U.S. Consumer Health Data Privacy Policies

UNITED STATES

Effective date: 02 February, 2025

• Washington
• Nevada

Washington Consumer Health Data Privacy Policy

The Washington My Health, My Data Act ("MHMDA") provides consumers residing in Washington and consumers whose consumer health data is collected in Washington ("Washington Consumers", "you", or "your") with specific rights regarding their consumer health data.

This Washington State Consumer Health Data Privacy Policy supplements our Verona Pharma, plc Privacy Policy and applies solely to Consumer Health Data (as defined below) of Washington Consumers collected by Verona Pharm, plc in connection with our products, services and websites (collectively the "Services"). It explains how we collect, share and use your Consumer Health Data, and how you can exercise your privacy rights.

"Consumer Health Data" means personal information that is linked or reasonably linkable to a consumer and that identifies past, present or future physical or mental health status.

"Personal Information" is defined as information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer. Personal Information includes, but is not limited to, data associated with a persistent unique identifier, such as a cookie ID, an IP address, a device identifier, or any other form of persistent unique identifier.

1. Categories of Consumer Health Data We Collect

The Consumer Health Data we collect varies based on your relationship with us.

We may collect the following categories of Consumer Health Data.

• Biographical and demographic information to the extent related to physical or mental health status, diagnosis, disease or treatment (such as age, gender).
• Health and medical information (such as information about physical health conditions, treatment, diseases, or diagnosis; medical interventions; use or purchase of prescribed medication).
• Location data such as state, including precise location information that could reasonably indicate your attempt to acquire or receive health care services or supplies.
• Records of your communications and other requests. For example, if you email, call, or otherwise communicate with us or with members of our team (e.g., when you fill out a form on one of our websites or sign up for news and updates from us).
• Information we may collect via automated means or derive about you, which could include any information that we, or one of our processors, processes to associate or identify you with the data described above that is derived or extrapolated from non- health information. Such information may also include your device and browser information, activities and usage data about your use of our Services, location information derived from your IP address or your mobile device, your online activity through cookies and similar technologies.

2. How We Use Consumer Health Data

We may use your Consumer Health Data for the following purposes:

• Providing Services and support. To provide and make available our Services; to communicate with you about your use of and interactions with our Services; to respond to your inquiries; to fulfill your orders and requests; to enroll you in our programs; to monitor, maintain and improve our Services.
• Customization and personalization. To tailor content we may send or display on our Services, including to offer location customization and personalized help and instructions, and to otherwise personalize your experiences.
• Marketing and advertising. To the extent permitted by applicable law, we use certain information of your Consumer Health Data for marketing and advertising purposes. For example, to send you information about our Services, such as newsletters and other information we think may interest you, as well as any other information that you sign up to receive. We also may use certain information we collect to manage and improve our marketing and advertising strategies.
• Security and protection of rights. To prevent, detect, protect against, and respond to security incidents, malicious or deceptive activities, or any illegal activity under state or federal law; preserve the integrity and security of our systems; and investigate, report, or prosecute those responsible for any illegal action under state or federal law.
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us; provided that we will not disclose your Consumer Health Data to a third party and or build a profile about you or otherwise alter your experience outside your current interaction with us.
• Quality, safety and regulatory reporting. To undertake activities to verify or maintain the quality or safety of a product, service that is owned, manufactured by, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service that is owned, manufactured, manufactured for, or controlled by us. We may record and report on information collected in association with product safety or quality, and other adverse event reports in compliance with our legal regulatory obligations. We may also contact you to seek additional information from individuals who report or communicate such product safety, quality, and other adverse event information, in order to fulfill our legal and regulatory obligations.
• Compliance with law and legal process. To comply with legal and regulatory obligations, respond to legal processes and in relation to legal proceedings, as well as for regulatory reporting and recordkeeping purposes.

Where legally required, we obtain consent from you for certain processing activities at the time of collection of your Consumer Health Data.

3. Sources from which We Collect Consumer Health Data

We may collect your Consumer Health Data online and offline in a few different ways:

Consumer Health Data that you provide. We may collect Consumer Health Data directly from you when you: (1) access or use our Services, (2) visit our websites, (3) communicate with us about our business or our Services, (4) sign up for our newsletters or other informational or marketing materials, (5) attend our programs or events, (6) register in a patient support program, and (7) interact with us in any other way.

Consumer Health Data from third-party sources. We may also obtain your Consumer Health Data indirectly from the following sources, including, but not limited, to:

• Healthcare providers (including specialty pharmacies);
• Health insurance companies (health plans) and other payors;
• Those authorized on your behalf such as authorized/legal representatives, family members, and caregivers;
• Payment processors and other financial institutions;
• Consumer reporting agencies and other third parties who verify the information you provide;
• Advertising partners who provide digital marketing services;
• Third-party service providers who provide website and online security services;
• benefit verification, program enrollment, and product fulfillment services in connection with our products and Services;
• digital marketing and analytics services for us using cookies and similar technologies that contain a unique identifier, such as an advertising ID;
• access to information you make publicly available, such as social media platforms;
• supplemental consumer data or data analytics and market research services, such as data aggregators;
• Third-party service providers who help us maintain the accuracy of our data and data aggregators that help us complete and enhance our records;
• Third-party service providers who assist with fraud prevention, detection, and mitigation;
• Third-party service providers who facilitate, process, and complete transactions for us, such as resellers, sales agents, and program partners.

Consumer Health Data collected from devices you use to connect with us or use our Services. When permitted, we may collect your Consumer Health Data from your mobile devices, other internet-connected devices and cookies and other similar technologies when you visit or interact with our websites, applications and online platforms, open or click on emails we send you and interact with our advertisements.

Drawn from other information we collect. Depending on your use of our Services, we may also draw inferences from the information we collect, such as your preferences, characteristics, attributes, and abilities.

4. Categories of Consumer Health Data that We Share

In the last twelve months, we may have disclosed or shared all of the categories of Consumer Health Data that we collect, as disclosed above in Section 1.

5. Third Parties With Whom We Share Consumer Health Data

We may share your Consumer Health Data with the following third parties:

• Our affiliates and related companies;
• Healthcare providers (including specialty pharmacies);
• Health insurance companies (health plans) and other payors;
• Authorized/legal representatives, family members, and caregivers;
• Third parties that help administer, manage, and analyze our programs and Services;
• Third parties with whom we have joint marketing and similar arrangements;
• Third parties who provide benefit verification, program enrollment, and product fulfillment services in connection with our products and Services;
• marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, email marketing vendors, and data analytics vendors;
• Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention;
• Third party network advertising partners;
• Third parties who assist with our information technology and security programs; fraud prevention, detection, and mitigation;
• Third parties as necessary to complete transactions and provide our products/Services, including delivery companies, agents, and manufacturers;
• Consumer reporting agencies;
• Our lawyers, auditors, and consultants;
• Legal and regulatory bodies and other third parties as required by law.

Where legally required, we enter into contracts to restrict non-affiliated parties' use of your Consumer Health Data.

6. How to Exercise Your Rights with Respect to your Consumer Health Data

Subject to certain limitations, you may have the right to access, to obtain a copy of, to delete your Consumer Health Data and to withdraw your consent relating to such data where applicable.

You can exercise your rights with respect to your Consumer Health Data, by contacting us at any time through any of the following methods.

• Mail. Verona Pharma plc.; 8529 Six Forks Road, Suite 400; Raleigh, North Carolina 27615


• Email. legal@veronapharma.com


• Telephone. 1 833-417-0262

We will respond to your request as required by applicable law. When you submit a request regarding your Consumer Health Data, we reserve the right to verify your identity to help ensure that we provide the information we maintain to the individuals to whom it pertains and allow only those individuals to exercise rights with respect to that information.

If you request an appeal of a denial of rights under the Washington My Health My Data Act and the appeal is denied, you may raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Disclaimer

Verona Pharma websites link to other websites. These include links to websites operated by businesses, government agencies, educational organizations, and non-profit organizations. When you link to another site, you are no longer on the Verona Pharma website and this Washington State Consumer Health Data Privacy Policy will not apply. When you link to another website, you are subject to the privacy policy of that site.  

Supplemental Notice for Nevada Consumers

This Supplemental Notice applies to Nevada Consumers for purposes of providing additional disclosures required by Nevada's Consumer Health Data privacy law.

Purposes & Manner of Processing. We collect, use, process, and share Consumer Health Data for the purposes and in the manners described in Sections 1 through 4 of our Washington Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.

Review & Revision of Consumer Health Data. If you would like to review and/or revise your Consumer Health Data, you may submit a request to us via any of the methods listed in our Washington Consumer Health Data Privacy Policy. We will respond to your requests to exercise your rights in accordance with applicable law.

Changes to this Supplemental Notice. We will notify you before making any changes to our privacy practices with respect to your Consumer Health Data by posting an updated notice on this page, with an updated effective date.

Third Party Collection of Consumer Health Data. We may use third parties, including cookie providers and other online trackers, to collect your Consumer Health Data over time and across different websites or online services when you use our websites or online services. Please note that third parties may be able to collect Consumer Health Data from you over time and across different websites depending on your browser, browser add-ons, and associated permissions you set on your device. This collection of Consumer Health Data by those third parties is unrelated to Verona Pharmas' collection of Consumer Health Data from you, and we encourage you to view those third parties' privacy notices for more information about their processing of Consumer Health Data and the methods they provide to allow you to opt out of such processing.