CTV

Privacy Notice

Last Updated: February 27, 2024

Veeva Systems is committed to maintaining a privacy program that is designed around trust, transparency and respecting your rights in your personal information. This privacy notice describes how we process personal information, including what information we collect, why we collect it, how we use it, how we may share it, and your controls over your personal information.

This privacy notice applies to the personal information we process as part of CTV.veeva.com (“CTV”), a Veeva website.

Information We Collect

When you visit CTV, we collect the following types of information:

Category of Information	Description
Device & Usage	We collect device and usage information such as cookie records, browser type, internet service provider (ISP), device IP address, operating systems and versions, advertising identifiers, device motion data, web beacons and clickstream data.
Registration	When you create an account, we collect information that you provide through that process, such as your name, email address, and username and password.
Account Verification and Management	If you log into an account you've created with us, we collect your IP address and other related information we need to verify you are the account owner, before allowing you to access that account. We also collect information contributed by you, such as notes you make about clinical trials and the trials you choose to follow, to help you manage and connect with your studies.

How We Collect Information

When you visit CTV, we collect information directly from you and indirectly from you by observing your actions on our website or from your devices. This includes collecting information using analytic tools and other tracking technologies.

When you create an account with CTV, we collect your information directly from you, as you engage with CTV and otherwise interact with us on the website.

Why We Collect Information and How We Use It

When you visit CTV we collect your information to help us understand how you interact with us, to provide you with relevant information and services, to help us to ensure CTV is working as designed and to provide, maintain, improve and enhance CTV. This includes processing personal information as necessary to analyze, improve and optimize the delivery and use of CTV and its security.

When you create an account with us, we collect your information to:

• provide you with the experience and information you've requested;
• personalize your content and experiences; and
• inform you of other services or information we believe you may be interested in.

We may also use your information:

• to find and prevent fraud and respond to trust and safety issues that may arise;
• for compliance purposes, including enforcing our Terms or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• for other purposes as described at the time your information is collected.

You will not be subject to decisions based on automated data processing without your prior consent.

Sharing your Information

We may share personal information internally and with our subsidiaries, service providers and other third parties for the following purposes:

• to support the purposes described in the section above entitled “Why We Collect Information and How We Use It”;
• to comply with applicable law, legal obligations and valid legal processes such as search warrants, subpoenas, or court orders;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate or prevent fraud or other illegal activity;
• as necessary to establish, exercise or defend against potential, threatened or actual litigation;
• in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets; and
• for additional purposes with your consent, where consent is required by law.

We will not sell your personal information or share it with third parties for cross-contextual behavioral advertising. When we share your personal information, we will ensure it is used in a manner consistent with this privacy notice.

Information from Cookies and Similar Technologies

We collect information using cookies, pixel tags, or similar technologies. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to CTV. We do not use third party cookies - cookies that are not controlled by us.

Please review your web browser's “Help” file to learn the proper way to modify your cookie settings. Please note that if you delete or choose not to accept cookies from CTV, you may not be able to utilize the features of CTV to their fullest potential.

Third Parties

CTV may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this privacy notice does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Security

We maintain a privacy and security program with technical, physical and organizational safeguards designed to protect against the wrongful access, use or disclosure of personal information, and to provide a level of security which we believe is appropriate to the risk our processing of your personal information poses posed to your privacy. We regularly review and modify our security measures to reflect changing technology, laws and regulations, risk, industry and security practices and other business needs.

Children's Privacy

CTV is not designed for or directed at children under 13 years of age. If you believe we may have mistakenly collected the personal information of a minor without appropriate consent, please contact us at support@clinicaltrialsveeva.com and we will investigate and promptly address the issue.

Your Controls

We offer you certain controls over your information. These controls may include the right to access, delete, correct, transfer and opt-out of or object to the processing of your information. If you choose to exercise your rights, we will respond to your request in accordance with applicable laws, which may vary depending on where you live.

If you wish to exercise your privacy rights, email support@clinicaltrialsveeva.com. In order to process your request, we require certain information about you. We will only use this information to verify your identity and facilitate the processing of your request. There may be times when we are unable to fulfill your request; in those cases, we will let you know why we are unable to fulfill your request, subject to applicable law.

Transfer of Personal Information Between Countries

We are a global company. As a global company, we may transfer your personal information to various locations around the world for the purposes described in this privacy notice. We apply the protections and limitations described in this privacy notice regardless of where we process your personal information. We also comply with various legal frameworks that enable the cross-border transfer of personal information. Where required, we rely on transfer mechanisms that lawfully support data transfer to locations that are not considered “adequate” by the appropriate data protection authority, which may include standard contractual clauses, obtaining your consent, or other recognized transfer mechanism.

Data Privacy Framework

Veeva Systems Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF (UK Extension), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the (i) EU-U.S. DPF Principles with regard to the processing of personal information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension, and (ii) Swiss-U.S. DPF Principles with regard to the processing of personal information received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program and to view our certification visit the Data Privacy Framework Program website.

If you have questions or concerns regarding our handling of your personal information under the DPF or about our privacy program generally, please contact us at privacy@veeva.com. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request. If neither process resolves your question or concern, you may be able to pursue binding arbitration; visit the Data Privacy Framework Program website for more information about how to submit a complaint.

The Federal Trade Commission has jurisdiction over our compliance with the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF. We remain responsible for personal information that we transfer to third parties for processing on our behalf. We may be required to disclose personal information that we handle under the DPF in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, as described in more detail by our Government Access Request Policy available at veeva.com/privacy.

Retaining Your Information

We will retain your information until it is no longer necessary to provide our services, until you request its deletion by contacting Veeva in writing at support@clinicaltrialsveeva.com, or as otherwise required by law.

Contact Us

Legal Basis

The legal basis for processing internet protocol addresses is our legitimate interest in providing the Veeva website. The legal basis for the processing of your registration, account and usage data is your consent.

Changes to this Privacy Notice

From time-to-time, we may change this privacy notice to reflect changing technology, laws, regulations, risk, industry and security practices and other business needs. The most up-to-date version will be found on this website; we post its effective date at the top. If we make a material update, we may notify you by posting notice on our website or by other means, consistent with applicable law.

Jurisdiction-Specific Disclosures

California, Colorado, Connecticut, Utah and Virginia

If you are a resident of California, Colorado, Connecticut, Utah or Virginia you have the following rights, subject to certain limitations. These rights include:

• Know: Right to know what personal information we hold about you;
• Correct*: Right to correct your inaccurate or incomplete personal information;
• Delete: Right to request your personal information be deleted;
• Portability: Right to obtain a copy of your personal information in a portable and readily usable format;
• Opt-Out: Right to opt out of the sale of your personal information or the processing of your personal information for targeted advertising or certain profiling and automated decision-making activities; ;
• Limit**: Right to limit the use or disclosure of your sensitive personal information; and
• Non-Discrimination: The right not to receive discriminatory treatment for the exercise of your privacy rights.

If you wish to exercise your rights, email support@clinicaltrialsveeva.com. You may also exercise your rights by calling us (free of charge) at 1 (877) 807-3230.

* Not available to Utah residents under the Utah Consumer Privacy Act.
** Available to California residents under the California Consumer Privacy Act.

The following additional notice applies to residents of California.

The categories of personal information we collect include:

• Identifiers such as a real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address and account name.
• Internet or other electronic network activity information, such as browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems and advertisements.

We collect this information to support the purposes described in the section of this privacy notice entitled "Why We Collect Information and How We Use It." We collect your personal information from the sources described under the "How We Collect Information" section of this privacy notice. We disclose the information from the above listed categories for the purposes and to the categories of recipients described in the section of this privacy notice entitled "Sharing Your Information."

We do not use or disclose sensitive personal information any purpose other than those specified in Section 7027(m) of the CCPA regulations. We did not receive any data subject requests from consumers in the State of California from January 1, 2023 - December 31, 2023.