A. Purpose and Basis of Personal Information Collection

Purpose. The Foundations collects your personal information for the purpose of maintaining a registry of patients affected by Autosomal Recessive Spastic Ataxia of Charlevoix-Saguenay (hereafter “ARSACS”).

The registry allows the Foundation to:

• promote and encourage research regarding ARSACS
• inform by email those in the registry of opportunities to participate in research on ARSACS
• collect survey information of individuals diagnosed with ARSACS in order to formulate market evaluations that may be provided to pharmaceutical companies in an anonymized form.

In the future, the Foundation may also use this information for other purposes compatible with the ones described above.

Basis. The collection, use, and disclosure of this personal information is based on your consent to the conditions described in this policy, which the registration reform requires you to explicitly accept.

B. Use, Disclosure, and Storage of Personal Information

Your personal information is only accessible, within the Foundation, to the registry administrator. The registry administrator will contact you once per year to ensure that your information is up to date.

Storage. Your personal information will be stored in an encrypted form in a database situated in Montreal. Encrypted backup copies of this data will be held in a storage service in the United States provided by Dropbox Inc. This service is a certified participant in the EU-U.S. Privacy Shield Framework which the European Commission has approved as ensuring an adequate level of protection to justify the transfer of personal information to the United States.

Encryption. Personal information submitted to the registry is encrypted in transit using the HTTPS protocol. Personal information held in the registry is encrypted at rest.

Statistics. The Foundation will aggregate and anonymize information in the registry and will use these statistics in public awareness campaigns, as well as campaigns targeting companies, notably regarding the market that may exist for, among other things, treatment and diagnostics relevant to ARSACS.

Third parties. To carry out maintenance, hosting, and development of the registry, the Foundation will allow certain third-party service providers to access the unencrypted contents of the registry. Such access will be limited to what is necessary for these purposes, and the information will be neither used, nor stored, nor disclosed by these third parties for any other purpose.

Disclosure. The Foundation will not disclose personal information in the registry for any purpose other than those set out elsewhere in this policy.

Retention. The personal information in the registry will be retained until the person concerned withdraws their consent or until research and awareness regarding ARSACS are no longer necessary. At this time, the relevant information will be destroyed, erased, or anonymized. All of the copies of the relevant information in the possession of the Foundation will then be erased in accordance with industry best practices.

C. Your Rights Under This Policy

Access. You have the right to receive, on request, a copy of your personal information from the Foundation in a machine-readable format.

Rectification. You have the right to ask that your personal information be rectified to correct any inaccuracy that it may contain.

Withdrawal. You have the right to withdraw your consent to the processing of your personal information at any time, subject to a reasonable delay and to any legal or contractual restriction binding the Foundation. You are in no way obligated to consent to the Foundation’s collection of your personal information, but without your consent, your information will not contribute to the registry’s purpose and the Foundation will no longer be able to send you relevant information by email.

Objection. You have the right to object to the processing of your personal information, in the case that someone else has consented to this processing on your behalf.

Erasure. You have the right to obtain the erasure of your personal information in the situations provided for by law.

Complaints. You have the right to complain to the registry administrator or to the Commission d’accès à l’information regarding the processing of your personal information.

D. Contacting the Foundation

The registry administrator receives all inquiries and complaints, and is generally responsible for this policy. Please write to: administrator@arsacs.com

The Foundation’s mailing address is:

Fondation de l’Ataxie Charlevoix-Saguenay
1000 Sherbrooke West, suite 2100
Montréal (Québec) H3A 3G4