Last Updated: 21 March 2024
Amylyx Pharmaceuticals, Inc., a Delaware corporation, including its affiliates (hereinafter "Amylyx,” “we,” “us,” and “our”) is committed to protecting the privacy of the Personal Data you (“Users”) entrust to us. This Privacy Notice explains what kind of Personal Data we may collect, use, store or otherwise process when you visit one of our website(s), mobile applications, interact with us online or through email, participate in programs or services operated by us, or engage in other business interactions with us (collectively our “Sites,” “Products” or “Services”) that refer to this Privacy Notice.
If any of our Sites show a different privacy notice, that notice will govern if there is a conflict with this Privacy Notice. Similarly, if one of our Sites contains statements about how information is processed, those statements will govern if there is a conflict with this Privacy Notice.
Amylyx Pharmaceuticals, Inc. is responsible as controller (as defined under EU/EEA, Swiss and UK data protection laws) for the processing of your Personal Data.
- What Personal Data We May Collect
- How We May Use your Personal Data
- Use of Cookies and other Technologies
- How We May Disclose Your Personal Data
- How We Protect Your Personal Data
- How long We Keep Your Personal Data
- Children Under Sixteen
- Links to Third Party Websites
- Your Privacy Choices and Rights in Relation to Your Personal Data
- Specific Information for Users in the EU/EEA, Switzerland and UK
- International Transfers of Data
- Changes to Our Privacy Notice
- Contact Us
- EU/UK Privacy Representatives
- Accessibility Notice
What Personal Data We May Collect
When you interact with our Sites, Products or Services, Amylyx collects information about you. This includes information that identifies you or can, directly or indirectly, be used to identify you ("Personal Data"). Amylyx collects, stores, uses or otherwise processes the following categories of Personal Data you provide to us directly or indirectly, such as:
- Business, personal contact information and unique identifiers, such as name, surname, country of residence, email address, telephone number, mailing address and online identifiers.
- Educational and professional related information such as credentials provided on a curriculum vitae or resume, job title, professional history, educational information, qualifications and specialty.
- Information regarding your interactions with our Sites (including information collected via cookies and similar technologies,) Products or Services, including inquiries, provisions of goods and services, consulting work, participation in Amylyx meetings and events, disease awareness educations, Speaker Programs, Advisory Boards, scientific exchange and sales and marketing interactions.
- Internet and electronic network activity information, such as information about your interactions with our websites (such as your IP address, which reveals approximate location (country), browser type and language, access times and referring website addresses), online advertising and cookie information.
- Profile information, such as your interests and preferences.
- Inferences drawn from Personal Data, such as profiles found on social media websites, public records or derived from other information that we collect, as permitted.
In the course of accessing our Sites and offering our Products or Services, and with your consent, where required, we may also collect and process Personal Data that is of a sensitive nature, including, for example the following categories of Sensitive Personal Data:
- Username and password that you may select in connection with establishing an account on our Sites, customer, or patient portals.
- Financial information including bank and account details, background checks for employee recruitment and other financial information as necessary to provide our Products or Services.
- Protected characteristics including race, ethnicity, gender, sexual orientation, physical or mental disability, political affiliation, trade union affiliation, religion, and philosophical beliefs.
- Disciplinary actions and/or criminal proceedings and/or sanctions (employees).
- Identification information (identity card/passport number, Social Security, or other taxpayer/government identification number like driving license details.
- Information related to your health and medical condition(s), which may include genetic data or biometric information; medical treatments, medications, and test results, or information about your insurance.
- Medical details related to the use of our products and any potential adverse events.
- Precise geolocation.
- Electronic and sensory data, including images and recordings.
We will only process Sensitive Personal Data when we have your consent, or another legal basis, if required. You may request to opt out or limit the processing of your sensitive information by clicking the link Limit The Use Of My Sensitive Personal Information or contacting us via the details found in the “Contact Us” section of this Notice.
The types of Personal Data listed above are not exhaustive and may vary depending on the way that you interact with us, or the type of Personal Data required to fulfill our obligations or provide you with other Products or Services. In the event we use Personal Data about you, which is not listed in this Privacy Notice, we will inform you of the data that we use at the time of collection or when we communicate with you.
How We May Use Your Personal Data
Amylyx may collect and use your Personal Data for the following purposes:
- Fulfill or meet the purpose(s) for which the information is provided. For example, address questions related to products in development, or in market, or deliver requested information on resources available related to the therapeutic areas or other medical or scientific areas that Amylyx provides.
- To detect, understand, and manage adverse reactions and quality complaints in connection with the use of our products on the market.
- Staff, facilitate, and manage our clinical trials, research, studies, and related activities including responding to questions on recruitment to our clinical trials or refer you to specific organizations that may provide information on how to participate in clinical trials.
- Provide patient support programs and other related Products or Services or support-related activities.
- Perform research and analysis aimed at improving our Products, Services, communications and technologies.
- Communicate with you, including service communications such as information on technical service issues, information about our investigational products, Products or Services, and business and security announcements or to inform you of other activities of Amylyx and its affiliates.
- Facilitate our employee recruitment activities, such as: processing employment applications, evaluating a job candidate for an employment activity, negotiating employment contracts, and monitoring recruitment statistics.
- Administrate employee-related activities, such as payroll and benefits, communication and collaboration tools and employee resources.
- Comply with regulatory monitoring and reporting obligations, such as those related to adverse events, product complaints, spend transparency, and patient safety.
- Track and respond to safety and product quality concerns, such as product recalls.
- Identify and engage thought leaders and external experts.
- For the performance of a contract or to conduct business with you (e.g., consulting; speaker agreement).
- Respond to your inquiries and requests, including with respect to medical information, investments and strategic collaborations.
- Evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, joint venture, or other sale, transfer or disposition of some or all of our assets, whether in connection with any bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us is among the assets transferred.
- Operate, evaluate and improve our websites, Products or Services.
- Protect the security and integrity of our websites and mobile applications, or otherwise protect Amylyx’ rights or property.
- Protect your health and safety, or the health and safety of others.
- Comply with applicable regulatory and legal requirements, responding to legal, court, or regulatory investigations or requests for data.
We may combine the Personal Data we collect about you online with the Personal Data we collect about you from our offline interactions with you (for example, our interactions by email, telephone or in person). We may also combine any of the data we collect about you with information we lawfully obtain from other sources, such as public records or websites, or other third parties (e.g., business partners, information agencies, recruitment agencies or previous employers, health care professionals, patient groups, government agencies). If necessary, we will collect your consent, or provide an opportunity for you to opt out of this type of processing.
How We May Disclose Your Personal Data
Amylyx may disclose Personal Data to third parties to the extent necessary for the business purposes described above or when we are required to disclose Personal Data according to applicable laws. Please note that Amylyx does not rent, lease, sell or exchange Personal Data with other organizations except as: authorized by your consent, where you have the opportunity to opt-out of such processing and choose to allow the processing, or as required by law.
We may disclose your Personal Data to the following categories of third parties:
- Our affiliates and business partners with whom we collaborate regarding our Products or Services and research programs such as scientific advisors, joint venture partners, and strategic collaboration partners.
- Service providers that provide services to help us with our business activities, such as providers to help perform statistical analysis, send you email or postal mail, host our websites, respond to communications you send to us, or provide customer support.
- Analytics and digital advertising providers who may deliver advertisements subject to your choices and cookies settings.
- Competent regulatory authorities for monitoring and safety purposes in connection with our pharmacovigilance activities as required by applicable laws and regulations.
- Law enforcement, government agencies, courts, public authorities or other third parties to protect ourselves, our employees, or others, to protect our or a third party's property, to investigate fraud, or as required by law, such as to comply with a subpoena or similar legal process.
- Third parties in the event Amylyx is involved in an actual or contemplated merger, acquisition, or sale of all or a portion of its assets, or in the unlikely event of bankruptcy. If this occurs, the Personal Data will be subject to the policies of the receiving organization. We will further inform you of such business transfers as required in accordance with applicable laws.
- Any other third party with your prior consent.
When we share your Personal Data for a business purpose we enter a contract with these third parties that describes the purposes for sharing your Personal Data and requires the third-party recipient to protect the confidentiality and secure the Personal Data shared and prohibits use or disclosure of your Personal Data except for the purpose(s) of performing the services under the contract, or as necessary to comply with applicable law.
How We Protect Your Personal Data
Although we cannot guarantee the security of activities, transmissions or communications conducted via the Internet, we have implemented reasonable physical, technical, and administrative security measures to protect Personal Data collected and used as described in this Privacy Notice.
How Long We Keep Your Personal Data
We retain your Personal Data for as long as reasonably necessary to achieve the purposes disclosed at the point of collection or in this Privacy Notice, unless a different retention period is required by law. For example, we retain your Personal Data for the period of time that enables us to handle and respond to your questions, complaints and requests, to perform a contractual or legal obligation, to investigate, initiate and defend legal claims, and to protect our rights or our legal position.
'We will delete your Personal Data relating to your use of our Products or Services after the above periods, unless further storage is required to comply with legal obligations (such as data retention obligations under legal, regulatory, audit or tax requirements) or to establish, exercise or defend our legal claims.
Children Under Sixteen
Our Services are not directed towards children under the age of 16. Amylyx does not knowingly collect Personal Data from children under the age of 16 through our Services. If we learn that we have collected Personal Data directly from a child under the age of 16, we will delete that data, unless we have obtained permission from the parent or guardian.
Links to Third Party Websites
This Privacy Notice applies exclusively to our Products or Services and not to any third-party websites which may be linked by one of our websites. The materials and websites referenced and/or linked to one of our websites are provided for informational purposes only. The linked sites are not under our control, and we do not assume any responsibility or liability for any communication or materials available at such linked sites. You should review the privacy notices and terms of use associated with those linked sites if you decide to access them. Any reference to a commercial or noncommercial product, process, service or company is not an endorsement or recommendation by Amylyx, nor a guarantee of the reliability of the information or product.
Your Privacy Choices and Rights with Respect to Personal Data
Amylyx is committed to respecting your choices about the use of your Personal Data, and we will take reasonable steps to respond to and honor your requests to exercise your rights considering applicable, country-specific, legal requirements, including:
- To withdraw consent at any time, if we are using and sharing your Personal Data on the basis of consent;
- To obtain information on the Personal Data processed by Amylyx concerning you and to obtain a copy of such information (right of access);
- To the rectification (correction) of any inaccurate Personal Data and, taking into account the purposes of the processing, to have incomplete Personal Information completed (right to rectification);
- To request the deletion of Personal Data, if there are legitimate reasons (right to erasure);
- To request that Amylyx restrict the way it processes your Personal Data, if the legal requirements are met (right to restriction / limitation of processing);
- If the legal requirements are met, to receive the Personal Data provided by you in a structured, commonly used and machine-readable format and to transfer this personal data to another controller or, if technically feasible, to have it transferred by Amylyx (right to data portability);
- Not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way, if the legal requirements are not met. An automated decision-making process is not carried out by Amylyx;
If you wish to exercise these rights, please contact us by email at: privacy@amylyx.com.
Residents of the USA may also call 1-877-902-7726 to exercise their rights.
To protect your privacy and security, we may require you to provide us with information to verify your identity to a reasonable degree of certainty. To verify your identity, we will ask you to provide your contact information and additional identifiers based on your relationship with us. We will respond to your request in accordance with applicable law, and if we are unable to comply with your request, we will provide you with an explanation.
These rights are not absolute and only apply in certain circumstances and may vary depending on your country, region or US state of residence. This means that we may be unable or not obligated to satisfy your request, for example, due to legal obligations or requirements to which Amylyx is subject.
Please note that you can unsubscribe from receiving emails and text message communications by using the ‘Unsubscribe' link or instructions provided in the emails and texts you receive from us.
Amylyx does not sell your Personal Data, but we do use cookies and similar technologies (such as web beacons, tags, scripts and device identifiers) for online advertising and analytics. We may disclose certain online identifiers with our advertising partners and analytics providers. Disclosing these identifiers with third parties for advertising or analytics purposes may be defined as the “sale” or “sharing” of your data under certain US state privacy laws. Per applicable law, you may opt-out of the sale or sharing of your data for marketing or analytics by clicking on Do Not Sell or Share My Personal Information and unselecting performance and targeting cookies. If you opt-out of this type of “sale” or “sharing” of your data, we will not deliver customized advertising to you. You may still see non-targeted advertising about our products and services.
Amylyx will not discriminate against you for exercising your rights, but we may not be able to provide you with the Products or Services that you have requested, or access some of the functionality of our Sites, if we are not able to use your data.
You have the right to lodge a complaint with the competent data protection authority if one is available in your country or US state.
Specific Information for Users in the EU/EEA, Switzerland and UK
If you are located in the European Union (“EU”), a contracting state of the European Economic Area (“EEA”), Switzerland or the United Kingdom (“UK”), your Personal Data may be protected by data protection laws in the EU/EEA, Switzerland or UK, such as the European Union General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP) , and the UK GDPR and UK Data Protection Act 2018.
In particular, under data protection laws in the EU/EEA, Switzerland and UK, you have, subject to and in accordance with applicable law the right to lodge a complaint with the competent data protection authority in the EU/EEA or UK, in particular in the country of your habitual residence, place of work, or place of the alleged infringement. For convenience, European Economic Area (“EEA”) data protection authority contact information can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en
You also have the right to object, in accordance with the statutory provisions, to the processing of personal data, which is necessary for the purpose of Amylyx’ legitimate interests, on grounds relating to your particular situation (right to object). If your personal data is processed by Amylyx for direct marketing purposes, you have the right to object to this processing at any time, without any special reason.
International Transfers of Data
Your Personal Data may be stored and processed in any country where we have facilities or in which we engage service providers. We will only transfer your Personal Data where we have established a legal basis, but you should not participate in our Services if you do not want your Personal Data potentially transferred, or otherwise processed, in countries outside of your country of residence, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Data.
If you are located in the EEA, Switzerland or UK, your Personal Data may be transferred to our affiliates or service providers in countries that are recognized (as appropriate by the European Commission or the Information Commissioner Office in the UK) and providing an adequate level of data protection. For transfers from the EEA Switzerland or UK to countries not considered adequate by the European Commission, we have put in place adequate measures to protect your Personal Data, such as standard contractual clauses adopted by the European Commission or the Information Commissioner Office in the UK.
Changes to This Privacy Notice
Amylyx reserves the right to change this Privacy Notice from time to time with changes effective as of the date indicated on the updated Notice. If we make any changes to the Privacy Notice that materially impact previously collected Personal Data about you, we will make reasonable efforts to provide notice and obtain consent to any such changes as may be required by law.
Contact Us
Amylyx welcomes your questions or comments regarding this Privacy Notice. Please contact Amylyx at the below email or our toll-free 877-902-7726
Amylyx Pharmaceuticals, Inc.
43 Thorndike St.
Cambridge MA 02141
You can also contact Amylyx’ data protection officer by email at: privacy@amylyx.com.
EU/UK Privacy Representatives
Amylyx Pharmaceuticals, Inc. has named Amylyx Pharmaceuticals EMEA B.V. (Barbara Strozzilaan 201, 1083HN Amsterdam, The Netherlands) to be its Data Protection Representative in the EU as required by law.
Amylyx Pharmaceuticals, Inc. has identified Amylyx Pharmaceuticals UK Limited based in England at 21 Holborn Viaduct, London, EC1A 2DY to be its Data Protection Representative in the UK as required by law.
Accessibility Notice
Amylyx is committed to making this Privacy Notice accessible to all people. If you encounter any difficulty accessing the information in this Privacy Notice or require access to it in an alternative format, please send us an e-mail or write us at our contact information set forth above in the "Contact Information" section of this Privacy Notice.
© 2024 Amylyx Pharmaceuticals, Inc. All rights reserved.