Privacy Policy

TREND Community Privacy Policy

Welcome to the www.trend.community website and its associated research and support community platform, which is operated by TREND Community PBC (“TREND,” “we,” “us,” “our”). TREND is a digital health analytics company that was founded by parents who understand the needs of other parents and community members dealing with rare and underserved diseases. As parents of a child with a rare disease (Prader-Willi syndrome) who share very personal information on social media about our journey as caregivers, we truly understand your concerns about privacy. Our mission is to inspire solutions that accelerate treatment discovery and improve the quality of life for those of us living with or caring for those with rare and underserved diseases by listening to communities and uniting stakeholders around them.

First and most importantly, the purpose of our analyses is to shed light on the prominent burdens and pressing unmet needs of your community. Most rare diseases have no cure and only limited treatment options. One of the significant challenges that innovators encounter is the lack of data about these diseases. Although there is a wealth of existing anecdotal information shared by patients and caregivers in their conversations on social media, it can be difficult to extract these meaningful insights from such vast amounts of data.

TREND uses social media analytics1 to analyze years of conversations shared within social networks to quantify disease burden, disease management strategies, and unmet community needs. TREND uses such data to enable analysis by, and to create reports for, all of its stakeholders.

This TREND Community Privacy Policy describes how TREND collects, uses, and discloses information about you in connection with its www.trend.community website and in connection with certain social media user groups in which you might participate (collectively, the “Sites”).

By accessing and using the Sites, you consent to our collection, use, and sharing of information as described below.

1. What Information Does TREND Collect Through the Sites?

(a) Information You Provide to Us

Personal Information. We may ask you to provide us with, you might submit via the Sites, or you might opt-in to our ability to access through social media channels your personally identifiable information, such as your first and last name, mailing address, telephone number, and email address (“Personal Information”). We may collect this Personal Information through various forms and in various places through the Sites, including account registration forms, “Contact Us” forms, or when you otherwise upload data to and interact with the Sites.

¹Social media analytics is the process of gathering and analyzing data from social networks. Gohar F. Khan and Marshall Sponder define it as “the art and science of extracting valuable hidden insights from vast amounts of semi- structured and unstructured social media data to enable informed and insightful decision-making” in Digital Analytics for Marketing (Copyright ©2018; Routledge).

In addition, we may collect sensitive personal information (e.g., ethnicity, age, geographic location); this information is not collected for, nor is it used for, any discriminatory purposes. You do not have to answer any question or submit any sensitive information if you are not comfortable.

(b) Information Collected From Social Media Platforms

TREND’s social media analytics begins with the data obtained through social media community groups. The specific types of data TREND collects, and how TREND uses that data, depend on the social media network from which it originated.

Facebook

At TREND, we gather information from Facebook groups in a way that prioritizes your privacy. Here is how it works:

Permission and Partnership

When we collaborate with Facebook group administrators to collect data to perform various analyses, we ensure transparency and accountability. Group administrators are encouraged to make a clear announcement within the group about our partnership. This message is usually pinned to the top of the group feed for at least two (2) weeks. It explains why we are partnering with the group and includes a link for members to learn more about TREND.

Administrators and their groups who wish to participate need to install the TREND Share productivity app via the Group apps dialog in the Group settings area of their Facebook group. They must also review and accept our Terms of Use and Privacy Policy through the TREND Share web application. This grants TREND permission to analyze the content of anonymized group conversations.

Ways We Collect User Data

There are two ways TREND will collect user-level data:

1. Logging into the TREND Share web application
2. A group member enabling author access directly from a specific Facebook group and accessing the installed TREND Share application

Unless a group member enables author access (option 2 above), TREND does not collect user IDs or connect any post or comment to a specific member within the group.

Information We Collect

From Facebook groups, we collect:

• The group name and description
• The group member count
• The group banner photo
• The group privacy level
• A randomly assigned ID for each post and comment, as well as the randomly assigned ID of a parent post and parent comment. These IDs are random, arbitrary, and not associated with the person who posted or their Facebook profile
• Information about the timing of the post or comment
• The contents of the post or comment
• The type of post (i.e., status, photo, video, link, or event)
• Whether a link exists in a post
• Information about the number of Facebook reactions
• The number of comments on a post
• The number of reactions

For Facebook group members who grant author access, we collect:

• Their name and profile picture
• Authored posts and comments of the member, through their Facebook user ID

NOTE: This access needs to be granted on a per-group basis. Granting author access in one group does not enable us to collect information about the same user in another group.

When a user logs in via the web application, we collect their:

• Facebook ID
• Name
• Email (if provided by Facebook)
• Picture
• Facebook group IDs for which the user is a member and/or administrator

Respecting Privacy

We use only anonymized text from the Facebook group posts or comments for group members who have not granted author information access. To further preserve the anonymity of any such person whose name is mentioned in a post or comment, TREND uses an automated process that attempts to identify the names and remove them from the data pool before they are analyzed.

Data Use

The information TREND collects from Facebook may be used to develop the following:

• The TREND Share application
• Community Voice Reports
• Data Exploration Reports
• Community Impact Reports
• Posts on the website’s “News” page
• Other reports, posters, articles, etc., as necessary

Interviews

TREND also gathers information through one-on-one interviews with patients and/or caregivers, which are conducted in person or by videoconference. TREND shares this information only if the patient and/or caregiver give(s) their consent. TREND may use the information from these interviews to:

• Create Patient Story Posters, which can be displayed in the corporate office, at conferences, or at other venues to raise awareness for the community
• Gather quotes, which are anonymized
• Develop Community Impact Reports
• Create posts on the Sites’ “News” pages
• Develop other reports, as necessary

Reddit

TREND also reviews public content on Reddit for information about diseases. The information that TREND collects from Reddit includes the following:

• The content of posts and comments
• The author ID of the posts or comments
• Information about the order in which the posts or comments were made
• Information about the timing of the post or comment
• The public link to the conversation online to share with researchers should they want to read the conversation in its original form
• The number of comments on a post

The information TREND collects from Reddit may be used to develop the following:

• Community Voice Reports
• Data Exploration Reports
• Community Impact Reports
• Posts on the website’s “News” page
• Other reports, as necessary

Other Forms of Data Collection

TREND also collects data from email listservs and other closed discussion groups where the participants know of and consent to TREND’s data collection. TREND’s process for collecting data through email listservs and closed discussion groups is similar to the process described above for Facebook [Link to Section]. The remainder of TREND’s data sources are public platforms, such as Reddit. TREND can only access these data if they are public.

(c) Information Collected or Stored As You Access and Use the Sites

In addition to any Personal Information or other information that you choose to submit to us via the Sites, we and our third-party service providers (such as a Site technology platform host) may use a variety of technologies that automatically (or passively) store or collect certain information whenever you visit or interact with the Sites (“Usage Information”). This Usage Information may be stored or accessed using a variety of technologies that may be downloaded to your personal computer, browser, laptop, tablet, mobile phone, or other device (a “Device”) whenever you visit or interact with the Sites. To the extent we associate Usage Information with Personal Information we collect directly from you via the Sites, we will treat it as Personal Information.

Usage Information may include:

• • Your IP address, Unique Device Identifier (UDID), or other unique identifier (“Device Identifier”). A Device Identifier is a number that is automatically assigned to your Device that is used to access the Sites; our computers identify your Device by its Device Identifier
  • Your Device functionality (including browser, operating system, hardware, and mobile network information)
  • The URL that referred you to the Sites
  • The areas within the Sites that you visit and your activities there, including remembering you and your preferences
  • Your Device location
  • Your Device characteristics
  • Certain other Device data, including the time of day

Tracking Technologies. We may use various methods and technologies to store or collect Usage Information (“Tracking Technologies”). Tracking Technologies may set, change, alter, or modify settings or configurations on your Device. A few of the Tracking Technologies include, without limitation, the following (and subsequent technology and methods later developed):

• Cookies. A cookie is a small piece of data (text file) that a website—when visited by a user— asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and are called first- party cookies. We also use third-party cookies—cookies from a domain different from the domain of the website you are visiting—for our advertising and marketing efforts.
•  
• Web Beacons. Small graphic images or other web programming code called web beacons (also known as “1×1 GIFs” or “clear GIFs”) may be included in the Sites’ pages and messages. Web beacons may be invisible to you, but any electronic image or other web programming code inserted into a page or email can act as a web beacon. Web beacons or similar technologies may be used for a number of purposes, including, without limitation, to count visitors of the Sites, to monitor how users navigate the Sites, to count how many emails that were sent were actually opened, or to count how many particular articles or links were actually viewed.

Tracking Technologies Usage. We may use Tracking Technologies for a variety of purposes, including to allow you to use and access the Sites, including cookies required to prevent fraudulent activity and improve security; as part of our analytic practices or otherwise to improve the content, products, or services offered through the Sites; and to understand the usefulness to you of the content that has been delivered to you.

(c) Information Third Parties Provide About You

We may, from time to time, supplement the information we collect directly from you on the Sites with outside records from third parties for various purposes, including to enhance our ability to serve you, tailor our content to you, and offer opportunities that may be of interest to you. To the extent that we combine information we receive from those sources with your Personal Information we collect via the Sites, it will be treated as Personal Information; we will apply this Privacy Policy to such combined information, unless we have disclosed otherwise. In no other circumstances do our statements under this Privacy Policy apply to information we receive about you from third parties, even if they have used our technology to collect it and share it with us.

(d) Interactions With Third-Party Services

The Sites include functionality that allows certain kinds of interactions between the Sites and a third- party application. The use of this functionality may involve the third-party operator providing certain information, including Personal Information, to us. For example, when you register with the Sites, you may have an option to use your Facebook, Google, or other account provided by a third-party site or application to facilitate the registration and login or transaction process on the Sites, or otherwise link accounts. If we offer and you choose to use this functionality to access or use the Sites, the third-party site or application may send Personal Information about you to us. If so, we will then treat it as Personal Information under this Privacy Policy, since we are collecting it as a result of your access of and interaction with and in relation to the Sites.

2. How Do We Use the Information Collected?

We may use the Personal Information or Usage Information that we collect about you (1) to determine whether you meet the criteria for a specific Site; (2) to communicate with you regarding your participation in a Site; (3) to provide you with information or services or to process transactions that you have requested or agreed to receive; (4) to enable you to participate in a variety of the Sites’ features; (5) to process your account inquiry, including verifying that your information is active and valid; (6) to improve the Sites, create new service offerings, customize your experience in the Sites, or serve you specific content that is most relevant to you; (7) to contact you with regard to your participation in the Sites and, at our discretion, changes to the Sites and/or any of the Sites’ policies; (8) for internal business purposes; and (9) for purposes disclosed at the time you provide your information or as otherwise set forth in this Privacy Policy.

3. How and When Do We Share Information With Third Parties?

We will not share Personal Information with third parties for direct marketing purposes. TREND may, however, combine and include in reports for Site members any of the content you submit to the Sites, including quotes and community activity participation information. We may share non– Personal Information, such as aggregated user statistics and browsing behavior information, with third parties, including (a) in analytics reports to help companies, doctors, medical researchers, and each other better understand Site participants’ interests; (b) within its findings in peer-reviewed journals, which may be co-authored by our partners and/or clients; (c) in findings presented at scientific and patient advocacy conferences; and (d) posting the findings on the Sites’ “News” page. TREND compiles these findings by gathering information from Community Voice Reports, data explorations, interviews, focus groups, and surveys.

We may share the information we have collected, including Personal Information, as disclosed at the time you provide the information and as described below or otherwise in this Privacy Policy.

TREND may also disclose Personal Information as follows:

(a) Third Parties Providing Services on Our Behalf

We use third-party vendors to perform certain services, such as hosting the Sites (e.g., Slack or Discord), designing and/or operating the Sites’ features, tracking the Sites’ activities and analytics, and us sending you special offers or performing other administrative services. We may provide these vendors with access to user information, including Device Identifiers and Personal Information, to carry out the services they are performing for you or for us. Third-party analytics and other service providers may set and access their own Tracking Technologies on your Device, and they may otherwise collect or have access to Personal Information. We are not responsible for those third-party technologies or activities arising out of them, nor are we responsible for the effectiveness of or compliance with any third parties’ opt-out options.

(b) To Protect the Rights of TREND and Others

To the fullest extent permitted by applicable law, we may also disclose Personal Information if we believe in good faith that doing so is necessary or appropriate to (i) protect or defend the rights, safety, or property of TREND or third parties (including through the enforcement of this Privacy Policy, our Terms of Use, the User Agreement, and/or other applicable agreements and policies); or (ii) comply with legal and regulatory obligations (e.g., pursuant to law enforcement inquiries, subpoenas, or court orders). To the fullest extent permitted by applicable law, we have complete discretion in electing to make or not make such disclosures, and to contest or not contest requests for such disclosures, all without notice to you.

(c) Affiliates and Business Transfer

We reserve the right to disclose and transfer all such information (i) to a subsequent owner, co-owner, or operator of the Sites or applicable database; or (ii) in connection with a merger, consolidation, restructuring, sale of substantially all of our interests and/or assets, or other corporate change, including during the course of any due diligence process.

If TREND would like to use your information or content for any purpose other than those set forth in this Privacy Policy, we will ask for your explicit consent before doing so.

4. What About Information I Post or Disclose to Others?

Social media sites and platforms permit you to post ideas, photographs, user profiles, writings, music, video, streamed and recorded audio content, computer graphics, pictures, data, questions, comments, suggestions, or other content, including Personal Information (collectively, “User Content”), included as part of your profile. Examples of this would be photographs or videos that you post illustrating changes in your condition.

Others may have access to this User Content and may have the ability to share it with third parties. For example, if you upload images to an online community forum and want to keep your location private, you should consider avoiding uploading images with embedded location data (EXIF GPS). Other community members can download and extract any location data from posted images. Please think carefully before deciding what information you share, including Personal Information. TREND cannot control who will have access to the information that you choose to post, and we cannot ensure that those who have access to such publicly available information will respect your privacy or keep it secure.

Your User Content is posted and transmitted to others at your own risk, as we cannot and do not guarantee that your User Content will not be viewed by unauthorized persons.

5. Do Links to Third-Party Content Appear Within the Sites?

Site postings from time to time may link to third-party web pages. If you “click” on such a link, you will be redirected from a Site to a different website. These other sites may independently collect data about you or others, including Personal Information, and may or may not have their own published privacy policies. We are not responsible for the privacy practices of the operators of other such websites. We encourage you to note when you leave the Sites, review the third-party privacy policies of all third-party websites, and exercise caution in connection with the third-party websites.

6. How Do I Change My Information and Communications Preferences?

You are responsible for maintaining the accuracy of the information you submit to us, such as your contact information provided as part of registration. The Sites may allow you to review, correct, or update Personal Information you have provided through the Sites’ registration forms or otherwise, and you may provide registration updates and changes by contacting us. If so, we will make good faith efforts to make requested changes in our then-active databases as soon as reasonably practicable. Please note that it is not always possible to completely remove or delete all of your information from our databases, and that residual data may remain on backup media or for other reasons. When you edit your Personal Information or change your preferences on the Sites, the information you remove may persist internally for TREND’s administrative purposes. We reserve the right to send you certain communications relating to your account or use of the Sites, such as administrative and service announcements, and these transactional account messages may be unaffected if you choose to opt-out from receiving our marketing communications. If you have any

questions about this Privacy Policy or practices described in it, you should contact us in the following ways: mail: TREND Community PBC, 30 S 15th St., Suite 700, Philadelphia, PA 19102; phone: 267.253.6545; or email: privacy@trend.community.

7. What About Transfer of Information to the United States?

The www.trend.community website is operated in the United States. If you are located outside the United States, please be aware that information we collect, including Personal Information, will be transferred to, processed, stored, and used in the United States. The data protection laws in the United States may differ from those of the country in which you are located, and your Personal Information may be subject to access requests from governments, courts, or law enforcement in the United States according to U.S. law. By using the Sites or providing us with any information, you consent to the transfer to and processing, usage, sharing, and storage of your information, including Personal Information, with the United States as set forth in this Privacy Policy.

8. European Union General Data Protection Regulation

If you are a European Union resident or are otherwise a data subject covered by the European Union’s General Data Protection Regulation (GDPR) or similar laws in other countries, you may have certain rights with regard to your personal information.

Legal Basis for the Processing of Personal Data

TREND seeks to avoid collecting personal data and generally collects only deidentified data which cannot be reconnected to the data subject.

In those instances in which TREND does collect personal data, TREND processes those personal data only pursuant to the following legal basis:

• Prior consent is given;
• To fulfill contractual obligations; or
• Legitimate interests of TREND or third parties.

In cases where TREND relies on legitimate interests for the processing of personal data, those interests are described in this policy under the relevant headings.

Data Processing Outside the European Union/European Economic Area

All data gathered by TREND, including European data, are entered into a cloud-based platform run by a U.S.-based company.

European Union Data Subject Rights Pursuant to GDPR

Under the GDPR, you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Information TREND holds about you and to check that TREND is lawfully processing it.

• Request correction of the Personal Information that TREND holds about you. This enables you to have any incomplete or inaccurate data TREND holds about you corrected, although TREND may need to verify the accuracy of the new data you provide.
• Request erasure of your Personal Information. This enables you to ask TREND to delete or remove Personal Information where there is no good reason to continue processing it. You may also have the right to ask TREND to delete or remove your Personal Information where you have successfully exercised your right to object to processing (see below), where TREND may have processed your information unlawfully, or where TREND is required to erase your Personal Information to comply with local law. Note, however, that TREND may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your Personal Information where TREND is relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts your fundamental rights and freedoms. You also may have the right to object in situations where TREND is processing your Personal Information for direct marketing purposes. In some cases, TREND may demonstrate that it has compelling, legitimate grounds to process your information that override your rights and freedoms.
• Request restriction of processing of your Personal Information. This enables you to ask TREND to suspend the processing of your Personal Information in the following scenarios:

(a) if you want TREND to establish the data’s accuracy; (b) where TREND’s use of the data is unlawful but you do not want TREND to erase them; (c) where you need TREND to hold the data even if TREND no longer requires them as you need to establish, exercise, or defend legal claims; or (d) you have objected to TREND’s use of your data but TREND needs to verify whether it has overriding legitimate grounds to use them.

• Request the transfer of your Personal Information to you or to a third party (“Data Portability”). This enables you, or a third party you have chosen, to seek to have your Personal Information provided in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for TREND to use or where TREND used the information to perform a contract with you.
• Withdraw consent at any time in which TREND is relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, TREND may not be able to provide certain products or services to you. TREND will advise you if this is the case at the time you withdraw your consent.
• Submit a complaint to a data protection supervisory authority about the processing of personal data by TREND. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.

You will not have to pay a fee to exercise any of these rights. However, TREND may charge a reasonable fee or may refuse to comply with your request if your request is repetitive or excessive. Further, TREND may not accommodate a request to access, change, or delete information if, for example:

• There is insufficient information to confirm the individual’s identity
• TREND believes that doing so would violate a law, professional privilege, or other legal obligation
• It would cause the information to be incorrect
• Doing so would reveal TREND’s confidential commercial information
• The burden or expense of providing access would be disproportionate to the risks to your privacy in that instance
• The rights or important interests of others would be violated
• It is likely to interfere with the safeguarding of important countervailing public interests (i.e., national security, defense, or public security)
• The Personal Information is being processed solely for research or statistical purposes
• It would interfere with the execution of enforcement of the law or with private causes of action, including the prevention, investigation, or detection of offenses or the right to a fair trial
• It would prejudice the confidentiality necessary for monitoring, inspection, or performance of regulatory functions connected with sound management, or in future or ongoing negotiations
• It would prejudice employee security investigations or grievance proceedings or in connection with employee succession planning and corporate reorganizations
• The individual is participating in a “blinded” study
• The information is public record information and is not combined with other Personal Information
• TREND is not legally obligated to so

Please note that much of the data TREND collects are deidentified, making it non–Personal Information. Therefore, TREND may not have a way of linking those data back to you. As a consequence, TREND may not be able to provide access to, correct, or delete your data, as TREND may not be able to know whether they are actually your data.

You may also access or correct your privacy preferences by sending TREND an email with your name, address, and email address (if different from the one you use to contact us) at privacy@trend.community.

TREND tries to respond to all legitimate requests in a timely manner. Occasionally, it may take TREND longer if your request is particularly complex or you have made a number of requests. In this case, TREND will notify you and keep you updated. TREND may also need to contact you about your request to verify your identity, confirm certain information, or clarify the request before TREND can fulfill it.

If you are a European Union resident or are otherwise a data subject covered by GDPR or a similar law and you would like to exercise these rights, or if you have questions about your rights, please contact TREND at privacy@trend.community or use TREND’s contact details listed above.

9. What Should Parents Know About Children?

We understand the importance of protecting children’s privacy in the interactive world. We are a general audience service and do not use the Sites to knowingly collect Personal Information from children under the age of thirteen (13) years that requires parental notice and consent under the Children’s Online Privacy Protection Act (“COPPA”) without such parental consent. If you are a child under 13 years of age, you are not permitted to use the Sites and should not send any information about yourself to us through the Sites.

In the event that we become aware that we have collected personal information from a child, we will dispose of that information in accordance with COPPA and other applicable laws and regulations. If you are a parent or guardian and you believe that your child under the age of 13 years has provided us with personal information without COPPA-required consent, please contact us as indicated previously.

10. What About Security?

We endeavor to incorporate commercially reasonable safeguards to help protect and secure Personal Information. However, no data transmission over the internet, mobile networks, wireless transmission, or electronic storage of information can be guaranteed to be 100% secure. Please note that we cannot ensure the security of any information you transmit to us, and you use the Sites and provide us with your information at your own risk.

11. What About Changes to the Privacy Policy?

We reserve the right to change this Privacy Policy at any time. Any changes will be effective immediately upon the posting of the revised Privacy Policy, and your use of the Sites indicates your consent to the privacy policy posted at the time of use. However, we will not use your previously collected Personal Information in a manner that is materially different from that represented at the time it was collected without your consent. To the extent that any provision of this Privacy Policy is found by a competent tribunal to be invalid or unenforceable, such provision shall be severed to the extent necessary for the remainder to be valid and enforceable.