AZURITY PRIVACY NOTICE

(Last updated: August 12, 2024)

This privacy notice (“Privacy Notice”) describes the privacy practices of Azurity Pharmaceuticals, Inc. and its subsidiaries and affiliates listed at the bottom of this notice (collectively, “Azurity”, “we”, “us”, “our”). Azurity specializes in providing innovative, high-quality medicines that serve overlooked patients. We supply a range of products (“Products”) to treat a wide range of medical conditions.

This Privacy Notice describes how we collect, use, disclose and otherwise process your personal data, and explains the rights and choices available to you with respect to your information.

1. When does this Privacy Notice Apply?

This Privacy Notice applies when we act as a controller of your personal data. This means we decide why we collect your personal data and how we use it. “Personal data” has different meanings given to it by the data protection and privacy laws applicable to you. It generally includes, for example, any information or opinion relating to you which allows us to identify you, such as your name, phone number, postal address, email address, or your online identifiers.

This Privacy Notice applies when:

• You inquire about our Products, or otherwise communicate with us as a prospective customer or business partner.
• We enter into a commercial transaction with you, or a company you represent.
• We process your information to promote or market our Products to you.
• You visit, interact, or use our website(s), https://azurity.com/, and any other website that links to this notice.
• You interact with us via our social media pages, such as our product Facebook or Instagram pages.
• You sign up to our webinars, events, or promotional activities.
• You interact with us in person at our offices.
• You provide us with services as our vendor.

This Privacy Notice does not apply to:

• Clinical trial participants or personnel: If you enroll or otherwise participate in a clinical trial which we sponsor, please refer to the privacy notice for that clinical trial.
• Azurity employees, contractors or job applicants.
• Information which does not constitute personal data: If we do not maintain information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household, such information is not considered personal data and this Privacy Notice will not apply to our processing of that information.
• Information collected by our business partners and distributors: When you give your data to one of our distributors who sell our Products, that distributor’s privacy notice, rather than this Privacy Notice, will apply to their processing of your personal data. However, our partners may share limited personal data related to adverse effects which we are obliged to report. In those limited cases, this Privacy Notice applies.
• External websites or services: Our website may contain links to other websites. We are not responsible for the handling of your personal data by those websites and recommend you review the privacy policy of those websites.

2. Personal data We Collect, How We Collect It, Who We Share Personal data With, and Purposes for Processing

Sources From Where We Collect Personal Data

In the past 12 months, we have collected your personal data when you visited our website, you engaged with us via social media, you interacted with us at our offices or via electronic communication, you requested information or enquired about our Products, you registered or attended our webinar or events, or when you entered into business transactions with us, or on behalf of a company you represent. We may have also collected some personal data from our third-party business partners that distribute and sell our Products. We will continue to collect personal data from these sources.

Categories of Personal Data We Collect

The categories of personal data which we collect depends on the nature of the relationship you have with us and the requirements of applicable laws. In the past 12 months, the categories of personal data we collected include:

• Biographical information (such as first name and surname).
• Business contact information (such as job title, employer name, email address, mailing address, phone number).
• Public professional information (such as if you are a third party with whom we have or are contemplating a contractual relationship, such as a health care professional, we collect publicly available information related to your practice, such as license information, disciplinary history, prior litigation and regulatory proceedings, and other due diligence related information).
• Payment-related information (such as billing address, partial credit card number, tax identification number and financial account information). We may collect some payment related information from you in these instances.
• If you are a health care professional information, we collect information about the programs and activities in which you have participated, our interactions with you, your prescribing of our products, and the agreements you have executed with us.
• Your photograph if you visitor our offices.
• Your digital or electronic signature.
• Publicly available information (such as your social media handle, comments describing support for and experience with Azurity products).
• CCTV information if you are a visitor to an Azurity office location, we collect information through closed circuit television.
• Other personal data you voluntarily provide to us (such as in emails, on phone calls, through our websites or mobile applications, or in other correspondence, such as market research surveys, with Azurity or its service providers or business partners).
• Automated information. We and our service providers may also collect certain information about your use of our websites by automated means, such as cookies, web beacons and other online tracking technologies. Please see our Cookie Notice for more information. We and our service providers may collect “Automated Information” about your online activities over time and across our own and third-party websites when you use our websites. The information that we may collect by automated means includes: details about the devices that are used to access our websites (such as the IP address, and type of operating system and web browser); dates and times of visits to, and use of, our websites; information about how our websites are used (such as the content that is viewed on our websites and how users navigate between our webpages,; URLs that refer visitors to our websites; search terms used to reach our websites.

Who We Share Personal Data With

The categories of individuals or entities we share your personal data with include:

• Azurity affiliates and subsidiaries.
• Service providers that perform services on our behalf, including:
  • Data storage and analytics providers
  • Customer service (including our medical information line) and patient support providers (including for product quality and adverse event reporting, patient co-pay assistance, medicine intake adherence programs, etc.).
  • Product recall service providers.
  • Technology providers (including technology support, email and web hosting providers, marketing and advertising technology providers, email and text communications providers)
  • Event planning and travel organizations that help facilitate Azurity programs.
  • Payment, shipping, and fulfilment service providers.
  • Professional advisors such as our lawyers and accountants.
• Regulators worldwide, as required by law, including in connection with monitoring, review and approval of our studies, products and services, and adverse event reporting.
• Business partners with whom we jointly develop products or services.

Unless prohibited by applicable law, we may disclose your personal data as part of a corporate business transaction, such as a merger, acquisition, reorganization, joint venture or financing or sale of our assets, and could be sold or transferred to a third party as party of such a transaction. We may also disclose personal data to a successor entity in the event of insolvency, bankruptcy, or receivership. After such a sale or transfer, you may contact the recipient with any inquiries concerning the processing of your personal data.

In addition, we may share your information to comply with legal and regulatory requirements (such as to comply with a government request, subpoena, or similar request), and protect against fraud, illegal activity (such as identifying and responding to incidents of hacking or misuse of our websites and systems), and claims and other liabilities.

Purposes for Processing and Lawful Basis for Processing

When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please contact us. In some situations, we may have a separate agreement or relationship with you with respect to a specific type of processing of your data, such as if you participate in a special program, activity, event, or clinical trial. These situations will be governed by specific terms, privacy notices, or consent forms that provide additional information about how we will use your information. We will honor these additional terms with respect to your information and thus, strongly recommend you review the additional terms prior to participating in any programs. If there is a conflict between this Privacy Policy and a separate written agreement on the subject matter of this Privacy Policy, the separate written agreement shall govern with regard to any conflicts.

3. Where Is Your Data Stored and Transferred to?

Azurity is headquartered in Boston in the United States of America (“U.S.”) and its data centers are in the U.S. We also use many U.S.-based service providers. This means that your personal data is primarily stored in the U.S. by us and our service providers. However, we operate globally through our subsidiaries, service providers, and business partners. This means that we may store and transfer your data to our subsidiaries, service providers, and business partners who are in different countries.

When your personal data is protected by data protection laws in the European Economic Area (“EEA”) or United Kingdom (“UK”), before transferring your personal data to third parties outside these regions, we will either require the third party to maintain at least the same level of privacy and security for your personal data that we do or ask for your explicit consent to transfer it. We remain liable for the protection of your personal data that we transfer or have transferred to third parties through our designated data transfer mechanism, such as the Standard Contractual Clauses, UK International Data Transfer Agreement and UK Transfer Addendum, except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing.

4. Your Privacy Rights

You have specific rights regarding your personal data that we collect and process. In this section, we first describe your rights and then we explain how you can exercise those rights.

Right to be Informed

This right allows you to know what personal data we collect about you, why we collect it, who collects it, how long it will be kept, who we share it with, amongst other things. Through this Privacy Notice we are informing you of this processing information.

If we do not collect personal data directly from you, we may be exempt from the obligation to inform you (i) when providing the information is either impossible or unreasonably expensive; (ii) the gathering and/or transmission is required by law, or if (iii) the personal data must remain confidential due to professional secrecy or other statutory secrecy obligations.

Right of Access

You have the right to obtain from us all information regarding our data processing activities that concern you. This includes confirmation of whether we process personal data concerning you (or your child) and, where that is the case, a copy or access to the personal data and certain related information.

Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial.

Right to Correct or Rectify

You have the right to correct inaccurate or incomplete personal data.

Right to Deletion (Right to be Forgotten)

You have the right to ask us to delete your personal data which we process. Sometimes it is not possible for either technical or legal reasons for us to delete your personal data. If that is the case, we will consider if we can limit how we use it and inform you of our reason for denying your deletion request.

Right to Restrict Processing

You have the right to ask us to only use or store your personal data for certain purposes. You have this right in certain circumstances, such as where you believe the information, we have about you is inaccurate or is being processed in an unlawful way.

Right to Object

You have the right to ask us to stop using your personal data. You have this right when we rely on our legitimate interests (or of a third party). You can also object to us processing your personal data for direct marketing purposes.

Following your request, we will stop processing the relevant personal data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your personal data to establish, exercise, or defend a legal claim.

Right to Data Portability (Right to Move or Transfer)

You have the right to ask for and receive a portable copy of your personal data that you have given us or that you have generated by using our services, so that you can: move it; copy it; keep it for yourself; or transfer it to another organization.

We will provide your personal data in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you a copy in electronic format.

Rights in Relation to Automated Decision-Making

For automated decisions that may seriously impact you, you have the right not to be subject to automatic decision-making, including profiling. But in those cases, we will always explain to you when we might do this, why it is happening, and the effect.

Withdraw My Consent

Where we rely on your consent as the legal basis for processing your personal data, you may withdraw your consent at any time. If you withdraw your consent, our use of your personal data before you withdraw is still lawful.

If you have given consent for your details to be shared with a third party and wish to withdraw this consent, please also contact the relevant third party to change your preferences.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. Unless applicable data protection laws permit it, we will not: deny you goods or services; charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Right to Opt Out of the Sale of Share of My Personal data

Azurity does not “sell” personal data as most people would typically understand that term i.e., for money. However, we do allow certain third-party advertising partners to collect information about consumers through our website for purposes of serving ads that are more relevant, for ad campaign measurement and analytics, and for ad fraud detection and reporting. This practice is interpreted to constitute a “sale” or “share” under certain data protection laws.

Depending on the region where you are located, you have the right to opt out of the “sale” or “share” of your personal data. To opt out of the sale or share of your personal data, you can contact us.

You can also alter the configuration of your browser to reject certain types of online tracking technologies. You can set up Do Not Track (“DNT”) or Global Privacy Control (“GPC”), or manage cookies using your browser settings.

Minors Under Age 16: We do not “sell” the personal data of consumers we know to be less than 16 years of age. However, if an activity or practice we engage in is found to constitute a “sale,” we will obtain affirmative authorization in accordance with applicable law.

Right to Limit Use of My Sensitive Personal data

If the CCPA applies to you, you have the right to ask us to limit use of your sensitive personal data.

Right to Complain

You have the right to complain if you are unhappy with how we process your personal data. If you are based in the European Economic Area or United Kingdom, you can complain to your national supervisory authority.

However, we hope that you will contact us first so we can address your concerns.

How can you exercise your privacy rights?

To exercise any of the rights listed above, please:

• Email us at privacy@azurity.com with the subject line “Privacy Rights Request” (Preferred Method)
• Call us at this toll-free number 1-800-461-7449
• Write to us: Azurity Pharmaceuticals, Inc. 8 Cabot Road, Suite 2000, Woburn, MA 01801, USA. Attention: Legal Department – Privacy Officer

When submitting a privacy request, please describe your relationship with us and provide sufficient detail to allows us to properly understand, evaluate, and respond to you.

Verifying Your Identity

We may need to verify your identity before processing your request, which may require us to request additional personal data from you. We will only use this additional personal data provided in connection with your request to review and comply with the request.

Responding To You

We will confirm the receipt of your request within ten (10) business days and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, unless we have already granted or denied the request.

Please allow us up to a month to reply to your requests (except requests to stop selling your personal data) from the day we received your request. If we need more time (up to 90 days in total), we will inform you of the reason why and the extension period in writing.

We will act upon your request to opt-out from selling your personal data within fifteen (15) business days. We will also notify the third parties to whom we sold your personal data of your request and instruct them not to further sell your personal data. We will inform you about this in ninety (90) days from the receipt of your request.

If we cannot satisfy a request, we will explain why in our response. For data portability requests, we will choose a format to provide your personal data that is readily useable and should allow you to transmit the information from one entity to another entity without difficulty.

We will not charge a fee for processing or responding to your requests. However, we may charge a fee if we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

5. Minors

We do not knowingly collect personal data from children under age 13 through our websites, or mobile applications. If we learn that we have collected personal data directly from a child under the age of 13 through our websites, we will delete that information.

6. How We Protect Personal data

Azurity maintains reasonable administrative, technical, and physical safeguards designed to protect the personal data we maintain against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure, or use. However, we cannot guarantee that the measures we maintain will ensure the security of the personal data.

7. How Long Do We Retain Your Personal data

We will retain your personal data for as long as is necessary to fulfil the purpose for which we collected your personal data and any other permitted linked purpose and in compliance with our data retention policies. For example, we will retain and use your personal data to the extent necessary to comply with our legal obligations under tax laws, to resolve disputes, and enforce our legal agreements and in accordance with our internal policies.

If your personal data is used for more than one purpose, we will retain it until the purpose with the longest retention period expires; but we will stop using it for the purpose with a shorter retention period once that period expires. Our retention periods are also based on our business needs and good practice.

Your personal data may need to be retained in our backup systems and will only be deleted or overwritten at a later time, normally done on a daily basis. This may be the case even when you or a Supervisory Authority has validly asked us to delete your personal data or when we do not no longer have a legal basis for processing such personal data. Please note that our backups are protected, and we have implemented a system to remind us to delete again the data when we restore a backup to production systems.

8. Links to Third-Party Websites and Third-Party Content

For your convenience and information, we may provide links to third-party websites and other third-party content that is not owned or operated by Azurity. The websites and third-party content to which we link may have separate privacy notices or policies. Azurity is not responsible for the privacy practices of any entity that it does not own or control.

9. Updates to Our Privacy Notice

We reserve the right to change this Privacy Notice at any time. When we update this Privacy Notice, we will notify you of changes by updating the date of this Privacy Notice and providing other notification as required by applicable law.

10. How to Contact Us

You may contact us with questions, comments, or complaints about this Privacy Notice or our privacy practices, or to submit a verifiable privacy request. When raising a privacy request or complaint, please provide sufficient details (including your relationship with us) and any relevant documentation.

The contact information for our Privacy Officer is:
Azurity Pharmaceuticals, Inc.
Attn: Legal Department – Privacy Officer
8 Cabot Road, Suite 2000
Woburn, MA 01801
privacy@azurity.com
1-800-461-7449

11. Corporate Entities Covered by this Privacy Notice

• Azurity Pharmaceuticals, Inc
• Azurity Pharmaceuticals Ireland Limited
• Azurity Pharmaceuticals India LLP
• Arbor Pharmaceuticals, LLC
• Wilshire Pharmaceuticals, Inc.
• Slayback Pharma, LLC

Cookie Notice

(Effective: JULY 2020)

Consent

By using the Azurity’s website and any other website (including mobile-optimized websites) owned or controlled by Azurity and which links to this Cookies Policy (collectively, the “Website”), you consent to the use of cookies in accordance with this Cookies Policy.

What are cookies?

Cookies are small amounts of data which your web browser stores on your device at the request of certain websites. Cookies are then sent back to the originating web domain on your subsequent visits to that domain. Most web pages contain elements from multiple web domains so when you visit the website, your browser may receive cookies from several sources.

Cookies are useful because they allow a website to recognize a user’s device. Cookies allow you to navigate between pages efficiently, remember preferences and generally improve the user experience. They can also be used to tailor advertising to your interests through tracking your browsing across websites.

There are two primary types of cookies that are used, session cookies and persistent cookies. Session cookies are deleted automatically when you close your browser and persistent cookies remain on your device after the browser is closed (for example to remember your user preferences when you return to the site). Each cookie typically falls into one of several categories.

What types of cookies does Azurity use?

We describe the categories of cookies Azurity and its contractors use below.

Strictly Necessary Cookies

These cookies are essential in order to enable you to move around the Website and use its features. Without these cookies, services you have asked for (such as navigating between pages) cannot be provided.

Performance Cookies

We make use of analytics cookies to analyze how our visitors use our Website and to monitor Website performance, including, but not limited to, those by Google Analytics. This allows us to provide a high-quality experience by customizing our offering and quickly identifying and fixing any issues that arise. For example, we might use performance cookies to keep track of which pages are most popular, which method of linking between pages is most effective, and to determine why some pages are receiving error messages. We might also use these cookies to highlight articles or site services that we think will be of interest to you based on your usage of the website. You can opt out of Google Analytics here.

Website Functionality Cookies

We make use of cookies to provide you with certain functionality. For example, to remember choices you make (such as your user name, language or the region you are in), or to recognize the platform from which you access the site, and to provide enhanced and more personal features. These cookies are not used to track your browsing on other sites.

Disabling cookies

If you do not agree to the use of cookies that are not strictly necessary, you may disable them by following the instructions for your browser as explained at http://www.allaboutcookies.org/manage-cookies/. Please note that some of our services may not function properly if cookies are disabled. You may also opt out of third-party cookies where available by using the links provided in this Cookies Policy.

Furthermore, some of our service providers that set cookies via our site on our behalf may offer the ability to opt-out of cookies via the Network Advertising Initiative’s consumer opt-out tool, or the Digital Advertising Alliance’s Consumer Choice Page.

Cookies policy does not cover third party websites

Please note that this cookies policy does not apply to, and we are not responsible for, the cookie practices of third-party websites which may be linked to this Website.

Changes to the Cookies Policy

We may update this cookies policy and we would encourage you to review the policy from time to time to stay informed of how we are using cookies.

Azurity Pharmaceuticals Corporate Entities Covered by this

Privacy Policy and Cookie Notice

• Azurity Pharmaceuticals, Inc.
• Arbor Pharmaceuticals, LLC