Safe Harbor Privacy Policy

Effective March 13, 2008

Abt Bio-Pharma Solutions, Inc. (ABS) is committed to ensuring the protection of personal information. Given the nature of our work, protecting the confidentiality of individually identifiable information is critical to ensure the confidence of our customers, research subjects, business partners, healthcare providers, and clinical investigators.

Our Standard Operating Procedures (SOPs) have been developed to ensure compliance wit h the requirements of 21CFR, Part 50. In addition, we adhere to the EU Safe Harbor Privacy Principles for all data transferred from the EU to the US. We strive to collect, use and disclose personal information in a manner consistent with the country in which we do business.

The following is based on the seven EU Privacy Principles:

Notice

When ABS is obtaining personal information directly from an individual, we will explain the purpose of the research study, how we intend to use the information, the types of third parties (if any) to whom we might disclose the information, and the choices and means that the individual has to limit this use and disclosure. This information will be presented in clear and conspicuous language understandable to the subject or representative when individuals are first asked to provide personal information or as soon as practicable thereafter, and in any event before ABS uses such information for a purpose other than that for which it was originally collected or processed by the transferring organization or discloses it to a third party.

Choice

ABS will offer individuals the opportunity to choose (opt out) whether their personal information is (a) to be disclosed to a third party or (b) to be used for a purpose other than that for which it was originally collected or subsequently authorized by the individual. Individuals will be provided with clear, easily understandable and affordable mechanisms to exercise their choices.

For sensitive information (e.g., personal health information, racial or ethnic origin, political opinions, etc.), ABS will obtain affirmative or explicit (opt in) choice if information is to be disclosed to a third party or used for a purpose other than its original purpose or a purpose subsequently authorized by the individual.

Onward Transfer

To disclose information to a third party, ABS will apply the Notice and Choice Principles described above. However, in some cases, ABS may share information with an agent or contract business partner. In these cases, ABS will ensure that the third party will safeguard the personal information in a manner consistent with this policy. Examples of appropriate assurances include: a contract with provisions obligating the agent to provide at least the same level of protection as is required by the Safe Harbor Principles, Safe Harbor certification, or being subject to the EU Data Protection Directive.

Where ABS becomes aware that an agent or contractor business partner is using or disclosing personal information in a manner inconsistent with this policy, ABS will take all reasonable steps to prevent or stop the use or disclosure.

Security

ABS will take all reasonable precautions to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. Our Standard Operating Procedures (SOPs) describe in some detail the steps that we employ to protect both electronic and hard copy data.

Data Integrity

Consistent with the Principles above, ABS will use personal information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the individual. ABS will take all reasonable steps to ensure that personal information is reliable for its intended use and is accurate, complete and current.

Access

Upon request, ABS will provide access to personal information in our possession and will allow them the ability to correct, amend, or delete information that is inaccurate, except where the burden or expense of providing access would be disproportionate to the individual’s privacy, or where the rights of other persons may be violated. However, in many cases, regulatory, statistical and contractual requirements limit our ability to provide access to research participants and clinical investigators until the study in question is closed.

Enforcement

This Principle has three components: (a) Verification that ABS Safe Harbor Privacy Policy is accurate, comprehensive, prominently displayed, completely implemented, accessible and conforms to the Safe Harbor Principles; (b) Procedure for Dispute Resolution and (c) Appropriate Remedies and Sanctions.

(a) Verification: ABS will perform a self-assessment at least one a year. In general, our Standard Operating Procedures (SOPs) provide a means to ensure that the Policy is being completely implemented as well as a mechanism by which an individual’s complaints will be investigated and resolved.

(b) Dispute Resolution: Any questions or concerns regarding the use or disclosure of personal information should first be directed to ABS at the e-mail address below. ABS will investigate and attempt to resolve complaints and disputes regarding proper use and disclosure of personal information in accordance with the Principles contained in this policy. Complaints that cannot be resolved between ABS and the individuals will be referred to the American Arbitration Association for resolution.

(c) Sanctions: For complaints or disputes resolved internally, ABS will ensure that any non-compliance is reversed or corrected. In addition, any employee that ABS determines is in violation of the Safe Harbor Privacy Policy will be subject to disciplinary action, up to and including termination of employment. For disputes resolved by a third party, we expect that the American Arbitration Association will impose sufficiently rigorous sanctions to ensure compliance.

Contact Information

Questions or comments regarding this policy or complaints should be submitted via e-mail to privacy.protection@abtbiopharma.com.

Reservation of Rights

ABS reserve the right to share personal information as required by law or in response to duly authorized requests of government authorities.