SFJ Privacy Policy

Effective Date 11-July-2023

Introduction
Welcome to the website, www.sfj-pharma.com (the “Site”), of SFJ Pharmaceuticals, Inc. (“SFJ”, “we”, “us” and/or “our”). When we refer to “SFJ,” “we, “us”, and/or “our”, we mean SFJ Pharmaceuticals Inc. and all its subsidiaries and affiliate companies. This Site is operated by SFJ and has been created to provide information about our company and our products and services (collectively, our “Services”) to our Site visitors (“you”, “your”). This Privacy Policy sets forth SFJ’s policy with respect to information including personally identifiable data (“Personal Data”) and other information that we collect from you; how we use that information; how protect it; and the choices you may have with respect to it.

Information We Collect
We collect personal data you voluntarily provide through registrations, applications, clinical trial participation, and in connection with your inquiries. For example, you may choose to provide your name, contact information, in connection with a business contact, a patient inquiry, assistance or support program, or job application. Healthcare providers may choose to provide information relating to their specialties and professional affiliations. We may collect personal data through your use of our Services including in connection with managing clinical trials, conducting research, and tracking adverse events reports.

In addition, we may gather information about you automatically through your use of the Site (e.g., your IP address and how you navigate our Site). To learn more about how we use these and your choices in relation to these tracking technologies, please refer to our Cookie Policy.

We may use or augment the personal data we have about you with information obtained from other sources, such as public databases, social media platforms and other third parties. For example, we may use such third-party information to confirm contact, to verify licensure of healthcare professionals or to better understand your interests by associating graphical and/or industry information with the information you have provided.

If you submit any personal data relating to other individuals to us, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

Use of Personal Data

We will use the information that we collect about you for the following purposes:

• Business operations and product and service delivery
• Communication with you
• Providing you with information about our business, services, health topics
• Connecting with third parties

We may provide functionality on the Site that will allow you to forward and share certain content with another person, or we may offer access to third party sharing functionality, such as third-party social media widgets/tools/buttons. If you choose to use our sharing functionality or a third party’s sharing functionality to refer someone to our content or service, we will use both of your data to send the content or link you request. If you use that functionality, your use is subject to the third party’s privacy policy and terms.

We use the information you provide for data analysis, to better understand, track and respond to concerns, for fraud prevention, and to comply with our regulatory monitoring and reporting obligations. If we want to use your information for any other purpose, we will ask you for consent and will use your information only upon receiving your consent, and only for the purpose(s) for which your consent was granted for, unless we are required to do otherwise by law.

How We Share Your Information
We will not transfer or sell your personal information to any third party without seeking your consent, except in limited circumstances as described below:

SFJ may share your personal data amongst and between the family of companies – subsidiaries and affiliates for the purposes listed in this Privacy Policy.

SFJ may share your personal data with another company on a sell or transfer of whole or part of the business. In this case, SFJ will require the receiving company to use and protect your personal data consistent with this Privacy Policy. We may also share your personal data with companies that were part of SFJ family of companies to whom we provide services during a transition period following separation.

We may employ, contract, and/or collaborate with other companies and individuals to perform services with respect to products or services (collectively, “Providers”). These Providers may be given access to your personal data needed to perform their functions. The Providers may not use such data other than on our behalf or subject to contracts that protect the confidentiality of the data. Providers include customer service and contract service/support providers, email and SMS vendors, data analytics firms, web hosting and development companies. Some Providers may collect personal data on our behalf on our Site or Services.

Among other Providers, we share information with third-party partners such as Google Analytics for the purpose of tracking website performance, statistics, and analytics through cookies. Google Analytics collects device information, IP address, location data, browser data, and user activity while using the Service. If you wish to opt-out of Google Analytics, you may do so here.

We reserve the right to disclose your personal data as required by law, when we believe disclosure is necessary or appropriate to comply with a regulatory requirement, judicial proceeding, court order, government request, or legal process served on us, or to protect the safety, rights, or property of our customers, the public, SFJ, or others.

SFJ may also disclose aggregate or de-identified data that is not personally identifiable to third parties for any purpose.

International Visitors
The Site is controlled and operated by us from the United States (“U.S.”) and is not intended to subject us to the laws or jurisdiction of any state, country or territory other than that of the United States. Any information you provide to SFJ through use of the Site may be stored and processed, transferred between and accessed from the United States and other countries which may not guarantee the same level of protection of personal data as the one in which you reside. However, SFJ will handle your personal data in accordance with this Privacy Policy regardless of where your personal data is stored and accessed. By providing any information, including personal information, on or through our Site, you consent to such transfer, storage, and processing.

This notice also applies to individuals based in the EU where personal data about those individuals is processed by SFJ and who are participants in the following clinical trial:

SFJ is a Controller of your PII covered by this Policy for the purposes of EU General Data Protection Regulation (GDPR) and in the development of this trial. In most instances, your personal data will be de-identified when transferred outside of the European Economic Area (EEA) and United Kingdom (UK) and replaced by a subject ID/code. This means your data such as your name and contact details will not be transferred.

Our lawful basis for each purpose is as below.

Purpose Types of data Lawful basis Retention
Screening and recruitment Demographic (name, country, contact details etc.) and Health Data Article 6(1)(f) – legitimate interest and Article 9(2)(j) research purposes 25 years as per the EU Clinical Trials Regulation (536/2014)

Operations of the clinical trial Health data Article 6(1)(f) – legitimate interest and Article 9(2)(j) research purposes 25 years as per the EU Clinical Trials Regulation (536/2014)

Pharmacovigilance Health and Trial data Article 6(1)(c) legal obligation and Article 9(2)(i) necessary for ensuring high standards and quality of medicinal products 25 years as per the EU Clinical Trials Regulation (536/2014)

Where we rely on our legitimate interest, our legitimate interest is the development of products which can support and treat those living with certain conditions. We are carrying out this clinical trial to explore whether this investigational product is safe and effective for humans. We also rely on our legal obligation under the EU Clinical Trial Regulation (536/2014) and the UK Clinical Trials Directive (2001/20/EC) to ensure the safety of our participants.

All individuals have consented to be part of the clinical trial and can withdraw from the study at any time.

Transfers
SFJ is based in the United States of America, and as such your personal data will be transferred to the USA and to other trusted service providers based in the USA all of which work under contract with SFJ. We must inform you that currently the United States have a different data protection regime to the regime in the EU, which is not deemed to provide an adequate level of protection for the purposes of EU data protection legislation. To maintain security of this data, personal data is only transferred to SFJ and its trusted suppliers when strictly necessary and under the EU’s Standard Contractual Clauses which provide safeguards for these transfers. We have put in place other safeguards to protect your personal data such as encryption and only your subject ID, gender, ethnicity, and research data will be sent outside of the EEA.

SFJ has appointed a European Economic Area (EEA) Representative who you can contact directly if you have any questions or concerns about how we use your personal data during and after the clinical trial: sfj-pharma@kdpc.es. SFJ has also appointed a United Kingdom (UK) representative that can be reached via: sfj-pharma@gdpr-rep.uk.

Recipients
Categories of recipients who will have access to your personal data will be the trial site study team, and SFJ’s study team and contract providers, drug safety team, trial monitoring team, clinical events committee, data monitoring committee, and global regulatory health authorities.

If you have any queries regarding the processing activities, you can contact our EEA representative at sfj-pharma@kdpc.es or our UK representative at sfj-pharma@gdpr-rep.uk. Our Data Protection Officer can be contacted at dpo.sfj-pharma@kdpc.uk. If we are unable to resolve your query, you may contact your local supervisory authority.

Your Rights
You may request access to the Personal Data we have collected about you, or to update or correct Personal Data that you have provided to us. You may have the right to request access to, or deletion of, your Personal Data under state or other jurisdictional law (e.g., EU General Data Protection Regulation). These rights may only apply in certain circumstances. This means that we may be unable (e.g., due to legal requirements) or not obligated to satisfy your request. In some cases, we may need to collect additional information from you in order to verify your identity before providing you access to or deleting your information, such as a government-issued identification. SFJ will not discriminate against you for exercising your rights, but we may not be able to provide you with Services that you have requested if we are not able to use your information.

If you have provided permission to SFJ to process your Personal Data, you have the right to withdraw your consent for such processing at any time by contacting us at privacy.officer@sfj-pharma.com or dpo.sfj-pharma@kdpc.uk. In most cases, it will be free to exercise these rights and SFJ will respond to your request within a period of one month.

Retention Period
We will retain your personal data for as long as needed or permitted considering the purpose(s) for which it was obtained and as outlined in this Privacy Policy. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the Site to you; (ii) whether there is a legal obligation to which we are subject; or (iii) whether retention is advisable considering our legal position.

For clinical trials, personal data will be retained for 25 years in line with the EU regulatory requirement for clinical trial data (EU Clinical Trials Regulation (536/2014)).

Third Parties
Our Site may contain links to third party websites, content, and services that are not owned, controlled, or controlled by SFJ. This Privacy Policy does not address the privacy policy and other practices of any third parties, including any third party operating any website or service that may be accessible via a link on the Site. We have no control over and are not responsible for the content, privacy policies or practices of any third-party sites or services. We advise you to review the privacy policy of every site you visit.

Security
We will use reasonable technical, administrative, and procedural security measures in an attempt to prevent the loss, misuse or unauthorized alteration of your information under our control. However, given the inherent risks, we cannot guarantee absolute security and consequently, we cannot ensure or warrant the security of any information you transmit to us. The site users (you) are responsible for maintaining the secrecy of their (your) own passwords. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel the security of any account you might have with us has been compromised), please immediately notify us by contacting us at Data.Incident@sfj-pharma.com.

Children’s Privacy
The Site is not directed to individuals under the age of thirteen (13), and we do not knowingly collect personal data from children under the age of 13. If you are under the age of 13, please do not submit any Personal Data through the Site. If you learn that a child under the age of 13 has provided Personal Data though this Site, please contact us at Privacy.Officer@sfj-pharma.com and we will delete such information.

Updates to SFJ’s Privacy Policy
We reserve the right to update and modify this Privacy Policy from time to time without prior notice. We will post the revised Privacy Policy on this page. If changes to this Privacy Policy significantly affect how we handle personal data, we will not use the personal data previously gathered without providing you with notice and/or obtaining your consent, as appropriate. Your continued use of the Site after any changes or revisions to this Privacy Policy shall indicate your agreement with the terms of the revised Privacy Policy. Please review the Privacy Policy periodically to keep yourself informed of any changes. This Privacy Policy was last updated on the date indicated below.

Contacting SFJ
This Site is operated by SFJ. If you have any queries or concerns about the processing of your information that is available with us, or have questions about this Privacy Policy, please contact us at 1 (925) 223-6233 or Privacy.Officer@sfj-pharma.com or:

SFJ Pharmaceuticals, Inc.
5000 Hopyard Road, Suite 330
Pleasanton, CA 94588
Attention: SFJ Privacy Officer

Last Updated: 11 JUL 2023