Cogstate Systems Privacy Policy

Version 3, July 2026

Cogstate Ltd. and all of its affiliates, including its subsidiaries, (collectively, “Cogstate” and throughout this policy referred to as “we”, “us” and “our”) respect your right to privacy and are committed to protecting your Personal Data.

“Personal Data”, as used in this Privacy Policy, is any information from which you can be identified, directly or indirectly, alone or together with other information.

“Cogstate Systems”, includes the various systems that Cogstate uses and provides to support its clinical trial service offering, including but not limited to Cogstate Learning Management System (Cogstate LMS), Cogstate eSource Platform (CeP).

“Artificial Intelligence” or “AI” means computational techniques (including machine learning and generative AI) used to generate content, responses or recommendations.

“Virtual Participant” means an AI-generated digital representation (for example, a simulated role, persona or subject-matter expert) that individuals can interact with for applied learning, training and practice purposes within Cogstate Systems.

“AI Interaction Data” means information generated when you interact with a Virtual Participant (including voice/audio recordings, video recordings, transcripts and other outputs derived from voice or video (where enabled), your inputs/prompts, the Virtual Participant outputs, interaction logs, timestamps, usage metrics, feedback you provide, and any assessments or outcomes associated with the interaction). Where AI Interaction Data is used to improve, tune or otherwise develop Virtual Participant capabilities, it may also be referred to as “Training Data”.

We encourage you to read this Privacy Policy carefully. It describes the practices and procedures that we have established to safeguard and appropriately handle your Personal Data. Amongst other things, it tells you what information we collect, how we collect it and how we use it, and it outlines your rights regarding that information, rights for example to correct, change or to otherwise control your information.

We may update this Privacy Policy from time to time. The updated version will be notified to you through the relevant Cogstate System and indicated by a new version number and revision date.

Information we collect and how and why we collect it

Cogstate collects information about you in relation to your use of Cogstate Systems and more generally the provision of those systems to its customers.

You may refuse to provide such Personal Data, but that may prevent us from being able to provide relevant services to our customers and providing you or our customer with access to the relevant Cogstate Systems, including in relation to the Cogstate LMS providing you with the proper training and certification that is required for certain clinical trials. You may at any time withdraw your consent to our collection, use or disclosure of your Personal Data, on reasonable notice, subject to legal or contractual restrictions. We will inform you of the implications of so withdrawing your consent to such collection, use and disclosure.

Information we collect from customers

The Personal Data about you that we may collect from our customers (Sponsors of the relevant clinical trial) include:

your name and email address
site number and full site address
company name and job title
role in the clinical trial
telephone and fax number(s)

Information we collect directly from you

The Personal Data that we may collect directly from you, including via the Cogstate Systems, will depend on your role in the clinical trial and the nature of the services that Cogstate is providing to its customer for the relevant clinical trial, but may include:

your name and email address (personal and professional)
site number and full site address
company name and job title
role in the clinical trial
telephone and fax number(s)
education, qualifications, CV
experience with specific therapeutic areas, patient populations, and psychometric/cognitive testing scales (whether computerized or hardcopy versions)
experience in clinical trials in which you have been involved, your preferred language for correspondence

Information we collect through your use of Cogstate Systems

Assessments on your performance
Audit trails on your use of the Cogstate Systems
AI Interaction Data (including text, voice/audio and video data) where you use features such as an AI-generated Virtual Participant for applied learning.

Where enabled in the relevant Cogstate System, AI Interaction Data may include content you type, speak, or upload during an applied learning exercise (including text, voice/audio and video), as well as system-generated logs used to operate, secure and improve the feature. This may include transcripts and technical metadata (for example, timestamps, device and session information).

Use and Disclosure of your Personal Data

Cogstate will only use your Personal Data as required to provide support and services related to the delivery of its clinical trial services, including provision of the Cogstate Systems, and as otherwise permitted under this Privacy Policy.

This includes, without limitation:

To provide contracted services to our customers.
To provide secure, user-authenticated services to users of the Cogstate Systems.
To communicate with you about your involvement in a specific clinical trial, or suitability for being a rater or test supervisor in future clinical trials.
To provide appropriate training on administration and scoring of psychometric or cognitive testing scales (computerized or hardcopy versions).
To evaluate the quality of raters or test supervisors in administering and scoring psychometric or cognitive testing scales (computerized or hardcopy versions).
To provide the clinical trial sponsor of the clinical trial with your name and certification status and only under written obligations of confidentiality between Cogstate and its customer.
To the CRO that may be conducting the clinical trial on the sponsor’s behalf and only under written obligations of confidentiality between Cogstate and the CEO.
To enable applied learning experiences, including interaction by individuals with an AI-generated Virtual Participant (for example, to simulate scenarios, practise skills, and reinforce training content).
To monitor, maintain, evaluate and improve Virtual Participant and other AI-enabled features (including by using AI Interaction Data as Training Data), such as to increase accuracy, reduce harmful or inappropriate outputs, enhance user experience, and develop new functionality. Where feasible and appropriate, we will use de-identified and/or aggregated data to develop and improve AI-enabled features. We may also use a combination of automated methods and limited human review to assess quality, troubleshoot issues, and support safety and compliance. We do not use Virtual Participant interactions to make decisions that produce legal or similarly significant effects about you without appropriate safeguards and, where required by applicable law, notice and/or consent.

Cogstate will not otherwise disclose your Personal Data without your consent to do so, except:

To third-party agents or service providers to carry out the purposes for which you have provided it to us and ensure proper functioning and management of Cogstate Systems and related clinical trial services;
In the context of a sale, amalgamation, re-organization, transfer or financing of parts or some or all of Cogstate’s business;
For purposes of research and development, including ongoing improvement of Cogstate Systems and related clinical trial service offerings, where your information is combined with all or some information of other users and such aggregated data is de-identified or otherwise anonymized and no longer contains Personal Data;
To comply with our legal, regulatory, compliance or auditing obligations; or
Under certain circumstances, in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

In any such cases where we share Personal Data, Cogstate requires recipients to comply with the terms of this Privacy Policy and all applicable privacy laws.

In the unlikely event that we discover that a recipient is using Personal Data in a way that conflicts with this Privacy Policy or applicable privacy laws, we will take all reasonable steps to stop them.

Secure storage of your Personal Data

We will retain your Personal Data for as long as required for the services being provided for the clinical trial. We will also retain your Personal Data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Where you use an AI-generated Virtual Participant, we will retain AI Interaction Data (including text, voice/audio and video recordings and any transcripts or other derived outputs, where enabled) for as long as reasonably necessary to provide the feature, to meet contractual and legal requirements, and (where applicable) to improve and train the Virtual Participant as described in this Privacy Policy. Where feasible, we will apply data minimisation measures (for example, retaining transcripts or other derived outputs instead of raw recordings) and may delete or de-identify raw audio/video sooner, subject to legal, contractual, and technical requirements. We may retain de-identified and/or aggregated AI Interaction Data for longer periods for product improvement, analytics, and research and development.

Where we no longer need to process your Personal Data for the purposes set out in this Privacy Policy, we will delete your Personal Data from our systems.

We have implemented commercially reasonable security safeguards to protect your Personal Data against loss or theft, as well as unauthorized access, disclosure, copying, use or modification. Methods of protection include physical measures (e.g., restricted access to facilities); organizational measures (e.g., security clearances and limiting access on a “need-to-know” basis); and technological measures (e.g., the use of complex passwords and encryption of data at rest and in transit). We also maintain reasonable procedures to help ensure that Personal Data is reliable for its intended use, accurate, complete, and current.

Overseas Transfer

Your Personal Data may be transferred to other countries, including the United Kingdom, Australia and the United States, each of which may provide different protection than your jurisdiction. In any such case, we will take appropriate measures to ensure that Personal Data is transferred, processed and protected in accordance with this Privacy Policy and all applicable privacy laws.

Your rights

Depending on your location, applicable data privacy laws may entitle you to additional consumer rights than those listed below. If you wish to exercise any of the other rights over your Personal Data described in this section, please use the contact details below.

Access and Correction

You may at any time request access to your Personal Data and/or challenge the accuracy and completeness of your Personal Data and have it amended or corrected as appropriate. In any such case, we will require that you provide identifying information sufficient to verify your identity and ownership of the Personal Data. Any such identifying information will be used only for this purpose.

Receipt or Transfer

You may at any time request to receive one copy of your Personal Data and to have your Personal Data transferred to a third-party. In any such case, we will, where technically feasible, provide it in a structured, commonly used and machine-readable format.

De-activation and Deletion

In some cases, you may request to have all or parts of your Personal Data permanently deleted. However, Cogstate will not be able to delete any information we are bound to keep by law or by codes of conduct or other authority.

Objection and Restriction

You may request that Cogstate cease or restrict certain processing of your Personal Data. If you are in any way unhappy with our collection or use of your Personal Data or even the terms of this Privacy Policy, we hope that you will contact us as described below so that we can address your concerns. If however you would like to lodge a complaint, you have the right to do so by contacting your local supervisory authority for further assistance and information.

Contact

Should you have any questions or concerns regarding this Privacy Policy, or wish to make a request to exercise any rights under this Privacy Policy, you may contact Cogstate’s:

Chief Privacy Officer via email at privacy@cogstate.com.

Alternatively, you can contact us either via telephone at +61 3 9664 1300 or via mail at:

Cogstate Ltd
Level 32, 367 Collins Street
Melbourne VIC 3000, Australia