Helios Clinical Research

Privacy Policy and Research Participant Privacy Notice

Published Revision: September 24, 2026

Introduction

Helios Clinical Research (“Helios,” “we,” “us,” or “our”) conducts and supports clinical research. This policy explains how we collect, use, disclose, and retain personal information when you visit our websites, submit a study inquiry, complete a pre-screening questionnaire, communicate with us, or participate in our programs and research activities.

This policy provides general information about our privacy practices. It does not replace a study’s informed consent form, a HIPAA authorization, or an applicable HIPAA Notice of Privacy Practices which may be collected by a third party. Those documents provide additional information about the particular study or services. This policy does not limit rights provided by law or authorize a use or disclosure that would otherwise require your consent or authorization.

Visiting a website or acknowledging this policy does not, by itself, provide consent to participate in research or authorize the use or disclosure of protected health information.

1. Information We Collect

We may collect information directly from you, automatically through your device, from partnered healthcare providers, research partners, and other authorized third parties.

Information You Provide Directly

You may provide information when you:

• Complete study pre-screening questionnaires
• Express interest in research opportunities
• Participate in a clinical trial
• Contact Helios by phone, email, SMS, website forms, or other communication channels
• Register for educational programs, events, or newsletters

Information collected may include:

Personal Information to include contact information

• Name
• Date of birth
• Mailing address
• Email address
• Telephone number
• Emergency contact information

Health Related Information

• Medical history
• Diagnoses and conditions
• Current and previous medications
• Treatment history
• Laboratory and diagnostic information
• Study eligibility responses
• Insurance information when applicable

Demographic Information

• Gender
• Race and ethnicity (when voluntarily provided)
• Language preferences

Communication Preferences

• Preferred methods of communication
• Participation and outreach preferences

Information Collected Automatically

When you visit our websites, we may automatically collect:

• IP address
• Device identifiers
• Browser information
• Operating system
• Website activity and usage information
• Pages visited
• Referral sources
• Session information

See Section 11 for information about cookies, similar technologies, and your choices.

Information Received from Third Parties

Where permitted by applicable law, including under your consent or authorization when required, we may receive information from:

• Healthcare providers and physicians
• Electronic Medical Record (EMR) systems
• Healthcare organizations participating in approved research activities
• Research sponsors
• Contract Research Organizations (CROs)
• Institutional Review Boards (IRBs)
• Recruitment partners
• Referral networks and physician partners
• Publicly available sources

Online Forms and Study Interest Submissions

Authorized Helios personnel may review information you submit through website forms, pre-screening questionnaires, study interest forms, event registrations, referral forms, and similar online tools. We use this information to assess potential study eligibility and respond to your inquiry. Additional research outreach, educational communications, and event information are subject to your communication preferences and any consent required by law. Submitting an inquiry does not enroll you in a study.

Information submitted through these forms may be entered into authorized research, operational, and participant engagement systems for follow-up, scheduling, study matching, regulatory compliance, and communication purposes.

 

2. How We Use Information

We use information for legitimate research, operational, compliance, and communication purposes.

Clinical Research Activities

• Determining study eligibility
• Conducting participant outreach
• Managing study participation
• Scheduling study visits
• Coordinating research activities
• Maintaining study records
• Supporting participant engagement

Research Operations

• Quality assurance and quality improvement
• Compliance monitoring
• Workforce training
• Internal auditing
• Operational management

Regulatory Compliance

• Compliance with FDA requirements
• Compliance with GCP standards
• Compliance with sponsor obligations
• Compliance with IRB requirements
• Compliance with federal and state laws

Communications

• Responding to inquiries
• Providing study-related updates
• Sharing educational materials
• Supporting participant engagement activities

Website Administration

• Website security
• Analytics and performance monitoring
• User experience improvements

3. How We Disclose Information

We disclose information only for the purposes described in this policy or otherwise permitted by law, subject to applicable consent, authorization, and confidentiality requirements.

Research and Care Recipients

Depending on the study and your involvement, relevant contact, demographic, eligibility, and health information may be disclosed to investigators, research coordinators, study sponsors, contract research organizations, Institutional Review Boards (IRBs), healthcare providers, and regulatory authorities. The information each recipient receives depends on its role, the study documents, and the applicable legal basis. Study-specific materials explain relevant research disclosures in greater detail.

Service Providers

Service providers support functions such as hosting, data storage, website operation, research technology, electronic data capture, scheduling, and communications. Depending on their services, they may process contact details, communication preferences, website information, or research and health information on our behalf.

Helios uses HubSpot for customer relationship management, study inquiries, participant engagement, communications, and related workflows. The safeguards and contractual requirements applicable to a particular service depend on the information processed and the service used. A provider’s security certification does not by itself establish that every Helios workflow is suitable for protected health information.

Legal and Safety Disclosures

We may disclose relevant information as required or permitted by law, including to respond to valid legal process, meet regulatory reporting obligations, report adverse events, protect participant or public safety, and address fraud or unauthorized activity. These disclosures remain subject to applicable health-information confidentiality protections.

Helios does not sell patient information.

4. Health Information and HIPAA

We may receive, create, or maintain health-related information in connection with study inquiries and research activities. The protections that apply depend on the entity handling the information, the activity, the information involved, and applicable law.

Where Helios acts as a HIPAA covered entity or business associate, the applicable HIPAA requirements govern its handling of protected health information.

This policy is not a HIPAA Notice of Privacy Practices. You may contact the Privacy Officer for help identifying which notice and request process apply to your information.

5 Consent Authorization and Your Choices

We obtain consent or authorization where required by applicable law. Depending on the circumstances, a use or disclosure may instead be permitted or required by law, including under an applicable research waiver. We do not treat acceptance of this policy as a substitute for a required consent or authorization.

You may withdraw consent to future processing where applicable by contacting Helios. To revoke a HIPAA authorization, follow the instructions in that authorization or submit a written request to Helios. Revocation does not undo actions already taken in lawful reliance on the authorization. See Section 8 for information about records already collected in research.

Communications

You may ask us to update your communication preferences using the contact information in Section 15. You may also use an unsubscribe mechanism included in an email. Opting out of optional recruitment or promotional communications does not itself withdraw you from an enrolled study or require deletion of records that must be retained. Contact your study team to discuss withdrawal or essential study and safety communications. For opting out of SMS messaging, please reply with STOP, and also contact Helios to ensure your information has been updated in real time within the clinical trial management system if you taken part in a study or currently participating.

6. Privacy Requests and Appeals

Depending on your location, the information involved, and applicable law, you may have rights to:

• Confirm whether we process your personal information and request access to it.
• Request correction of inaccurate information.
• Request deletion, subject to applicable exceptions.
• Obtain a portable copy of information where required.
• Withdraw consent to processing that depends on consent.
• Opt out of covered sales, advertising sharing, targeted advertising, or certain profiling activities.
• Limit certain uses or disclosures of sensitive personal information where that right applies.
• Appeal a decision about a privacy request where provided by law.

How to Submit a Request

Email info@heliosclinical.com, or call 214-550-3029.,. Explain your request and provide enough information for us to locate the relevant records. Please do not send medical records, identification documents, or other sensitive information in an initial ordinary email; we can arrange an appropriate follow-up method if necessary.

We may request information reasonably necessary to verify your identity and protect against unauthorized access, correction, or deletion. Verification requirements depend on the request and applicable law. We do not require identity verification for an opt-out where the law prohibits it, and you do not need to create an account to submit a request.

Where permitted by law, an authorized agent may submit a request on your behalf. We may need evidence of the agent’s authority and may verify your identity as permitted by law. Parents, guardians, and other legally authorized representatives may contact us regarding information they are legally entitled to manage.

Responses and Appeals

We respond within the period required by the law governing your request. Deadlines differ by the type of request and applicable law. If a permitted extension is needed, we will notify you within the required period and explain the reason. Requests are free of charge except where a fee is expressly permitted by law; we will explain any proposed fee before proceeding.

If we deny all or part of a request, we will explain the reason, subject to legal restrictions. Where an appeal is available, email the Privacy Officer with the subject “Privacy Request Appeal,” or call or write using the same contact details. Include the original request and the reason you believe the decision should be reconsidered. We will respond within the applicable appeal period and, where required, explain how to contact the relevant regulator if an appeal is denied.

We will not unlawfully discriminate or retaliate against you for exercising privacy rights.

7. State Privacy and Consumer Health Data Rights

State privacy protections depend on your location, the entity handling your information, the activity, and any applicable exemptions. A research or health-information exemption applies only when its legal conditions are met; it does not automatically apply to all website activity or recruitment information.

California Residents

Where the California Consumer Privacy Act applies, you may have rights to know, access, correct, delete, and obtain information about our collection and disclosure practices; opt out of sale or sharing for cross-context behavioral advertising; and limit certain uses or disclosures of sensitive personal information. You also have the right not to be unlawfully discriminated against for exercising these rights. Not every sensitive-information use triggers a right to limit.

Section 1 describes information categories and sources, Section 2 describes purposes, Section 3 describes recipients, and Section 10 describes retention criteria. Use Section 6 to submit requests or act through an authorized agent.

Consumer Health Data

Where consumer health privacy laws apply, you may have additional rights concerning access, deletion, consent withdrawal, and disclosures of consumer health data. These rights may include information about recipients of your health data. Contact the Privacy Officer using Section 6 to make a request.

8. Research Participation Withdrawal and Study Records

Participation in research is governed by the study’s informed consent process and applicable law. Contact your study team if you want to stop participating or have questions about continued follow-up.

Withdrawing from a study, withdrawing consent to optional communications, revoking a health-information authorization, and requesting deletion are different actions. Please tell us which action you want to take so we can direct your request appropriately.

Data already collected in an FDA-regulated study generally must remain part of the study record. Where permitted by applicable law, previously collected information may continue to be used or disclosed to preserve study integrity, meet regulatory obligations, report safety information, or document withdrawal.

Revocation of a HIPAA authorization does not allow continued collection or disclosure of new information under the revoked authorization merely because earlier information must be retained. Any continued collection, follow-up, or disclosure requires an applicable legal basis.

We evaluate deletion and correction requests under the law governing the records. A sponsor agreement or a general reference to scientific necessity does not by itself override an applicable privacy right. Corrections to regulated records may need to preserve the original entry and an audit trail. Where information must be retained, retention does not automatically authorize continued optional recruitment or marketing use.

9. Data Security and Incident Response

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and loss. Safeguards are selected according to the sensitivity of the information and the systems and activities involved. No method of transmission or storage can be guaranteed completely secure.

We restrict access according to authorized responsibilities. If an incident requires notification under applicable law, we will provide the required notices to affected individuals, authorities, or others as appropriate.

10 Retention of Information

We determine retention based on the type of information, the purpose for which it was collected, applicable legal requirements, and any lawful need to preserve records. We distinguish between:

• Study records: retained for the period required by applicable research and regulatory requirements, taking account of permitted contractual obligations and legal holds.
• Recruitment and pre-screening information: retained according to the purpose of the inquiry, permitted future study matching, your choices, and applicable law. An inquiry is not automatically subject to the same retention period as an enrolled participant’s study record.
• Communication preferences: retained as needed to administer preferences, document required consent, and honor opt-out requests. A limited suppression record may be needed to avoid contacting someone who has opted out.
• Website and technical information: retained according to the relevant security, functionality, analytics, or other disclosed purpose and applicable law.

A deletion request may be subject to a specific legal exception, which we will explain where required.

11 Cookies Analytics and Advertising Technologies

Our websites may use cookies and similar technologies for website operation, security, preference storage, and performance analytics. These tools may process the device and website-activity information described in Section 1.

You can manage cookies through browser settings. Blocking certain cookies may affect website functions. Browser settings may not control server-side disclosures, information previously collected, or every form of advertising data processing.

A consent banner or privacy-policy statement does not, by itself, authorize disclosure of health information to advertising or analytics providers. Any such processing remains subject to the applicable legal requirements and your choices.

12 Childrens and Adolescents Information

Our general websites are intended for adults, including parents and legal guardians seeking information about pediatric research. Information a parent or guardian provides about a child may be used to respond to a study inquiry and evaluate potential eligibility, subject to applicable law.

Pediatric research participation is handled through the applicable study consent process, including parental or guardian permission and the child’s assent where required. Study permission does not automatically authorize unrelated advertising or online data collection.

Children under 13 should not submit information directly through our general website forms. If you believe a child has submitted information without the required permission, contact Helios. We will assess the circumstances and take appropriate steps under applicable law, including stopping unauthorized collection and deleting improperly collected information where required. Legally required research records are handled separately under Section 8.

13 Changes to This Policy

We may update this policy to reflect changes in our practices or applicable requirements. We will post the revised policy with its updated date. Where required, we will provide additional notice and obtain consent before applying a material change or using information for a new purpose. Posting an updated policy does not by itself supply consent that the law requires.

14 Study Specific Information and Other Notices

Your study documents, the ICF, explain matters such as the information collected for that study, who may review it, applicable confidentiality protections, and the consequences of withdrawal. Ask your study team for a copy or an explanation of those documents.

An applicable HIPAA Notice of Privacy Practices explains the responsible covered entity’s health-information practices and rights-request procedures. A consumer health-data notice may describe additional protections for covered information outside HIPAA. These notices complement this general policy and do not waive or reduce rights provided by law.

For help identifying the notice, study team, or entity responsible for your information, contact Helios.

15 Contact Us

Helios Clinical Research

1307 8th Avenue, Suite 201

Fort Worth, Texas 76104

Privacy Officer

Email: info@heliosclinical.com

Phone: 214-550-3029

Questions, privacy requests, concerns, or complaints may be directed to the Privacy Officer using the contact information above.