Vor Biopharma, Inc. (referred to as “VOR”, “the Company”, “We, “Our” or “Us”) are committed to protecting the privacy and security of your Personal Data.
This VOR Privacy Notice applies to you when you interact with VOR, including through VOR’s corporate website, clinical trial recruitment websites, study-interest forms, participant-facing notices that link to this Notice, and other VOR websites or online services, and if you are:
- A service user of this website (VOR)
- A VOR clinical trial participant;
- A healthcare professional;
- An employee, contractor or other associated party associated with VOR;
- An employee, contractor or other associated party contracted by VOR’s Service Providers; or,
- Any other individual with whom VOR may conduct commercial operations.
We have developed this Privacy Notice to inform you of the data we collect, what we do with your information, what we do to keep it secure, and the rights and choices you have over your Personal Data. This Notice also explains how we process information submitted through clinical trial recruitment websites and study-interest forms before a person is enrolled in a clinical trial.
Where a separate privacy notice, informed consent form, recruitment notice, or study-specific document applies to a clinical trial or recruitment activity, that document will supplement this Notice. If there is a direct conflict between this Notice and a study-specific document, the study-specific document will control for that study or activity.
1. Definitions
For the purposes of this VOR Privacy Notice:
Company (referred to as either “VOR”, “the Company”, “We”, “Us” or “Our” in this Agreement) refers to VOR Biopharma, Inc., with an address at 500 Boylston St., Suite 1350
Boston, MA, 02116, USA.
Cookies are small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses.
Data Controller, for the purposes of both UK and EU GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data. For the purpose of both UK and EU GDPR, the Company is the Data Controller.
Data Processor, for the purposes of both UK and EU GDPR, refers to the Company’s Service Providers.
Data Protection Legislation, as defined in the Data Protection Legislation section below.
Device means any device that can access the Service such as a computer, a mobile phone, or a digital tablet.
Personal Data is any information that relates to an identified or identifiable individual.
For the purposes of both UK and EU GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.
Service refers to the Website and any VOR online service, recruitment page, study-interest form, contact form, participant-facing notice that links to this Notice, or related communication channel, unless otherwise stated.
Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of both UK and EU GDPR, Service Providers are considered Data Processors.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
Website refers to the VOR corporate website, accessible from https://www.vorbio.com, and any VOR-operated or VOR-sponsored websites that link to this Notice, including clinical trial recruitment websites, study-interest pages, and associated websites.
You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under both UK and EU GDPR (General Data Protection Regulation), You can be referred to as the Data Subject or as the User as you are the individual using the Service.
2. Data protection legislation
Throughout this document we refer to Data Protection Legislation.
Where data is processed by a controller or processor established in the European Union (EU) or comprises the data of people in the European Union, it is subject to the General Data Protection Regulation (Regulation (EU) 2016/679) (‘EU GDPR’) as well as any local data protection implementation laws. This includes any replacement legislation coming into effect from time to time.
In the United Kingdom (UK), Data Protection Legislation means the Data Protection Act 2018 (‘DPA 2018’), United Kingdom General Data Protection Regulation (‘UK GDPR’), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (‘PECR’) and Data (Use and Access) Act 2025, and any legislation implemented in connection with the aforementioned legislation.
If you are an individual resident in the USA, Canada or another jurisdiction outside of the EEA/UK with different data protection and privacy laws and regulations governing personal data collection, use, and disclosure then those local data protection and privacy laws and regulations will be adhered to.
VOR is the Data Controller (‘controller’) for the Personal Data we process, unless otherwise stated.
We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform, and advise on data protection obligations, and act as a point of contact for data subjects and supervisory authorities. For further details on how you can contact our DPO, please see the Contact Us section below.
3. The information we collect
We only collect Personal Data that we know we will genuinely use and in accordance with the Data Protection Legislation and/or legislation related to clinical trials, such as the EU Clinical Trial Regulations (EU CTR). The type of Personal Data that we will collect on you will depend on whether you are a clinical trial participant, prospective participant or recruitment contact, healthcare professional, employee, contractor, service provider contact, user of this website, or other person who interacts with VOR:
Clinical trial participant
- Your name*
- Your date of birth*
- Your age*
- Your gender*
- Your contact information (telephone number or email address)*
- Where applicable, the name of your legally authorized representative*
- Where applicable, the name and contact details of your partner*
- Your pseudonymized unique identification number(s)
- Your health data
- Your genetic data
- Your ethnicity
Prospective clinical trial participants and recruitment contacts
- Where you submit information through a clinical trial recruitment website, study-interest form, referral process, screening questionnaire, or other recruitment channel, we may collect:
- Your name
- Your contact information, such as email address, telephone number, and mailing address
- Your location or preferred clinical trial site
- Information about your interest in a VOR study
- Limited health, diagnosis, treatment, eligibility, demographic, or related information you choose to provide or that is collected to assess potential study interest or eligibility
- Information about your caregiver, parent, guardian, legally authorized representative, or referring healthcare professional, where applicable
- Your communications with VOR, our vendors, CROs, recruitment partners, or Research Sites
Healthcare professional (HCP)
- Your name
- Title
- Contact details
- Your employment details, where applicable
Employees, board of directors and contractors of VOR or VOR’s service providers
- Your name
- Title
- Your date of birth
- Your contact information (telephone number, email address, or mailing address)
- Your employment details
- Where relevant, your pseudonymized unique identification number(s) (e.g., payroll no.)
- Where relevant, your financial information (e.g., bank information)
- Where relevant, your Right to Work information (e.g., nationality)
- Where relevant, your health data (e.g., sick leave information)
- Where relevant, your photograph and biography
* Participant identifiable information collected during clinical trial enrollment and conduct is generally collected by VOR’s Research Sites, acting on their behalf as Data Processors or independent controllers, as applicable. This data may be shared with clinicians, health authorities, ethics bodies, Vor, Vor’s CROs, and other personnel as authorized by VOR, but only where necessary for clinical trial operations, safety reporting, regulatory compliance, or as otherwise permitted or required by Clinical Trial Regulations and other applicable laws. VOR does not routinely receive directly identifiable participant information from Research Sites unless necessary for those purposes. Information submitted through recruitment websites or study-interest forms may be received by Vor, Vor’s vendors, CROs, recruitment partners, or Research Sites so that interest in a study can be assessed, responded to, and routed appropriately.
† You are under no statutory or contractual requirement or obligation to provide us with your Personal Data; however, we require at least the information above in order for us to deal with you as a Service User in an efficient and effective manner.
4. Cookies, analytics and tracking technologies
We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyse Our Service.
You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service.
Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close your web browser. We use both session and persistent Cookies for the purposes set out below:
Necessary / essential cookies
Type: Session Cookies
Administered by: Us
Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.
Cookies policy / notice acceptance cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies identify if users have accepted the use of cookies on the Website.
Functionality cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.
Tracking and performance cookies
Type: Persistent Cookies
Administered by: Third-Parties
Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features, or functionality of the Website to see how our users react to them.
We and the third parties we work with may use cookies and similar tracking technologies to collect information about your use of the Services, such as your IP address, browser type, browser version, pages viewed, time spent on pages, links clicked and conversion information. This information may be used by us and others to, among other things, analyze and track data, determine the popularity of certain content, measure recruitment outreach, provide customer support, troubleshoot issues with and improve the operation of our Website and Services, and better understand your online activity. Where required by applicable law, we will obtain your consent before using non-essential cookies or similar tracking technologies, including technologies used for advertising, remarketing, conversion measurement, or cross-site tracking. For further information, please see the Website Privacy Notice.
5. How we use your information
We will only process your Personal Data when the law allows us to do so. We will have provided you with our lawful basis for processing your Personal Data at the point the information was initially collected from you. We will not store, process, or transfer your data unless we have an appropriate lawful reason to do so.
Under Data Protection Legislation, the lawful bases we rely on for processing your information are:
- GDPR Article 6(1)(a) – Your consent;*
- GDPR Article 6(1)(b) – We have a contractual obligation;
- GDPR Article 6(1)(c) – We have a legal obligation;
- GDPR, Article 6(1)(d) – In order to protect the vital interests of You or a third party;
- GDPR, Article 6(1)(e) – We have a public interest; or,
- GDPR, Article 6(1)(f) – We have a legitimate interest.
* Where the lawful basis for processing is Consent, you are able to remove your consent at any time. You can do this by contacting our DPO using the contact details provided in the Contact Us section below.
We may use your information for the following purposes:
Processing Activity: Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of Consent, to collect information from you and process your health information in order to conduct a clinical trial
Lawful Basis: Consent
Processing Activity: Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of Legitimate Interest, to collect information from you and process your health information in order to conduct a clinical trial
Lawful Basis: Legitimate Interest in conducting clinical research
Processing Activity: Where you are a clinical trial participant in a jurisdiction where clinical trials occur on the lawful basis of Legal Obligation, to collect information from you and process your health information in order to conduct a clinical trial
Lawful Basis: Legal Obligation
Processing Activity: Where you are a Health Care Professional (HCP) involved in the planning, delivery, or oversight of VOR clinical trials, to collect information from you and process your employment information in order to conduct a clinical trial
Lawful Basis: Legitimate Interest in conducting clinical research
Processing Activity: Where you are a Health Care Professional (HCP), to collect and process your contact and employment information for purposes related to scientific exchange and medical affairs activities
Lawful Basis: Legitimate Interest, Contractual Obligation
Processing Activity: Where you are an employee of VOR to collect information from you and make available our services to you
Lawful Basis: Legitimate Interest in managing VOR’s affairs
Processing Activity: Where you are an employee of VOR’s Service Providers, to collect information from you and take payment from you, make a payment to you, give you a refund or request a refund
Lawful Basis: Contractual Obligation
Processing Activity: Where you are an employee of VOR’s Service Providers, to collect information from you or your employer and liaise with your employer about your contact details and/or the nature and performance of your work, as required
Lawful Basis: Legitimate Interest in managing VOR’s affairs
Processing Activity: Where you are an employee or Board member of VOR to collect your consent for the use of your photographs on the company website, where required and for other purposes as consented to, as applicable
Lawful Basis: Consent
Processing Activity: To collect information from you and monitor, provide and maintain our Service
Lawful Basis: Legitimate Interest in providing Services to you
Processing Activity: To contact you following your inquiry where you have provided your contact information and to reply to any questions, suggestions, issues, or complaints, including any Data Subject Requests, about which you have contacted us
Lawful Basis: Legitimate Interest in providing Services to you
Processing Activity: To collect your Usage Data in order to power our security measures and services so you can safely access our website and other Services
Lawful Basis: Legitimate Interest in providing a secure platform
Processing Activity: To contact you, where you have provided your contact information, about news and information relating to our Services through service messages
Lawful Basis: Legitimate Interest in contacting you about our Services
Processing Activity: B2B direct marketing to you, where you have provided your contact information, about products and services from us where you are classified as a corporate subscriber and/or the ‘soft opt-in’ applies under UK PECR
Lawful Basis: Legitimate Interest in marketing our Services to you
Processing Activity: B2B direct marketing to you, where you have provided your contact information, about products and services from us where you are a sole trader, partnership or otherwise classified as an individual subscriber and/or the ‘soft opt-in’ does not apply under UK PECR
Lawful Basis: Consent
Processing Activity: To retain any accounting information generated during the course of our interaction for statutory accountancy retention periods
Lawful Basis: Legal Obligation
Processing Activity: To respond to and defend against legal claims, where you have provided us with information which may give rise to legal claims
Lawful Basis: Legal Obligation
Processing Activity: Share your personal information with other professional advisors, such as insurers, accountants, auditors or lawyers.
To provide professional/expert advice in connection with our business objectives where necessary in the course of the professional services that they render to us or in connection with the clinical trial.
Lawful Basis: Legitimate Interest, Legal Obligation
Processing Activity: Share your personal information with other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents. To meet our legal, regulatory and compliance obligations. For example, VOR is required to provide tax-related information to relevant authorities.
Lawful Basis: Legal Obligation
Processing Activity: Any prospective or new companies (e.g. if we restructure, or acquire or merge with other companies) or any businesses that buy part of or all of VOR (including the rights to the study drug and all related data) to other entities.
In relation to compliance and completion of pre-merger or acquisition, consolidation, corporate divestiture, restructuring or liquidation/ dissolution due diligence. If this occurs the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice.
Lawful Basis: Legitimate Interest
For prospective clinical trial participants, study candidates, caregivers, parents, guardians, legally authorized representatives, and recruitment contacts, we may use Personal Data to respond to study-interest submissions, assess potential eligibility at a preliminary level, route inquiries to appropriate Research Sites, CROs, vendors, recruitment partners, or study personnel, schedule follow-up communications, support recruitment operations, maintain records of recruitment activity, satisfy safety, quality, regulatory, and legal obligations, and protect VOR’s rights and the integrity of its clinical trials. Depending on the jurisdiction and activity, the lawful basis may include Consent, Legitimate Interest in conducting clinical research and managing recruitment, Legal Obligation, Vital Interests, or another lawful basis identified at the point of collection or in study-specific materials. Where special category data is processed, we rely on an applicable condition under Data Protection Legislation, which may include explicit consent, scientific research, public interest in the area of public health, health care, legal claims, or another applicable condition.
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
6. Automated technologies and A.I. use
Automated decision-making may take place when an electronic system uses personal data to make a decision without human intervention. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
As part of our ongoing efforts to improve the efficiency and quality of our research, clinical trial, recruitment, and business activities, we may use approved artificial intelligence (AI) tools to support data analysis, communications, administrative workflows, and system functionality. Some third-party software platforms and systems may process your personal data, such as the Microsoft 365 suite of applications, including Connected Experiences and Microsoft Copilot. Other approved systems used by us may also include AI features and functionalities that process personal data. We apply internal safeguards designed to limit the use of directly identifiable health, genetic, or clinical trial information in AI tools unless such use is authorized, appropriate for the purpose, and subject to applicable contractual, technical, and organizational protections. For further information on this processing, please contact us.
Throughout our professional relationship, your personal data may be processed within the Microsoft office 365 suite of applications. This may include processing by Microsoft Copilot AI as part of Microsoft Connected Experiences, in accordance with Microsoft’s privacy and security standards. For more information about how Microsoft may process your personal data, see the Microsoft privacy statement which can be accessed here: Microsoft Privacy Statement – Microsoft privacy. If you have any questions or concerns about this processing, please contact our Data Protection Officer on the contact email address set out in the Contact us section.
Our use of AI tools for processing your personal data is carried out on the basis of our Legitimate Interests, unless another lawful basis is more appropriate for the specific processing activity. We balance our interests against your data protection rights and apply appropriate safeguards to protect your personal data.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
7. Who we might share your information with
We may share your personal data with other organizations in the following circumstances:
- From time to time, we may need to share your Personal Data with our strategic clinical trial partners, CROs, clinical trial sites, investigators, recruitment partners, patient engagement vendors, and other study-related service providers.
- If the law or a public authority says we must share the Personal Data;
- If we need to share Personal Data in order to establish, exercise or defend our legal rights – this includes providing Personal Data to others for the purposes of detecting and preventing fraud; or
- From time to time, employ the services of other parties for dealing with certain processes necessary for the operation of our services.
- Other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents to meet our legal, regulatory and compliance obligations.
- With Law enforcement, government, courts, regulators, governmental or quasi- governmental organisations, tribunals and arbitrators to meet our regulatory and legal obligations. VOR’s legal duty to assist with detecting fraud and tax evasion, financial crime prevention, regulatory reporting, litigation or defending legal rights. For example, VOR is required to provide immigration information to the relevant authorities and any information for the purposes of preventing and detecting fraud or crime (if necessary) to the police.
We use Service Providers (“Data Processors”) and other third parties who provide elements of services for us, including website hosting, recruitment, study-interest form intake, clinical trial operations, data hosting, analytics, communications, and IT support. Examples of these Data Processors include, but are not limited to:
- Our Contract Research Organizations (CRO) and EU representative;
- Our Clinical Trial Data Processors,
- Our IT Service Providers, such as Microsoft Corporation.
We have Data Processor Agreements in place with our data processors. This means that they cannot do anything with your Personal Data unless we have instructed them to do it. They will not share your Personal Data with any organization apart from us or further sub-processors who must comply with our Data Processor Agreement. They will hold your Personal Data securely and retain it for the period we instruct.
8. How long we keep your information for
We retain a record of your Personal Data in order to provide you with a high quality and consistent service. We will always retain your Personal Data in accordance with the Data Protection Legislation and never retain your information for longer than is necessary. VOR follows a Retention Schedule which outlines how long VOR will retain your Personal Data. VOR considers the retention period to begin from the point at which VOR last contacted you or otherwise reviewed your record to determine whether it was still active, unless otherwise required by law. As such, unless otherwise required by law, your data will be retained for the period specified in the summarized table below and then securely deleted in accordance with our internal policies and procedures.
For Personal Data collected through clinical trial recruitment websites, study-interest forms, or other recruitment channels before enrollment, we retain the information for as long as necessary to respond to the inquiry, assess and document recruitment activity, support study operations, comply with legal, regulatory, safety, audit, and recordkeeping obligations, resolve disputes, and protect VOR’s rights. If a person enrolls in a study, the applicable clinical trial retention period and study-specific documents will apply to the relevant study records.
Purpose: Processing data in relation to You as a clinical trial participant
Retention Period: 25 years following the conclusion of the clinical trial, as determined by EU Clinical Trial Regulations (EU-CTRs)
Purpose: Processing data in relation to You as a Health Care Professional (HCP) involved in the planning, delivery, or oversight of an VOR’s clinical trial
Retention Period: 25 years following the conclusion of the clinical trial, as determined by EU Clinical Trial Regulations (EU-CTRs)
Purpose: Processing data in relation to You as an employee, contractor or other associated party contracted by VOR.
Retention Period: 6 years following the termination of your employment
Purpose: Processing data in relation to You as an employee, contractor or other associated party contracted by VOR’s Service Providers
Retention Period: 6 years following the termination of your employment
Purpose: Processing data in relation to You as a service user of this website
Retention Period: 1 year
Purpose: Processing data in relation to You as any other individual with whom VOR may conduct commercial operations
Retention Period: 6 years
9. Children’s privacy
Our general corporate Website is not intended for use by anyone under 18 years of age. Clinical trial recruitment websites, study-interest forms, and clinical trial materials may relate to minors only where the applicable study permits participation by minors and appropriate parent, guardian, or legally authorized representative involvement is obtained as required by applicable law and study documents. Except where permitted in connection with an applicable clinical trial, recruitment activity, or communication involving a parent, guardian, or legally authorized representative, we do not seek or knowingly collect any personal information about children under 18 years of age. If we become aware that we have unknowingly collected personal information from a child under the age of 18 outside of those circumstances, we will make commercially reasonable efforts to delete such information from our database.
If you are the parent or guardian of a minor child who has provided us with personal information, you may contact us using the information below to request it be deleted.
10. Your rights over your information
10.1 The right to be informed about our collection and use of personal data
You have the right to be informed about the collection and use of your personal data. We ensure we do this with our internal and external Privacy Notices (including this document). These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.
10.2 Right to access your personal data
You have the right to access the Personal Data that we hold about you in many circumstances, by making a request. This is sometimes termed ‘Data Subject Access Request’. If we agree that we are obliged to provide Personal Data to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within 1 month from when your identity has been confirmed.
We would ask for proof of identity and sufficient information about your interactions with us that we can locate your Personal Data.
If you would like to exercise this right, please Contact Us as set out below.
10.3 Right to rectify your personal data
If any of the Personal Data we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it.
If you would like to exercise this right, please Contact Us as set out below.
10.4 Right to erasure
You have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances. For instance, the right to erasure does not apply where we have a legal obligation to retain your Personal Data.
If you would like to exercise this right, please Contact Us as set out below.
10.5 Right to restrict processing
You have the right to ask us to restrict the processing of your personal data. For example, this may be because you have issues with the accuracy of the data we hold or the way we have processed your data. The right is not absolute and only applies in certain circumstances.
If you would like to exercise this right, please Contact Us as set out below.
10.6 Right to portability
The right to portability gives you the right to receive personal data you have provided to a controller in a structured, commonly used, and machine-readable format. It also gives them you the right to request that a controller transmits this data directly to another controller.
If you would like to exercise this right, please Contact Us as set out below.
10.7 Right to object
You have the right to object to our processing of some or all of the personal data that we hold about you. This is an absolute right when we use your data for direct marketing but may not apply in other circumstances where we have a compelling reason to do so, e.g., a legal obligation.
If you would like to exercise this right, please Contact Us as set out below.
10.8 Rights related to automated decision-making
You have the right to object to our processing where a decision is made about you solely based upon automated processed and which has significant or legal effects. VOR does not intend to conduct any automated decision-making for your Personal Data.
If you would like to contact us regarding this right, please Contact Us as set out below.
10.9 For more information about your privacy rights
Depending on your jurisdiction, it is possible that a different regulator or supervisory authority may govern the processing of Personal Data. Your government’s website should be able to point you in the right direction of the relevant regulatory body. You can find your country’s regulatory body here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. If you have any questions about which supervisory authority applies in your jurisdiction, please Contact Us as set out below.
In the UK, the Information Commissioner’s Office (ICO) regulates data protection and privacy matters. They make a lot of information accessible to consumers on their website, which you can access here: https://ico.org.uk/for-the-public.
You can make a complaint to the ICO, or any other supervisory authority, at any time about the way we use your information. However, we hope that you would consider raising any issue or complaint you have with us first. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have.
11. Security
Data security is of great importance to VOR. We have put in place appropriate technical and organizational measures to prevent your Personal Data from being accidently lost, used, or accessed in an unauthorized way, altered, or disclosed.
We take security measures to protect your information including:
- Limiting access to our buildings and resources to only those that we have determined are entitled to be there (by use of passes, key card access and other related technologies).
- Managing a data security breach reporting and notification system which allows us to monitor and communicate information on data breaches with you or with the applicable regulator when required to do so by law.
- Implementing access controls to our information technology such as appropriate procedures and technical security measures including encryption, anonymisation (where applicable) and archiving techniques to safeguard your information across all our computer systems, networks, websites, mobile apps and offices.
- Deploying appropriate procedures and technical security measures (including strict encryption, anonymization and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices, and stores.
12. International transfers
Because VOR operates globally, your personal data may be transferred outside of the country in which you interact with VOR, including to countries whose data protection laws substantially differ from the country in which you work or reside and may not provide the same level of data protection as in your country of residence. To accomplish the purposes described in this Notice, we may also disclose and transfer personal data to personnel and other departments throughout VOR, or to service providers and/or collaborators, licensees and strategic partners based overseas, to the extent that your personal data is shared with service providers, VOR affiliates, successors, licensees, collaborators, designees, connected companies or partners or other third parties processing Personal Data on our behalf, which are located outside your country of residence.
For example, your Personal Data may be transferred or accessed by VOR and its affiliate entities in the United States of America.
VOR shall seek to maintain confidentiality as required within the limits of local laws in these countries.
Whenever we are required to transfer your Personal Data out of the UK or EEA, we ensure that at least one of the following safeguards is implemented:
- transferring your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission or the UK government, as applicable.
- using specific contracts, data transfer mechanisms and approved safeguards which give Personal Data the same protection it has in Europe including Standard Data Protection Clauses approved by the European Commission, the UK government or Swiss government, as applicable providing adequate protection of Personal Data.
We may also seek you consent to disclose your Personal Data to third parties and the transfer of your personal data to a country which does not provide an adequate protection equivalent to the laws of your country of residence where required.
Please contact our DPO using the details in the Contact Us section below if you would like further information on the specific mechanism used by us when transferring your personal data out of the EEA or UK.
If you are an individual located in the USA, Canada or another jurisdiction outside of the EEA/UK with different data protection and privacy laws and regulations governing personal data collection, use, and disclosure, please be aware that any personal data we collect (including through the use of methods such as Cookies and other web technologies) may be processed and stored in those jurisdictions according to local data protection laws and regulations.
Also if you reside in a country outside of the EEA or UK where the local data protection laws require that international data transfers adhere to local specific Standard Contractual Clauses, we will ensure that these are executed between the parties.
13. Compliance with U.S. and other global data protection laws
In addition to the EU and UK data protection legislation, we comply with applicable data protection and privacy laws in other jurisdictions where we operate. These may include:
13.1 United States
U.S. privacy law is a patchwork of federal and state regulations rather than a single comprehensive statute. Federal and state privacy, consumer protection, health information, clinical trial, and security laws may apply depending on the type of data, the individual, the activity, and VOR’s role in the processing.
Several states, such as California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, Indiana, Tennessee, Montana, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, Kentucky, and Rhode Island, have enacted comprehensive consumer privacy laws granting rights that may include access, correction, deletion, portability, opt-out of certain targeted advertising, sales, or profiling, and protections for sensitive data, depending on the law and the context.
Where applicable, we structure our privacy practices to account for the California Consumer Privacy Act as amended (CCPA/CPRA) and other applicable U.S. state privacy laws. These laws may provide rights and obligations such as transparency in data collection, rights to access, correct, and delete personal information, and limitations on certain data sharing, sales, targeted advertising, profiling, and sensitive data processing. We apply these principles across our U.S. operations where appropriate to support a consistent privacy program while preserving VOR’s ability to process Personal Data for clinical research, safety, regulatory, legal, business, and operational purposes as permitted by applicable law.
We do not share personal information with third parties for their own direct marketing purposes as described by California Civil Code Section 1798.83 (“Shine The Light Law”).
13.2 Other global jurisdictions
Many countries outside the EEA/ UK have adopted their own data protection frameworks, such as Brazil’s LGPD, Canada’s PIPEDA, and laws in regions including Asia-Pacific, Latin America, and Africa. While requirements vary, these laws generally emphasize transparency, lawful processing, security safeguards, and respect for individual rights.
Where required, we implement appropriate measures to meet local legal obligations, including honoring data subject rights and ensuring secure international data transfers through mechanisms such as adequacy decisions, standard contractual clauses, or other recognized safeguards
14. Providing us with other people’s data
If you give us any personal data that does not relate to you (e.g., information about your next of kin/dependants), you must ensure that you have the required legal basis to collect and share their personal data. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this Notice. You must also tell them how they can see what information we have about them, correct any mistakes or request copies of their information.
15. How we keep you updated on our products and services
Where you are a clinical trial participant or a Health Care Professional involved in the planning, delivery, or oversight of a VOR clinical trial, we will contact you through our Contracted Research Organization (CRO) where it is necessary to do so.
Where you are an employee of VOR, we will contact you through existing VOR communication channels, including email, where it is appropriate to do so.
Where you are an employee of VOR’s Service Providers, a user of this website who has provided us with your contact information, or any other business contact, we will send you relevant news about our services in a number of ways including by email, but only if we have a Legitimate Interest to do so. Where we do not have a Legitimate Interest, we will not send you marketing communications unless we have asked for, and gained, your consent.
We make every effort to ensure that we only send such communications to those acting in a business capacity and do not send such materials to consumers via personal email addresses if it is clear they are not acting in such a capacity or have not otherwise provided their consent.
All email communications will have an option to unsubscribe and so if you wish to amend your marketing preferences, you can do so by following the link in the email and updating your preferences. Alternatively, you can contact our DPO using the contact details provided in the Contact Us section below.
16. Giving your reviews and sharing your thoughts
When using our website and other Services, you may be able to share information through social networks like Facebook and Twitter. For example, when you ‘like’, ‘share’ or review our Services. When doing this, your Personal Data may be visible to the providers of those social networks and/or their other users. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts so that you are comfortable with how your information is used and shared on them.
17. Change of ownership
In the event that the ownership of our business, assets, or drug development rights is transferred to another entity, whether through merger, acquisition, sale, or licensing, we may share your personal data with the acquiring or licensing entity. This is to ensure continuity of research, regulatory obligations, and product development.
The receiving entity will be required to process your personal data in accordance with applicable data protection laws and the purposes outlined in this Privacy Notice, or as otherwise communicated to you at the time of transfer.
Where necessary, we will update this Privacy Notice and notify you of any material changes in how your personal data is handled.
18. Contact us
If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this Privacy Notice or the way your Personal Data is processed, please contact our Data Protection Officer (DPO) by one of the following means:
By email: dpo@vorbiopharma.com
By telephone: +4402037971289
By post: The DPO Centre Ltd., 50 Liverpool Street, London, UK, EC2M 7PY
EU Representative is European Data Protection Office (EDPO), who can be contacted via email: Privacy@edpo.com. https://edpo.com/gdpr-data-request/