Thank you for visiting the Website of Idorsia Pharmaceuticals Ltd. (“Idorsia”, “we”). This Privacy Policy applies to personal data collected from Idorsia’s online resources and communications (such as websites, e-mail, and other online tools). For purposes of this Privacy Policy, “Personal Data” is any information by which you can be individually identified both directly and indirectly, including, but not limited to, your name, address, e-mail address, and telephone number. This Privacy Policy does not apply to personal information collected from offline resources and communications, except in cases where such personal information is consolidated with personal information collected by Idorsia online. This Privacy Policy also does not apply to third-party online resources to which Idorsia’s websites may link, where Idorsia does not control the content or the privacy processes. This Privacy Policy governs the manner in which your Personal Data is collected, stored and processed by Idorsia. This Privacy Policy may be updated from time to time and is valid in the version which is current at the time of accessing the Idorsia website (hereinafter the “Website”). With the use of the Website, you agree to the terms of this Privacy Policy.

Statutory data privacy laws and regulations or the relevant jurisdictions will apply in addition to this Privacy Policy.

Personal Information

We generally do not collect, process and use any of your Personal Data if you visit our Website for informational purposes only. We may collect your personally identifiable information (such as name, address, telephone number, e-mail address or other identifying information) only when you choose to submit it to us.

Registration:

Some of the services provided on the Website may require registration. When registering with Idorsia, you may need to complete certain data fields and choose a username and password. This registration may disclose certain Personal Data (such as your name, home address, email address and other). Please note that in the event you decide to withhold certain Personal Data, it may not be possible for you to access certain parts of the Website or for Idorsia to respond to your request.

Automatically collected Information

We automatically receive certain types of information whenever you interact with us on our Website and in some e-mails we may send each other. Automatic technologies we use may include,

• IP address
• Date and time the web page was accessed
• Name and address of the website accessed
• URL
• Web page from which you are accessing
• HTTP status code
• Volume of data transferred
• Browser type
• Language and version of browser software

We process your Personal Data on our Website for many reasons, including:

• To respond to your requests or inquiries;
• To provide you with the services and information offered through the Website;
• To personalize your visit to this Website;
• To perform Website analytics and measure Website performance;
• To maintain the Website, including for security purposes.
• To track and monitor adverse events and other activities related to pharmacovigilance; and
• To tell you about products and services offered by us.

Processing for security purposes

We also process your personal data for security purposes, e.g. by means of a firewall, spam filters or anti-virus software.

Idorsia may use selected third party service providers to provide us with services, including companies that provide us with technical support and assistance in respect of the Website, who may have access to your Personal Data while performing services on our behalf.

We may also share your Personal Data as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary. We may also transfer your Personal Data to another entity in the event of any reorganization, merger, sale, joint venture, assignment, or transfer of all or any portion of our business or assets.

Any third parties retained by Idorsia are contractually required to process your Personal Data only to the extent to which Idorsia is permitted to process your Personal Data itself and such third parties must guarantee the same safeguards as observed by Idorsia.

Idorsia will not share any Personal Data that is sensitive (e.g. biometrics, genetics or medical history) with any third party without your prior and explicit consent, and you may always withdraw your consent at any later time. Please note that if you withdraw your consent, Idorsia may not be able to comply with some of your requests. However, Idorsia will, where practicable, inform third parties to whom your Personal Data has been transferred of your withdrawal of consent.

Idorsia will not make your Personal Data available to any recipients that are domiciled in countries that do not provide for adequate data protection as the level applicable in the country referenced in the Imprint of the Website, unless Idorsia enters into appropriate contractual arrangements with such foreign recipients, as for example the Standard Contractual Clauses issued by the European Commission (you have the right to request a copy of those clauses at the address below).

Idorsia ensures appropriate data privacy in compliance with statutory requirements. In particular, Idorsia protects the Website and all other systems using your Personal Data in an appropriate manner by means of technical and organizational measures against loss, destruction, access, modification or divulgence of your Personal Data by or to unauthorized third parties.

If you disclose Personal Data pertaining to third parties to Idorsia, you are responsible for the third parties’ consent and for the accuracy of the information provided. Idorsia assumes no responsibility for the disclosure and/or accuracy of these third-party data.

Idorsia reserves the right to save your Personal Data as long as there is a legitimate reason for it or until you request its deletion in writing. Statutory data retention requirements remain reserved.

Idorsia reserves the right to retain your personal data for as long as necessary for the purpose for which the personal data was collected or until you request in writing that it be deleted. Statutory retention obligations remain unaffected.

Cookies

The Website uses "cookies". Cookies are small text files sent by the corresponding web server to your browser upon first visiting of the Website and saved onto your device or in the cache of the browser. When the same device accesses the Website the next time, the browser checks whether a corresponding cookie is already available. The browser then sends the data saved in the cookie back to the web server. That way the web server can detect whether the browser has already visited the respective Website.

The data collected with the help of cookies are merely used by Idorsia or its service provider to analyze the usage and to improve the Website and its functionalities. There is no other use of the data, nor are the data under any circumstances used to identify you personally.

You can set your browser not to save any cookies of the Website on your hard disk, or have your browser delete the cookies already saved on your device respectively. However, you should bear in mind that by doing so you may no longer be able to use all the provided functions of the Website. The procedure to change the browser settings vary from browser to browser. Information on how to modify or define your browser settings can be found in the "Help" menu of each browser.

Idorsia Cookie Policy shall apply accordingly.

Google Analytics

The Website uses Google Analytics, a web-analyzing service by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA ("Google"). Google Analytics uses cookies. The information created by the Google Analytics cookie regarding the usage of this Website (including the IP addresses) is sent to, and saved onto, a Google server in the USA. If IP-anonymity is activated on the Website, your IP address will be shortened by Google beforehand. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. Google will use this information to analyze the usage of the Website, compile reports on the web traffic for the Website owners and provide other services related to the usage of the Website and the Internet. Furthermore, Google will send this information to third parties only if required by law or if third parties will process this information on behalf of Google. The IP address disclosed by your web browser in the context of Google Analytics will not be aggregate with other data compiled by Google.

A specific setting of your web browser allows you to prevent cookies from being saved; however, you are reminded that you will no longer be able to use all the functions of the Website in full.

Use of Social Plugins: Facebook, Twitter, Google+, and YouTube

Our Website uses social plugins ("Plugins") of the social networks facebook.com, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"), twitter.com, operated by Twitter Inc., 795 Folsom Street, Suite 600, San Francisco, CA 94107, USA ("Twitter")and youtube.com, operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”) (Youtube, Facebook, Twitter, and Google+ hereinafter referred to as "Social Networks"). The Plugins are labeled with an icon of the corresponding Social Network.

When you visit a Website containing Plugins, your browser establishes a direct connection to the servers of the corresponding Social Network. The content of the Plugins is directly transmitted from the Social Network to your browser and linked to the Website. Due to the integration of the Plugins, the Social Network is notified that your browser has called up the Website.

If you are logged in on the corresponding Social Network, it can assign the access of the Website to your account of the corresponding Social Network. When you interact with the Plugins, for instance with Facebook's "Like" button, or add a comment, the corresponding information is transmitted from your browser directly to the corresponding Social Network and stored there.

Please refer to the data privacy statements of Facebook, Twitter, Google+, or YouTube regarding the purpose and extent of data collection, the processing and usage by the corresponding Social Networks, as well as your rights in this respect and setting options for protecting your privacy.

Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on our Website. The provider is Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland ("Google"). The purpose of reCAPTCHA is to verify whether data entry on our Website (e.g. in a contact form) is made by a human or by an automated program, script or bot. For this purpose, reCAPTCHA analyzes the behavior of the Website visitor based on various characteristics. This analysis starts automatically as soon as the Website visitor enters the Website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent by the Website visitor on the Website or mouse movements made by the user). The data collected during the analysis is forwarded to Google. If you have any concerns in connection with the use of Google reCAPTCHA you may block Google reCAPTCHA by installing e.g. a plug-in in your browser. A plug-in for the most common browsers can be downloaded here.

Contact form: Should you send us requests via the contact form, we will collect the data entered on the form, including the contact details you provide, to be able to get in touch with you and answer your question and any follow-up questions. We may pass on your data within Idorsia or to our external service provider. We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Any mandatory statutory provisions, especially those regarding mandatory data retention periods, remain unaffected by this provision.

Stay Informed Media Releases: If you would like to receive the “Stay Informed” offered on the Website, we require from you information that allows us to verify that you agree to receive the newsletter. Further data is not collected or only on a voluntary basis. Where necessary for the registration, dispatch and administration of the newsfeed, we may pass on your data within Idorsia affiliates or to our external service provider. The processing of the data entered in the registration form is based exclusively on your consent. You can revoke your consent to the storage of the data, the e-mail address and their use for sending the newsfeed at any time, for example via the "unsubscribe" link in the Stay Informed message. The legality of the data processing operations already carried out remains unaffected by the revocation. The data you provide for the purpose of receiving the newsfeed will be stored by us until you unsubscribe from the newsfeed and will be deleted after you unsubscribe.

External links: Our website may contain links to third-party websites over whose processing we have no control, e.g. if personal data is transmitted to the third party by clicking on the link (e.g. your IP address or the URL of our website on which the link is located). We assume no responsibility for the processing of personal data by third parties. Rather, the respective data protection provisions of the third party apply.

There is no automated decision-making, including profiling, based solely on automated processing that produces legal effects vis-à-vis you or similarly significantly affects you.

Idorsia provides adequate data protection in compliance with the law. In particular, Idorsia protects the Website and all other systems that use your personal data in an appropriate manner by technical and organizational measures against loss, destruction, access, alteration or disclosure of your personal data by or to unauthorized third parties.

Idorsia attempts to ensure that your Personal Data are updated, accurate and complete according to the information that has been provided.

You may at any time request information on the data saved on your person by using the contacts mentioned below. You may also request the deletion or correction of your Personal Data, or request limited processing or data portability. Your Personal Data will then be deleted, transferred or blocked at once, unless there are statutory data retention obligations on our part; in such case your Personal Data will be stored but not processed until expiration of the retention obligation. Idorsia will address your request in a prompt and accurate manner and free of charge. Any request related to the exercise of your privacy rights shall be sent through the contact form to the Data Protection Officer (see below), or in writing to the following address:

Switzerland: Idorsia Pharmaceuticals Ltd, Attn.: Data Protection Officer, Hegenheimermattweg 91, 4123 Allschwil, Switzerland.

China: Idorsia (Shanghai) Pharmaceuticals Co., Ltd, Room 311, No. 6, Lane 368, Lushuo Road, Shanghai, PRC

Canada: Idorsia Pharmaceuticals Canada Ltd., 220-6500 RTE TranscanadiennePointe-Claire Québec H9R0A5

France: Idorsia Pharmaceuticals France SAS, Immeuble Colisée Gardens Bâtiment B, 8-14 Avenue de l'Arche, FR-92400 Courbevoie

Germany:

• Idorsia Pharmaceuticals Deutschland GmbH, Marie-Curie-Strasse 8 DE-79539 Lörrach
• Idorsia Pharmaceuticals Germany GmbH, Dachauer Straße 63, 80335 München
• Idorsia (Berlin) Pharmaceuticals GmbH, Magnusstrasse 11 D-12489 Berlin

Italy: Idorsia Pharmaceuticals Italy S.R.L, Via Vittor Pisani 15 IT-20124 Milano

The Netherlands: Idorsia Pharmaceuticals Ltd, Dutch branch, Saturnusstraat 46, 2132HB Hoofddorp

Nordics: Idorsia Pharmaceuticals Nordics AB, c/o FirstOffice, Gustav III:s Boulevard 42, 169 73 Solna, Sweden

Spain: Idorsia Pharmaceuticals Spain S.L., Paseo de la Castellana 79 ES-28046 Madrid

UK: Idorsia Pharmaceuticals UK Limited, 20 Eastbourne Terrace, London, W2 6LG United Kingdom

USA:

• Idorsia US Holding Company Inc., c/o Corporation Service Company 251 Little Falls Drive Wilmington, DE 19808 USA
• Idorsia Clinical Development US Inc., c/o Corporation Service Company 251 Little Falls Drive Wilmington, DE 19808 USA
• Idorsia Pharmaceuticals US Inc., c/o Corporation Service Company 251 Little Falls Drive Wilmington, DE 19808 USA

For further information, please contact the Data Protection Officer.

• Data Protection Officer