Data Privacy

Re:Cognition Health Corporation Data Privacy Framework Notice

Last updated: December 18, 2023

Re:Cognition Health Corporation and its subsidiaries (collectively, “Re:Cognition Health”, “we”, “our” or “us”) have created this Data Privacy Framework Notice (“Notice”) to describe our standards and procedures for handling Personal Information in accordance with the EU-U.S. and the UK Extension to the EU-U.S. Data Privacy Frameworks (“DPF”).

Re:Cognition Health complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Re:Cognition Health has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“Principles”) with regard to the processing of Personal Information received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. To learn more about the DPF, and to view our certification, please visit https://www.dataprivacyframework.gov/.

This Notice supplements our Privacy Policy. Unless specifically defined in this Notice, the terms in this Notice have the same meaning as in our Privacy Policy. In case of conflict between the Privacy Policy and this Notice, this Notice prevails. In case of conflict between this Notice and the Principles, the Principles will govern. In this Notice, “Personal Information” means any information relating to an identified or identifiable natural person. “Controller” and “Processor” have the meaning given to them in the General Data Protection Regulation (EU) 2016/679 and the UK Data Protection Act 2018.

How we obtain Personal Information

We obtain and process Personal Information from the European Economic Area (“EEA”) and the United Kingdom (“UK”) in different capacities:

As a Controller, we collect and process EEA and UK Personal Information directly from individuals, either via our publicly available websites or when you use our Private Brain & Mind Services.
As a Processor, we obtain and process EEA and UK Personal Information on behalf of and at the instructions of our sponsors in relation to conducting Clinical Trials.

Re:Cognition Health commits to subject to the Principles all Personal Information received from the EEA and the UK in reliance on the DPF as a Controller or as a Processor, as applicable.

DPF Principles

- Our Privacy Policy in combination with this Notice describes our privacy practices, including the types of Personal Information collected and the purposes of the processing. When providing our Services as a Processor, our sponsors determine the types of Personal Information we process and the purposes of the processing. Accordingly, our sponsors are responsible for providing notice to individuals.
We will adhere to the Principles for as long as we retain the Personal Information collected under the DPF.

When providing our Services as a Processor, we process and retain Personal Information as necessary to provide our Services as permitted in our agreements, or as required or permitted under applicable law.
- Re:Cognition Health may transfer Personal Information as described in the Privacy Policy. When providing our Services as a Processor, we disclose Personal Information as provided in our agreement with sponsors.
We remain responsible for the processing of Personal Information received under the DPF and subsequently transferred to a third party acting as a Processor if the Processor processes such Personal Information in a manner inconsistent with the Principles unless we prove that we are not responsible for the event giving rise to the damage. Re:Cognition Health will only onward transfer Personal Information received in reliance on the DPF if the third party recipient is also covered by the DPF or if it contractually ensures to provide the same level of protection for such data as is required by the Principles.
Re:Cognition Health takes reasonable and appropriate precautions, taking into account the risks involved in the processing and the nature of the Personal Information, to help protect Personal Information from loss, misuse and unauthorized access, disclosure, alteration, and destruction.
- Any Personal Information we receive may be processed by Re:Cognition Health for the purposes indicated in our Privacy Policy or as otherwise notified to you. We will not process Personal Information in a way that is incompatible with these purposes unless subsequently authorized by you.
We take reasonable steps to limit the collection and usage of Personal Information to that which is relevant for the purposes for which it was collected and to ensure that such Personal Information is reliable, accurate, complete, and current. Individuals are encouraged to keep their Personal Information with Re:Cognition Health up to date and may contact Re:Cognition Health as indicated below or in the Privacy Policy to request that their Personal Information be updated or corrected.
- If we intend to use your Personal Information for a purpose that is materially different from the purposes for which it was originally collected or subsequently authorized, or if we intend to disclose it to a third party acting as a Controller not previously identified, we will offer you the opportunity to opt out of such uses and/or disclosures where it involves non-sensitive information or opt-in where sensitive information is involved.
Where appropriate, you have the right to access to the Personal Information we maintain about you and to correct, amend, or delete that information when it is inaccurate or has been processed in violation of the Principles by sending a written request as indicated in “Contact Us” below. We will review your request in accordance with the Principles and may limit or deny access to Personal Information as permitted by the Principles.

When providing our Services as a Processor, we only process and disclose the Personal Information as instructed by the Controller in our agreements. Our sponsors control how Personal Information can be modified. Accordingly, if you want to limit the use or disclosure of your Personal Information, please contact Re:Cognition Health and we will liaise with the relevant sponsor to complete the request in line with the Principles.
- We conduct an annual self-assessment of our practices regarding Personal Information intended to verify that the assertions we make about our practices are true and that such practices have been implemented as represented.
If you have any questions or concerns, we encourage you to first write to us as indicated below. We will investigate and attempt to resolve complaints and disputes regarding the use and disclosure of Personal Information in accordance with the Principles. We will respond to you within 45 days of receiving your complaint.

If an issue cannot be resolved through Re:Cognition Health’s internal dispute resolution mechanism, you may submit a complaint, at no cost, to JAMS (https://www.jamsadr.com/DPF-Dispute-Resolution) which serves as Re:Cognition Health’s external alternative dispute resolution provider.

For residual complaints not fully or partially resolved by other means, you may be able to invoke binding arbitration as detailed in the Principles available here for the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

Re:Cognition Health is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Changes to this Notice

This Notice may be amended consistent with the requirements of the DPF. When we update this Notice, we will also revise the “Last Updated” date at the top of this document. Any changes to this Notice will become effective when we post the revised version on our website.

Contact Us

If you have any questions, concerns, or complaints regarding our privacy practices, or if you’d like to exercise your choices or rights, you can contact us:

via email at compliance@re-cognitionhealth.com; or
by mailing to Re:Cognition Health, 8316 Arlington Blvd, Suite 420, Fairfax, VA, 22031.