Introduction and Scope:

MODAL Clinical is a Software as a Service (SaaS) Study Training and Engagement Portal that is a customizable web-based platform facilitating access, delivery, and monitoring of study-specific training and patient/site engagement services while enhancing effectiveness in clinical trial management (the "Product"). MODAL is a product of Boco Digital Media, LLC, a Syneos Health® company (“we”, “us”).

We license versions of the Product for our business customers (“Customers”) through custom service packages that can include different levels of end-to-end support and experience. When we license the Product to a Customer through a services agreement, we collect, store, use and disclose personal data submitted by the Customer and its respective Users on behalf of and under instructions of such Customer as part of their use of the Product (“Customer Data”). We process such Customer Data as a data processor for the Customer in accordance with the terms of the Customer agreement.

This Privacy Notice does not apply to said processing of Customer Data done on our Customers’ behalf or to the processing done by each Customer as a data controller, which is subject to each Customer’s own privacy notice. If you are a User of the Product through one of our Customers, we suggest that you contact the respective Customer with any questions related to their privacy and data-handling practices. If the Customer provides us with a link to the Customer’s Privacy Policy, it will be made available to you on the Account Activation page as part of the registration process on the Product, and after registration it will also be available on the initial login page and in the footer on all sections in the system once you are logged in.

This Privacy Notice describes our own privacy and data processing practices in respect of personal data relating to users of the Product (collectively, “Users”) that we process independently as part of our management of the Product (“User Data”).

If you are a User (“you”), please read this Privacy Notice carefully and make sure that you fully understand it. The use of the Product is voluntary. You are not legally required to provide us with any personal data. If you do not wish to provide us or our Service Providers (defined below) with your personal data, please avoid any interaction with us or using the Product.

Data Collection & Processing:

When we use the term “personal data” or “personal information” in this Privacy Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include anonymized, aggregated or de-identified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

1. Types of personal data collected. We collect and generate the following types of personal data about Users:

• User information: First and last name; Email address; Site name, number, and PI that user is registered to (where applicable); Country (based in assigned site where applicable); User Role; Date registered; Total number of logins; Last login date; Welcome email date sent; Days since welcome email sent; Date of tasks assigned; Name of tasks assigned, pending, and completed tasks for user; User closeout date; Assigned trainings; Progress and training completion; Training completion certificates; Content and date of communication sent to User; Study event completion dates (where applicable); System Generated User ID (where applicable).

• Account information: names, business email addresses, title, site name or number, country, user role, study title. • Product usage data: IP addresses, device data (like type of operating system, device ID, browser version, locale and language settings used), activity logs, and data generated from your use of the Product (e.g. course registration, completion, feedback, etc.). • Direct interactions and communications with us: personal data contained in communications with Product Users (e.g., for user enablement, support and training purposes).

2. Categories of sources from which personal data is collected. We collect personal data from the following sources:

• Data received directly from you. Some of the personal data we process is received directly from you. For example, where you provide us with your contact details when creating an account with MODAL or submitting a form on our website or in the Product. • Data collected from third parties. We collect personal data from third parties, such as our Customers; for example, we may receive Users’ details from their employer (our Customer) as part of our commercial engagement with them. • Automatically generated data. We also collect personal data that is automatically generated when you access our Product or use the Service, including with the use of cookies and similar data collection technologies (see section 10 of this Privacy Notice for more information).

3. Data Uses.

We use personal data for the following purposes:

- Service delivery. We use personal data to: • provide, operate and improve our business and the services we provide; • communicate with you about the services, including by sending you announcements, updates, security alerts, and support and administrative messages; • communicate with you about events, surveys, questionnaires or webinars in which you participate; • understand your needs and interests, and personalize your experience with our services and communications; • provide support and maintenance for our sites; and • respond to your requests, questions and feedback.

- Research and development. We may also use personal data to analyze and improve our Product, services, and business. As part of these activities, we will create aggregated, de-identified or other anonymous data from personal data we collect.

- Compliance. We may use Personal Data to: • comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities; • protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); • audit our internal processes for compliance with legal and contractual requirements and internal policies; • enforce the terms and conditions that govern our services; and • prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

4. Disclosure to Third Parties

We may share personal data with third parties, as described below. • Affiliates: We may share personal data with our subsidiaries and affiliates for purposes consistent with this notice.

• Companies and people who work for us: We contract with other companies and individuals to help us provide services (“Service Providers”). In order to perform their services, these other companies may have limited access to some of the personal data we maintain about Users. Other companies may collect information on our behalf through their websites or applications. We require that such companies not use your personal data for any purpose other than fulfilling their responsibilities to us. We also require that such companies keep your personal data confidential and comply with applicable laws. Our practice is to (i) conduct reasonable and appropriate due diligence on our Service Providers; and (ii) obtain written commitments regarding the processing of personal data, including that the Service Provider will only handle personal data in accordance with our instructions; adopt adequate technical and organizational measures to protect personal data; and not retain personal data when it is no longer required for completion of its services. Details of Service Providers and the countries in which they are based are available by contacting our Global Privacy and Data Protection Officer (see contact details in section 14 of this Privacy Notice).

• Professional advisors: We may disclose personal data to professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.

• Business transfers: If we transfer a business unit or an asset (such as the Product) to another company, we may transfer the personal data we have collected to the relevant third party.

• Legal requirements: We may be obligated to cooperate with various law enforcement inquiries. We reserve the right to share or transfer your information to comply with a legal requirement, disclose any activities or information about you to law enforcement or other government officials as we, at our sole discretion, determine necessary or appropriate, in connection with an investigation of fraud, for the administration of justice, intellectual property infringements, or other activity that is illegal or may expose us or you to legal liability. We may release information if, in our judgment, the release may be necessary to prevent the death or serious injury of an individual.

5. Legal Basis for Processing Personal Data

In certain jurisdictions, such as the Member States of the European Union, we are required to identify the legal bases for processing personal data. We process personal data: • To comply with a legal obligation; • For our legitimate business interests, which will be assessed in connection with the specific use of personal data; • With your consent (or, where required to process sensitive personal data, with your explicit consent), which will be requested and given via the Product or otherwise.

6. Withdrawal of Consent

In certain jurisdictions, when we process personal data based on your consent or your explicit consent, you have the right to withdraw your consent in whole or in part at any time. Where applicable, once we have received notification that you have withdrawn your consent, we will no longer process the personal data for the purpose(s) to which you originally consented unless there are compelling legitimate grounds that override your interests, rights and freedoms (for example, to comply with a legal obligation), or for the establishment, exercise, or defense of legal claims. The withdrawal of your consent does not affect the lawfulness of such processing that occurred before its withdrawal.

7. Cross-Border Transfers

We operate on a global basis, and your personal data may be transferred, accessed and stored globally as necessary for the uses stated in this notice, or in another notice or agreement provided to you. We have taken measures to protect the confidentiality, integrity, availability, and security of personal data when it is transferred. By using the Product (and if required by law), you consent to the transfer of your personal data to countries outside of your country of residence. It is our practice to enter into appropriate contracts that require recipients to whom we transfer personal data to comply with applicable data protection laws. Where required, we implement standard contractual clauses approved by the relevant regulatory body, including by the European Commission. For a copy of the EU Standard Contractual Clauses, please contact [email protected].

8. Retention and Deletion

We will retain your personal data for as long as your account is active; as needed to provide you access to the Product; as needed for the purposes outlined in this Privacy Notice or at the time of collection; as necessary to comply with our legal obligations (e.g., to honor opt-outs), resolve disputes, and enforce our agreements; or to the extent permitted by law. We do not retain personal data after it no longer serves the purposes for which it was collected or subsequently authorized. At the end of the retention period, we will delete your personal data in a manner designed to ensure that it cannot be reconstructed or read.

9. Protection of Information

The security of your personal data is important to us. We use reasonable physical, electronic, and administrative safeguards that are designed to protect your personal data from loss, misuse and unauthorized access, disclosure, alteration, and destruction. However, regardless of our efforts and the device you use to access the Product, it is possible that third parties may unlawfully intercept or access transmissions or private communications over an unsecured transmission.

10. Cookies and Other Tracking Technologies

The Product and/or third parties may use “cookies,” “web beacons,” scripts, tags, Local Shared Objects (Flash cookies), Local Storage (HTML5) beacons, and other similar tracking technologies (collectively, “Tracking Technologies”) to collect information from you automatically as you use the Product, browse our websites, and the web. These Tracking Technologies help us tailor our content, gather statistics about and understand website and internet usage, improve or customize the content, offerings, or advertisements through the Product, personalize your experience with respect to the Product (for example, to recognize you by name when you return to our website), save your password in password-protected areas, save your online video player settings, help us offer you programs or services that may be of interest to you, deliver relevant advertising, maintain and administer the Product, and for other purposes described in Section 3, " Data Uses" of this Privacy Notice. These Tracking Technologies collect “click stream” data and other information regarding your use of the Product, such as your visits, use of our features and preferences, and may also collect your IP address or some other identifier unique to the device you use to access the Product (“Identifier”). Your Identifier may be automatically assigned to the device you use to access the Product. The Product and/or third parties may also use cookies and similar technologies to recognize you on, off, and across the Product and across your devices. By using the Product, whether as a registered user or otherwise, you acknowledge, understand, and hereby agree that you are giving us your consent to track your activities and your use of the Product through these technologies. - A. Cookies "Cookies" are text files that a website can send to your device through your browser, which are then used to identify your device by the website. Cookies can be both “session level” (stored only until you close your web browser), which help you efficiently navigate our Product during a visit, and “persistent” (stored for a longer period, even after you close your browser), which remember relevant information such as your language preference. The Product may use both session level and persistent cookies. Cookies may also be “first-party cookies,” which are cookies that are placed by the website owner on a website, or “third-party cookies,” which are cookies belonging to one party that are placed on another party’s website. We may use both first- and third- party cookies on the Product. Some of the third-party cookies we use relate to Tracking Technologies we have licensed from third parties, including Adobe Experience Cloud and Google Analytics. These companies use programming code to collect information about your interaction with our sites, such as the pages you visit, the links you click on, and how long you are on our sites. If you would like more information about cookies, including how to manage them, please see  All About Cookies.

- B. Other Tracking Technologies We may also use other technologies to collect information about how our Product is used, tailor our content, gather statistics about and understand website and internet usage, improve or customize the content, offerings or advertisements through the Product, personalize your experience with respect to the Product (for example, to recognize you by name when you return to the portal), save your password in password-protected areas, save your online video player settings, help us offer you programs or services that may be of interest to you, deliver relevant advertising, maintain and administer the Product and for other purposes described in Section 3, "Data Uses." Some examples of these Tracking Technologies include: • "Web beacons" (also known as image tags, gifs or web bugs), including conversion pixels, are small pieces of code used to collect advertising data. They may count page views or help us understand, for example, whether e-mails we send out have been opened or whether certain links have been clicked. • Local Shared Objects (e.g., Flash cookies), and Local Storage (e.g., HTML5) may be used to store content information and preferences. You may manage Flash cookies by clicking . Your browser may offer settings to turn off HTML5. The Product does not recognize automated “do not track” instructions. You can, however, adjust your web browser’s privacy preferences regarding the use of most cookies, through your browser’s privacy settings. Unless you choose to block cookies, some Product pages may issue cookies when you visit them or click on an e-mail link that we send to you, even if you have previously deleted our cookies. If you choose to delete or block cookies, you may impact your user experience on the Product, as some features may no longer work. In addition to deleting or blocking cookies, you may be able to manage cookie preferences with the cookie manufacturer. For example, you can opt out of Google Analytics by downloading and installing a browser plugin available . You can opt out of Adobe Experience Cloud by clicking .

11. Children's Privacy

Services provided through the Product are not intended or designed for use by children. For that reason, we do not knowingly collect or maintain personal information from any person we actually know is under the age of 13. No part of the Product is structured to attract anyone under age 13. If we determine that we have collected information about individuals under the age of 13 (or, in certain jurisdictions, 16) through our Product, we will delete that information.

12. Your Contact Preferences

Once you receive access to the Product, you will receive weekly notifications that are automatically sent when there are new trainings, whether required, optional, re-certifiable that will expire in 30-days, and re-certifiable that have expired. You may also receive communications from Product administrators via the communication hub. You have the ability to opt out of new training notifications that are not required to be completed by clicking on the designated checkbox in your User profile.

13. Your Rights as a Data Subject

In some jurisdictions (for example, the Member States of the European Union) you may be entitled to certain rights in and to your personal data, subject to certain conditions and exceptions contained in applicable law. These rights may include the following: • Request us to confirm whether your personal data is processed by us, and if we do, to obtain access to your personal data and certain information about it. • Require the correction of your personal data if it is inaccurate or incomplete. • Direct us to stop processing your personal data under certain circumstances. • Erase or delete your personal data, for example, where the data is no longer needed to achieve the purpose for which it was collected. • Restrict the further processing of personal data. • Request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (we currently do not engage in such processing and will notify you prior to doing so). • Request to receive your personal data for transmission to, or to directly transmit to, another data controller in a structured, commonly used and machine-readable format. To protect your privacy and the security of your personal data, we will take reasonable steps to verify your identity before complying with such rights requests.

14. Exercising Your Rights or Raising Concerns

Should you have questions about the personal data that we process, or if you have a question, concern, or would like to exercise your legal rights in and to your personal data, please contact us at [email protected]. Alternatively, you can always contact the Syneos Health Global Privacy and Data Protection Officer via e-mail at [email protected] or by post as follows: Attn.: Privacy Office, Syneos Health, 1030 Sync Street, Morrisville, NC 27560, United States of America.

15. How Your Dispute or Complaint May Be Resolved

Any questions, concerns, or complaints regarding the use of your personal data should be directed to the Product support mailbox indicated above or to the Syneos Health Global Privacy and Data Protection Officer using the contact information presented above. If you are located in certain jurisdictions, such as the European Union, you also have the right to raise a complaint about the collection or use of your personal data to your local regulator. For residents of the European Union, you may access the contact information for the Supervisory Authority for the Member State in which you reside by clicking here. For residents of the United Kingdom, you may contact the Information Commissioner’s Office by clicking here.

16. Changes to This Privacy Notice

We may periodically update this notice. When we post changes to this notice, we will also revise the “Last Updated” date appearing at the top of the notice. If there are material changes to this notice, we will notify you by e-mail and/or by means of a notice on our home page. We encourage you to review this notice periodically to be informed of how we are using your information and to be aware of any changes to it. Your continued use of the Product after the posting of any amended notice shall constitute your agreement to be bound by any such changes. Any changes to this notice are effective immediately after we post them.

ANNEX – NOTICE AT COLLECTION FOR CALIFORNIA RESIDENTS

We are required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, (referred to collectively as “CCPA”) to explain to California residents (“Consumers”) our online and offline practices regarding how we collect, use and share their Personal Information, and the rights and choices we offer them regarding our handling of their Personal Information. This annex supplements the above MODAL Privacy Notice and applies to Users who are Consumers under CCPA. Capitalized terms not specifically defined herein shall have the meaning set forth in the CCPA as context requires.

- 1. Categories of Personal Information Collected: We collect the following categories of Personal Information:

• User information: First and last name; Email address; Site name, number, and PI that user is registered to (where applicable); Country (based in assigned site where applicable); User Role; Date registered; Total number of logins; Last login date; Welcome email date sent; Days since welcome email sent; Date of tasks assigned; Name of tasks assigned, pending, and completed tasks for User; User closeout date; Assigned trainings; Progress and training completion; Training completion certificates; Content and date of communication sent to User; Study event completion dates (where applicable); System Generated User ID (where applicable). • Account information: names, business email addresses, title, site name or number, country, User role, study title. • Product usage data: IP addresses, device data (like type of Operating system, device id, browser version, locale and language settings used), activity logs, and data generated from your use of the Product (e.g. course registration, completion, feedback, etc.). • Direct interactions and communications with us: personal data contained in communications with Product Users (e.g., for User enablement, support and training purposes). Sensitive information: We do not collect or use Sensitive Personal Information as defined by CCPA.

2. Purposes for Collection and Use: We collect and use Personal Information for the following purposes:

• Service delivery: to provide, operate and improve our business and the services we provide; communicate with you about the services, including by sending you announcements, updates, security alerts, and support and administrative messages; communicate with you about events, surveys, questionnaires or webinars in which you participate; understand your needs and interests, and personalize your experience with our services and communications; provide support and maintenance for our sites; and respond to your requests, questions and feedback. • Research and development: to analyze and improve our Product, services, and business.  As part of these activities, we will create aggregated, de-identified or other anonymous data from Personal Information we collect. • Compliance: to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities; protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); audit our internal processes for compliance with legal and contractual requirements and internal policies; enforce the terms and conditions that govern our services; and prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

3. Sale or Sharing of Personal Information: We do not knowingly sell or share Personal Information of Consumers.

4. Retention Period: We will retain your personal data for as long as your account is active; as needed to provide you access to the Product; as needed for the purposes outlined in this Privacy Notice or at the time of collection; as necessary to comply with our legal obligations (e.g., to honor opt-outs), resolve disputes, and enforce our agreements; or to the extent permitted by law. We do not retain personal data after it no longer serves the purposes for which it was collected or subsequently authorized. At the end of the retention period, we will delete your personal data in a manner designed to ensure that it cannot be reconstructed or read.

5. Your Rights Concerning Personal Information: California residents may have certain rights in respect of their Personal Information. If you are a California resident, you may exercise such rights via our webform or by calling us at 866-875-1569.

6. Link to Privacy Policy: For more information, please refer to Syneos Health's privacy policy available at https://www.syneoshealth.com/syneos-health-tm-privacy-statement-and-terms-use

Last updated: 2026—v1.0 — April 2026