SUPPLEMENTAL EUROPEAN PRIVACY NOTICE (For persons located in the EU/UK)

Effective as of April 22nd, 2024.

European Union Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“EU GDPR”) and the Data Protection Act 2018 in the United Kingdom of Great Britain (UK) requires us as the data controller to provide additional and different information about our data processing practices to data subjects located in the European Economic Area (“EEA”) and the UK.  If you are a data subject located within the EEA or the UK, this Supplemental European Privacy Notice applies to you in addition to any other information we provide regarding data privacy.

Table of Contents

  • How We Use Your Personal Data
  • Clinical Trial Data
  • Change of Purpose
  • International Transfers of Personal Data
  • How Long We Retain Your Personal Data
  • Your Protection Data Rights
  • How to Contact Us

How We Use Your Personal Data

We will only use your personal data when applicable law allows us to so.  Most commonly, we will use your personal data in the following circumstances:

  • Where we need to perform the contract that we are about to enter into or have entered into with you
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
  • Where we need to comply with a legal or regulatory obligation.
  • Necessary for scientific research purposes

Information we obtain from social media platforms. We may maintain pages for Kyverna on social media platforms, such as Facebook, LinkedIn, X (formerly Twitter), Google, YouTube, Instagram, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.

We may also use your personal data in the following situations, which are likely to be rare:

  • Where we need to perform the contract that we are about to enter into or have entered into with you
  • Where it is needed in the public interest or for official purposes

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation conduction clinical studies in mainland Europe. 

 


Purpose/Activity Category of personal data Lawful basis for processing including basis of legitimate interest
To register you as a new client, contractor or employee. (a) Identity

(b) Contact		 Performance of a contract with you
To process and deliver your service or order including:

(a) Manage payments, fees and charges

(b) Collect and recover money owed to us

 (a) Identity

(b) Contact

(c) Financial

(d) Transaction

(e) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary for our legitimate interests

  • to recover debts due to us

    		•
    To manage our relationship with you which will include:

    (a) Notifying you about changes to our terms or privacy policy

    (b) Asking you to leave a review or take a survey

    (c) As an employee

    		 (a) Identity

    (b) Contact

    (c) Profile

    (d) Usage

    (e) Marketing and Communications

    (f) Financial

    		 (a) Performance of a contract with you

    (b) Necessary to comply with a legal obligation

    (c) Necessary for our legitimate interests

  • to keep our records updated
  • to study how customers and clients use our products/services and
  • to administer our employee relationships
    		•
    To enable you to complete a survey (a) Identity

    (b) Contact

    (c) Profile

    (d) Usage

    (e) Marketing and Communications

    		 (a) Performance of a contract with you

    (b) Necessary for our legitimate interests

  • to study how customers use our products/services; and

  • to develop them and grow our business
    		•
    To administer and protect our business and our intranet and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) (a) Identity

    (b) Contact

    (c) Profile

    (d) Technical

    (e) Usage

    		 (a) Necessary for our legitimate interests

  • for running our business and employee relationship
  • provision of administration and IT services, network security
  • to prevent fraud and
  • in the context of a business reorganisation or group restructuring exercise

    • (b) Necessary to comply with a legal obligation
    To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you (a) Identity

    (b) Contact

    (c) Profile

    (d) Usage

    (e) Marketing and Communications

    (f) Technical     		Necessary for our legitimate interests

  • to study how customers use our products/services

  • to develop them

  • to grow our business and

  • to inform our marketing strategy

    		•
    To use data analytics to improve our website, products/services, marketing, customer relationships and experiences (a) Technical

    (b) Usage

    		Necessary for our legitimate interests

  • to define types of customers for our products and services

  • to keep our website updated and relevant

  • to develop our business and,

  • to inform our marketing strategy

    		•
    To make suggestions and recommendations to you about goods or services that may be of interest to you(a) Identity

    (b) Contact

    (c) Technical

    (d) Usage

    (e) Profile

    		Necessary for our legitimate interests

  • to develop our products/services; and

  • to grow our business)

    		•
    To conduct a research program(a) Identity

    (b) Contact

    (c) Financial

    (d) Special Categories (Health Data)

    		Consent (in mainland Europe)
    Necessary for our legitimate interests (in the United Kingdom)
  • to improve healthcare; and

  • to conduct and analyse the research study

    • Necessary for scientific research purposes

    Clinical Trial Data

    Where we undertake clinical studies within the EU and the UK we will use information from subjects’ medical records and other health data in order to improve healthcare.  As a pharmaceutical organisation, we have a legitimate interest in using information relating to your health for research studies, when you agree to take part in a research study. Our exception to the general provision at Article 9(1) GDPR not to process special categories of data is that processing is necessary for scientific research purposes in accordance with Article 89(1) GDPR. This means that we will use your data when we act as the data controller for such studies, collected in the course of a research study, in the ways needed to conduct and analyse the research study. The Informed Consent Form will provide further detail of the processing of your personal data should you be a subject of a study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally identifiable information possible.

     

    Change of Purpose

    We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

    We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

    Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

     

    International Transfers of Personal Data

    Our primary location is based outside the European Economic Area, so the processing of your personal data may involve a transfer of data outside the EEA or UK.  Information on how to contact the Data Protection Officer (DPO) can be found in the dedicated Section of this Notice (“How to Contact Us:”).

    Whenever we transfer your personal data out of the EEA or UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

    • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or UK Government
    • Regarding transfers to the US, we are required to incorporate Standard Contractual Clauses in agreements for transfer from the EEA provided by the European Commission or from the UK by the International Data Transfer Agreement provided by the Information Commissioner’s Office in the UK in order to provide similar protection to personal data shared within Europe or the UK

    How Long We Retain Your Personal Data

    We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

    To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

    In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

    Your Data Protection Rights

    Under certain circumstances, visitors from within the EEA have the following data protection rights:

    • access to your personal data
    • correction of your personal data
    • erasure of your personal data
    • object to processing of your personal data
    • restrict of processing your personal data
    • transfer of your personal data
    • withdraw consent to any consent that you have previously given

    You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

    How to Contact Us:

    If you wish to exercise any of the rights set out above, please contact us at the address, below. You can also contact the Supervisory Authority in the country of your residence within the EU for advice or to make a complaint. Please be aware that your rights in relation to clinical research data may be limited.

    Please direct any questions or comments about this Policy or privacy practices to info@kyvernatx.com. You may also write to us via postal mail at:

    Kyverna Therapeutics, Inc.

    Attn: Legal – Privacy

    Address:

    5980 Horton Street, Suite 550

    Emeryville, CA 94608