This Policy applies to Aqur Biosciences, Inc. (also referred to as “Aqur”, “Company”, “we”, or “our”) and its U.S. operating subsidiaries (collectively referred to as “Aqur”, “Company”, “we” or “our”) when Personal Information is received from or about Individuals in the European Economic Area (“EEA”), in any format including electronic, paper or verbal. Aqur respects the relationships we have with our customers and respects the privacy of all Individuals whose Personal Information (see Definitions) may be processed by Aqur in the performance of our services and our business operations. To demonstrate our commitment to the protection of Personal Information, including Personal Information transferred out of the EEA and Switzerland for the performance of our services and business operations in the United States, Aqur complies with the EU-U.S. Privacy Shield Framework and the Swiss – U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States, respectively.  Aqur has certified to the Department of Commerce that it adheres to the Privacy Shield Principles.  If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. We also use standard contractual clauses and other mechanisms approved by the European Union and Switzerland, respectively, for certain transfers of Personal Information to the United States from the EEA and Switzerland.

SCOPE:

This Policy applies to all Personal Information of Individuals received by Aqur in the U.S. from the EEA or Switzerland, including Personal Information of consumers, healthcare professionals, patients, medical research subjects, clinical investigators, customers, suppliers, vendors, job applicants, business contacts and partners, investors, and government officials. Further information concerning how Aqur collects, uses, shares and safeguards the Personal Information of Company Personnel is available in Aqur’s internal privacy policy.

This Policy will help you understand how Aqur collects, uses, shares and safeguards Individuals’ Personal Information, and how, in certain circumstances, you can elect whether or not to allow your Personal Information to be used or shared. Aqur endeavors to collect, use and disclose Personal Information in a manner consistent with the laws of countries in which it does business, and also has a tradition of upholding the highest ethical standards in its business practices.

LIMITATIONS ON SCOPE:

Adherence to the Privacy Shield Principles may be limited (i) to the extent required or allowed by applicable law, rule or regulation; (ii) to the extent necessary to respond to lawful requests by public authorities, including to meet national security, law enforcement, legal or governmental requirements; and/or (iii) to protect the health or safety of an Individual. Also, this Policy may not apply or may be limited when Personal Information is collected or processed by the following:

• Aqur, under an agreement that contains the requisite standard contractual clauses approved by the European Commission with respect to the Personal Information;
• Aqur, when necessary for the performance of a contract (e.g., an employment contract) between an Individual and Aqur; or
• Any Aqur affiliate, successor, subsidiary, business division or group that makes a separate certification to Privacy Shield, whether or not such certification covers only part of or all types of Personal Information in scope of this Policy.

DEFINITIONS:

For purposes of this Policy, the following definitions shall apply:

• “Agent” means any third party that uses Personal Information provided to it by Aqur to perform tasks on behalf of and/or under the instructions of Aqur or to which Aqur discloses Personal Information for use on its behalf.
• “European Economic Area” (EEA) means for the purposes of this Policy the following thirty‐one (31) countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Ireland, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden (i.e., countries within the European Union), and Iceland, Liechtenstein, Norway, and the United Kingdom.
• “Individual” means any natural person located in the EEA or Switzerland whose Personal Information is shared with Aqur in the United States.
• “Personal Information” means any information or set of information about an identified or identifiable individual, including, but not limited to: (a) first name or initial and last name; (b) home or other physical address; (c) telephone number; (d) email address or online identifier associated with the individual; (e) Social Security number or other similar identifier; (f) employment, financial or health information; or (g) any other information relating to an individual that is combined with any of the above. The term “Personal Information” does not include non‐identified information or information that is reported in the aggregate (provided that such aggregated information is not identifiable to a natural person).
• “Personnel” includes, but is not limited to, any employee (permanent or temporary), director, officer, contractor, worker, temporary worker, job applicant, retiree of Aqur and any and all of their respective dependents.
• “Privacy Shield Principles” collectively means the seven (7) privacy principles, as well as the supplemental privacy principles and the associated guidance.
• “Sensitive Personal Information” means Personal Information subject to specified extra protection under the EU Data Protection Directive of 95/46/EC, the European Union General Data Protection Regulation or any superseding legislation, such as race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data where Processed to uniquely identify a person, or that concerns medical or health conditions or sex life. In addition, Aqur will treat as Sensitive Personal Information any information received from an employee or third party where that employee or third party treats and identifies the information as sensitive.

NOTICE:

Where Aqur collects Personal Information directly from Individuals, it will explain the purposes for which it collects and uses Personal Information about the Individuals, the types of third parties to which Aqur discloses that information, and the choices and means, if any, Aqur offers Individuals for limiting the use and disclosure of Personal Information about them. Notice will be provided in clear and conspicuous language. This explanation will be provided as soon as practicable and, in any event, before Aqur discloses the Personal Information or uses such information for a purpose materially different than that for which it was originally collected or processed. Where Aqur receives Personal Information from its subsidiaries, affiliates or other entities, including when acting as a Contract Research Organization (CRO) processing Personal Information under the direction of a customer, it will use such information in accordance with the notices provided by such entities and the choices made by the Individuals to whom such Personal Information relates.

In circumstances in which Aqur obtains personal data as a service provider for its clients or affiliates, Aqur’s clients or affiliates are responsible for providing appropriate notice to the Individuals whose personal data are transferred to the U.S. and obtaining any requisite consent (unless this function has been delegated to Aqur).

• Research Studies-Related Information. For Individuals participating in research studies being managed by Aqur as a CRO or in other situations where Aqur is participating in research studies, including patients, their spouses/partners, care givers, and relatives, clinical investigators or other study personnel, and other consultants, contractors, managers, and agents (who are natural persons) of the study sponsor and its corporate affiliates, business partners and third‐party service providers, Personal Information may be used in order to carry out the applicable studies and other study‐related services and/or pharmacovigilance. This may include the transfer of such Personal Information to the applicable study sponsor, its corporate affiliates, business partners and third‐party service providers performing services related to the study (e.g., study data management, clinical research monitoring services, safety monitoring, etc.).
• Human Resources-Related Information. For Individuals who are Personnel, we will process Personal Information to carry out and support our human resources functions and activities, including but not limited to, (i) evaluation of qualifications for an employment position; (ii) provision of employment benefits; (iii) administration and management of employees, compensation, stock options, grants and purchase plans, bonuses, retirement, training, and career planning; (iv) utilizing employee skills and ongoing employee resource allocation; (v) communicating with employees or their emergency contacts; (vi) administration of the company’s business including budgeting, manpower planning, and organizational design; (vii) authentication of the individual’s identity when gaining access to computer system applications; (viii) Personal Information data changes; (ix) employment status changes; (x) travel and expense planning and reimbursement; and (xi) evaluation of employee performance and time management; and (xi) management of Personnel performance, and implementation, investigation and reporting on compliance and discipline procedures and matters. Aqur may provide Personal Information to Agents to support Aqur in performance of these human resources‐related activities. Further information concerning how Aqur collects, uses, shares and safeguards the Personal Information of Company Personnel is available to Aqur Company Personnel in Aqur’s internal privacy policy. In addition, for job applicants, Personal Information will be used for the evaluation of suitability of the applicant for a position. Aqur may, under its discretion and with the consent of the candidate where required by law or otherwise obtained, perform such background checks as deemed appropriate to evaluate this suitability.
• Business Contacts. For Individuals who are business contacts of Aqur, Aqur may collect personal information concerning contact information for such business contacts. This information may be used for purposes consistent with the provision of information by these contacts, which may include marketing activities focused on sales of new products and services, requests to participate in market research that enhance Aqur’s product offerings and other business activities.
• Health Care Professionals. Aqur collects information about health care professionals directly from the health care professionals, from public sources and from business partners. We use this information in connection with various health care activities, including clinical trials, real world studies of patient treatment, health care outcomes analysis, market research activities, and other situations where primary intelligence from health care professionals is applicable. 
• Customers and Program Participant Information. For Individuals sharing Personal Information with Aqur in order to inquire about or otherwise make use of our services or purchase, receive or seek information, including about any health care products and services, opportunities to participate in clinical research, health care education and patient support programs which may be available through Aqur, we will use such Personal Information in order to provide the requested information, products, and/or services. Such uses may include but is not limited to processing requested transactions, improving the quality of our services, sending communications about the products and services available through Aqur, and enabling our business partners and Agents to perform certain activities on our behalf.
• Data Analytics Functions. In certain situations, Aqur obtains and processes information about Individuals for various data analytics purposes. In most situations, this data has been anonymized or de‐identified and is no longer Personal Information when it is obtained by Aqur (or when it is transferred to the United States). In some situations, Aqur receives Personal Information from a customer or other data supplier for the purpose of such anonymization or de‐identification. In other situations, the data that is obtained and processed by Aqur is pseudonymous. This pseudonymous information may be used for research purposes, primarily in connection with academic partners, with academia, and may be transferred by Aqur to the United States as part of these research-related activities. For all of these situations, Aqur’s activities are consistent with the notice and choice provided by these customers or data suppliers to Individuals, and Aqur’s use of this information is consistent with Aqur’s obligation to provide services to these entities. In those situations, and where such information is transferred to the United States, Aqur uses such information only in manners consistent with the Privacy Shield Principles and the manner in which this data was obtained.

Aqur may also use the Personal Information collected above to comply with our legal and regulatory obligations, policies and procedures, and for internal administrative purposes.

CHOICE:

Aqur will offer Individuals the opportunity, where practical and appropriate, to choose (optout) whether their Personal Information is (a) to be disclosed to a non‐agent third party, or (b) to be used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized by the Individual. 

Aqur will not process Sensitive Personal Information about Individuals for purposes other than those for which the information was originally obtained or subsequently authorized by the Individual unless the Individual explicitly consents to the processing (“opt‐in”), or as required or permitted, or where not prohibited by law or regulation. 

In some cases, even if an Individual opts‐out of disclosures of their Personal Information, Aqur may still disclose such Personal Information (i) if we are required to do so by law, court order or legal process; (ii) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; (iii) under the discovery process in litigation; (iv) to enforce Aqur policies or contracts; (v) to collect amounts owed to Aqur; (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; or (vii) in the good faith believe that disclosure is otherwise necessary or advisable. Aqur also may transfer Personal Information when a material event concerning its business operation(s), assets or shares, such as purchase, disposal, merger, joint venture or acquisition, is proposed or occurs. In such an event, Aqur will endeavor to direct the transferee to use Personal Information in a manner that is consistent with this Policy. Aqur will provide Individuals with reasonable mechanisms to exercise their choices to the extent required by applicable law. 

ONWARD TRANSFER:

In most situations, transfers to third parties are covered by the provisions in this Policy regarding notice and choice.

Aqur does not sell or otherwise disclose Individuals’ Personal Information, except as described in this Privacy Policy or in a notice provided to Individuals at the time of collection, or as Individuals explicitly consent. Aqur may share Individuals’ Personal Information with our service providers, consultants and affiliates for our and our affiliates’ internal business purposes or to provide Individuals with a requested service.

Aqur will endeavor to only transfer Personal Information to a third party/Agent where such third party/Agent has given assurances that it provides at least the same level of privacy protection as required by the Privacy Shield Principles and this Policy and will notify Aqur if it makes a determination, it can no longer meet this obligation. Aqur may, for example, provide an Individual’s Personal Information to Agents to host our databases, for data processing services, or to send to that Individual the information that he or she requested. Where Aqur has knowledge that an Agent is using or disclosing Personal Information in a manner contrary to the Privacy Shield Principles and/or this Policy, Aqur will take reasonable steps to prevent or stop the use or disclosure. With respect to onward transfers to Agents, Privacy Shield requires that, to the extent it is responsible for the event, Aqur shall remain liable should its Agents Process Personal Information in a manner inconsistent with the Privacy Shield Principles, and Aqur accepts and shall follow this principle.

Where Aqur knows that any third party to whom it has provided Personal Information is using or disclosing Personal Information in a manner contrary to this Policy and/or the Privacy Shield Principles, Aqur will take reasonable steps to prevent or stop the use or disclosure. With respect to such onward transfers to Agents, and to the extent Aqur is responsible for the event, Aqur shall remain liable should its Agents process Personal Information in a manner inconsistent with the Privacy Shield Principles and this Policy.

In circumstances in which Aqur obtains personal data as a service provider for its clients or affiliates, Aqur’s clients or affiliates are responsible for protecting individual rights with respect to onward transfers.

SECURITY:

Aqur will endeavor to take reasonable and appropriate technical, administrative and physical precautions designed to protect Personal Information in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the Personal Information Aqur is processing, and regardless of whether such Personal Information is in electronic or tangible, hard copy form.

DATA INTEGRITY AND PURPOSE LIMITATION:

Aqur endeavors to use Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the Individual. Aqur will take reasonable steps designed to ensure that only Personal Information that is relevant to its intended use, accurate, complete, current, and otherwise reliable in relation to the purposes for which the information was obtained is used by Aqur for as long as Aqur retains possession of such information. Aqur’s Personnel have a responsibility to assist Aqur in maintaining accurate, complete and current Personal Information. When acting as a CRO or in other situations where Aqur acts on behalf of another entity, Aqur endeavors only to process Personal Information that is relevant to the services it provides, and only for purposes compatible with those for which the Personal Information was collected. Where Aqur processes Personal Information as a CRO or otherwise acts under the direction of its customers, Aqur works with such customers so that the customers can provide a way for Individuals to correct or update their Personal Information. 

ACCESS:

Aqur will, on request, provide an Individual with confirmation regarding whether Aqur is processing Personal Information about them. In addition, upon request of an Individual, Aqur will take reasonable steps to correct, amend, or delete their Personal Information that is found to be inaccurate, incomplete or processed in a manner non‐compliant with this Policy or the Privacy Shield Principles, except where the burden or expense of providing access would be disproportionate to the risks to that Individual’s privacy, where the rights of persons other than the Individual would be violated or where doing so is otherwise consistent with Privacy Shield Principles. Unless prohibited by applicable law, Aqur reserves the right to charge a reasonable fee to cover costs for providing copies of Personal Information requested by Individuals.

In circumstances in which Aqur maintains personal data as a service provider for its clients or affiliates, Aqur ’s clients or affiliates are responsible for providing Individuals with access to their personal data and the right to correct, amend or delete the data where it is inaccurate. In these circumstances, Individuals should direct their questions to the appropriate Aqur client or affiliate. If they do not receive a response, Aqur will provide reasonable assistance in forwarding the Individual’s request.

RECOURSE, ENFORCEMENT AND LIABILITY:

Aqur encourages Individuals covered by this Policy to raise questions about the processing of Personal Information about them by contacting Aqur through the contact information provided below. Any Personnel that Aqur determines is in violation of the Privacy Shield Principles and/or this Policy will be subject to disciplinary action up to and including termination of employment, where applicable, in accordance with Aqur’s disciplinary procedures.

In accordance with the Privacy Shield Principles, Aqur commits to resolve complaints about Individuals’ collection or use of your Personal Information. Any Individuals with inquiries or complaints regarding this Policy or the use or disclosure of Personal Information in accordance with the Privacy Shield Principles should first contact Aqur using the contact information given below. Aqur will investigate and attempt to resolve complaints and disputes regarding use and disclosure of Personal Information in accordance with the Principles contained in this Policy. In addition, Aqur has further committed to cooperate with the panel established by the EU data protection authorities (“DPAs”) and comply with the advice given by the panel with respect to unresolved Privacy Shield complaints related to Individuals’ human resources data transferred from the EEA in the context of the employment relationship. Aqur commits to cooperate with the Swiss Federal Data Protection and Information Commissioner (FDPIC) and comply with the advice given by such authorities with regard to human resources data transferred from Switzerland in the context of the employment relationship. If you do not receive timely acknowledgement of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact the EU DPAs or Swiss FDPIC, as applicable, for more information or to file a complaint. The services of EU DPAs and Swiss FDPIC are provided at no cost to Individuals. If any request remains unresolved, Individuals may, under certain circumstances, have a right to invoke binding arbitration under Privacy Shield; The Federal Trade Commission has jurisdiction over Aqur’ compliance with the Privacy Shield Principles.

In addition, Aqur has agreed to cooperate with JAMS with respect to complaints of Individuals that are not Personnel of the Company and with the local data protection authorities with respect to Personnel and human resources related information. For more information and to submit a complaint to JAMS, visit https://www.jamsadr.com/dpf-dispute-resolution. Such independent dispute resolution mechanisms are available to Individuals free of charge. If any request remains unresolved, Individuals may have a right to invoke binding arbitration under Privacy Shield.

In circumstances in which Aqur obtained or maintains Personal Information as a CRO or other Service Provider, Individuals may submit complaints concerning the processing of their Personal Information to the relevant client, in accordance with the client’s dispute resolution process. Aqur will participate in this process at the request of the client or the Individual. Aqur will take steps to remedy any issues arising out of potential failure to comply with the Privacy Shield Principles.

CONTACT INFORMATION:

Questions, comments, concerns or complaints regarding this Policy or Aqur’s processing of Personal Information should be submitted to Aqur by clicking here. 

RESERVATION OF RIGHTS:

Aqur reserves the right to share an Individual’s Personal Information and contracts with Agents as required or authorized by law or regulation or in response to duly authorized information requests of government authorities.

CHANGES TO THE PRIVACY POLICY:

This Policy may be reviewed and amended from time to time, without advance notice, to ensure that an appropriate level of protection for Personal Information is maintained. All amendments will be posted on this website.

Please check back periodically for updates to this Policy.