Puma Biotechnology

Last updated/Effective Date: March 01, 2024

This privacy statement applies to these sites (https://www.pumabiotechnology.com, https://nerlynx.com, https://reducerecurrence.com, https://investor.pumabiotechnology.com/investors-home/default.aspx, and https://nerlynxhcp.com (the “Websites”)). It does not apply to any site that does not display or link to this statement or that contains its own privacy statement.

Puma Biotechnology, Inc. (“we”, “our”, “us”) is committed to protecting and respecting your privacy. We are a corporation established in the United States with a registered office at 10880 Wilshire Boulevard, Suite 2150, Los Angeles, CA 90024, and for the purpose of the General Data Protection Regulation (the “GDPR”), we are the data controller.

This policy sets out the basis on which we will process any information about your “personal data” or usage information we collect from you, or that you provide to us, in connection with your use of our Websites, your participation in our patient education and support programs, your application for employment and/or in your capacity as a representative of a business we work with. If you are a patient enrolling in the Puma Patient Lynx Services, please see the Patient HIPAA Authorization for how we handle the data we receive in that program. Please read this policy carefully so that you understand your rights in relation to your personal data, and how we will collect, use and process your personal data.

About This Site

This site is owned by Puma Biotechnology, Inc. This Privacy Policy is designed to tell you about our practices regarding collection, use, and disclosure of personal data that you may provide when you interact with us. Please be sure to read this entire Privacy Policy before using or submitting personal data to this site. This site is governed solely by applicable Federal and State laws and governmental regulations in the United States.

By using this site, you agree to the terms of this Privacy Policy. If you do not agree with this Privacy Policy in general or any part of it, you should not access the Websites.

About Children

This site is not intended for children under the age of 16. We will not knowingly collect or maintain personal data from site visitors in this age group.

What types of personal data do we collect and how do we use it?

Personal data you give us. You may provide personal data to us when you interact with us. Personal data that you directly submit to us may include:

basic contact details (name, address, phone number, email).
applicant details (information included in your resume or CV, references, job history).
any other information you choose to include in communications with us, for example, when sending an email to us or completing a form for our patient education and support programs.

As it is in our legitimate interests to be responsive to you and to ensure the proper functioning of our products and organization, we will use your personal data to:

communicate with you;
contact you via telephone or email;
evaluate your candidacy and process your application for employment;
identify our users; or
enforce our Websites’ terms and conditions.

Technical usage information. When you visit the Websites, certain information can be passively collected (that is, gathered without your actively providing the information). We collect such information sent to us by your computer, mobile phone, or other access device. This information includes:

your IP address;
location information (by region);
device information including, but not limited to, identifier, name, and type of operating system;
mobile network information; and
standard web information, such as your browser type and the pages you access on our Websites.

We collect this information in order to:

personalize our Websites to ensure content is presented in the most effective manner for you and your device;
monitor and analyze trends, usage and activity in connection with our Websites and when you interact with us to improve the Websites;
administer the Websites and for internal operations, in order to conduct troubleshooting, data analysis, testing, research, statistical and survey analysis;
keep the Websites safe and secure; and/or
measure and understand the effectiveness of the content we serve to you and others.

Do we use cookies and other tracking technologies?

A "cookie" is a bit of data that a website sends to your computer browser that helps the website remember information about you and your preferences. We collect and use certain information about your interaction with the Websites through cookies, tags, pixels and other unique tracking codes to run analytics and better understand user interaction with the Websites.

We use Microsoft’s services to understand user interactions with our Websites, and Microsoft may collect or receive limited data to provide us services. Microsoft’s privacy policy is available at: https://privacy.microsoft.com/en-us/privacystatement.

Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of such technologies. If you so choose, you may block or delete our cookies from your browser; however, blocking or deleting cookies may cause some of the Websites, including certain features and general functionality, to work incorrectly. If you have questions regarding the specific information about you that we process or retain, as well as your choices regarding our collection and use practices, please contact us using the information listed below. Our Websites do not currently respond to “Do Not Track” signals of web browsers in general, as there currently are no uniform technological standards for recognizing and implementing “Do Not Track” signals. However, our websites do respond to signals sent from California residents using a service called the Global Privacy Control (GPC), which may be considered a “Do Not Track” signal. For information on how our websites respond to GPC signals, see the section titled “California Residents” below.

How do we disclose your personal data?

We do not sell, rent or lease your personal data to others except as described in this Privacy Policy. We disclose personal data about you to selected recipients. These categories of recipients include:

patient support program vendors who help manage, administer, and support our various patient education and support programs;
IT Services providers that provide us with SaaS services; and
analytics and search engine providers that assist us in the improvement and optimization of the Website.

We will share your personal data with law enforcement agencies, public authorities or other organizations if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

comply with a legal obligation, process, or request;
enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
detect, prevent, or otherwise address security, fraud, or technical issues; or
protect the rights, property or safety of us, our users, a third party, or the public as required or permitted by law.

We will also disclose your personal data to third parties:

in the event that we license or sell any business or assets, in which case we will disclose your data to the prospective licensee or buyer of such business or assets; or
if we or substantially all of our assets are acquired by a third party, in which case personal data held by us about our users will be one of the transferred assets.

Where do we store your personal data?

The personal data that we collect from you will be transferred to, stored at, and processed in the United States. Your personal data is also processed by staff operating in the United States or outside of the European Economic Area (EEA) who work for us or for one of our suppliers or vendors. Such staff are engaged in, among other things, the provision of support services. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this policy and have put in place appropriate safeguards in accordance with applicable legal requirements to ensure that data is adequately safeguarded and protected irrespective of the country in which the data is processed. This includes obtaining written assurances from third parties given access to your data requiring them to adopt standards that ensure an equivalent level of protection for data as that adopted by us. Should you wish to know more about how your personal data is protected please contact us at info@pumabiotechnology.com.

The security of your personal data

Unfortunately, the transmission of information via the internet or email is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted through the Websites or over email; any transmission is at your own risk. Once we have received your personal data, we will take appropriate technical and organizational measures to safeguard your personal data against loss, theft and unauthorized use, access, or modification.

We will, from time to time, host links to and from the websites of our affiliates or third parties. If you follow a link to any of these websites, these websites will have their own privacy policies and we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to those websites.

How long do we store your personal data?

We will retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required by law, contract, or similar business obligations. To determine the appropriate retention period, we consider the amount, nature and sensitivity of your personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data (and whether we can achieve those purposes through other means), and applicable legal requirements. We will also retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.

The personal data we retain includes:

your personal data that you give us through our Websites, email, or telephone; and
your technical usage information.

We may also store your information in an aggregated and anonymized format, and we may use this information indefinitely without further notice to you.

Washington Residents

If you are a resident of Washington, please see our Consumer Health Data Privacy Policy.

California Residents

This section applies to you only if you are a California resident (“resident” or “residents”).

Processing of California Resident Personal Data

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal data and sensitive personal information (denoted by *) about residents:

	Category of Personal Data	Categories of Recipients
A	Identifiers such as real name, alias, telephone number, postal address, unique personal identifier, online identifier, Internet Protocol address, and email address.	staffing and background check vendors, patient support program vendors, data analytics and advertising vendors, IT service management vendors, security vendors, and website hosting vendors
B	Customer records identified by state law (including the California law that requires reasonable security for certain categories of information) (information in this category may overlap with others) such as name, signature, social security number, tax identification number, address, telephone number, health insurance information, passport number, driver’s license or state identification card number.	staffing and background check vendors, patient support program vendors, data analytics vendors, IT service management vendors, security vendors, and website hosting vendors
C	Characteristics of protected classifications under California or federal law such as race, national origin, sex, gender, age, and citizenship.	background check vendors, patient support program vendors, data analytics vendors, IT service management vendors, security vendors, and website hosting vendors
D	Geolocation information (city level) such as IP address.	data analytics and advertising vendors, patient support program vendors, IT service management vendors, security vendors, and website hosting vendors
E	Internet or other similar network activity information such as information on your interaction with our Websites.	data analytics and advertising vendors, patient support program vendors, IT service management vendors, security vendors, and website hosting vendorsx
F	Professional or employment-related information such as title of profession, current or past employer, and professional background.	staffing and background check vendors, data analytics vendors, IT service management vendors, security vendors, and website hosting vendors
G	*Government Identifiers such as social security number, tax identification number, driver’s license, state identification card, or passport number.**	background check vendors, data analytics vendors, IT service management vendors, security vendors, and website hosting vendors
H	Racial or ethnic origin.*	IT service management vendors, security vendors, and website hosting vendors
I	The contents of a resident’s mail or email.*	IT service management vendors, security vendors, and website hosting vendors
J	Personal information concerning a resident’s health, such as information submitted in relation to a patient support program (including medical condition and treatment).*	data analytics and advertising vendors, patient support program vendors, IT service management vendors, security vendors, and website hosting vendors

We do not collect, use, or disclose personal data, including sensitive personal information, for purposes other than those specified in this Privacy Policy. Further, we only use and disclose sensitive personal information for purposes permitted by California Consumer Protection Act (CCPA), or otherwise with your consent. The purposes for which we collect your personal data and the categories of sources from which we collect your personal data are described in the “What types of personal data do we collect and how do we use it?” section above. The criteria we use to determine how long to retain your personal data is described in the section above titled “How long do we store your personal data?”

We disclosed personal data over the preceding 12 months for the following business purposes:

to provide, personalize, conduct, and improve our services;
to communicate with you;
to comply with a legal obligation, process, or request;
to enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
to detect, prevent, or otherwise address security, fraud, or technical issues;
to protect the rights, property, or safety of us, our users, a third party, or the public as required or permitted by law; and
to evaluate your candidacy and process your application for employment.

Selling and/or Sharing of Personal Data

We do not “sell” (as that term is defined under the CCPA) personal data, nor have we done so in the preceding 12 months. Further, we do not have actual knowledge that we “sell” or “share” personal data of residents under 16 years of age. However, we do share for our own targeted advertising (referred to as cross-context behavioral advertising under the law) certain categories of personal data and sensitive personal information and, in the preceding 12 months, we have shared the following categories of personal data and sensitive personal information about residents:

	Category of Personal Data	Categories of Recipients
A	Identifiers such as unique personal identifier, online identifier, Internet Protocol address.	Advertising vendors including Google Advertising, Microsoft Advertising, DSP partners, Vimeo and Meta
D	Geolocation information (city level) such as IP address.	Advertising vendors including Google Advertising, Microsoft Advertising, DSP partners, Vimeo and Meta
E	Internet or other similar network activity information such as information on your interaction with our Websites.	Advertising vendors including Google Advertising, Microsoft Advertising, DSP partners, Vimeo and Meta
J	Personal information concerning a resident’s health, as such information pertains to the general access and use of our product specific Websites.*	Advertising vendors including Google Advertising, Microsoft Advertising, DSP partners, Vimeo and Meta

We shared personal data over the preceding 12 months for the following business purposes:

to personalize the Websites’ content and communications based on your preferences; and
to market our services to you.

Global Privacy Control
We participate in a service called the Global Privacy Control (GPC) that lets you set a “Do Not Share” preference at the browser level. You’ll need to have a GPC-enabled browser or browser extension that you’ll activate or turn on in the browser. If we’re receiving your GPC signal, we’ll automatically opt you out of the sale of your personal data and tell you that a GPC signal was used.

Your rights

Depending on where you live and subject to certain exceptions, you may have rights in relation to the personal data we hold about you. We set out below an outline of those rights and how to exercise those rights. Please note that we will require you to verify your identity before responding to any requests to exercise your rights by contacting us at Puma Biotechnology, Inc., 10880 Wilshire Blvd., Suite 2150, Los Angeles, CA 90024. To exercise any of your rights, please email us at info@pumabiotechnology.com. For each of the rights below we may have valid legal reasons to refuse your request, and in such instances we will let you know if that is the case.

Access: You have the right to know whether we process personal data about you, and if we do, to access data we hold about you and certain information about how we use it and who we share it with. You may also have a right to receive that personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another business without impediment. If you are a California resident, you have a right to request the following information about our collection, use and disclosure of your personal data over the prior 12 months:
- categories of personal data about you we have collected, disclosed for a business purpose;
- categories of sources from which we collected personal data about you;
- the business or commercial purposes for collecting personal data about you;
- categories of third parties to whom the personal data about you was disclosed for a business purpose; and
- specific pieces of personal data about you we have collected.
Correction: You have the right to require us to correct any personal data held about you that is inaccurate, and have incomplete data completed.
Erasure: You may request that we erase the personal data we hold about you in the following circumstances:
- where you believe it is no longer necessary for us to hold the personal data,
- we are processing your data on the basis of our legitimate interest and you object to such processing, or
- you believe we are unlawfully processing your data.
Please provide as much detail as possible on your reasons for the request to assist us in determining whether you have a valid basis for erasure.
Right to Opt out of Sharing and Limit Our Use/Disclosure of Sensitive Personal Information: You have a right to direct us not to share your personal data and to limit the use and disclosure of sensitive personal information to certain reserved purposes. To exercise either right, please use the following form: Do Not Share My Personal Data, which is also available at the bottom of this policy. For information on how we process opt-out preference signals, see the section above titled, “Global Privacy Control”. For information on how we process opt-out preference signals, see the section above titled, “Do we use cookies and other tracking technologies?”
Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights. Restriction of Processing to Storage Only: You have a right to require us to stop processing the personal data we hold about you other than for storage purposes in the following circumstances:
- you believe the personal data is not accurate for the period it takes for us to verify whether the data is accurate,
- we no longer need the personal data for the purposes of the processing but you require us to retain the data for the establishment, exercise, or defense of legal claims;
- and you have objected to us processing personal data we hold about you on the basis of our legitimate interest and you wish us to stop processing the personal data whilst we determine whether there is an overriding interest in us retaining such personal data.
Objection: You have the right to object to our processing of data about you and we will consider your request. Please provide us with detail as to your reasoning so that we can assess whether there is a compelling overriding interest in us continuing to process such data or we need to process it in relation to legal claims.

You may exercise any of these rights by contacting us using the information provided below. We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address or date of birth before providing a substantive response to the request. Depending on your location, you may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

In addition, where applicable, we will provide you with more information about our appeal process. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

Withdrawal of Consent

Where you have provided your consent to us processing your personal data, you can withdraw your consent at any time by contacting us at Puma Biotechnology, Inc., 10880 Wilshire Blvd., Suite 2150, Los Angeles, CA 90024, or email us at info@pumabiotechnology.com.

Objection to Marketing

At any time you have the right to object to our processing of data about you in order to send you marketing, including where we build profiles for such purposes, and we will stop processing the data for that purpose.

Complaints

In the event that you wish to make a complaint about how we process your personal data, please contact us in the first instance at info@pumabiotechnology.com and we will endeavor to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with the data protection supervisory authority in the EU country in which you live or work where you think we have infringed data protection laws.

Changes

If we make material changes to the way in which we use personal data we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Websites, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not access or continue to use the Websites or interact with us.

Contact

Questions, comments and requests regarding this policy are welcomed and should be addressed to info@pumabiotechnology.com, by calling us at 844-PUMABIO (844-786-2246), or at the following link Data Rights Request.

Puma Biotechnology, Inc.

10880 Wilshire Blvd., Suite 2150
Los Angeles, CA 90024
424-248-6500 Main
424-248-6501 Fax