HCP Privacy Notice

March 22, 2024

This Healthcare Professional Privacy Notice (“HCP Privacy Notice”) informs you of the  processing and use of your personal identifiable information, also known as Personal Data (as that term is defined under applicable data protection legislation) in your capacity as physician or other healthcare professional, including when you work on behalf of a Healthcare Organisation (i.e. hospital). It also informs you of your  rights  about the processing of your personal data.

If any Amylyx website or document (for example, a contract) contains a different HCP privacy notice, the language of that notice will take precedence over this HCP Privacy Notice in the event of a conflict between the two.

The Amylyx entities responsible for the processing of your personal data are:

• Amylyx Pharmaceuticals, Inc. (43 Thorndike Street, Cambridge MA 02141, United States) and its affiliates and subsidiaries including:
  • Amylyx Pharmaceuticals Canada Inc.
  • Amylyx Pharmaceuticals Japan K.K.
  • Amylyx Pharmaceuticals EMEA B.V. (Barbara Strozzilaan 201, 1083 HN Amsterdam, Netherlands); 
  • Amylyx country affiliate that is dealing with the relationship with you, as listed in the contact details section.jointly referred to as “Amylyx” (or "us", "we", or "our").

jointly referred to as “Amylyx” (or "us", "we", or "our").

What personal data we process

Personal data is all data that identifies you directly or in combination with other data. The personal data we collect, store and use includes: 

• Personal Identification & Contact information, including your name,  email address, , professional phone number, medical ID number, postal address, 
• Professional Qualification and other professional details information about your function, such as your title, self-employed or hospital employment status, country of business, position, role, name of the company/ institution you work for, specialty area, academic degree, training and qualifications, organizations or institutional affiliations;
• Information on our interactions, such as information about the activities and interactions you have with us, information about the programs and activities in which you have participated, your prescribing of our products and the agreements you have executed with us and other information you provide to us (e.g. in emails, on phone calls, in research projects, or in other correspondence with us or our service providers or business partners);
•  Information on our agreements, such as information on our terms of engagement and, if applicable, payment and transfer of value-related information (e.g. bank information, credit card details and tax identification number);
• Media, such as photographs, audio recordings, video recordings and/or other types of media productions, including virtual meetings and webinars, that capture your voice and/or image; 
• Communication channel preferences, for example whether you prefer to receive certain types of information by email, SMS/WhatsApp or in writing;
• Areas of medical/scientific interest, such as your interest in and participation to scientific or medical events/topics in the field of neurology and neurodegenerative diseases and information provided to register for medial scientific and educational materials and newsletters;
•  Marketing preferences, such as your preferences for receiving product related communications, newsletter and any other information about Amylyx products and relevant disease areas, including information on new developments and topics in the field of neurology and neurodegenerative diseases that may be of interest to you; 
• Segmentation and profile information, such as your username and password when using our websites as well as demographic and profiling information, such as your area of expertise, number of patients, participation in clinical trials, participation in  congresses, international recognition, geographical area of activities, area of research, participation in  medical professional associations, professional interests and preferences, involvement in local/regional or national guideline development;
• Websites usage information and cookies, such as information that we collect when you use Amylyx websites, like IP domain, how you interact with our websites, and cookie preferences; and
• Publicly available information, such as publications, your affiliation with  scientific/ medical networks and comments describing support for and experience with our products.

The personal data is collected from you directly or from professional business partners that work with us (like Veeva Open Data) and that may share your personal data based on the agreement that you have with such business partners. We may also collect personal data from publicly available sources, such as professional social networks and your organization’s website.

There is no obligation to provide personal data to us. However, not providing certain personal data may prohibit us from engaging with you or entering into an agreement with you. 

How and Why we Use your Personal Data

We will collect your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. We process your personal data for the following purposes:

1. Maintaining our professional relationship (e.g., manage and update our global Customer Relationship Management system, organize and manage visits and calls, communicate with you about upcoming meetings and events for which you have registered and sending customer surveys). Our processing of your personal data is necessary to help us  to improve our products and services as well as maintain and grow our relationship with you.
2. Entering into and fulfilling obligations in relation to contracting with you (e.g. enter into pre-contractual steps, meeting our contractual obligations, including billing, invoicing, collecting payments, archiving, record keeping, tax and reporting obligations). Our processing of your personal data is necessary to (a) enter into and/or perform the agreement we have with you); (b) comply with a legal obligation to keep, process and disclose certain personal data (e.g. for tax reporting and mandatory transparency requirements under applicable law); and (c) to generally comply with the local laws and regulations that govern our business(e.g. for tax reporting under foreign national laws).
3. Keeping our systems and services safe (e.g. fraud prevention and security reporting). Our processing of your personal data is necessary to serve our legitimate interests (Art. 6 (1) f) of the GDPR) of keeping our systems, services and products safe and secure.
4. Identification and authentication: (e.g. verify your identity when you communicate with us and secure your personal data). Our processing of your personal data is necessary to to authenticate the identity of our website users or the recipients of a particular content, so we can be sure to provide information to the intended addresses and protect the privacy and security of our systems.
5. Communicating with you: (e.g. contact you for important medical or safety information, medical information, respond to your queries and provide you with requested support). Our processing of your personal data is necessary (a) for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract; (b) to respond to your questions; and (c) comply with our legal obligations to provide you updated safety information or manage product recalls. of the GDPR).
6. Exchange information within Amylyx group of companies: (e.g. exchange your contact details and other information about the relationship with you with other companies of the Amylyx group, in their capacity either as data controllers or data processors). Our processing of your personal data is necessary to centralize data processing activities, the implementation of organizational and security measures at group level and allow cross-company teams to work together efficiently. 
7. Safeguard Amylyx’ business interests, including against legal claims and in legal proceedings: (e.g. detect, prevent and respond to fraud claims, intellectual property infringement claims or violations of law or misuse of our products, services and websites and provide evidences). Our processing of your personal data is necessary to conduct our business and defend our interests against legal claims and in legal proceedings. 
8. Report safety and quality issues: (e.g. comply with the requirement to report product complaints and safety issues). Our processing of your personal data is necessary to comply with a legal obligations on pharmacovigilance and quality of medicinal products.).
9. Meet industry guidelines relating to transparency (as opposed to mandatory law which is described above under point 2(b)): (e.g. track and disclose the values we transfer to you in our interactions with us). Our processing of your personal data is necessary to comply with industry requirements/guidelines and to conduct our business in a transparent manner.
10. Research and analysis (e.g. improving, developing and customizing our products and services and analyzing our dataset, obtaining your professional insight, perform market research, registry and real world evidence studies, define new target populations and/or indications and improve patients’ health conditions and quality of life). Our processing of your personal data is necessary for improving or developing products and services. If required under applicable laws, we will obtain your consent for such research and analysis purposes. 
11. Exchange medical scientific materials, information and invitations to industry, academic and scientific events: (e.g. providing scientific/educational materials, publications and newsletters, real-world data and information on a particular scientific or medical topic and/or event in the field of neurology and neurodegenerative diseases). Our processing of your personal data is necessary to proactively provide medical/scientific information and invitations to scientific events according to your interests, provided that you have not opted-out from receiving such type of communications. Where legally required, we will request your prior consent). You can unsubscribe from  medical/scientific information and communications at any time by using the relevant “Unsubscribe” link within the relevant email, or by sending us an email at privacy@amylyx.com specifying the type of information and/or channel you wish to change your preference to; for example, with an email entitled “Unsubscribe from emails on medical scientific information”. 
12. Sending of marketing materials, information and invitation to product related or company events: (e.g. send you marketing information, product related information, communications and recommendations on our products, services and events and relevant disease areas regarding neurology and neurodegenerative diseases). Our processing of your personal data is to proactively provide marketing information and invitations to promotional events according to your interests, provided that you have not opted-out from receiving such type of communications. Where legally required, we will request your prior consent. You can unsubscribe from product related information and communications at any time by using the relevant “Unsubscribe” link within the relevant email, or by sending us an email at privacy@amylyx.com specifying the type of information and/or channel you wish to change your preference to; for example, with an email entitled “Unsubscribe from emails on product related information”.
13. Manage digital interactions: (e.g. inviting to you to participate to online meetings and webinars, including those organized by third party business parties instructed by us to develop and/or host meetings and webinars, and in line with your medical scientific and marketing preferences). Our processing of your personal data is necessary to allow meetings and webinars to be performed through digital platforms;
14. Segmentation activities and profiling: (i.e. segmentation activities based on non-invasive categories such as, among others, the professional category to which you belong, the city/province/region in which you are based, the type of product or service used, the way you interact with us). Subject to your consent for the processing of your personal data for proactive (medical and/or product related) information and communications, and as long as you have not opted-out from receiving them, the segmentation activities described may also be carried out for the sending of personalized communications referred to in the points 11, 12 and 13 above. Our processing of your personal data is necessary to define how best we can organize our activities and optimize our interactions and communications based on your preferences. If required under applicable laws, we will obtain your prior consent  for profiling purposes. You have the right to object to our processing of your personal data for such purposes at any time.
15.  Improve our websites with usage information and cookies: (a) on an aggregate user level (e.g. through web analytics), support and improve the functionality of and better understand usage patterns relating to our websites and how you access different features of our website for analytics purposes; and (b) on an individual level, obtain insights regarding your preferences and interests by tracking your browsing behavior on the Amylyx  websites you visit, so that we may use this information to tailor our interactions (including face-to-face meetings and other communications) with you. Depending on applicable local requirements, the setting of cookies on your browser may  be subject to your consent (except for strictly necessary cookies) and, if so, processing of information from these cookies will only occur for those Amylyx websites where such cookies are enabled and only to the extent that you have accepted the placement of those cookies on your browser. By accepting cookies you also consent to the processing of your personal data in this relation. In some cases, depending on applicable local requirements, processing of your personal data through performance and advertising cookies may be based on a opt-out mechanism. In any event, you could change the cookie setting preferences at any time and for more information, please consult the cookie policy of the Amylyx website you are visiting.
16. Audio-video recording: (i.e., audio-video record your presentation or a meeting/webinars you are attending). Our processing of your personal data is necessary to record a presentation for meeting minutes, educational purposes and create a summary of the discussion for internal or external use. If required under applicable laws, we will obtain your prior consent for audio-video recording.

Data sharing

We may share personal data with parties that we trust or when we are required to share personal data according to applicable law, including:

• Group companies: we may share certain personal data with our group companies to develop and maintain our business for purposes consistent with this HCP Privacy Notice and to ensure compliance with legal and regulatory obligations to which we or our group companies are subject;
• Authorities: we may share your personal data with governmental authorities, public institutions, financial authorities, prosecutors, courts and regulatory bodies to the extent this is required under applicable laws, legally binding orders or regulatory guidance. We may also transfer personal data to authorities to protect our rights and property, or the rights and property of third parties, for instance in case of legal proceedings; 
• Service providers: we may use third party service providers to help us achieve the purposes set out in this HCP Privacy Notice. We require our service providers to respect the security and confidentiality of your personal data and to process personal data in accordance with applicable laws; 
• Business transfers: we may sell, transfer or otherwise share some or all of our business or assets, including personal data, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. We will inform you of such business transfers in accordance with applicable laws. 

International transfers

We use a global Customer Relationship Management system, for the collection, storage and processing of HCP personal data, which means that your personal data is transferred to or accessible from several countries where Amylyx is located including the EU, UK, Switzerland, the US, Canada, and Japan.  This list may change from time to time.  Although these countries may have different levels of Personal Data protection, Amylyx has implemented technical and organization safeguards to protect your Personal Data and is ultimately responsible for protecting your privacy.  While Amylyx’ measures reduce the risk your Personal Data being misused or accessed inappropriately, such risks cannot be eliminated entirely. When transferring personal data  we will adhere to the rules that apply to such transfers. In particular, before the transfer, we will verify if the recipients are based in countries that offer an adequate level of protection or if there is a legal instrument providing appropriate safeguards to your personal data (For transfer of personal data from the EEA, UK and Switzerland to a non-adequate country, Amylyx will put in place Standard Contractual Clauses as approved by the European Commission for the personal data originating from the EEA and Switzerland or the Information Commissioner Office for the personal data originating from the UK).  
When we are not able to provide enough safeguards to the privacy and confidentiality of your personal data, we will seek your prior consent. 
If you have questions about the international transfer of your personal data or the appropriate safeguards that we have taken to protect you, or to obtain a copy of them, please send an email to privacy@amylyx.com.

Data Retention

We will only retain your personal data for as long as necessary for the purpose for which we are processing it or as long as we are required to retain it in accordance with applicable laws. In particular, we will retain your information for the duration of the relationship with you (unless you previously withdraw your consent) and, in accordance with statutory limits, for the additional period of 5 years. We could retain your data for longer if we would need to perform a contractual or legal obligation (e.g., personal data processed for pharmacovigilance purposes will be stored in accordance with legal data retention obligations for at least 10 years beginning with the end of the marketing authorization of the respective medicinal product). In case of a legal complaint or dispute, we would retain your personal data until a final, non-appealable, decision has been issued by the competent court. 

When we no longer require your personal data, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), securely store your personal data and isolate it from any further processing until deletion is possible.

If you have questions on the retention of your personal data, please send an email to privacy@amylyx.com.

Your rights in relation to our processing of your personal data 

Subject to and in accordance with applicable data protection laws, you may be granted specific rights regarding your personal data, which may include the right:

• Right to Know -to obtain confirmation Amylyx has collected your Personal Data and information about how we use your Personal Data;
• Right of Access - to obtain information on and a copy of your personal data ;
• Right to Rectification -to have any inaccurate personal data rectified and, having regard to the purposes of the processing, to have incomplete personal data completed;
• Right to Erasure - if there are legitimate grounds, to request the deletion of your personal data ;
• Right to Restricted Processing -to request the restriction of the processing of your personal data;
• Right to Data Portability -to receive the personal data provided by you in a structured, commonly used and machine-readable format and to transfer this personal data to another controller or, if technically feasible, to have it transferred by Amylyx;
• Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. There is no automated decision-making by Amylyx; 
• Right to File a Complaint - to submit a complaint with a data protection authority where you consider a breach of data protection law has occurred;
• Right to Opt Out of Sale – Amylyx does not sell Personal Data but give you the specific right to opt out of such sales;
• Right to be free from Discrimination – If you are a California Resident you have the right to be free from discrimination or retaliation for exercising any or your rights under the California Consumer Privacy Act of 2018 (CCPA).

Where the processing of your personal data is based on your consent, you have also the Right to Amend or Withdraw your Consent at any time with effect for the future. Please note that if you withdraw your consent, we might still need to process certain personal data relating to you if there are other valid legal grounds, for example to comply with a legal obligation, to perform a contract with you or to pursue a legitimate business interest. 

Depending on applicable local requirements, you  may have the right to object, on grounds relating to your particular situation, at any time to any processing of your personal data we perform to pursue a legitimate business interest. Where your personal data are processed for direct marketing, proactive scientific communication and/or profiling purposes, you further have the right to object at any time to such processing.

The rights above may be limited to jurisdictions that require them by law.  Limitations may apply where regulatory requirements may prevent us from fulfilling your request.  In some instances this may occur to preserve scientific integrity since your personal data must be managed in a particular manner for the information to be reliable and accurate and to meet regulatory requirements. In addition, your rights may be limited by the rights of other persons, where legal exemptions to your exercise of rights might apply, where your request is not legitimate or applicable, or where it is needed to conduct business operation as allowed by applicable data protection laws.  When you submit a request to exercise your rights, we are entitled to verify your identity and we may request additional personal data to complete the verification.

If you want to exercise any of the above rights, please contact us at privacy@amylyx.com.

Contact Information

If you have any questions regarding this HCP Privacy Notice or on how Amylyx processes your personal data you can use the contact information below:

You can also contact Amylyx Data Protection Officer by writing to privacy@amylyx.com.

EU/UK Representatives

Amylyx Pharmaceuticals, Inc. has named Amylyx Pharmaceuticals EMEA B.V. (Barbara Strozzilaan 201, 1083HN Amsterdam, The Netherlands) to be its Data Protection Representative in the EU as required by law. 

Amylyx Pharmaceuticals, Inc. has identified Amylyx Pharmaceuticals UK Limited based in England at 21 Holborn Viaduct, London, EC1A 2DY to be its Data Protection Representative in the UK as required by law.

Changes to this HCP Privacy Notice

We may update this HCP Privacy Notice from time to time. We will notify you of any material changes in advance through our usual communication channels (e.g. by post, email or via our internet websites). We encourage you to periodically review this HCP Privacy Notice to learn how we use your personal data.