Privacy Policy

SCOPE

This privacy policy (“Policy”) describes how Deciphera Pharmaceuticals (Switzerland) AG and its affiliates and subsidiaries (collectively “Deciphera,” “we,” “our,” or “us”) collect, use, and disclose information about you (“Personal Data”) when you visit our website gist-hub.com (“Website”).

Specifically, this Policy applies when you visit www.rethinkGIST.com and any other websites and applications that link to this Privacy Policy (the “Services”); and

By accessing or using our Services, you confirm that you understand the use of your Personal Data in accordance with this Policy, which is incorporated into our Terms of Use. If you do not understand this Policy or have any questions regarding the collection, use, or disclosure of your Personal Data by Deciphera, please reach out to us by using the contact details found at the end of this Policy.

Please note, Deciphera has unique privacy policies and notices that apply to certain specific situations, such as notices that cover data processing activities related to your role as a participant in a clinical trial or study or notices which outline how Deciphera uses the personal information of healthcare professionals. Some of these notices are publicly available and may be found at the top of this page.

To the extent those policies and notices apply and conflict with this Policy, the said policies and notices govern our interactions with you.

Information We Collect

Information You Provide

We collect the Personal Data you voluntarily provide to us when you access or use the Services. For example, we might collect information from you when you:

• Access and navigate the Services
• Use a feature on the Services;
• Contact us with a question, comment, or request;

The categories of personal data that we collect directly from you when you use the Services include the following:

• Online identifiers such as IP address, device ID or cookie ID;
• Information you choose to provide to us when you contact us or when you voluntarily complete any of the forms or surveys on our websites e.g. email or postal address, first and last name and any other identification data as you deem necessary, personal opinions or information on professional practice

Information We May Generate

In addition, we may generate the following categories of personal data about you in the context of your interactions with us:

• Analytics and metrics on your use of the Services and your preferences;
• Records of our interactions with you; and
• Internal notes, including notes about your inquiry into our products and services.

Information We Receive from Third Parties

We may receive your information, including online identifiers, cookies and beacons from our marketing partners in order to provide various marketing, advertising, and customer support Services directly to you.

Information We Collect Automatically

When you access and use the Services, we and our third party service providers may collect information, including usage and technical data, automatically from your device, including, for example:

• Personal Identifiers, such as device identifiers;
• Internet or other electronic network activity information, such as IP address, cookies and other device identifying technologies revealing the date and time you accessed our Services and how you interacted with our Services; and

Online Identification Technologies

We may use online identification technologies, such as cookies, web beacons, or pixels in connection with the Services. You can learn more by reading through our Cookie Policy.

How We Use Your Personal Data

We may use your Personal Data or other information we collect about you for the following purposes:

• Identification and authentication: We use Personal Data to verify your identity when you access and use our Services and to ensure the security of your Personal Data.
• Operating the Services: We process your Personal Data to provide the services you have requested, including to deliver confirmations, notifications, and similar operational communications,
• Improving our Services: We analyze information about how you use our Services to provide an improved experience for our customers of all our services, including product testing and analytics.
• Communicating with you: We may use your Personal Data when we communicate with you, in accordance with your preferences, for example to send you information about our services and other topics that are likely to be of interest to you, including newsletters, updates, or other communications, to respond to your questions or requests concerning the Services offered by Deciphera or our partner, or if we are providing information about changes to our Terms of Use.
• Developing our business: By collecting information and generating insights related to our products and services in relation to healthcare professional and patients
• Informing you of research, clinical trial, and treatment opportunities: If you are healthcare provider or patient, we may use your Personal Data to identify research studies, clinical trials, treatments, and similar opportunities that may be of interest to you and, as appropriate, we may communicate with you regarding any such opportunities. Where necessary, we will obtain your consent before sending such communications. Please note, if you choose to participate in any opportunities, as patient or provider, the Personal Data collected from you as participant may be subject to additional and different privacy notices.
• Exercising our rights: We may use your Personal Data to exercise our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims or violations of law or our Terms of Use or to investigate, prevent, or take action in situations involving threats to our property or the property or physical safety of any person or third party.
• Customizing your experience: when you use the Services, we may use your Personal Data to improve your experience of the Services, such as by providing interactive or personalized elements on the Services and providing you with content based on your interests.

We may use de-identified aggregate or anonymized information to help us analyze the use of the Services. Where permitted by law, this Policy does not limit our use or disclosure of de-identified, aggregate, or anonymous information, and we reserve the right to use and disclose such information other third parties in our discretion.

Legal Bases for Processing

We need to have a legal basis to process your Personal Data. There are different legal bases that we rely on to use Personal Data, namely:

• Performance of a Contract: The use of Personal Data may be necessary to perform the contract that you have with us or to take steps at your request prior to entering into a contract with you. For example, by using the Services, you agree to be bound by the relevant Terms of Use and you acknowledge that Deciphera will collect a minimum amount of data (e.g. device identifier, IP address). The Services cannot be provided to you if you do not agree to.  
• Consent. We will rely on consent, which, in some cases where local laws allow, may be implied, to use: (i) technical information, such as cookie data, as described in this Policy; (ii) Personal Data for certain marketing or promotional purposes in accordance with your preferences such as sending you email alerts on events and company news that you have signed-up for. You may withdraw your consent at any time by contacting us at the addresses at the end of this Policy or by unsubscribing from a mailing list by using the relevant unsubscribe link at the end of every email communication you receive from us. Legitimate interests. It is also in our legitimate interests to process Personal Data through our Services in order to improve our products and services, perform administrative tasks, and, where consent is not required by applicable law, to identify and authenticate you and to secure our systems and information.
• Legitimate Interest: Deciphera has a legitimate interest to develop and enhance its business model by using information collected from website visitors, healthcare professionals, patients and other individuals who use its services or products. Deciphera will use such information as appropriate solely in cases where such legitimate interest does not come into conflict with the rights and freedoms of natural persons and will always ensure that individuals are adequately informed.

Furthermore, it is also in our legitimate interests to protect the legal rights, safety, and security of Deciphera, our affiliates, and our business partners; to respond to and resolve claims or complaints; to prevent fraud; and to manage risks associated with our business.

Disclosure of Personal Data

We may share your Personal Data with third parties under the following circumstances which include:

• Our affiliates: We may share Personal Data with our affiliated entities for their own research and analytics purposes or for internal reporting purposes.
• Service providers and business partners: We may share your Personal Data with our service providers and business partners that perform services for us including third-party providers for website hosting, maintenance, business operations, and identity verification. These service providers and business partners are only given access to your information to the extent necessary to process your information and/or provide the Services, and they are prohibited from using or sharing your information for any other purposes.
• Parties to a corporate transaction: In the event our assets are transferred or sold to another entity, your Personal Data may be transferred to the acquiring entity and/or to potential acquiring entities to the extent permitted by applicable law and we will seek your consent where required.
• Third parties as necessary to protect our interests and interests of others: We may disclose your Personal Data as is necessary to identify, contact, or bring legal action against a person or entity who may be violating our Terms of Use, or who may be causing harm to, or interfering with, other users of the Services.
• Law enforcement agencies, courts, or other government authorities or third parties where required by law: We may share your Personal Data with law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

Data Subject Rights

You may have certain rights regarding your personal data, subject to local data protection laws. These include the following rights:

• Access your Personal Data;
• Rectify the information we hold about you;
• Erase your Personal Data;
• Restrict our use of your Personal Data;
• Object to our use of your Personal Data;
• Receive your Personal Data in a usable electronic format and transmit it to a third party (right to data portability); and
• Lodge a complaint with your local data protection authority.

Please note, we do not make automated decisions about you based on your Personal Data.

If you would like to discuss or exercise these rights, please contact us at the details below. We encourage you to contact us to update or correct your information if it changes or if the Personal Data we hold about you is inaccurate. We may contact you if we need additional information from you in order to honor your requests.

Please note that we may require additional information from you in order to honor your request, and there may be circumstances where we will not be able to honor your request. For example, if you request deletion, we may need to retain certain Personal Data to comply with our legal obligations or other permitted purposes. We will only use Personal Data provided in a verifiable consumer request to verify your identity or authority to make the request.

International Data Transfers

Any information you provide to us or that we automatically collect will be received in the United States and may be transferred to other jurisdictions as necessary. By using our Services or submitting information, you explicitly authorize its processing in the United States and subsequent transfers outside the United States.

As such, your Personal Data may be transferred to, stored and processed in various countries, including those that are not regarded as ensuring an adequate level of protection for Personal Data under European Union law or by the European Commission. In cases that your Personal Data are being transferred to countries that do not provide adequate level of data protection, Deciphera has implemented adequate safeguards to protect your Personal Data. In addition, Deciphera relies on the execution of the approved Standard Contractual Clauses for the transfer of Personal Data outside of the EU/EEA, the UK and Switzerland and the implementation of appropriate technical and organisational security measures to ensure the security of the processing.  

Children’s Information

The Services is not intended for or directed to individuals under the age of sixteen (16). We also do knowingly collect any Personal Data from children under thirteen (13). If a parent or guardian becomes aware that his or her child has directly provided us with Personal Data, please contact us by using the contact information below.

 Retention

We will retain your Personal Data as long as we have a relationship with you. When deciding how long to keep your Personal Data after our relationship with you has ended, we take into account our legal obligations, including, for example fraud prevention, dispute resolution, investigations, and enforcement our Terms of Use. 

 Security

Deciphera uses commercially reasonable physical, electronic, and procedural safeguards to protect Personal Data against loss or unauthorized access, use, modification, or deletion. However, we cannot guarantee the absolute security of Personal Data or other information.

 Changes to the Privacy Notice

We may modify or update this privacy notice from time to time. If we make any revisions that materially change the ways in which we process your Personal Data, we will notify you of these changes before applying them to that Personal Data. We may notify you by email or other reasonable means, including through notifications on the Services.

Contact Us

Deciphera Pharmaceuticals (Switzerland) AG is the controller responsible for the Personal Data we collect and process and we are located at Dammstrasse 19, 6300 Zug, Switzerland.

To exercise your privacy related rights under applicable local law, please email us at dataprotection@deciphera.com or call us at  +41 41 562 02 50.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If you have any questions or concerns about this Policy, please contact us at dataprotection@deciphera.com. Last Updated: September 12, 2023

---