A. Content

Every time a customer ("you" or "Customer") accesses a website (the “Website”) of Idorsia Pharmaceuticals Ltd or one of its affiliates ("Idorsia"), he or she discloses certain personal data. Therefore, we kindly ask you to read this Privacy Policy carefully. This Privacy Policy governs the manner in which your personal data is collected, stored and processed by Idorsia. This Privacy Policy may be updated from time to time and is valid in the version which is current at the time of accessing the Website. With the continued use of the Website, you agree to the terms of this Privacy Policy.

Statutory data privacy laws and regulations or the relevant jurisdictions will apply in addition to this Privacy Policy.

B. Processing of Personal Data

Some of the services (the “Services”) provided on the Website may require registration. When registering with Idorsia, you may need to complete certain data fields and choose a user name and password. This registration may disclose certain personal data (“Data”) such as your name, home address, email address and other. Please note that in the event you decide to withhold certain Data, it may not be possible for you to access certain parts of the website or for Idorsia to respond to your request.

Furthermore, the date and time of access, the name and address of the accessed website, your device's IP address, the URL from which you have accessed the Website, transmitted data volume, as well as information on type and version of the browser you are using may be logged.

Idorsia will only process your Data for the purpose of the Services, for customer care, technical administration and for its own marketing purposes. Your Data will only be disclosed to third parties if and to the extent it is required for the Services provided through the Website or if and to the extent you have given your prior consent. Idorsia will only collect, store and process your Data lawfully, in good faith, proportionally and for the purposes mentioned in this Privacy Policy. Any third parties retained by Idorsia are contractually required to process your Data only to the extent to which Idorsia is permitted to process your Data itself and such third parties must guarantee the same safeguards as observed by Idorsia.

Idorsia will not share any Data that is sensitive (e.g. medical history) with any third party without your prior and explicit consent, and you may always withdraw your consent at any later time. Please note that if you withdraw your consent, Idorsia may not be able to comply with some of your requests. However, Idorsia will, where practicable, inform third parties to whom your Data has been transferred of your withdrawal of consent.

Idorsia will not make your Data available to any recipients that are domiciled in countries that do not provide for adequate data protection as the level applicable in the country referenced in the Imprint of the Website, unless Idorsia enters into appropriate contractual arrangements with such foreign recipients, as for example the Standard Contractual Clauses issued by the European Commission (you have the right to request a copy of those clauses at the address below).

Idorsia ensures appropriate data privacy in compliance with statutory requirements. In particular, Idorsia protects the Website and all other systems using your Data in an appropriate manner by means of technical and organizational measures against loss, destruction, access, modification or divulgence of your Data by or to unauthorized third parties.

If you disclose Data pertaining to third parties to Idorsia, you are responsible for the third parties’ consent and for the accuracy of the information provided. Idorsia assumes no responsibility for the disclosure and/or accuracy of these third-party data.

Idorsia reserves the right to save your Data as long as there is a legitimate reason for it or until you request its deletion in writing. Statutory data retention requirements remain reserved.

C. Cookies

The Website uses "cookies". Cookies are small text files sent by the corresponding web server to the Customer's browser upon first visit of the Website and saved onto the Customer's device or in the cache of the browser. When the same device accesses the Website the next time, the browser checks whether a corresponding cookie is already available. The browser then sends the data saved in the cookie back to the web server. That way the web server can detect whether the browser has already visited the respective Website.

The data collected with the help of cookies are merely used by Idorsia or its service provider to analyze the usage and to improve the Website and the Services. There is no other use of the data, nor are the data under any circumstances used to identify you personally.

You can set your browser not to save any cookies of the Website on your hard disk, or have your browser delete the cookies already saved on your device respectively. However, you should bear in mind that by doing so you may no longer be able to use all the provided functions of the Website. The procedure to change the browser settings vary from browser to browser. Information on how to modify or define your browser settings can be found in the "Help" menu of each browser.

Idorsia Cookie Policy shall apply accordingly.

D. Google Analytics

The Website uses Google Analytics, a web-analyzing service by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA ("Google"). Google Analytics uses cookies. The information created by the Google Analytics cookie regarding the usage of this Website (including the IP addresses) is sent to, and saved onto, a Google server in the USA. If IP-anonymity is activated on the Website, your IP address will be shortened by Google beforehand. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. Google will use this information to analyze the usage of the Website, compile reports on the web traffic for the Website owners and provide other services related to the usage of the Website and the Internet. Furthermore, Google will send this information to third parties only if required by law or if third parties will process this information on behalf of Google. The IP address disclosed by the Customer's web browser in the context of Google Analytics will not be aggregate with other data compiled by Google.

A specific setting of their web browser allows Customers to prevent cookies from being saved; however, they are reminded that that they will no longer be able to use all the functions of the Website in full. Furthermore, Customers can prevent the capture of the data created by the cookies and related to their usage of the Website (including their IP address), as well as the processing of the data by Google, by downloading and installing the following browser plugin available at this link.

E. Use of Facebook, Twitter, Google+, and YouTube Plugins

Some Websites use social plugins ("Plugins") of the social networks facebook.com, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"), twitter.com, operated by Twitter Inc., 795 Folsom Street, Suite 600, San Francisco, CA 94107, USA ("Twitter"), plus.google.com, operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (“Google+”) and youtube.com, operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”, Facebook, Twitter, and Google+ hereinafter referred to as "Social Networks"). The Plugins are labeled with an icon of the corresponding Social Network.

When you visit a website containing Plugins, your browser establishes a direct connection to the servers of the corresponding Social Network. The content of the Plugins is directly transmitted from the Social Network to your browser and linked to the Website. Due to the integration of the Plugins, the Social Network is notified that your browser has called up the Website.

If you are logged in on the corresponding Social Network, it can assign the access of the Website to your account of the corresponding Social Network. When you interact with the Plugins, for instance with Facebook's "Like" button, or add a comment, the corresponding information is transmitted from your browser directly to the corresponding Social Network and stored there.

Please refer to the data privacy statements of Facebook, Twitter, Google+, or YouTube regarding the purpose and extent of data collection, the processing and usage by the corresponding Social Networks, as well as your rights in this respect and setting options for protecting your privacy.

F. Owner of the Data File

Idorsia Pharmaceuticals Ltd, Hegenheimermattweg 91, 4123 Allschwil, Switzerland, is the owner of the Data file.

Idorsia’s legal representative in the European Union is Idorsia Pharmaceuticals Deutschland GmbH, Marie-Curie-Strasse 8, 79539 Lörrach, Germany.

G. Exercise of Privacy Rights

Idorsia attempts to ensure that your Data are updated, accurate and complete according to the information that has been provided. You are entitled to access your Data at any time. In addition, you have the right to rectification, deletion, limitation of processing and data portability of your Data. However, requests to delete personal data will be subject to applicable legal reporting, document filing or retention obligations Idorsia must comply with. Idorsia will address your request in a prompt and accurate manner and free of charge. Any request related to the exercise of your privacy rights shall be sent through the contact form to the Data Protection Officer, or in writing to the following address:

Idorsia Pharmaceuticals Ltd, Hegenheimermattweg 91, 4123 Allschwil, Switzerland.

For further information please contact the Data Protection Officer.