Privacy Notice for Clinical Trials – Serbian Participants

Please note, this privacy notice has also been translated into the following languages (countries):

Scope

This Privacy Notice applies to Personal Data of data subjects in Serbia that are received by Xenon in any format, including electronic and paper, and processed by Xenon and/or by partners and service providers (“third parties”) on behalf of Xenon. Categories of third-party organizations and data recipients are described below.

Definitions

“Anonymous Data” is information which does not relate to an identified or identifiable natural person or personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. The PDPL does not concern the processing of Anonymous Data.

“Clinical Trial Data” is the data collected and processed by Xenon for clinical trial purposes. It includes Pseudonymised Data received from third parties as well as new data generated by Xenon and third parties based on data collected for the clinical trial. These new data may not relate to an identified or identifiable natural person.

“Clinical Trial Participant” means an individual participating in a clinical trial in Serbia and providing personal data to third parties Xenon has contracted with to conduct the study. Clinical Trial Participant has the same meaning as “Data Subject” under Article 4 of the PDPL.

“Personal Data” means any information relating to an identified or identifiable natural person (‘data subject’) in Serbia; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“PDPL” means the Law on Personal Data Protection (“Official Gazette of the Republic of Serbia”, No. 87/2018).

“Pseudonymised Data” means Personal Data that can no longer be attributed to a specific individual in Serbia without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data are not attributed to an individual. Xenon will protect Pseudonymised Data subject to the PDPL with the same care and high standards as Personal Data.

“Processing” means any operations or set of operations performed on Personal Data.

“Special categories of data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Purposes for Processing Personal Information

When individuals in Serbia become Clinical Trial Participants, Personal Data will be processed for the purpose of scientific research into the effects of medical treatment.

Categories of Information Processed

Common personal details

• Participant identifier (unique ID#)
• Location data – country, investigative site
• Personal details – year of birth, age in years, sex

Special categories of data

• Health data
• Physical details – height, weight, Body Mass Index (BMI)
• Childbearing status
• Physical health data
• Psychological details – quality of life rating
• Mental health data
• Genetic data related to genetic research
• Data revealing racial or ethnic origin

Legal Basis for Processing Personal Information

Clinical Trial Data

Depending on the country in which the clinical trial is conducted, the processing operations related to research activities in the context of the clinical trial may be based on one or more of the following legal justifications:

(i) need to comply with sponsor’s legal and regulatory obligations,

(ii) legitimate interests of the sponsor,

(iii) consent;

and/or for special categories of data such as health data:

(i) public interest in the area of public health,

(ii) scientific research purposes or processing necessary for archiving in the public interest, scientific or historical research purposes or statistical purposes,

(iii) explicit consent.

Genetic data for research purposes

Genetic data for the purpose of genotype/biomarker assessment will be processed based on your consent and the necessity of processing for archiving purposes in public interest, scientific or historical research purposes or statistical purposes. Participation in this assessment is entirely voluntary. The decision not to participate in the assessment will not stop the data subject from participating in the rest of the study. If applicable, consent to participate in the genotype/biomarker assessment is collected and recorded during the enrollment process using an Informed Consent Form.

Automated Processing

During the course of the Clinical Trial, Xenon will not make decisions regarding data subjects based solely on automated processing.

Categories of Third Parties and Data Recipients

Xenon contracts with a Contract Research Organisation (CRO) to run trials based on the protocols, or “instructions”, we have developed. The CRO selects investigators and study sites, processes Clinical Trial Data based on the protocol, and monitors the trial activities. CROs and third parties engaged by Xenon for the purposes of conducting a clinical trial are required by law and contractual undertakings to:

• Keep your Personal Data confidential and secure; and
• To use and disclose it for purposes that a reasonable person would consider appropriate in the circumstances, in compliance with all applicable legislation.

Categories of third parties that Xenon engages for clinical trials include:

• Wholly owned subsidiaries of Xenon
• Contract Research Organisations and other third-party vendors
• Statistical Research Analysts
• Clinical advisors
• Technical providers for hosting and software services
• Safety board
• Government regulatory authorities

The list of third parties that Xenon engages for a specific trial is available upon request.

Clinical Trial Data Transmitted to Third Countries

Xenon Pharmaceuticals Inc. is located in Canada. Clinical Trial Data from data subjects in Serbia are processed in Serbia, the EU, Canada, and the United States.

Xenon will only transfer data internationally from Serbia to the EU, UK, Canada or the United States on the basis of the appropriate legal mechanism:

• the standard contractual clauses under the PDPL, or
• Clinical Trial Data will be pseudonymised prior to processing outside of Serbia.
• We will ensure that there are adequate measures and specific guarantees in place to protect Personal Data.
• Xenon Pharmaceuticals USA Inc., a wholly owned subsidiary of Xenon Pharmaceuticals Inc., may process Clinical Trial Data upon instructions by Xenon Pharmaceuticals Inc. Xenon Pharmaceuticals USA Inc. is contractually bound to protect any Personal Data to the same standards as Xenon Pharmaceuticals Inc.

The list of processors Xenon uses for a specific trial is available upon request.

Retention

Xenon will retain Clinical Trial Data and will instruct third parties to retain Personal Data or Clinical Trial Data, depending on their role in the study, subject to applicable legislation. Xenon retains Clinical Trial Data in accordance with applicable law.

Your Rights

Where data subjects in Serbia seek to exercise their rights related to their Personal Data, Xenon will provide support to exercise those rights. Xenon may not be able to comply with a direct request where Xenon is not in a position to identify you. This would occur where Xenon has received Pseudonymised Data or where Personal Data have been destroyed, erased, or made anonymous in accordance with our record retention obligations and practices. You can reach out to your study doctor at any time who will know how to help you.

Your rights related to the trial, including the right to withdraw consent, are described in the clinical trial Informed Consent Form.

Depending on the legal basis for processing the Clinical Trial Data, rights related to the Personal Data of Clinical Trial Participants may include:

• Access to your Personal Data
• Right to rectification where Personal Data are incorrect or incomplete
• Right to restrict/suspend further processing of Personal Data
• Right to data portability
• Right to withdraw consent
• Right to complain to the Serbian data protection authority

The right to erasure will not apply to processing that is necessary for Xenon to comply with a legal obligation, for a task carried out in the area of public health, or for scientific research purposes.

Please contact the physician or hospital that enrolled you in the clinical trial if you would like to exercise your rights related to your Personal Data collected for clinical trial purposes.

Security Measures

We have taken appropriate technical and organisational security measures to protect Clinical Trial Data against unintentional or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and any other unlawful or unauthorized forms of processing under applicable law.

Such measures include, ensuring confidentiality, integrity, and availability of data by controlling physical access to the data, as well as the relevant access, input, disclosure, security of availability and its separation. In addition, we take into account the protection of Clinical Trial Data when developing or selecting the hardware, software, and procedures in line with the principle of data protection through technology and privacy by design.

Children Personal Information

Some of Xenon’s clinical trials involve participants that are children. Xenon will only process a child’s personal data with parental consent, or the consent of a legal representative, and in accordance with the laws where the clinical trial is being conducted.

Complaints

When contacting Xenon regarding any issue, please do not include any personal information (other than your contact information) or health information in the subject line or in the content of your message.

Clinical Trial Participants in Serbia may contact our Data Protection Office with complaints regarding this Privacy Notice and Xenon’s processing of Personal Data:

Data Protection Office
3650 Gilmore Way
Burnaby, British Columbia
Canada V5G 4W8
E: dpo@xenon-pharma.com

Or our Data Representative in Serbia (at the contact details provided above).

Xenon will reply to complaints within 30 calendar days of their receipt and will attempt resolution in accordance with this Privacy Notice.

You may lodge a complaint with the Serbian data protection authority.

Last updated: July 13, 2026