Investors, Incubators & Accelerators

The recurring ones are a dataset reused for research or AI training without a legal basis that covers that use, consent forms that do not match how data is actually used, missing data processing agreements with CROs and vendors, transfers of health data to the United States without a documented mechanism, no DPIA for trials or products processing health data at scale, and the absence of a DPO or EU representative where the GDPR requires one. Most of these can be remediated. The serious cases are those where the company's core asset, such as a clinical dataset, a biobank or a trained model, cannot be lawfully used as the business plan assumes.

Yes, when they affect the asset being bought. A dataset collected without a basis for its intended reuse, or a model trained on such data, may have to be retrained, restricted or deleted, because supervisory authorities can order processing to stop or data to be erased under Art. 58(2) GDPR. Such findings feed into price, specific indemnities, conditions precedent and remediation covenants that apply after closing. Less critical gaps, such as incomplete records or contracts, usually become a remediation plan with a cost and a timeline. iliomad quantifies both, so that the deal team negotiates on facts rather than assumptions.

Yes, with a lighter scope. Preclinical companies often hold genomic or sample data from biobanks and academic partners, license datasets to train models, process data of key opinion leaders and advisers, and are preparing a first trial whose design will determine their data protection position. The review checks that these inputs were obtained with rights that cover the intended use, that the contracts with data providers allow it, and that the first study can be set up correctly. Identifying these points before investment is cheaper than discovering them when a pharma partner runs its own diligence.

It depends on what it does with personal data, not on where its investors are. A company established outside the EU falls under the GDPR when it offers goods or services to people in the EU or monitors their behaviour, which includes running clinical trials with EU participants or selling a digital health product to European users (Art. 3(2) GDPR). Raising from a European fund does not by itself trigger the GDPR. Once in scope, the company typically needs an EU representative under Art. 27, a DPO where Art. 37 requires one and documented transfers, and the UK GDPR applies in parallel for UK activity.

Yes, and it is responsible for that processing. Reviewing a data room means accessing employment contracts, cap table details, agreements with advisers and investigators and sometimes extracts of study data, which makes the fund and its advisers controllers for the processing they carry out for the transaction. Good practice is to restrict access to what the review needs, ask the target to redact or pseudonymise participant data before upload, use confidentiality undertakings and clean team rules for sensitive information, and delete copies once the deal closes or fails. iliomad applies the same principles to its own due diligence work.

It is scoped to the deal timetable. A review of a seed or Series A target with a well organised data room can usually be completed within a few weeks; larger targets with several trials, products or AI systems take longer. The deliverable is a fixed scope report that scores the target's position across legal bases, documentation, contracts, transfers, security and AI Act exposure, flags the critical items for the deal team, and sets out a costed remediation plan that can be turned into covenants for after closing or executed by iliomad once the transaction completes.