AZURITY PRIVACY NOTICE

(Last updated: August 12, 2024)

This privacy notice (“Privacy Notice”) describes the privacy practices of Azurity Pharmaceuticals, Inc. and its subsidiaries and affiliates listed at the bottom of this notice (collectively, “Azurity”, “we”, “us”, “our”). Azurity specializes in providing innovative, high-quality medicines that serve overlooked patients. We supply a range of products (“Products”) to treat a wide range of medical conditions.

This Privacy Notice describes how we collect, use, disclose and otherwise process your personal data, and explains the rights and choices available to you with respect to your information.

1. When does this Privacy Notice Apply?

This Privacy Notice applies when we act as a controller of your personal data. This means we decide why we collect your personal data and how we use it. “Personal data” has different meanings given to it by the data protection and privacy laws applicable to you. It generally includes, for example, any information or opinion relating to you which allows us to identify you, such as your name, phone number, postal address, email address, or your online identifiers.

This Privacy Notice applies when:

• You inquire about our Products, or otherwise communicate with us as a prospective customer or business partner.
• We enter into a commercial transaction with you, or a company you represent.
• We process your information to promote or market our Products to you.
• You visit, interact, or use our website(s), https://azurity.com/, and any other website that links to this notice.
• You interact with us via our social media pages, such as our product Facebook or Instagram pages.
• You sign up to our webinars, events, or promotional activities.
• You interact with us in person at our offices.
• You provide us with services as our vendor.

This Privacy Notice does not apply to:

• Clinical trial participants or personnel: If you enroll or otherwise participate in a clinical trial which we sponsor, please refer to the privacy notice for that clinical trial.
• Azurity employees, contractors or job applicants.
• Information which does not constitute personal data: If we do not maintain information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household, such information is not considered personal data and this Privacy Notice will not apply to our processing of that information.
• Information collected by our business partners and distributors: When you give your data to one of our distributors who sell our Products, that distributor’s privacy notice, rather than this Privacy Notice, will apply to their processing of your personal data. However, our partners may share limited personal data related to adverse effects which we are obliged to report. In those limited cases, this Privacy Notice applies.
• External websites or services: Our website may contain links to other websites. We are not responsible for the handling of your personal data by those websites and recommend you review the privacy policy of those websites.

2. Personal data We Collect, How We Collect It, Who We Share Personal data With, and Purposes for Processing

Sources From Where We Collect Personal Data

In the past 12 months, we have collected your personal data when you visited our website, you engaged with us via social media, you interacted with us at our offices or via electronic communication, you requested information or enquired about our Products, you registered or attended our webinar or events, or when you entered into business transactions with us, or on behalf of a company you represent. We may have also collected some personal data from our third-party business partners that distribute and sell our Products. We will continue to collect personal data from these sources.

Categories of Personal Data We Collect

The categories of personal data which we collect depends on the nature of the relationship you have with us and the requirements of applicable laws. In the past 12 months, the categories of personal data we collected include:

• Biographical information (such as first name and surname).
• Business contact information (such as job title, employer name, email address, mailing address, phone number).
• Public professional information (such as if you are a third party with whom we have or are contemplating a contractual relationship, such as a health care professional, we collect publicly available information related to your practice, such as license information, disciplinary history, prior litigation and regulatory proceedings, and other due diligence related information).
• Payment-related information (such as billing address, partial credit card number, tax identification number and financial account information). We may collect some payment related information from you in these instances.
• If you are a health care professional information, we collect information about the programs and activities in which you have participated, our interactions with you, your prescribing of our products, and the agreements you have executed with us.
• Your photograph if you visitor our offices.
• Your digital or electronic signature.
• Publicly available information (such as your social media handle, comments describing support for and experience with Azurity products).
• CCTV information if you are a visitor to an Azurity office location, we collect information through closed circuit television.
• Other personal data you voluntarily provide to us (such as in emails, on phone calls, through our websites or mobile applications, or in other correspondence, such as market research surveys, with Azurity or its service providers or business partners).
• Automated information. We and our service providers may also collect certain information about your use of our websites by automated means, such as cookies, web beacons and other online tracking technologies. Please see our Cookie Notice for more information. We and our service providers may collect “Automated Information” about your online activities over time and across our own and third-party websites when you use our websites. The information that we may collect by automated means includes: details about the devices that are used to access our websites (such as the IP address, and type of operating system and web browser); dates and times of visits to, and use of, our websites; information about how our websites are used (such as the content that is viewed on our websites and how users navigate between our webpages,; URLs that refer visitors to our websites; search terms used to reach our websites.

Who We Share Personal Data With

The categories of individuals or entities we share your personal data with include:

• Azurity affiliates and subsidiaries.
• Service providers that perform services on our behalf, including:
  • Data storage and analytics providers
  • Customer service (including our medical information line) and patient support providers (including for product quality and adverse event reporting, patient co-pay assistance, medicine intake adherence programs, etc.).
  • Product recall service providers.
  • Technology providers (including technology support, email and web hosting providers, marketing and advertising technology providers, email and text communications providers)
  • Event planning and travel organizations that help facilitate Azurity programs.
  • Payment, shipping, and fulfilment service providers.
  • Professional advisors such as our lawyers and accountants.
• Regulators worldwide, as required by law, including in connection with monitoring, review and approval of our studies, products and services, and adverse event reporting.
• Business partners with whom we jointly develop products or services.

Unless prohibited by applicable law, we may disclose your personal data as part of a corporate business transaction, such as a merger, acquisition, reorganization, joint venture or financing or sale of our assets, and could be sold or transferred to a third party as party of such a transaction. We may also disclose personal data to a successor entity in the event of insolvency, bankruptcy, or receivership. After such a sale or transfer, you may contact the recipient with any inquiries concerning the processing of your personal data.

In addition, we may share your information to comply with legal and regulatory requirements (such as to comply with a government request, subpoena, or similar request), and protect against fraud, illegal activity (such as identifying and responding to incidents of hacking or misuse of our websites and systems), and claims and other liabilities.

Purposes for Processing and Lawful Basis for Processing

When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please contact us. In some situations, we may have a separate agreement or relationship with you with respect to a specific type of processing of your data, such as if you participate in a special program, activity, event, or clinical trial. These situations will be governed by specific terms, privacy notices, or consent forms that provide additional information about how we will use your information. We will honor these additional terms with respect to your information and thus, strongly recommend you review the additional terms prior to participating in any programs. If there is a conflict between this Privacy Policy and a separate written agreement on the subject matter of this Privacy Policy, the separate written agreement shall govern with regard to any conflicts.

3. Where Is Your Data Stored and Transferred to?

Azurity is headquartered in Boston in the United States of America (“U.S.”) and its data centers are in the U.S. We also use many U.S.-based service providers. This means that your personal data is primarily stored in the U.S. by us and our service providers. However, we operate globally through our subsidiaries, service providers, and business partners. This means that we may store and transfer your data to our subsidiaries, service providers, and business partners who are in different countries.

When your personal data is protected by data protection laws in the European Economic Area (“EEA”) or United Kingdom (“UK”), before transferring your personal data to third parties outside these regions, we will either require the third party to maintain at least the same level of privacy and security for your personal data that we do or ask for your explicit consent to transfer it. We remain liable for the protection of your personal data that we transfer or have transferred to third parties through our designated data transfer mechanism, such as the Standard Contractual Clauses, UK International Data Transfer Agreement and UK Transfer Addendum, except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing.

4. Your Privacy Rights

You have specific rights regarding your personal data that we collect and process. In this section, we first describe your rights and then we explain how you can exercise those rights.

Right to be Informed

This right allows you to know what personal data we collect about you, why we collect it, who collects it, how long it will be kept, who we share it with, amongst other things. Through this Privacy Notice we are informing you of this processing information.

If we do not collect personal data directly from you, we may be exempt from the obligation to inform you (i) when providing the information is either impossible or unreasonably expensive; (ii) the gathering and/or transmission is required by law, or if (iii) the personal data must remain confidential due to professional secrecy or other statutory secrecy obligations.

Right of Access

You have the right to obtain from us all information regarding our data processing activities that concern you. This includes confirmation of whether we process personal data concerning you (or your child) and, where that is the case, a copy or access to the personal data and certain related information.

Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial.

Right to Correct or Rectify

You have the right to correct inaccurate or incomplete personal data.

Right to Deletion (Right to be Forgotten)

You have the right to ask us to delete your personal data which we process. Sometimes it is not possible for either technical or legal reasons for us to delete your personal data. If that is the case, we will consider if we can limit how we use it and inform you of our reason for denying your deletion request.

Right to Restrict Processing

You have the right to ask us to only use or store your personal data for certain purposes. You have this right in certain circumstances, such as where you believe the information, we have about you is inaccurate or is being processed in an unlawful way.

Right to Object

You have the right to ask us to stop using your personal data. You have this right when we rely on our legitimate interests (or of a third party). You can also object to us processing your personal data for direct marketing purposes.

Following your request, we will stop processing the relevant personal data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your personal data to establish, exercise, or defend a legal claim.

Right to Data Portability (Right to Move or Transfer)

You have the right to ask for and receive a portable copy of your personal data that you have given us or that you have generated by using our services, so that you can: move it; copy it; keep it for yourself; or transfer it to another organization.

We will provide your personal data in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you a copy in electronic format.

Rights in Relation to Automated Decision-Making

For automated decisions that may seriously impact you, you have the right not to be subject to automatic decision-making, including profiling. But in those cases, we will always explain to you when we might do this, why it is happening, and the effect.

Withdraw My Consent

Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time. If you withdraw your consent, our use of your personal data before you withdraw is still lawful.

If you have given consent for your details to be shared with a third party and wish to withdraw this consent, please also contact the relevant third party to change your preferences.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. Unless applicable data protection laws permit it, we will not: deny you goods or services; charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Right to Opt Out of the Sale of Share of My Personal data

Azurity does not “sell” personal data as most people would typically understand that term i.e., for money. However, we do allow certain third-party advertising partners to collect information about consumers through our website for purposes of serving ads that are more relevant, for ad campaign measurement and analytics, and for ad fraud detection and reporting. This practice is interpreted to constitute a “sale” or “share” under certain data protection laws.

Depending on the region where you are located, you have the right to opt out of the “sale” or “share” of your personal data. To opt out of the sale or share of your personal data, you can contact us.

You can also alter the configuration of your browser to reject certain types of online tracking technologies. You can set up Do Not Track (“DNT”) or Global Privacy Control (“GPC”), or manage cookies using your browser settings.

Minors Under Age 16: We do not “sell” the personal data of consumers we know to be less than 16 years of age. However, if an activity or practice we engage in is found to constitute a “sale,” we will obtain affirmative authorization in accordance with applicable law.

Right to Limit Use of My Sensitive Personal data

If the CCPA applies to you, you have the right to ask us to limit use of your sensitive personal data.

Right to Complain

You have the right to complain if you are unhappy with how we process your personal data. If you are based in the European Economic Area or United Kingdom, you can complain to your national supervisory authority.

However, we hope that you will contact us first so we can address your concerns.

How can you exercise your privacy rights?

To exercise any of the rights listed above, please:

• Email us at privacy@azurity.com with the subject line “Privacy Rights Request” (Preferred Method)
• Call us at this toll-free number 1-800-461-7449
• Write to us: Azurity Pharmaceuticals, Inc. 8 Cabot Road, Suite 2000, Woburn, MA 01801, USA. Attention: Legal Department – Privacy Officer

When submitting a privacy request, please describe your relationship with us and provide sufficient detail to allows us to properly understand, evaluate, and respond to you.

Verifying Your Identity

We may need to verify your identity before processing your request, which may require us to request additional personal data from you. We will only use this additional personal data provided in connection with your request to review and comply with the request.

Responding To You

We will confirm the receipt of your request within ten (10) business days and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, unless we have already granted or denied the request.

Please allow us up to a month to reply to your requests (except requests to stop selling your personal data) from the day we received your request. If we need more time (up to 90 days in total), we will inform you of the reason why and the extension period in writing.

We will act upon your request to opt-out from selling your personal data within fifteen (15) business days. We will also notify the third parties to whom we sold your personal data of your request and instruct them not to further sell your personal data. We will inform you about this in ninety (90) days from the receipt of your request.

If we cannot satisfy a request, we will explain why in our response. For data portability requests, we will choose a format to provide your personal data that is readily useable and should allow you to transmit the information from one entity to another entity without difficulty.

We will not charge a fee for processing or responding to your requests. However, we may charge a fee if we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

5. Minors

We do not knowingly collect personal data from children under age 13 through our websites, or mobile applications. If we learn that we have collected personal data directly from a child under the age of 13 through our websites, we will delete that information.

6. How We Protect Personal data

Azurity maintains reasonable administrative, technical, and physical safeguards designed to protect the personal data we maintain against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure, or use. However, we cannot guarantee that the measures we maintain will ensure the security of the personal data.

7. How Long Do We Retain Your Personal data

We will retain your personal data for as long as is necessary to fulfil the purpose for which we collected your personal data and any other permitted linked purpose and in compliance with our data retention policies. For example, we will retain and use your personal data to the extent necessary to comply with our legal obligations under tax laws, to resolve disputes, and enforce our legal agreements and in accordance with our internal policies.

If your personal data is used for more than one purpose, we will retain it until the purpose with the longest retention period expires; but we will stop using it for the purpose with a shorter retention period once that period expires. Our retention periods are also based on our business needs and good practice.

Your personal data may need to be retained in our backup systems and will only be deleted or overwritten at a later time, normally done on a daily basis. This may be the case even when you or a Supervisory Authority has validly asked us to delete your personal data or when we do not no longer have a legal basis for processing such personal data. Please note that our backups are protected, and we have implemented a system to remind us to delete again the data when we restore a backup to production systems.

8. Links to Third-Party Websites and Third-Party Content

For your convenience and information, we may provide links to third-party websites and other third-party content that is not owned or operated by Azurity. The websites and third-party content to which we link may have separate privacy notices or policies. Azurity is not responsible for the privacy practices of any entity that it does not own or control.

9. Updates to Our Privacy Notice

We reserve the right to change this Privacy Notice at any time. When we update this Privacy Notice, we will notify you of changes by updating the date of this Privacy Notice and providing other notification as required by applicable law.

10. How to Contact Us

You may contact us with questions, comments, or complaints about this Privacy Notice or our privacy practices, or to submit a verifiable privacy request. When raising a privacy request or complaint, please provide sufficient details (including your relationship with us) and any relevant documentation.

The contact information for our Privacy Officer is:
Azurity Pharmaceuticals, Inc.
Attn: Legal Department – Privacy Officer
8 Cabot Road, Suite 2000
Woburn, MA 01801
privacy@azurity.com
1-800-461-7449

11. Corporate Entities Covered by this Privacy Notice

• Azurity Pharmaceuticals, Inc
• Azurity Pharmaceuticals Ireland Limited
• Azurity Pharmaceuticals India LLP
• Arbor Pharmaceuticals, LLC
• Wilshire Pharmaceuticals, Inc.
• Slayback Pharma, LLC

Azurity.com Cookie Notice

Effective date: January 1, 2025

Introduction and Scope

This Cookie Notice (the “Notice”) is designed to assist you in understanding how and why Azurity Pharmaceuticals, Inc. (“Azurity,” “we,” “us,” or “our”) use cookies and other similar technologies (“Tracking Technologies”) on our website https://azurity.com/ and any other website that links to this notice (collectively, the “Website”) to collect and develop data.

We use Tracking Technologies to allow the Website to operate, to increase its functionality and efficiency, to analyze how you use it so that we can improve it, to tailor the content and information that we display to you, to provide you with targeted advertisements, and fulfill other legitimate purposes as described below. This Notice does not apply to Tracking Technologies that may be active on our Website following your visit(s) to other websites.

To the extent that any information collected by the Tracking Technologies, either on its own or in combination with other information, constitutes personal information and personal data as those terms are used in our Privacy Notice, both our Privacy Notice and this Notice shall apply to the processing and transferring of such personal information and personal data.

Cookies and Other Tracking Technologies
Cookies. A cookie is a small text file stored on your device (computer, phone, tablet, etc.) that contains information about your browser and online activity. This information often consists of a string of numbers and letters that uniquely identifies your device.

We use session cookies and persistent cookies on our Website. The session cookies are deleted or removed when you close your browser. The persistent cookies may remain on your device after you close your browser, but they have an expiration date.

Some of the cookies placed on your device through our Website are first-party cookies, meaning they are placed directly by us. Others are third-party cookies, meaning they are placed on your device through our Website by third parties, such as Google. In other words, when you visit our Website, certain third parties may place cookies on your device to collect information about your online activities over time and across different Internet websites or online services.

Local Storage. Local storage enables our Website to store information locally on your device. Local storage may be used to improve your experience with our Website, for example, by enabling features, remembering your preferences, and speeding up our Website functionality.

Clear GIFs (a.k.a. “web beacons”). Our Website may also employ a software technology called clear GIFs that helps us better manage content on our Website by providing insight into which content is most effective. Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies, that are used to track the online movements of Website users.

Local shared objects (a.k.a. “flash cookies”). Flash cookies are pieces of data that websites which use Adobe Flash may store on your device.

Pixels. A tracking pixel is a 1×1 pixel graphic used for the purpose of tracking user behavior, web traffic, and site conversions. A tracking pixel allows us to collect data relating to the use of our Website. Tracking pixels are used to trigger advertisements on any participating websites based on the activity tracked from your browser or device and can also be used for third-party web analytics.

Other similar tracking technologies. We may also use other tracking technologies, such as mobile advertising IDs and tags, for similar purposes as described in this Notice.

As noted above, we refer to all of these technologies collectively as “Tracking Technologies” in this Notice.

Opting Out; How We Respond to Do Not Track Signals and Global Privacy Control

You have the right to opt out or reject use of non-essential Tracking Technologies by following the link to cookie settings found at the bottom of this web page.

You can also alter the configuration of your browser to reject certain types of Tracking Technologies. You can set your browser to send a “Do Not Track” (“DNT”) signal, set up Global Privacy Control (“GPC”), or manage cookies using your browser settings.

DNT is an optional browser setting that you can use to express your preferences regarding tracking by advertisers and other third parties.

You can alter the configuration of your browser to reject certain types of Tracking Technologies by setting GPC. For more information on GPC, please visit: https://globalprivacycontrol.org/#download.

For more information about how to manage and delete cookies in your browser, please visit https://www.aboutcookies.org/how-to-manage-and-delete-cookies. Please note, however, that if you reject certain cookies, you may not be able to access and use all of the features on our Website.

You may also control your online behavioral advertising preferences and opt out from having your data processed by certain marketing companies by visiting http://www.youronlinechoices.com/ and http://optout.aboutads.info/. Please note, however, that managing these preferences will not turn off internet advertisements in general. You will still receive the same number of advertisements, but those advertisements will be less reflective of your interests, as indicated by your web browsing habits.

In addition, please note that the opt-out preferences that you set using these tools may be nullified if you delete your cookies after setting them.

How We Use Tracking Technologies on our Website
In the tables below, we provide you with links to the applicable privacy notices for the providers who place third-party cookies on your device through our Website, where possible. Please refer to the privacy notices of those third parties to learn more about the ways in which they collect and process personal data about you.

Strictly Necessary Tracking Technologies

The following Tracking Technologies are necessary for our Website to function, and we cannot turn them off in our systems. You may still be able to set your browser to block or alert you about some of these Tracking Technologies, but if you do block these Tracking Technologies, some parts of our Website will not work.

Performance or Analytics Tracking Technologies or Statistics Cookies & Functional or Preference Tracking Technologies

The following Tracking Technologies allow us, among other things, to count Website visits and traffic sources so that we can measure and improve the performance of our Website. They help us to know which pages are the most – and least – popular and see how visitors move around the Website. If you do not allow these Tracking Technologies, we will not know when you have visited our Website, and we will not be able to monitor our Website’s performance.

The following Tracking Technologies enable the Website to provide enhanced functionality and personalization. They may be used by us or by third-party providers whose services we have added to our pages. If you do not allow these Tracking Technologies, then some or all of these services may not function properly.

Targeting Tracking Technologies

The following Tracking Technologies may be used on our Website by our advertising partners (or set directly by our advertising partners) to collect data about your online activity. They record your visits to our Website, the pages you have visited, and the links you have followed. They are used by our advertising partners to build a profile of your interests and show you relevant advertisements on our Website as well as other sites. For example, they’re used to detect when you click on an ad and show you ads based on your social media interests and browsing history.

We and third parties use social media cookies to show you ads and content based on your social media profiles and activity on our Website. They’re used to connect your activity on our Website to your social media profiles so the ads and content you see on our Website and on social media will better reflect your interests.

If you do not allow these Tracking Technologies, you will experience fewer targeted advertisements, and you will impair our ability to provide you with tailored services and offerings.

Changes to this Notice

Azurity may change the Cookies it utilizes, or not all Cookies utilized by Azurity may be immediately reflected in this Notice. If we make any material change to this Notice, we will post the revised Notice to our Website and update the “Effective Date” above to reflect the date on which the new Notice became effective.

Contact Us

If you have any questions about this Notice, please send us an e-mail to privacy@azurity.com or contact us by postal mail at:

Azurity Pharmaceuticals, Inc.
8 Cabot Road, Suite 2000
Woburn, MA 01801
USA

Please allow up to four (4) weeks for us to reply.