HEMAB
Global Privacy Notice

1. Who we are and what this Notice covers

Hemab ApS and Hemab Inc. are members of the Hemab group (together, “Hemab,” “we,” “us,” or “our”), which is committed to developing therapeutic options for patients with underserved bleeding disorders. This Privacy Notice (“Notice”) explains how Hemab collects, uses, discloses, transfers, retains, and otherwise processes personal information or personal data (“Personal Data”) in connection with the activities described below.

The Hemab entity responsible for your Personal Data depends on the context of your interaction with us. Hemab ApS is generally the controller where you interact with our Danish/European operations. Hemab Inc. is generally the controller where you interact directly with our U.S. operations. Where a Hemab entity enters into a contract with you or your organisation, communicates directly with you, or otherwise determines the purposes and means of the relevant processing, that entity will ordinarily be the controller for that processing. In some circumstances, two Hemab entities may act as joint or independent controllers. You may contact privacy@hemab.com if you would like confirmation of the relevant controller for a particular processing activity.

This Notice applies globally to visitors to hemab.com and related online services; persons who receive or request communications from Hemab; patients, caregivers and healthcare professionals who interact with us through our website, patient advocacy activities clinical or other non-clinical channels; and individuals who engage in commercial or professional interactions with Hemab.

This Notice is intended to provide a common global framework. Certain rights and obligations vary by jurisdiction. Sections 7 and 8 contain additional provisions for individuals in the EEA, United Kingdom and Switzerland and for U.S. residents, respectively.

Which Hemab entity is the controller for which activity

The table below sets out which Hemab entity is the controller of Personal Data for each category of activity covered by this Notice. Where a processing activity concerns you, the applicable rights and legal regime are those set out for the corresponding entity.

‍

Where the same Personal Data is processed both in a Hemab Inc.-controlled activity and a Hemab ApS-controlled activity (for example, a healthcare professional based outside the United States who also attends a Hemab Inc. event), each entity acts as controller for its own activity and each processes only what is necessary for that activity.

2. Personal Data we collect

Depending on how you interact with Hemab, we may collect the following categories of Personal Data. We collect only information that is reasonably necessary for the relevant purposes and subject to applicable law.

‍

In addition to the sources indicated in the table above, we may receive your Personal Data from third parties who have a lawful basis to share it with us, such as healthcare professionals and healthcare organizations, patient advocacy groups, referral sources, our service providers, advertising or analytics partners, and publicly available sources.

Health information and certain other information may constitute sensitive or “special category” Personal Data under applicable law. We process such information only where an appropriate legal basis and, where required, an additional condition for processing such sensitive/special category Personal Data, applies.

3. How and why we use Personal Data

We use Personal Data for the following purposes, as relevant to your interaction with Hemab:

• Provide, operate, maintain, secure and improve hemab.com and our online services, including our patient advocacy resources
• Respond to enquiries from patients, caregivers, healthcare professionals, 
• Support patient advocacy, disease awareness, educational and storytelling initiatives,
• Identify and communicate with healthcare professionals and potential investigators and support clinical and medical research activities, subject to applicable research notices and requirements,
• Manage contracts, commercial relationships, payments, billing and related administration,
• Send scientific, educational, research, event, marketing or promotional communications, where permitted by law and, where required, with your consent,
• Conduct analytics and understand use of hemab.com, subject to applicable cookie and consent requirements,
• Produce, edit, publish and distribute stories, testimonials, photographs, audio/video or similar content where you have provided the necessary consent, release or other authorization,
• Monitor and report adverse events, product quality complaints and other pharmacovigilance matters as required by law,
• Protect Hemab, our systems, personnel, data and assets; prevent fraud and security incidents; investigate misconduct; establish, exercise or defend legal claims; and
• Comply with legal, regulatory, tax, accounting, recordkeeping and other obligations.

We do not currently use Personal Data to make solely automated decisions that produce legal or similarly significant effects concerning you.

4. Legal bases for processing (where applicable)

Privacy laws differ across jurisdictions. Where the GDPR, UK GDPR or another law requires Hemab to identify a legal basis, we rely on one or more of the following, depending on the processing activity:

• performance of a contract with you, or steps requested by you before entering into a contract;
• compliance with a legal or regulatory obligation;
• our legitimate interests or those of a third party, where those interests are not overridden by your rights and interests (for example, operating and securing our business, responding to professional enquiries, improving services, and establishing or defending legal claims);
• your consent, where consent is required or otherwise appropriate, including for certain marketing, cookies/tracking technologies, patient stories and advocacy content; and

‍

Where special-category Personal Data such as health data is processed, an applicable condition under Article 9 GDPR/UK GDPR or equivalent law, which may include explicit consent, processing necessary for scientific research subject to appropriate safeguards, reasons of public interest in public health, or establishment/exercise/defence of legal claims, as applicable to the specific activity.

Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. How we disclose Personal Data

We may disclose Personal Data, where necessary and permitted by law, to:

• Hemab group companies, where necessary for the purposes described in this Notice;
• Service providers and processors that perform functions on our behalf — such as website hosting, clinical research organisations, payment processing, email delivery, customer support tools, and analytics — under contracts that limit their use of the information to providing services to us;
• Advertising partners: on Hemab Inc.’s U.S.-directed hemab.com site, we allow third-party advertising cookies and pixels, which results in the disclosure of identifiers and internet activity data to advertising networks for targeted advertising purposes. Under certain U.S. state laws this constitutes a “sale” of Personal Data or “sharing” for cross-context behavioural advertising. You may opt out at any time as described in Section 8;
• Patient advocacy organisations and campaign partners: where we collaborate with patient advocacy groups, non-profit organisations, or other partners on disease awareness, educational, or storytelling campaigns, we may share the Personal Data necessary for that collaboration, including any content you submit for the campaign (subject to any separate consent or release you provide);
• Professional advisors, such as lawyers, auditors, and insurers, where necessary;
• Public authorities and other parties where required by law, to respond to legal process, or to protect the rights, property, or safety of us, our users, or others; and
• A buyer or successor entity in the event of a merger, acquisition, financing, or sale of all or part of our business, in which case this Notice will continue to apply to your Personal Data.

Where you submit a story, video testimonial, photograph, audio recording, or similar content to us for a disease awareness, patient advocacy, educational, or storytelling campaign and provide a separate consent or release for its use, we may publish that content on hemab.com, on campaign microsites, on our social media channels, and in printed and digital communications. Content published in this way will be publicly available and may be accessed, downloaded, shared, and further used by third parties. Once content has been published or accessed by third parties, we may not be able to remove or recall all copies, although we will honour requests to remove content from channels we control where reasonably possible.

Other than the disclosures to advertising partners described above, we do not sell Personal Data for monetary consideration, and we have not done so in the preceding twelve (12) months.

6. Cookies and similar technologies

We and our partners use cookies, pixels and similar technologies, to operate hemab.com, remember preferences, understand performance of hemab.com and, where applicable, support advertising.

Where applicable law requires consent before storing or accessing non-essential technologies on your device, non-essential analytics, advertising and similar technologies will be activated only after the required consent has been obtained. You can withdraw or change your choices through the cookie/privacy settings made available on hemab.com. Strictly necessary technologies may operate without consent where permitted by law.

For U.S. visitors, we also honour legally required opt-out mechanisms, including recognized universal opt-out signals such as Global Privacy Control (GPC) where applicable. Browser- or device-based choices may need to be renewed if cookies are cleared or a different browser or device is used.

To opt out of cookies used for targeted advertising, click "Your Privacy Choices" in the footer of hemab.com or see Section 8. You may also block or restrict cookies through your browser settings, though doing so may affect the functionality of hemab.com.

7. Additional information for individuals in the EEA, United Kingdom and Switzerland

7.1 International transfers

Hemab operates internationally, and Personal Data may be transferred to or accessed from countries outside the country in which it was collected, including the United States and Denmark. Where EEA, UK or Swiss Personal Data is transferred internationally, Hemab uses a transfer mechanism recognised under applicable law. Depending on the destination and recipient, this may include an adequacy decision, participation by an eligible U.S. recipient in an applicable recognised data privacy framework, the European Commission’s Standard Contractual Clauses (and, where relevant, the UK International Data Transfer Addendum or other UK transfer mechanism), or another lawful safeguard or derogation. Where required, Hemab also assesses whether supplementary measures are appropriate.

You may contact privacy@hemab.com for further information about the safeguards applicable to a relevant transfer.

7.2 Your rights

Subject to national laws and applicable conditions, limitations and exemptions, you may exercise different rights depending on your county of residence as detailed in the Supplemental Notices below.

We will respond to requests within the period required by applicable law. Under the GDPR/UK GDPR this is generally one month, subject to permitted extensions in appropriate circumstances.

8. Additional information for U.S. residents

U.S. state privacy laws may provide residents of certain states with rights to know/access, correct, delete and obtain a portable copy of Personal Data; opt out of targeted advertising, sale or sharing; appeal certain decisions; and receive non-discriminatory treatment for exercising privacy rights. The precise rights, definitions and exceptions vary by state. Hemab will provide the rights required by the law applicable to you and may, as a matter of policy, extend certain rights more broadly.

Where our use of advertising cookies or pixels constitutes a “sale,” “sharing,” or processing for targeted advertising under applicable U.S. state law, you may opt out through the “Your Privacy Choices” mechanism on hemab.com, by using a recognised universal opt-out signal such as Global Privacy Control where legally required, or by contacting privacy@hemab.com.

California residents may have additional disclosures and rights under the California Consumer Privacy Act, including with respect to sensitive Personal Data and disclosures for cross-context behavioural advertising. Hemab does not disclose Personal Data to third parties for their own direct marketing purposes and does not offer financial incentive programmes in exchange for the retention or sale of Personal Data.

For U.S. requests, we may verify your identity using information reasonably necessary to match you to records we maintain. Where applicable, you may use an authorised agent. We will respond within the time required by the applicable state law and provide appeal information where required.

9. Retention and security

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Notice and in accordance with legal, regulatory, tax, accounting, research, pharmacovigilance, dispute-resolution and recordkeeping requirements. Relevant factors include the nature and sensitivity of the data, the purpose of processing, the duration of our relationship, applicable limitation periods and mandatory retention obligations.

When Personal Data is no longer required, we delete, anonymize or otherwise securely dispose of it, subject to lawful archival or retention requirements. We maintain appropriate administrative, technical and organizational safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. No security measure can guarantee absolute security.

10. Children’s privacy

hemab.com is intended for a general audience and is not directed to children. We do not knowingly collect Personal Data from children through hemab.com except where a specific programme lawfully permits such processing and provides an appropriate separate notice and, where required, parental or guardian consent. For U.S. general-audience hemab.com use, we do not knowingly collect Personal Data from children under 13. If you believe a child has provided Personal Data to us inappropriately, please contact privacy@hemab.com.

11. How to exercise privacy rights

You may submit a privacy request by emailing privacy@hemab.com or using any privacy request form made available in the footer of hemab.com. We may take reasonable steps to verify your identity and authority before fulfilling a request. We will not request more information than reasonably necessary for verification and will respond within the period required by applicable law.

12. Links to other websites and social media

hemab.com may contain links to third-party websites and social media features. Hemab is not responsible for the content or privacy practices of those third parties, and this Notice does not govern their independent processing. We encourage you to review the privacy information provided by any third-party service you use.

13. Accessibility

We aim to make this Notice accessible. To request this Notice in an alternative format or report an accessibility barrier, contact privacy@hemab.com.

14. Changes to this Notice

We may update this Notice from time to time. We will revise the effective/last-updated date and, where required by law or appropriate in light of a material change, provide additional notice before the change takes effect.

Where consent is required for a new processing purpose, we will seek that consent rather than treating continued use of hemab.com as consent.

15. Contact us

For questions, concerns or privacy-rights requests, contact:

Hemab ApS
Nordre Fasanvej 215, 2000 Frederiksberg.
Denmark

Hemab Inc.
101 Main Street, Suite 1220, Cambridge, MA 02142
United States

Email: privacy@hemab.com
Clinical Trial Enquiries: clinicaltrials@hemab.com

‍

Supplemental USA State Notice

If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have certain additional rights relating to your Personal Data. This section provides additional detail into the Personal Data we collect through hemab.com and through our online services, the purpose for collecting that Personal Data, and the persons or entities to whom we disclose that Personal Data.

‍

Individual Rights

Depending on your state of residence, you may have rights relating to the collection, use, disclosure, and other processing of your Personal Data, subject to applicable legal exceptions and requirements. Such rights may include:

Right to Know/Access

You may have the right to ask for a copy of your Personal Data in a readable, usable format. You can also ask for details about how we handle your data, including:

Where we get your information from;

Why we collect, sell, or share it;

What kinds of companies we share it with; and

What types of your information we share.

Right to Data Portability.

You may have the right to access your Personal Data in a portable format.

Right to Delete

You may have the right to request that we delete the Personal Data we have collected from or about you.

Right to Correct

You may have the right to request that we correct inaccurate Personal Data that we have collected and maintained about you.

Right to Revoke Consent

You may have the right to revoke your consent to certain processing activities concerning any sensitive Personal Data we may collect about you.

Right to Limit Use of Sensitive Personal Information

You may have the right to limit the use and disclosure of your sensitive Personal Data to certain limited purposes, including for the specific provision of service you may have requested. 

Right to Appeal

In certain states, you may have the right to appeal a decision we have made in connection with your privacy rights request.

Right to Opt Out of Targeted Advertising, Sale, or Sharing of Personal Data

You may have the right to opt out of “targeted advertising” and the “sale” or “sharing” of your Personal Data.

Right to Request Categories of Third Parties

You have the right to request a list of the categories of third parties to whom we have disclosed your Personal Data.

Right to Non-Discrimination

You may have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise your rights under applicable laws. 

Submitting Requests and Exercising Your Applicable Rights

To submit requests under applicable laws, please contact us at privacy@hemab.com. We may ask you to verify your identity before responding to such requests. We reserve the right to refuse any request if we are not obligated to respond under applicable law. Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf. We may ask any authorized agent to verify that they have been authorized by you to make the request under applicable local law, which may include signed permission provided by you. Please note, we may not be able to provide certain aspects of hemab.com or our online services without some necessary data. If you have any questions specifically about this Notice or our privacy practices, please contact us.

‍

Supplemental Notice for EEA, UK and Swiss residents

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”) or Switzerland, you may have additional rights regarding your Personal Data under applicable data protection law.

Subject to applicable conditions, limitations and exemptions, these may include:

Right of access: You may request confirmation as to whether we process your Personal Data and, where applicable, obtain access to your Personal Data and information about how we process it.

Right to rectification: You may request that inaccurate Personal Data be corrected and, where applicable, that incomplete Personal Data be completed.

Right to erasure or deletion: In certain circumstances, you may request that we delete your Personal Data, for example where it is no longer required for the purposes for which it was collected. This right may not apply where continued processing is necessary to comply with a legal or regulatory obligation or for other purposes permitted by applicable law.

Right to restriction of processing: Where applicable, you may request that we restrict the processing of your Personal Data in certain circumstances.

Right to data portability: Where applicable, you may request to receive certain Personal Data in a structured, commonly used and machine-readable format and, where legally and technically possible, request that it be transmitted to another controller.

Right to object: Where we process your Personal Data on the basis of our legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation.

Right to object to direct marketing: You may object at any time to the processing of your Personal Data for direct marketing purposes. If you object, we will stop processing your Personal Data for those purposes.

Right to withdraw consent: Where we rely on your consent to process Personal Data, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights relating to automated decision-making: Where applicable, you may have rights in relation to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you. Hemab does not currently use Personal Data to make solely automated decisions that produce legal or similarly significant effects.

The availability and scope of these rights may differ depending on whether the GDPR, UK GDPR, Swiss Federal Act on Data Protection or other applicable law applies to the processing.

You may exercise your applicable rights by contacting us at privacy@hemab.com. We may take reasonable steps to verify your identity before responding to your request and will respond within the period required by applicable law.

You also have the right, where applicable, to lodge a complaint with the competent data protection authority. EEA residents may contact the competent supervisory authority in their EEA country. For processing for which Hemab ApS is the relevant Danish controller, the Danish Data Protection Agency (Datatilsynet) may be the competent supervisory authority.

UK residents may contact the Information Commissioner’s Office (ICO) and Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).

‍