Health Care Professional

May 2024 v1

This Privacy Notice explains how BicycleTX Limited, Blocks A & B Portway Building, Granta Park, Great Abington, Cambridge CB21 6GS (collectively referred to as  “Bicycle”, “we” or “our”) may collect your personal data directly from  you and from third-party sources such as the organization where you work, public available sources, interactions with us (including online available sources), and as a result of your business and professional relationship with us.

1. We may collect the following categories of personal data:

• Contact details such as full name, age/date of birth, business affiliations, business contact information (postal address, telephone or fax number, email address), medical speciality, professional details, and accomplishments such as training and qualification, past or present organizational or institutional affiliations, membership in association and boards, details about paper or articles you may have published, or research conducted. The personal data collected may include your medical licence identification number and licencing status where required or permitted by law.
• Details of interactions with us, such as meetings we have held, product request information, opinions and requests about our products and services, training acknowledgements.
• Financial information, such as bank account number, and payments and other transfers of value details received from your interactions with us. The personal data collected may include tax identification number where required or permitted by law.
• Communications and other personal preferences. Data collected from cookies and online tracking systems in case of online interactions.
• Photograph and video taken on events organized or sponsored by us.

2. We may use your persona data for the following purposes:

• Based in our legal and regulatory obligations:
  • Medical Information requests, Pharmacovigilance and adverse event monitoring, reporting, auditing to inquires or issues in relation to our services and products.
  • Compliance with applicable laws and regulations including code of conduct (e.g., tracking and reporting of payments and other transfers of value subject to local requirements, evaluate your request for a medical education grant, grant for scientific advancement and/or company sponsorship and corporate membership, conflict of interest reporting, finance obligations, pharmacovigilance and medical information reports).
  • To respond legal proceedings and government investigations (such as warrants, subpoenas, and court or legal orders).
• For the performance of a contract with have entered with you or with the institution you work for and manage collaboration and payments.
• Based on our legitimate interest in developing and improving our services:
  • Managing and improving our relationships with you, including planning, organizing and reviewing any collaboration with you, engage in scientific exchange, and responding to your questions and requests about our services and products.
  • Communicating with you, subject to local consent requirements, engaging and helping ensure that we provide you, on-line and off-line, with information that is relevant based on your expertise, interests, and preferences such as speaking engagement, seminars, trainings, focus groups or other HCPs engagement functions, or about general health information or scientific programs.
  • To administer patient-support programs and provide access to you where applicable.
  • To manage business transactions, respond to product orders and to determine your eligibility for certain product or programs.
  • Research and analytics purposes, including market research, to develop, evaluate and improve our products, services, materials and treatments.
  • Our internal organizational planning and development.
  • Internal accounting and analysis in connection with internal policies and rules, such as Code of Business Conduct.

3. We may share or disclose your personal data with or to:

• Our affiliates and/or research and commercial partners, for the purposes defined above.
• Third parties with whom we contract to represent or carry out services on our behalf. If we do, we will require that these third parties acting on our behalf protect the confidentiality and security of your Personal Data that we share with them. We will seek to ensure that these third parties contractually agree that they will not use or disclose your Personal Data for any other purposes than necessary to provide us services, perform services on our behalf, or to comply with applicable laws or regulations.
• Potential or actual third-party purchasers in case Bicycle decides to reorganize or divest its business: If we decide to reorganize or divest our business through a sale, merger, or acquisition, we may share your Personal Data with actual or prospective purchasers. We will require that any such purchasers treat your Personal Data consistently with this Privacy Notice.
• Other third parties in the event of a court order, to protect Bicycle’s interests or as otherwise required by law or regulation.
• Government agencies, auditors, and authorities. Bicycle may disclose your Personal Data, including your financial relationship with you and any amounts you have been paid, to government authorities, publicly accessible transparency and disclosure registers, auditors, and agencies, relating to its regulatory activities, in response to authorized information requests, or as otherwise required by laws, regulations, or industry codes.

4. International data transfers:

Bicycle may need to transfer your personal data outside your home country to countries that do not offer same level of data protection, including United States. Bicycle and its third parties are contractually obligated to protect and process your personal information in accordance with this privacy notice and to comply with applicable laws or regulations, including having a valid EU Personal Data cross-border transfer mechanism in place to receive the EU personal data, which can include an “adequacy” determination by the European Commission, and/or executing EU (and UK) Standard Contractual Clauses with Bicycle and Transfer Impact Assessments, and/or other transfer legal mechanism and safeguards. For residents in EU: a copy of the Bicycle intra company agreement which incorporates the EU SSCs can be obtained by sending an email to privacy@bicycletx.com.

Bicycle will take appropriate technical and organizational security measures to protect your personal data consistent with applicable privacy and data security laws. We will retain your personal data only for as long as we reasonably consider it necessary for achieving the purposes set out in this Privacy Policy, or for as long as we are required by law and regulations to retain it. If you have questions about applicable retention periods, please contact us.

5. Your data privacy rights:

You have the right to access, correct, erase, restrict, object and ask that we transfer the information you gave us from one organisation to another, or give it to you. To exercise any of these rights, or if you have any question about the processing of your personal data, please contact us at privacy@bicycletx.com

If you are not able to resolve a problem directly with us, you have right to lodge a complaint with your country-specific data protection authority.

6. Additional information:

Bicycle may update this notice from time to time. Please, refer to the Bicycle’s website at https://www.bicycletherapeutics.com/information/privacy/  for updated versions of this notice and for additional information how Bicycle processes personal data. If you have any questions about this notice or Bicycle’s handling of your personal data, please contact us at privacy@bicycletx.com.

May 2024 v1

This Privacy Notice explains how BicycleTX Limited, Blocks A & B Portway Building, Granta Park, Great Abington, Cambridge CB21 6GS (collectively referred to as  “Bicycle”, “we” or “our”) may collect your personal data directly from  you and from third-party sources such as the organization where you work, public available sources, interactions with us (including online available sources), and as a result of your business and professional relationship with us.

1. We may collect the following categories of personal data:

• Business contact details such as full name, age/date of birth, business affiliations, business contact information (postal address, telephone or fax number, email address), medical speciality, professional details, and accomplishments such as training and qualification, past or present organizational or institutional affiliations, membership in association and boards, details about paper or articles you may have published, or research conducted. The personal data collected may include your medical licence identification number and licencing status where required or permitted by law.
• Details of interactions with us, such as meetings we have held, product request information, opinions and requests about our products and services, training acknowledgements.
• Financial information, such as bank account number, and payments and other transfers of value details received from your interactions with us. The personal data collected may include tax identification number where required or permitted by law.
• Communications and other personal preferences. Data collected from cookies and online tracking systems in case of online interactions.
• Photograph and video taken on events organized or sponsored by us.

2. We may use your persona data for the following purposes:

• Based in our legal and regulatory obligations:
  • Medical Information requests, Pharmacovigilance and adverse event monitoring, reporting, auditing to inquires or issues in relation to our services and products.
  • Compliance with applicable laws and regulations including code of conduct (e.g., tracking and reporting of payments and other transfers of value subject to local requirements, evaluate your request for a medical education grant, grant for scientific advancement and/or company sponsorship and corporate membership, conflict of interest reporting, finance obligations, pharmacovigilance and medical information reports).
  • To respond legal proceedings and government investigations (such as warrants, subpoenas, and court or legal orders).
• For the performance of a contract with have entered with you or with the institution you work for and manage collaboration and payments.
• Based on our legitimate interest in developing and improving our services:
  • Managing and improving our relationships with you, including planning, organizing and reviewing any collaboration with you, engage in scientific exchange, and responding to your questions and requests about our services and products.
  • Communicating with you, subject to local consent requirements, engaging and helping ensure that we provide you, on-line and off-line, with information that is relevant based on your expertise, interests, and preferences such as speaking engagement, seminars, trainings, focus groups or other HCPs engagement functions, or about general health information or scientific programs.
  • To administer patient-support programs and provide access to you where applicable.
  • To manage business transactions, respond to product orders and to determine your eligibility for certain product or programs.
  • Research and analytics purposes, including market research, to develop, evaluate and improve our products, services, materials and treatments.
  • Our internal organizational planning and development.
  • Internal accounting and analysis in connection with internal policies and rules, such as Code of Business Conduct.

3. We may share or disclose your personal data with or to:

• Our affiliates and/or research and commercial partners, for the purposes defined above.
• Third parties with whom we contract to represent or carry out services on our behalf. If we do, we will require that these third parties acting on our behalf protect the confidentiality and security of your Personal Data that we share with them. We will seek to ensure that these third parties contractually agree that they will not use or disclose your Personal Data for any other purposes than necessary to provide us services, perform services on our behalf, or to comply with applicable laws or regulations.
• Potential or actual third-party purchasers in case Bicycle decides to reorganize or divest its business: If we decide to reorganize or divest our business through a sale, merger, or acquisition, we may share your Personal Data with actual or prospective purchasers. We will require that any such purchasers treat your Personal Data consistently with this Privacy Notice.
• Other third parties in the event of a court order, to protect Bicycle’s interests or as otherwise required by law or regulation.
• Government agencies, auditors, and authorities. Bicycle may disclose your Personal Data, including your financial relationship with you and any amounts you have been paid, to government authorities, publicly accessible transparency and disclosure registers, auditors, and agencies, relating to its regulatory activities, in response to authorized information requests, or as otherwise required by laws, regulations, or industry codes.

4. Data Security and retention:

Bicycle will take appropriate technical and organizational security measures to protect your personal data consistent with applicable privacy and data security laws. We will retain your personal data only for as long as we reasonably consider it necessary for achieving the purposes set out in this Privacy Policy, or for as long as we are required by law and regulations to retain it. If you have questions about applicable retention periods, please contact us.

5. If you are a California resident, you have the following rights:

• Right to Know. You have the right to request: (i) the categories or personal information we collected about you; (ii) the categories of sources from which the personal information is collected; (iii) our business or commercial purposes for collecting, selling, or sharing personal information; (iv) the categories of third parties to whom we have disclosed personal information; and (v) a copy of the specific pieces of personal information we have collected about you.
• Right to Delete. You have the right to request we delete personal information that we have collected from you.
• Right to Correct. You have the right to request that we correct inaccuracies in the personal information we maintain about you.
• Right to Opt-Out of Sales and Sharing. You have the right to opt-out of “sales” and “sharing” of your personal information, as those terms are defined under California privacy laws and regulations. However, Bicycle does not “sell” your personal data as defined under California privacy laws and regulations.
• Right to Limit Use and Disclosure. You have the right to limit the use and disclosure of your sensitive personal information.
• Right to Non-Discrimination. You have the right not to be subjected to discriminatory treatment for exercising any of the rights described in this section.

To exercise any of these rights, or if you have any question about the processing of your personal data, please contact us at privacy@bicycletx.com.

6. Additional information:

Bicycle may update this notice from time to time. Please, refer to the Bicycle’s website at https://www.bicycletherapeutics.com/information/privacy/  for updated versions of this notice and for additional information how Bicycle processes personal data. If you have any questions about this notice or Bicycle’s handling of your personal data, please contact us at privacy@bicycletx.com.