTRALIA
• Email: info@emeritusresearch.com
• Telephone: +61 03 9509 6166

Sydney

• Postal: Suite 2, Ground Floor, Building 2A, 2-12 Lord Street, Botany NSW 2019, AUSTRALIA
• Email: sydneyinfo@emeritusresearch.com
• Telephone: +61 02 8964 8186

Privacy complaints will be reviewed and managed in accordance with Emeritus Research's internal complaints management processes. If you are not satisfied with the outcome of your complaint, you may be entitled to make a complaint to the Office of the Australian Information Commissioner (OAIC) or another applicable regulatory authority.

6. Dissemination and Implementation

Approved Policies will be disseminated electronically through Qualio for reading and acknowledgement by Internal staff. If required, Policies may be uploaded and made viewable on the Emeritus Research SiteDocs portal under ‘Core Documents’ (e.g. specific remote monitoring requirements); this will be reviewed on a case by case basis. Any updates to the existing approved Policies will be disseminated internally and will be effective immediately.

7. Monitoring Compliance

Compliance with this Policy will be monitored as part of the Emeritus Research monitoring and audit process. Any queries concerning the effectiveness of this Policy identified during the monitoring process or through use will be addressed and may result in the requirement to update the Policy.

8. Review and Updating

This Policy will be reviewed every 4 years or when changes to legislation or working practices impact the contents of this document. This Policy may be merged with another SOP or Policy if appropriate or removed entirely if it becomes redundant.

9. Reference(s)

• Privacy Principles under the Privacy Act 1988 (Cth)
• Office of the Australian Information Commissioner (OAIC)

10. Related Document(s)

• QPOL-15 Cyber Security
• QPOL-24 Data Breach Management

‍