Galleri® Multi-Cancer Early Detection Test

Last updated: October 27, 2026

GRAIL, Inc. – Canada Privacy Notice – Detailed Version

To administer the Galleri® test, your Galleri prescribing healthcare provider or institution (your “Provider”) must provide your blood sample and certain personal information to the manufacturer and provider of the Galleri® test, GRAIL, Inc. (“GRAIL”), in the United States. This Privacy Notice describes what personal information GRAIL will process and how it will use your blood sample and personal information.

Please read this form carefully before deciding whether to take the Galleri® test. Before receiving the Galleri® test, you will also receive a summary version of this Privacy Notice and will be given the opportunity to provide optional permission for GRAIL to conduct clinical surveillance and further research, as described in greater detail below. Providing your permission for clinical surveillance and future research is optional and will not impact GRAIL’s ability to provide the Galleri® test.

GRAIL processes your data for the Galleri® test and for the purposes identified in this Privacy Notice. Your Provider processes your data when providing the test to you and when providing medical care to you. If you have any questions about how your Provider processes your personal information, please contact them directly.

1. What personal information will GRAIL receive?

GRAIL will receive the following personal information:

  • Patient name
  • Date of Birth
  • Sex at birth
  • Blood sample(s)
  • Complaints, queries and correspondence from you

As further described in Section 2, with your permission, GRAIL may request certain follow-up information (known as “clinical surveillance” data), to obtain information about the effectiveness of the Galleri® test. This may include, depending on your result:

  • Your reason for ordering the Galleri® test (e.g. possible symptoms or concerns)
  • Your cancer history
  • Other relevant medical history (e.g., immune conditions, presence of heme precursors)
  • Details of any diagnostic or other relevant workups
  • Any cancer diagnoses confirmed after receiving the Galleri® test results

All personal information will be collected directly from you by your Provider and transferred to GRAIL.

2. For what purposes does GRAIL process your personal information?

GRAIL will process your personal information for the following purposes:

  • To perform the Galleri® test.
  • To communicate your results to your Provider.
  • If you provide your permission below, to perform clinical surveillance activities which allow GRAIL to evaluate the effectiveness of the Galleri® test, for GRAIL’s clinical laboratory to monitor and maintain quality-related metrics, to ensure that the real-world performance of the Galleri® test aligns with expectations from clinical studies, and to further develop and research products and services. Clinical surveillance involves GRAIL being provided with your future medical details from your Provider, for example to check whether a future diagnosis matches your Galleri® test results.
  • If you provide your permission below, GRAIL may also use pseudonymised data for future medical and biological research studies, including publication of the results of any such research, as described in Section 4.
  • GRAIL may also collect, use and share aggregated data such as statistical data which is not personal information as it does not directly (or indirectly) reveal your identity. For example, we may aggregate ages of patients to calculate which age groups use the Galleri® test the most or to analyse general trends.
  • For purposes required by applicable law.

In this document, applicable data protection laws refer to, but are not limited to:

  • The federal Personal PIPEDA and any applicable provincial privacy laws such as, but not limited to, the Act respecting the protection of personal information in the private sector (“Québec Private Sector Privacy Act – QPSPA”), the British Columbia Personal Information Act, SBC 2003 (“PIPA”) and/or the Personal Health Information Protection Act, S.O. 2004, c. 3, Sched. A. (“PHIPA”).

GRAIL’s lawful bases for processing your personal information are:

  • Your Consent (Section 6.1 and Principle 3 of Schedule 1, Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy laws): GRAIL relies on your consent to conduct clinical surveillance and research (as described in Sections 2 and 4) to improve our products and services.

When GRAIL processes sensitive data concerning your health and/or genetic data, GRAIL relies on the following:

  • Express consent – Section 6.1 and Principle 3 of Schedule 1 to the Personal Information Protection and Electronic Documents Act (PIPEDA) (and any applicable provincial privacy laws) – processing is based on your express consent for the purposes described in this Privacy Notice, on the basis that a clinician has prescribed the Galleri® test for you.
  • Clinical Surveillance and Research – Section 6.1 and Principle 3 of Schedule 1 to PIPEDA (and any applicable provincial privacy laws) – processing is based on your express consent for clinical surveillance (as described in Section 2) or for using pseudonymised information for future research, with anonymisation wherever possible (as described in Section 4).
  • Legal Proceedings – where required or permitted by applicable law – processing is necessary for the establishment, exercise or defence of legal claims, including in judicial, administrative or arbitral proceedings.

4. Optional Use of Pseudonymised Data for Secondary Research Purposes

If you provide your permission below, GRAIL may pseudonymise your personal information and blood sample to use such information (in combination with pseudonymised information from other patients) for future medical and biological research studies, including publication of the results of any such research. Pseudonymised data means that any information that could directly identify you – such as your name, date of birth, or PatientID – is removed and replaced with a code number.

Such secondary uses may lead to important scientific breakthroughs and improve the effectiveness of the Galleri® test and other cancer-detecting technologies. Such use would be without further notice or compensation to you. You may withdraw your permission to the use of your pseudonymised data for secondary purposes at any time; however, personal information that has already been collected may still be used by GRAIL. You can also request the destruction of your blood sample following the process described in Section 5, below.

5. How your personal information and samples are protected and retained

The personal information which is sent to GRAIL is stored in a secure cloud-based information centre in the US for a maximum of 10 years, unless a longer period is required by law or in the event of a complaint or if GRAIL reasonably believes there may be a dispute. GRAIL may choose to destroy your biological sample at the end of the testing process or retain it for a maximum of 10 years. If you do not want the unused portion of your blood sample to be retained by GRAIL, you may request it be destroyed by contacting your Provider.

6. Transferring your personal information to the United States

When your Provider provides your personal information to GRAIL (including your blood samples), this involves sending your personal information to the United States. To ensure an adequate level of protection for your personal information when it is transferred outside of Canada, GRAIL relies on appropriate and suitable safeguards as required by the applicable data protection laws above. More details on this are available upon request. For further information, please contact your Provider or GRAIL using the details in Section 9 below.

7. Sharing your personal information

GRAIL may share your personal information with the following, as set out below:

  • Your Provider – to provide services to you and for the purposes set out in this Privacy Notice.
  • Affiliates of GRAIL – GRAIL may share your personal information with its corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Notice.
  • Service Providers and Contractors – GRAIL uses trusted third parties with whom we contract to help us provide, improve, protect, and promote our business, and to perform business operations, such as providing services to you. These third parties will access your personal information only to perform tasks on our behalf in compliance with this Privacy Notice.
  • For Compliance, Fraud Prevention and Safety – GRAIL may share personal information for compliance, fraud prevention and safety purposes and to comply with legal requirements and processes.
  • Business Transfers – GRAIL may transfer or otherwise share some or all of its business or assets, including personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.
  • Legal Purposes – GRAIL may disclose your personal information when it is necessary to investigate or prevent actual or suspected fraud, criminal activity, injury or damage to GRAIL or others; when otherwise required by law, regulation, subpoena, court order, warrant, or similar legal process; or if necessary to assert or protect GRAIL’s rights or assets.

8. Accessing your personal information or making a request relating to other rights

You have the following rights with respect to your personal information:

  • The right to request access to your personal information (commonly known as a “subject access request”). This enables you to receive a copy of the personal information that GRAIL holds about you and to check that GRAIL is lawfully processing it.
  • The right to have incorrect personal information corrected or completed if it is incomplete.
  • Where we rely on your consent, you may withdraw consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, GRAIL may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
  • The right to lodge a complaint with a supervisory authority. However, before doing so please make sure you have first made your complaint to GRAIL or asked us for clarification if there is something you do not understand.
  • If you would like to lodge a complaint with the supervisory authority, you can do so with the Privacy Commissioner of your place of establishment. Please follow this link to identify which Privacy Commissioner you can contact: https://www.priv.gc.ca/en/report-a-concern/leg_info_201405/
  • Depending on the province in which you reside, you may have additional rights under applicable provincial privacy laws.

These rights will not always apply. Requests will be considered according to the legal bases for the processing of your personal information. To make a request or find out more about how GRAIL processes your personal information, please contact your Provider initially, who will then coordinate with GRAIL regarding your request if necessary. You may need to provide information to verify your identity and enable your Provider and/or GRAIL to respond to your request.

9. GRAIL contact information

You may contact GRAIL with questions regarding this privacy notice by emailing [email protected] or by post at GRAIL, Inc., 250 S. Mathilda Avenue, Suite 100, Sunnyvale, CA, 94086, USA (mark post for the attention of the GRAIL DPO).

Last updated July 2026