KalVista Pharmaceuticals Privacy Notice

This privacy notice (“Notice”) sets out how KalVista Pharmaceuticals uses and protects any information that you give Kalvista Pharmaceuticals when you use this website. To review our Supplemental Consumer Privacy Notice for residents of applicable U.S. States, please see below.

We are committed to protecting and securing  your personal information. In order to prevent unauthorized access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

This Privacy Notice explains how we process personal information of the users of our Website and other services that KalVista may provide. This Notice describes our customary practices regarding how we, as a controller or a business, collect, disclose, retain, use, and otherwise process (“Process”) Personal Information. Personal Information does not include, and this Notice does not apply to, aggregate information or information that has been de-identified or anonymized in accordance with applicable law. Any specific privacy notice will be delivered to the data subjects for that specific purpose(s).  This is a notice of our privacy practices; it does not create any agreement between the parties.

For the purposes of applicable data protection and privacy laws, KalVista Pharmaceuticals (“KalVista”, “us”, “we”), with its registered offices at 55 Cambridge Parkway, Suite 901E, Cambridge, Massachusetts 02142 USA, or Porton Science Park, Bybrook Rd, Porton Down, Wiltshire, SP4 0BF, United Kingdom is considered the “business” or “data controller” in respect of the personal information that it collects, uses and manages in accordance with this Notice.

1. What is personal information?

Personal information is any information which relates to an identified or identifiable living individual. Examples include name, address, email address, phone number, IP address, location data, or cookies. Email address is the only one of these personal information types that may be processed if you interact with our website.

2. What are the types of personal information that we Process?

During the last 12-months, we may use the following personal information about you (below is not a full accounting of the data related to any category):

• Contact information: name, address, email address, phone number, date of birth, and other similar contact information.
• Health information: health statistics, tests, results, diseases, symptoms, therapies, medications, patient or research study id, outcomes, barriers to access, insurance information, and dates of service.
• Mental and physical characteristics: eye color, height, weight, attitude, and emotions.
• Employment information: employer, job title, specialty, employment history, awards and honors, membership in professional organizations, speaking engagements, and affiliations with patient advocacy organizations.
• Education history: degrees, level of education attained, institutions attended, majors and areas of study, and grades.
• Job candidates and recruitment related information: social security number; government issued identification number; interview information and notes; employment information; employee termination information; race or ethnic origin; credit history; criminal history; immigration status, work permit status; and other appropriate information.
• Photograph, audio, or video information.
• System Account information: username and password.
• Financial information: bank account information, credit card number, and bank accounts.
• Inferences: notes about preferences and aptitudes.
• Opinions or statements: publicly available social media posts and opinions.
• Internet or other electronic network activity information: IP address, country or geographic region location, browser type, device type, operating system, dates, and times you access our services, browsing history, and other information about your interactions with our online services. We collect such information through cookies and other tracking technologies. Please see our “Cookies and Other Tracking Technologies” section below.

3. How do we collect your personal information?

We may collect or obtain personal information:

• Directly from you or someone acting directly on your behalf, such as a caregiver
• From your healthcare provider (“HCP”), including hospitals, clinics, doctors, and other HCPs
• From contract research organizations (“CROs”) or clinical research investigators (“PIs”)
• From industry and patient advocacy organizations (“PAOs”)
• From third party service providers, business partners, and data aggregators
• From government authorities or public sources
• Through our Sites or social media
• Automatically through cookies, or other technologies (explained more below)

4. The purposes for which we process your personal information

We process your personal information for the following business, commercial, and operational purposes (If applicable laws require a “legal basis” to Process personal information, we indicate our legal bases applicable for only for those jurisdictions. The legal bases provided herein do not apply in any jurisdictions not requiring such.):

From time-to-time, KalVista may provide a privacy notice or just-in-time privacy notice specific to a Processing. In the event that such notice conflicts in any way with the information provided herein, including any legal bases, that notice will govern that processing activity.

With your consent/explicit consent, or if you are a Minor (explained more below), with your or your parent’s or legal guardian’s consent, to:

• As part of your participation in our clinical research (when consent and explicit consent are the applicable legal bases only, otherwise for more clarity, please refer to your applicable informed consent document for more information about applicable legal bases), patient support programs, or other Processing related to patients. In addition to the information contained in this Notice, this Processing will be in accordance with any privacy notice provided for this activity.
• Send communication, promotional and other materials (where consent is required under applicable law). You have the right to opt out of communications at any time. We use your contact information, like name, address, email, phone, etc. for this purpose.
• Evaluate job candidates, including receiving and reviewing any job applications, obtaining information from external recruiters or websites, talking to references, and performing legally permissible background checks. We use your contact information, employment-related information, education history, demographic information, and medical certificate, if required by local applicable employment law. For more information, please also visit https://privacy.adp.com/privacy.html?locale=en_US.
• Collect information from or about you (where consent is required under applicable law) for internal and external use. We use your contact information, photographs, audio, video, and sensitive information, such as health and medical information and mental and physical characteristics.

Related to contract (including pre-entering a contract) between us:

• Hiring you to provide services or partner with you. We may use your contact information and financial information.
• Giving donations, grants, and access to products through compassionate use. We may use your contact information, health information, mental and physical characteristics, employment-related information, education history, and demographic information. For access to products through compassionate use, KalVista using reasonable efforts to maintain your confidentiality, even from us, as such we rely on your HCP to provide you with any Notice and provide us with the appropriate limited Personal Information on your behalf.
• Other contractual interactions.

Required in accordance with our legitimate interests:

• Operating and administration of KalVista’s business, including but not limited to supporting safe, responsible, compliant, and ethical business and commercial operations; facilitating quality and safety of our products and research; conducting audits and investigations; managing our financial and other accounts; developing and improving our products; etc. We may use any of the categories of personal Information, including but not limited to contact information, background information, education history, and photographs, video, and audio information.
• Interacting with you when you contact us. We may use your contact information or any other Personal Information you share with us. KalVista requests that you do not share any sensitive or health information with us unless we request it under obligations under law.
• Processing and responding to any unsolicited requests for information. KalVista requests that you do not provide any sensitive or health information.
• Identifying potential candidates for recruitment via online or public sources. We may use your contact information, professional or employment-related information, education history, and demographic information.
• Operating the KalVista Website, the Mind The HAE Attack website and any other KalVista websites. We may use Internet and other electronic network activity information, including but not limited to IP (Internet Protocol) address, country or geographic region location, browser type, device type, operating system, dates/times you access our services, browser history, and other information about your interactions with the Sites. We can collect such information through cookies and other tracking technologies, for more information please see our “Cookies and Other Tracking Technologies” section below.
• Protecting rights and interests, including but not limited to protecting the health, safety, and security of KalVista, its employees, patients, caregivers, HCPs, and the general public; enforcing our legal rights; and pursuing remedies or otherwise taking steps to limit losses and liabilities. We may use your contact information to investigate violations of our contracts or health and medical information in an emergency.
• De-identification of your personal information. In accordance with applicable legal requirements, we may de-identify or anonymise personal information from and about you so that it can no longer be linked to you. Information that has been de-identified/anonymised (as applicable by law) in such a way is no longer subject to this Notice and can be used and shared by KalVista at our discretion.

When required by law, for example, by:

• Monitoring and reporting pharmacovigilance and the safety, quality, and complaints related to our products and any clinical research. We may use your contact information, health information, and mental and physical characteristics. We process this personal information only when required by law and as necessary for reasons of public interest in the area of public health.
• Complying with transparency requirements. We may use your contact information, employment-related information, and financial information.
• Ensuring compliance with applicable laws and regulations. We may use your contact information and financial information.
• Responding to legal inquiries, requests, and summons. We may use your contact information, employment-related information, financial information, contractual information, and other information.

Due to the nature of our business, KalVista may be subject to a number of legal requirements, thus requiring KalVista to Process personal information and sensitive information (including health information and mental and physical characteristics) to meet these requirements. When permissible under the law, we will attempt to limit and protection the Processing of your personal information to the extent possible, for example, pseudonymizing information, while still complying with our legal obligations. To the extent applicable, KalVista will reasonably rely on the authority of HCPs, and any other individuals to act on your behalf. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. §164.512(b) allows for health professionals to release information concerning adverse events/side effects to pharmaceutical companies.

5. Who do we share your personal information with?

KalVista may share your personal information:

• with people within the company who have a “need to know” that data for business or legal reasons (e.g., to direct a query that you have submitted to the relevant person within KalVista);
• with third parties, vendors and service providers, including KalVista’s advisors, suppliers of IT services and third parties engaged by KalVista, under the legal bases set out above;
• with business partners, including but not limited to research collaborators, co-developers, co-promotors, and co-licensors;
• with a third-party related to a business transfer, including by not limited to as part of a sale, assignment, or transfer of a KalVista business or asset, or an acquisition of or merger with another entity. We may also share your personal information in contemplation of such transactions, such as due diligence;
• with government or law enforcement agencies (where required or permitted by applicable laws, court orders, or government relations);
• with third parties to protect rights and interests, including when needed for audits, investigations, or to respond to inquiries/complaints, etc.; and
• with your consent or as directed by you.

Because KalVista operates in the UK, Ireland, Switzerland, Japan and the US, we may share the personal information you submit to us with other locations.

6. Transfers of personal information

Please note that any person to whom KalVista may disclose your personal information under this Notice may be situated in a country other than your own and that such country may provide a lower level of data protection requirements than your own country.

Whenever we transfer personal information across borders, we take legally required steps to ensure that appropriate safeguards are in place to protect your personal information and to make sure it is treated in accordance with this Notice, including but not limited to utilizing data transfer mechanisms permitted under applicable laws such as standard contractual clauses. If you are located in the UK, you can request a copy of the safeguards which we have put in place to protect your personal information and privacy rights in these circumstances. Contact information can be found on the Contact page of our website.

7. How long do we retain your personal information?

Your personal information is not kept for longer than is necessary for the purposes for which it is collected, unless a longer period is required to comply with applicable laws and regulations. To determine appropriate retention periods, we assess the personal information type and nature, the Processing involved, our interaction with you, and any other legal obligations. Data and records (including personal information) are deleted from our systems when no longer required. Please contact us if you would like more information on applicable retention periods.

8. How do we secure your personal information?

Securing your personal information is very important to KalVista, which is why we maintain privacy and security measures and controls designed to help protect your personal information. No security measure, however, is 100% effective and we cannot guarantee total security of your personal information. Please take steps to protect yourself, including using and protecting your unique login credentials and passwords, utilizing encryption, personal firewalls, and anti-virus solutions.

9. Your rights

Many jurisdictions, including certain U.S. States, afford data subject rights. We comply with any applicable laws permitting data subject rights and will honor requests according to applicable laws. Depending on your jurisdictions, your rights may include the following:

• You may opt out of communications from us at any time by following any Unsubscribe or opt-out instructions in the communication, including selecting the unsubscribe link. We may still need to send you important administrative messages even if you opt out of receiving communications;
• To the extent provided for under applicable law, you may request a copy of the personal information that we hold about you, access to, rectification of, opt-out of, deletion of, restrict, object to, or to limit the processing of your personal information;
• You may also request to obtain a portable copy of your personal information;
• In addition, you may at any time withdraw your consent without any legal effect impacting you at any time.
• Automated decision making: KalVista does not engage in any Automated Decision making.

Please submit your written request to the Data Protection Officer via info@KalVista.com, however, cannot guarantee that we will be able to provide every right or continue certain activities after respecting your request.

10. Questions and complaints

If you have a concern or complaint about how KalVista has used your personal information, as a first step, you should raise this in writing with KalVista. Please see the Contact page on our Website or contact us at

KalVista Pharmaceuticals                                              KalVista Pharmaceuticals Ltd.

55 Cambridge Parkway, Suite 901E                            Porton Science Park, Bybrook Rd,

Cambridge, Massachusetts 02142 USA                   Porton Down, Wiltshire, SP4 0BF, United Kingdom

If you are not satisfied with the handling of your concern or complaint by KalVista, you can escalate this to your national Supervisory Authority, if applicable – available here.

11. Cookies

Cookies and other tracking technologies can be used for the following purposes:

• A cookie is a small data file that a website may write to and sometimes store on your hard drive when you visit. A cookie file can contain information (such as a user ID) that the website can use to track the pages you have visited. A cookie cannot read data from your hard disk or read cookie files created by other websites. Your browsers may be set-up to automatically accept cookies, however, you can change your browser settings at any time to deny all cookies or specific types of cookies. Please note that if you deny certain cookies, the websites that you visit might not be fully functional.
• A web beacon allows website providers to see what you have accessed on the website.

The KalVista Website leverages Google Analytics to help measure, collect, analyze, and report on the Website’s usage to better optimize and enhance the Website or to understand user preferences. We use Google Analytics to track user traffic patterns and to provide a better service for users when they visit the website. To learn more about Google’s privacy practices, please review the Google Privacy Policy. To prevent Google Analytics from using your information for analytics, you can install the Google Analytics Opt-Out Browser Add-on here.

Users can set their browsers to provide notification when a cookie is received, and the opportunity to accept or reject the cookie. Users can also refuse all cookies by turning the function off in their browsers. However, to ensure the full functionality of the KalVista Website, the use of cookies is required.

Do Not Track Signals: At this time we do not respond to browser ‘do not track’ signals. Third parties, including our service providers, may collect information about your online activities over time and across different websites, including when you visit the Website. To learn more about how to exercise your choice regarding the collection of information about your online activities over time and across third-party websites or online services by visiting http://www.aboutads.info/ and http://www.networkadvertising.org/ack’ signals.

12. Links to Other Websites

Our Website may contain links to other websites of interest. However, once you have used these links, you will have left our Website. Please note that we do not have any control over that other website, their privacy policies or practices. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Notice. You should exercise caution and look at the privacy statement applicable to the website in question.

13. Personal information related to Minors

It is not KalVista’s intent to Process personal information related to individuals under 18 (“Minors”). If we determine that we have or are Process personal information related to Minors, we will seek the consent of their parent or guardian or will take reasonable steps to delete the personal information, as permitted by applicable laws.

14. Updates

We may change this Notice ay any time and without notice. Please check back regularly to stay up to date with the most recent version.

Last updated: September 2024

 

SUPPLEMENTAL PRIVACY NOTICE FOR CALIFORNIA AND CERTAIN OTHER U.S. STATE RESIDENTS

This Supplemental Notice of Privacy Practices (“Supplemental Notice”) describes KalVista’s Processing of Personal Information of consumers residing in California and certain other U.S. States.

We do not sell Personal Information as the term “sell” is traditionally understood or defined as a “sale” or “sharing” under applicable California Privacy law. We do not knowingly sell the Personal Information of consumers under 16 years of age.

The types of personal information that we Process:

During the last 12-months, we may use the following personal information about you (below is not a full accounting of the data related to any category):

• Contact information: name, address, email address, phone number, date of birth, and other similar contact information.
• Health information: health statistics, tests, results, diseases, symptoms, therapies, medications, patient or research study id, outcomes, barriers to access, insurance information, and dates of service.
• Mental and physical characteristics: eye color, height, weight, attitude, and emotions.
• Employment information: employer, job title, specialty, employment history, awards and honors, membership in professional organizations, speaking engagements, and affiliations with patient advocacy organizations.
• Education history: degrees, level of education attained, institutions attended, majors and areas of study, and grades.
• Job candidates and recruitment related information: social security number; government issued identification number; interview information and notes; employment information; employee termination information; race or ethnic origin; credit history; criminal history; immigration status, work permit status; and other appropriate information.
• Photograph, audio, or video information.
• System Account information: username and password.
• Financial information: bank account information, credit card number, and bank accounts.
• Inferences: notes about preferences and aptitudes.
• Opinions or statements: publicly available social media posts and opinions.
• Internet or other electronic network activity information: IP address, country or geographic region location, browser type, device type, operating system, dates, and times you access our services, browsing history, and other information about your interactions with our online services. We collect such information through cookies and other tracking technologies. Please see our “Cookies and Other Tracking Technologies” section below.

We may collect or obtain personal information:

• Directly from you or someone acting directly on your behalf, such as a caregiver
• From your healthcare provider (“HCP”), including hospitals, clinics, doctors, and other HCPs
• From contract research organizations (“CROs”) or clinical research investigators (“PIs”)
• From industry and patient advocacy organizations (“PAOs”)
• From third party service providers, business partners, and data aggregators
• From government authorities or public sources
• Through our Sites or social media
• Automatically through cookies, or other technologies (explained more below)

We process your personal information for the following business, commercial, and operational purposes:

• As part of your participation in our clinical research, patient support programs, or other Processing related to patients. In addition to the information contained in this Notice, this Processing will be in accordance with any privacy notice provided for this activity. For more clarity regarding any Processing related to clinical research, please refer to your applicable informed consent documentation.
• Send communication, promotional and other materials. You have the right to opt out of communications at any time. We use your contact information, like name, address, email, phone, etc. for this purpose.
• Evaluate job candidates, including receiving and reviewing any job applications, obtaining information from external recruiters or websites, talking to references, and performing legally permissible background checks. We use your contact information, employment-related information, education history, demographic information, and medical certificate, if required by local applicable employment law. For more information, please also visit https://privacy.adp.com/privacy.html?locale=en_US.
• Collect information from or about you (where consent is required under applicable law) for internal and external use. We use your contact information, photographs, audio, video, and sensitive information, such as health and medical information and mental and physical characteristics.
• Hiring you to provide services or partner with you. We may use your contact information and financial information.
• Giving donations, grants, and access to products through compassionate use. We may use your contact information, health information, mental and physical characteristics, employment-related information, education history, and demographic information. For access to products through compassionate use, KalVista using reasonable efforts to maintain your confidentiality, even from us, as such we rely on your HCP to provide you with any Notice and provide us with the appropriate limited Personal Information on your behalf.
• Other contractual interactions.
• Operating and administration of KalVista’s business, including but not limited to supporting safe, responsible, compliant, and ethical business and commercial operations; facilitating quality and safety of our products and research; conducting audits and investigations; managing our financial and other accounts; developing and improving our products; etc. We may use any of the categories of personal Information, including but not limited to contact information, background information, education history, and photographs, video, and audio information.
• Interacting with you when you contact us. We may use your contact information or any other Personal Information you share with us. KalVista requests that you do not share any sensitive or health information with us unless we request it under obligations under law.
• Processing and responding to any unsolicited requests for information. KalVista requests that you do not provide any sensitive or health information.
• Identifying potential candidates for recruitment via online or public sources. We may use your contact information, professional or employment-related information, education history, and demographic information.
• Operating the KalVista Website, the Mind The HAE Attack website and any other KalVista websites. We may use Internet and other electronic network activity information, including but not limited to IP (Internet Protocol) address, country or geographic region location, browser type, device type, operating system, dates/times you access our services, browser history, and other information about your interactions with the Website. We can collect such information through cookies and other tracking technologies, for more information please see our “Cookies and Other Tracking Technologies” section below.
• Protecting rights and interests, including but not limited to protecting the health, safety, and security of KalVista, its employees, patients, caregivers, HCPs, and the general public; enforcing our legal rights; and pursuing remedies or otherwise taking steps to limit losses and liabilities. We may use your contact information to investigate violations of our contracts or health and medical information in an emergency.
• De-identification of your personal information. In accordance with applicable legal requirements, we may de-identify personal information from and about you so that it can no longer be linked to you. Information that has been de-identified in such a way is no longer subject to this Notice and can be used and shared by KalVista at our discretion.
• Monitoring and reporting pharmacovigilance and the safety, quality, and complaints related to our products and any clinical research. We may use your contact information, health information, and mental and physical characteristics. We process this personal information only when required by law and as necessary for reasons of public interest in the area of public health.
• Complying with transparency requirements. We may use your contact information, employment-related information, and financial information.
• Ensuring compliance with applicable laws and regulations. We may use your contact information and financial information.
• Responding to legal inquiries, requests, and summons. We may use your contact information, employment-related information, financial information, contractual information, and other information.

Due to the nature of our business, KalVista may be subject to a number of legal requirements, thus requiring KalVista to Process personal information and sensitive information (including health information and mental and physical characteristics) to meet these requirements. When permissible under the law, we will attempt to limit and protection the Processing of your personal information to the extent possible, for example, pseudonymizing information, while still complying with our legal obligations. To the extent applicable, KalVista will reasonably rely on the authority of HCPs, and any other individuals to act on your behalf. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. §164.512(b) allows for health professionals to release information concerning adverse events/side effects to pharmaceutical companies.

Consumer Privacy Rights

Many jurisdictions, including certain U.S. States, afford data subject rights. In addition, the State of California affords consumers certain additional rights with respect to their personal information. You may exercise the rights applicable to you by emailing us at info@kalvista.com. At this time, KalVista does not reach the threshold compliance levels for any applicable U.S. State Consumer Privacy laws. In the event that any U.S. State Consumer Privacy Law becomes applicable to KalVista, we will comply permitting consumer privacy rights and will honor requests according to applicable laws. Depending on your jurisdictions, your rights may include the following:

• You may opt out of communications from us at any time by following any Unsubscribe or opt-out instructions in the communication, including selecting the unsubscribe link. We may still need to send you important administrative messages even if you opt out of receiving communications.
• To the extent provided for under applicable law, you may request access to, correction of, opt-out of the sale of, or deletion of the Personal Information we process about you.

Verification: When you make a request, please provide your full name (first and last name), email address, city, and state of residence, and which of the right(s) described above that you are requesting. We will verify your request against our records. We cannot fulfill any unverified or incomplete requests.

We do not and will not discriminate against you for exercising your data subject rights, however, we cannot guarantee that all services and features will be available and will not be impacted because of your request.

You may designate an authorized agent to request data subject rights on your behalf by providing a signed and authenticated letter that identifies (i) your agent and (ii) the purposes for and nature of your appointment of an agent. If you are an authorized agent, you must provide the information described in “Verification” hereinabove about the consumer for which you are acting as an agent, as well as your own full name (first and last name), email address, and a letter, signed by the consumer, that appoints you as their agent. In some instances, we may decline to honor your request if an exception applies under applicable law, however we will respond to your request in compliance with applicable law.

 

We may change this Notice at any time and without notice. Please check back regularly to stay up to date with the most recent version.

Contact Us:

If you wish to contact KalVista about your personal information, please see the Contact page on our Website or contact us at:

KalVista Pharmaceuticals

55 Cambridge Parkway, Suite 901E

Cambridge, Massachusetts 02142 USA

Email: info@kalvista.com

 

Last updated: September 2024