Privacy Policy

EDGEWISE PRIVACY NOTICE

Last Updated: September 11, 2024

Edgewise Therapeutics, Inc. ( “Edgewise,” “we,” “our,” and “us”) is committed to protecting and maintaining your privacy.  This Privacy Notice (“Notice”) is designed to help you understand how we collect, use, and share your Personal Data, which includes any data that can be used to identify you or could be linked to you. 

This Notice applies to the processing of your Personal Data when:

  • you visit www.edgewisetx.com or other websites or applications we provide (collectively, the “Sites”) or we process your Personal Data to receive and respond to communications you make with us;
  • you are a principal, employee, agent, or contractor of our business partners;
  • you are a clinical investigator, member of an investigator team, or other study site personnel; or
  • you are a candidate for employment or a job applicant.

In some circumstances, if you do not provide us with your Personal Data, our Sites or services may not be available to you.

Note:  If you are a participant in a clinical study, clinical trial, or other health-related research, you should receive a separate privacy notice regarding the Personal Data we process for those purposes.

Please review this Notice carefully.  To the extent permitted by applicable law, by providing us your Personal Data or otherwise interacting with us, you are agreeing to this Notice.  Your use of our Sites is also subject to our Terms of Use.

Information Collected, Who We Share It With, and Purposes of Processing

Below is a summary of how we may collect, process, and use Personal Data, the potential recipients of your Personal Data, and how we may have processed your Personal Data in the preceding 12 months.  Some jurisdictions require us to state the legal bases for processing your Personal Data, which are included below, but please note that not all jurisdictions may recognize all legal bases.

 

Site Visitors and People Who Communicate with Us
We may process your Personal Data when you visit our Sites or communicate with us either online (such as by email) or offline (such as by phone or to our physical address).

Examples of the types of data we may process:

Where do we get the data?

Why do we process the data?

The legal bases for processing:

Who do we share data with?

 

Identity and contact data, such as:

  • first and last name
  • email address
  • mailing address
  • phone number

Technical Information, such as:

  • Internet Protocol (IP) address and browser type, version, and language
  • device type, including unique device identifiers
  • operating system information
  • usage information and statistics
  • data collected from cookies, pixel tags, or other similar technologies
  • you directly
  • your devices
  • third parties
  • to communicate with you
  • to administer our relationship with you and to provide you products and services
  • to send you updates
  • to customize content for you
  • for security and to protect against fraudulent, malicious, or illegal activity
  • to operate and ensure the appropriate use of the Sites and services
  • for administrative and legal  purposes
  • for marketing, sales, recruiting, and other related purposes
  • for the purposes of our legitimate interests
  • to comply with a legal obligation
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**
  • Edgewise and our affiliates or subsidiaries
  • partners that assist us (e.g., suppliers, service providers, IT systems providers, analytics partners, cloud service providers, database providers, and consultants)
  • professional advisors, such as lawyers, insurers, and auditors
  • business partners***
  

Business Partners and Their Employees, Agents, and Contractors
We may process your Personal Data when you act as a business partner, such as a vendor, supplier, distributor, retailer, or service provider, or an employee, agent, or contractor of a business partner.

Examples of the types of data we may process:

Where do we get the data?

Why do we process the data?

The legal bases for processing:

Who do we share data with?

 

Identity and contact data, such as:

  • first and last name
  • company/employer
  • business and personal email and physical addresses and phone numbers

Other personal data, such as:

  • age
  • gender
  • disability
  • social security number
  • date of birth

Commercial or financial data, such as:

  • products and services purchased, obtained, or considered
  • request documentation
  • financial transaction history
  • credit card number, expiration date, and CVV
  • financial account number
  • you directly
  • your devices
  • our business partners and other third parties
  • your employer or principal
  • to communicate with you
  • to administer our relationship with you and to provide products and services
  • to send you updates
  • to customize content for you
  • for security and to protect against fraudulent, malicious, or illegal activity
  • to operate and ensure the appropriate use of the Sites and services
  • for administrative and legal  purposes
  • for marketing, sales, recruiting, and other related purposes
  • for the purposes of our legitimate interests
  • to comply with a legal obligation
  • in preparation for or to perform a contract
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**
  • Edgewise and our affiliates or subsidiaries
  • professional advisors, such as lawyers, insurers and auditors
  • partners that assist us (e.g., suppliers, service providers, IT systems providers, analytics partners cloud service providers, database providers and consultants)
  • business partners***
  

Clinical Investigators and Members of Investigator Teams
We may process your Personal Data when you act as an existing or prospective clinical investigator or member of an investigation team.

Examples of the types of data we may process:

Where do we get the data?

Why do we process the data?

The legal bases for processing:

Who do we share data with?

 

Identity and contact data, such as:

  • first and last name
  • company/employer
  • business and personal email address
  • business and personal postal address
  • phone number

Other personal data, such as:

  • age
  • gender
  • disability
  • social security number
  • date of birth

Professional and educational data, such as:

  • job title or position
  • employer and address
  • medical specialty
  • professional qualifications and experience
  • medical license
  • training
  • publications
  • awards
  • affiliations

Commercial or financial data, such as:

  • request documentation
  • financial transaction history
  • credit card number, expiration date, and CVV
  • financial account number
  • you directly
  • your device
  • institution conducting the clinical trial
  • principal investigator
  • contract research organization (the CRO)
  • our business partners or other third parties
  • your employer or principal
  • to assess your suitability
  • to communicate with you
  • to manage the conduct of the trial and your role
  • to carry out other trial activities and administer our relationship with you
  • to communicate with regulatory bodies and prepare and submit regulatory filings
  • to publicly disclose payments or benefits made to you
  • to comply with requests from regulators, courts, law enforcement authorities, government investigators, or in connection with litigation, or for other administrative and legal purposes
  • for security and to protect against fraudulent, malicious, or illegal activity
  • for the purposes of our legitimate interests
  • to comply with a legal obligation
  • in preparation for or to perform a contract
  • for the purposes of public health interests
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**

 
  • Edgewise and our affiliates or subsidiaries
  • CROs, clinical trial sites, and their agents, affiliates, and collaborators
  • professional advisors, such as lawyers, insurers, and auditors
  • business partners***
  

Employment Candidates and Applicants
We may process your Personal Data when you apply or are a candidate for employment at Edgewise.

Examples of the types of data we may process:
  • Where do we get the data?
  • Why do we process the data?
  • The legal bases for processing:
  • Who receives the data?
  

Identity and contact information, such as:

  • first and last name
  • email address
  • postal address
  • phone number

Other personal information, such as:

  • age
  • gender
  • marital status
  • disability
  • ethnicity
  • citizenship and visa information
  • social security number
  • date of birth
  • social media presence

Technical Information, such as:

  • Internet Protocol (IP) address and browser type, version, and language
  • device type, including unique device identifiers
  • operating system information
  • usage information and statistics
  • data collected from cookies, pixel tags, or other similar technologies
  • data collected from cookies, pixel tags, or other similar technologies

Professional and educational data, such as:

  • job title or position
  • employer and address
  • work skills and training
  • degrees and certifications
  • publications, awards, and affiliations
  • employment history
  • assessments

Video information, such as:

  • recordings of video interviews
  • you directly
  • your devices
  • third parties
  • your employer or principal

 
  • to communicate with you
  • to administer our relationship with you
  • to send you updates
  • to customize content for you
  • for security and to protect against fraudulent, malicious, or illegal activity
  • to operate and ensure the appropriate use of the Sites and services
  • for administrative and legal  purposes, including for background screening and checks, compliance with legal requirements, and evaluation of your candidacy
  • for marketing, sales, and other related purposes
  • for the purposes of our legitimate interests
  • in preparation for or to perform a contract with you
  • for the purposes of public health interests
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law.**
  • Edgewise and our affiliates or subsidiaries
  • professional advisors, such as lawyers, insurers and auditors
  • our business partners***
  

 

**The legal bases relied upon by Edgewise include those enumerated in Articles 6 and 9 of the EU General Data Protection Regulation (“GDPR”), depending on the type of Personal Data.

***In limited circumstances, recipients may include: (1) an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, or in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets; and (2) government or regulatory officials, law enforcement, courts, public authorities, or others when permitted by this Notice or required by law.

Anonymized Data and Deidentified Data.  Anonymized data and deidentified data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.  In addition to the above, we may also collect anonymized or deidentified data about you.  We will not attempt to reidentify you or anyone else from this anonymized or deidentified data.  Deidentified data may include protected health information that has removed identifiers required under the Health Insurance Portability and Accountability Act, 45 CFR § 164.514(b)(2).

Combination of Data. We may combine information we collect, whether Personal Data or not, with Personal Data that we may obtain from other sources and other third parties.

Children’s Data.  Our Sites and services are not directed to children under the age of 16, and we do not knowingly collect, maintain, or use Personal Data from children under 16 years of age.  If you learn that a child has provided us with Personal Data in violation of this Notice, please contact us as set out in the “Contact Us” section below.

Marketing Uses, Cookies, and Other Activities

To the extent permitted by applicable law, including in accordance with your consent where required by applicable law, we may engage in the following activities:

  • We may use your contact details to contact you to determine whether you would like to initiate a business relationship with us or to send you marketing emails.  If you do not wish to receive such marketing emails, you may opt out by declining to receive such emails when registering or in our subsequent communications by following opt-out instructions included in the email or at other information collection points on the Sites.
  • We may display advertisements to you regarding the Sites or other of our products and services that we believe are relevant to you based on your activities on the Sites or on other web or digital properties.  Such advertisements may be shown on our Sites or the websites of others.  We achieve this by using, and allowing third parties to use certain cookies, eTags, pixels, web beacons, and other tracking technologies to track your activities on our Sites.
  • We also perform statistical analyses of the users of our Sites to improve the functionality, content, design, and navigation of the Sites.

Do-Not-Track Signals.  Certain web browsers and other programs may transmit “opt-out” signals, also called a Global Privacy Control (or GPC) signal (we refer to these as “GPC Signals”), to websites with which the browser communicates.  We currently do not respond to GPC Signals.

How we Use Cookies and Similar Technologies.  Cookies are small pieces of data that may be stored in and retrieved from your web browser while you browse a website.  Our Sites use cookies and similar storage technologies to collect information about your browsing activities and to distinguish you from other users of our Sites.  This allows us to understand and improve the functionality of our Sites. We use the following cookies:

  • Strictly necessary cookies.  These cookies are strictly necessary to make our Sites available to you; for example, for security or network management, or to remember your language preferences.  We cannot provide you with the Sites without these cookies.
  • Performance or analytical cookies.  These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Sites.  They help us to know which pages are the most and least popular and see how visitors move around the Site.  You can opt out of Google Analytics without affecting how you visit our Sites by going to https://tools.google.com/dlpage/gaoptout.
  • Functional cookies.  These cookies enable the Sites to provide enhanced functionality and personalization.  They may be set by us or by third party providers whose services we have added to our pages.  If you do not allow these cookies, then some or all of these services may not function properly.

You can adjust your cookies settings through our Cookies Settings page, accessed through the cookie button on our Sites.  You can also block cookies by setting your internet browser to block some or all our cookies.  However, if you use your browser settings to block all cookies, you may not be able to access all or parts of our Sites.

Third Party Service Providers and Services

Third party service providers acting on our behalf must execute agreements including confidentiality requirements and will only process Personal Data as necessary to perform their functions in a manner consistent with this Notice, other applicable privacy policies, and as explicitly permitted or required by applicable laws.  Our third-party service providers may be located in the United States and other jurisdictions.

Our Sites and services may contain features or links to websites, products, or services provided by third parties.  Any information you provide on third party sites or services is provided directly to the operators of such services and is subject to those operators’ policies, if any, governing privacy and security, even if accessed through the Sites or services.  We are not responsible for the content or privacy and security practices and policies of third-party sites or services to which links or access are provided through the Sites or services.  We encourage you to read their privacy policies before providing any information to them.

Safeguarding Information

Edgewise has put in place organizational and technical safeguards to help protect the information we collect from unauthorized access, use, alteration, and disclosure consistent with legal obligations and industry practices.  Although we do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data.

Your Rights Regarding Your Personal Data

Please note that in many circumstances, we cannot effectively do business with you without processing some Personal Data about you (e.g., your contact information).  Under your jurisdiction’s data protection law, you may have one or more of the following rights with respect to some or all of your Personal Data:

To request to know about the Personal Data we process about you or, in other jurisdictions, to request to acknowledge our processing of your Personal Data or a list of the categories of third parties to which your Personal Data has been disclosed;

  • To request access to and a copy or representative summary of your Personal Data, including to provide your Personal Data directly to another organization, i.e., a right to data portability;
  • To request that we correct your Personal Data;
  • To request that we delete your Personal Data;
  • To opt-out, including to opt-out of or request that we limit the processing of your sensitive Personal Data, to opt-out of the sale or sharing of your Personal Data, or to opt-out of targeted advertising or automated decision-making.
  • When we previously obtained your consent, to withdraw consent to processing; and
  • To appeal the denial of a request.

To learn if you have the other above rights in the jurisdiction in which you live and to exercise any of these rights with respect to your Personal Data, please contact us at the email or address provided below.  We will not discriminate against you for exercising any of the rights described above, although we may not be able to continue to provide you products and services and it may otherwise affect the way we are able to interact with you.

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws.  We may, after receiving your request, require additional information from you to honor your request and verify your identity.  Please be aware that we may be unable to afford these rights to you under certain circumstances and we may have valid legal reasons to refuse your request (fully or partially), and we will inform you if that is the case.

In the event you wish to make a complaint about how we process your Personal Data, please contact us at the email address below and we will handle your request as soon as possible.  Even if you make a complaint to us, you may always lodge a complaint with the relevant authority in your location.

Transfer of Personal Data Across National Borders

Please be aware that Personal Data we collect and process may be transferred and maintained outside your state, province, country, or other jurisdiction where the privacy laws may not be as protective as those in your location, including the United States.  Edgewise has put in place lawful transfer mechanisms and adequate safeguards, in accordance with applicable legal requirements, to afford adequate protection for your Personal Data.  For more information about how we transfer Personal Data internationally, please contact us as set out in the “Contact Us” section below.

How Long Your Personal Data Will Be Retained

We store all Personal Data for as long as necessary to fulfill the purposes set out in this Notice, or for as long as we are required to do so for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal or regulatory obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.  Retention periods will be determined taking into account the type of information that is collected and the purpose for which it was collected, bearing in mind the requirements applicable to the situation and the need to delete outdated, unused information at the earliest reasonable time.

Changes to This Notice

We may update this Notice from time to time.  We will post any changes we make to this Notice online.  The date the Notice was last revised is identified at the top of the page.  Please monitor our Sites and this Notice periodically to check for any changes.  In the event that the modifications materially alter your rights or obligations, we will make reasonable efforts to notify you of the change.

Contact Us

Edgewise is the entity responsible for the processing of your Personal Data.  If you have any questions, comments, or concerns about our privacy practices or wish to exercise your rights, please email us at privacy@edgewisetx.com or write to us at the address specified below.

If you wish to lodge a complaint about how we process your Personal Data, please contact us at privacy@edgewisetx.com.  We will endeavor to respond to your complaint as soon as possible.

For the purposes of GDPR and the UK General Data Protection Regulation (“UK GDPR”) we are the data controller. Our representative in the European Economic Area and United Kingdom are as follows:


European Economic Area
The DPO Centre Europe Ltd.
Address: Alexandra House, 3 Ballsbridge Park, Dublin, D04C 7H2
Phone number: +353 1 631 9460
Email: dpo@dpocentre.com

United Kingdom
The DPO Centre Ltd.
Address: 50 Liverpool street, London, EC2M 7PY, UK
Phone number: +44 203 797 6340
Email: dpo@dpocentre.com

 Edgewise Therapeutics, Inc
1715 38th Street, Boulder, CO 80301