Privacy Notice for Health Care Professionals & Employees or Representatives of Healthcare Organisations

Introduction

Curium Group and its Affiliates (hereinafter “Curium” or “we”) is strongly committed to protecting your privacy and will make all reasonable efforts to protect your personal data (“Personal Data”) in accordance with applicable data protection laws and this Privacy Notice (“Notice”) which applies to the Personal Data that it collects and processes about health care professionals and employees/representatives of healthcare organizations.

Data Controller and Data Protection Officer (“DPO”)

Each Curium entity is acting as a Data Controller for the purposes of this Notice when processing Your Personal Data. You can find more information on Curium affiliates in Europe and worldwide as well as their establishment and contact details here:
Contact us – Curium Pharma.

Curium’s designated Data Protection Officer (DPO) is responsible for supervising and monitoring Curium’s compliance with applicable data protection laws and regulations when processing your Personal Data. Curium’s appointed DPO can be contacted via email at: privacy.office@curiumpharma.com.

Curium has appointed Curium Holding France SAS (12 rue Lord Byron, 75008 Paris, France, privacy.office@curiumpharma.com) as its Representative in the European Union for data protection purposes.

Personal Data Curium collects and sources of Personal Data

Curium collects and processes Personal Data about you; the types of Personal Data Curium collect depend on your relationship with Curium as well as applicable laws, but may include the following categories of information:

• Basic personal details such as such as name, age, identity;
• Business contact information, such as your business postal address, mobile e-mail address;
• Educational and professional details such as qualifications and organisational or institutional affiliations;
• Financial details, such as banking information and payments related information and related transfers of value, where necessary.
• Registration details for attendance at Curium hosted or sponsored virtual as well as face to face events, meetings/webinars and congresses etc.
• Business travel and meeting arrangements, such as travel/accommodation/subsistence information related to business travel and participation at Curium hosted or sponsored events and other special conditions related to such participation (e.g. dietary preferences/requirements, accessibility information,
• Technical and online activity/usage data, such as information about how you/your device has interacted with our emails, websites or advertisements, including which emails you have opened and which links you have clicked on, the pages accessed, and documents, files, audiovisual, user account registration, career opportunities, customer service, mailing lists, product inquiries, promotional materials, feedback, surveys, and other online content that you may have downloaded, consumed and/or used;
• Details of your interactions with Curium and Curium representatives, such as what kind of meetings you have participated in, your opinions and prescription or disease diagnosis and patient care habits, as well as information related to order forms and deliveries)
• Professional details collected in the context of a market research and/or real world evidence research through a third party market research or fieldwork agency;
• Electronic communications consent preferences, such as your preferred channels of communication and frequency of communications as well as your choices related to the content of such communications.

• Social media details, such as social media accounts and/or activity.

This information may come directly from you, from publicly available online resources such as professional directories, social professional networks, as well as third-party owned and provided information sources (professional subscription dataset/databank owned by third-party service providers).

To better understand and address your interests, and to ensure that the Personal Data that Curium maintains and processes about you is accurate, Curium may correct or add to any Personal Data you provided directly to Curium with Personal Data relating to you that Curium receives from other third-party sources.

Lawfulness of processing

Curium processes Personal Data based on one or more of the following legal grounds:

• In certain cases, such as in direct marketing and promotional processing activities, Curium may ask for your consent to collect and process your Personal Data. Should you choose to provide your consent, you may withdraw your consent at any time, without giving any reason. Please note that the withdrawal of consent will not affect processing by Curium which has already occurred up to the date of withdrawal.
• In other instances, the processing of your Personal Data may be necessary in order to comply with an applicable law or regulation or for the performance of a contract to which you are subject (e.g., speaker agreement)..
• In still other instances, Curium may process your Personal Data based on Curium’s overriding legitimate interests and as permitted under applicable legislation, e.g., in communicating with you about our products and services, about scientific research and/or about educational opportunities..

How Curium uses your Personal Data

Curium processes your Personal Data for one or more of the following purposes:

• To perform Curium’s obligations under a contract to which you are a party;
• To comply with applicable laws or regulations;
• To publicly disclose any transfers of value made to you, as a Health Care Professional, as required by law or in order to comply with applicable industry standards (further information relating to this purpose;
• To carry out promotional activities to you, subject to other applicable regulatory provisions ;
• To provide to you, on your request, medical and scientific information ;
• To handle adverse events reports or quality complaints;
• To provide you with corporate news and updates on Curium;
• To send invitations to promotional or scientific events (e.g. workshops, professional trade shows);
• To contact you to arrange face-to-face meetings and to invite you to share with Curium your professional insights, by participating in surveys and other market research activities
• Review a grant, donation or sponsorship that you may have applied for, and assess your professional history for our due diligence purposes and determine your eligibility to receive the requested grant, donation or sponsorship ;
• To collect and analyse your interests and professional insights to create and improve our profile of you as an HCP to provide you with tailored communications and materials based on your professional needs and preferences per communication channel and frequency and to further enhance the business relationship we have with you (such profile may include your medical specialty, prescription habits and other personal identifiers).

Curium shall use your Personal Data only for the purposes specified in this section; processing of your Personal Data for any other purpose will be carried out only through prior notification and your specific consent to processing such Personal Data, where necessary.

With whom Curium shares your Personal Data

Curium may disclose your Personal Data to the extent legally required or permitted for the purposes mentioned above to the following categories of recipients which are bound contractually to comply with applicable data protection laws and regulations and Curium’s policies and procedures as applicable:

• Curium affiliates worldwide. These affiliates may in turn transmit Personal Data about you to other Curium affiliates;
• Selected third-parties; Curium may also contract with third party service providers to perform wholly or partly activities or functions related to the purposes specified above on behalf of Curium that involve the use of Personal Data about you. In such cases, Curium will require these third parties to comply with applicable data protection laws or regulations and Curium policies to protect the confidentiality and security of the Personal Data that is shared with them. These third parties will be required to agree that they will not use or disclose Personal Data about you except as necessary to provide services to us or perform services on our behalf, or as necessary to comply with applicable laws or regulations; depending on the services provided, the aforementioned third party service providers may contact you directly on behalf of Curium (e.g., through email); in such cases, you will be notified accordingly on the rationale and purpose of such communications in accordance with the transparency principle enshrined under the applicable data protections laws and regulations.
• Regulatory authorities, public / external governmental and supervisory bodies, having the power to execute checks and investigations towards Curium in fulfilment of legal obligations or regulations.

Moreover, all of Curium’s affiliates and third-party data processors acting for and on behalf of Curium are required to treat Personal Data in a manner consistent with applicable data protection laws and internal company policies including this Notice.

Some of Curium’s group companies and/or third-party service providers may be located in countries outside of the European Union and/or the European Economic Area (“EEA”), whose laws may not afford your Personal Data the same level of data protection as the one afforded inside the EU/EEA. Where your Personal Data will be transferred to third countries, Curium will ensure that all adequate safeguards are in place and that all applicable laws and regulations are complied with in connection with such cross-border data transfers; in particular by adopting in its contractual arrangements the execution of standard contractual clauses for cross-border data transfers for Controllers and Processors, as approved by the EU Commission or the competent data protection national supervisory authority, as well as by implementing appropriate technical and organisational security measures to ensure the security of the processing.

In the event Curium decides to reorganise or divest our business through sale, merger, or acquisition, Curium may share Personal Data about you with actual or prospective purchasers. Curium will require any actual or prospective purchasers to treat this Personal Data in a manner consistent with this Notice.

To obtain a full list of Curium’s data processors and categories of data controllers as well as additional information regarding the safeguards Curium has in place for cross-border transfers of Personal Data, please contact us via email at privacy.office@curiumpharma.com.

How Curium protects your Personal Data

Curium will take all reasonable and appropriate physical, administrative and technical safeguards to protect the processing of your Personal Data from loss, misuse, unauthorized access, disclosure, alteration or destruction. In this perspective, the data may be used only by Curium’s personnel who need it because of their job or hierarchical position, with confidentiality obligations, which have been assigned a specific role and which have been given appropriate operating instructions.

Your rights and how to exercise them

You may have the following data subject rights which may be subject to limitations and/or restrictions set out in applicable laws. These rights include the right to: (i) request access to and rectification or erasure of their Personal Data; (ii) restrict processing, or to object to processing of their Personal Data; (iii) the right to data portability and (iv) object to the Processing of Personal Data for direct marketing purposes. If you wish to exercise one of the above-mentioned rights, please contact our appointed DPO at privacy.office@curiumpharma.com.

You also have the right to ask Curium not to process your Personal Data for marketing purposes. Curium will usually inform you (before collecting your data) if it intends to use your data for such purposes or if it intends to disclose your information to any third party for such purposes. You can exercise the right to prevent such processing by informing Curium at any time that you do not wish to receive such marketing. For additional information, please contact our appointed DPO at privacy.office@curiumpharma.com.

If you are not satisfied with our response to you, you also have the right to lodge a complaint about the processing of your Personal Data with the appropriate national Data Protection Authority; a list of the national Data Protection Authorities in Europe and their contact details can be found here:
https://edpb.europa.eu/about-edpb/board/members_en.

How long Curium retains Personal Data

Personal Data will only be stored as long as necessary to fulfil the purposes and respective obligations related to such Personal Data, for which it was collected, subject to local laws and regulations and legitimate business needs in accordance with Curium internal policies. Once Personal Data is no longer necessary, Curium destroys it or erases it as soon as possible.

How to reach us

For questions, concerns or to exercise your data subject’s rights in relation to the processing of your Personal Data, you may contact our DPO by email at: privacy.office@curiumpharma.com. For further details on how Curium collects and processes your Personal Data, please visit our Privacy Statement available here.

Last updated: October 31, 2025