GDPR Policy

CYTOKINETICS PRIVACY POLICY

Last Updated: April 24, 2023

Cytokinetics, Incorporated (“Cytokinetics”, “we”, “us” and “our”) respects the privacy and confidentiality of the individuals whose personal information we collect, including users of our online services and healthcare professionals. This Privacy Policy (“Privacy Policy”) was created to inform you of our practices regarding the collection, use and disclosure of personal information and the choices you have related to that information.

Please note that we may update this Privacy Policy from time to time as described in the Changes to This Privacy Policy section below.

If you are a California resident and would like to exercise your California privacy rights, please see the California Privacy Rights section below.

If you reside in the European Union, please see the Additional Information Regarding the EEA section below.

Scope
Personal Information We Collect
How We Use Personal Information
When We Disclose Personal Information
Other Information
Third-Party Links
Our Commitment to Children’s Privacy
Sensitive Information
Data Security
Data Retention
Jurisdiction and International Transfers
Your Privacy Choices
California Privacy Rights
Notice to Nevada Residents
Additional Information Regarding the EEA
Changes to This Privacy Policy
Contact Us

SCOPE

This Privacy Policy applies to all personal information collected about you by Cytokinetics, when you:

use our online, offline or digital Services, including but not limited to our corporate website, www.cytokinetics.com, https://heartofcontractility.com, and any other websites offered by Cytokinetics or a third party on its behalf that link to this Privacy Policy; (the “Websites”);
use software applications made available by us or a third party on our behalf for use on or through computers and mobile devices (the “Apps”);

interact with our social media pages and apps (collectively, our “Social Media Pages”);

communicate with us by email;
participate in our questionnaires, surveys or other interactive Services; and
interact with us offline, such as when you communicate with us orally, in writing or by electronic or other means.

Collectively, we refer to the Websites, Social Media Pages, e-mails, other communications, and offline business interactions as the “Services.”

PERSONAL INFORMATION WE COLLECT

We collect personal information when you use our Services and when we communicate with you. As used throughout this Privacy Policy, “Personal Information” means any information that relates to, identifies or could be used to identify a specific individual, such as their name, email address or telephone number. Personal information does not include anonymous data. The types of personal information that we may collect about you through the Services include:

Name

Professional work title, company

Postal address
Telephone number
Email address

Information related to your use of our products and services, your interactions with us, your preferred way of communicating with us

IP address (we may also derive your approximate location from your IP address)
Profile picture
Social media account ID

If you are a healthcare provider, we may also collect:

Banking and/or financial information, if you enter into a direct contract (for services) with us for the purpose of payment of those contracted services
Professional work title, company, and biography
Information related to your use of our products and services, your interactions with us, your preferred way of communicating with us

Collection of Personal Information

We and our service providers collect Personal Information in a variety of ways, including:

From You Directly Through the Services. We collect Personal Information through the Services, for example:

When you sign up for our email alerts, access or use the Services, (whether those services are operated by Cytokinetics or by a third party on our behalf), for example, when you participate in our programs, activities, industry events, or trade shows;
When you communicate with Cytokinetics directly. When you request information about Cytokinetics, for example, we may collect information such as your name, mailing address, email address or telephone number;
When you apply for a job, we may ask for employment information, educational history or records; and
We may also ask you to update your Personal Information from time to time in order to ensure it is accurate.

From Other Sources. In some instances, we receive Personal Information from other sources, for example:

Research and Analytics Providers: Entities who perform business functions for Cytokinetics, such as research organizations and analytics service providers;
Data companies: Entities who provide information services in the healthcare sector;
Partners: Entities with whom we partner to provide our Services;
Social Networks: Social networks that you choose to interact with in relation to our Services, such as LinkedIn, Facebook and Twitter.
Public Sources: We may collect Personal Information from public sources (including social networks) to verify your identity or professional credentials. In some cases, we may augment our existing contact databases with information from these public sources.

We need to collect Personal Information to provide the requested Services to you. If you choose not to provide the information requested, we may not be able to provide the Services. If you disclose any Personal Information relating to other people to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

HOW WE USE PERSONAL INFORMATION

We and our authorized third-party service providers process Personal Information for the following purposes:

Providing the functionality of the Services and fulfilling your requests.
- To operate, maintain, analyze and enhance our Services and develop new features, functionality and offerings.
- To respond to your inquiries and requests or otherwise communicate with you or provide you with assistance.
- To notify you of updates to our Services, send privacy or security related notices or otherwise communicate with you in compliance with the law.
- If you are a healthcare provider, to create and maintain our healthcare professionals database to identify you and, where appropriate, to contact you based on your expertise and opinions and, if applicable, your previous interactions with us.

We will engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.

Providing you with marketing materials and facilitating social sharing.

- To send you marketing related emails, with information about our services, new products, other news about our company, and/or promotional materials on scientific or health matters, which may be personalized to your professional area and interests.

- To facilitate social sharing functionality that you choose to use.

We will engage in this activity with your consent or where we have a legitimate interest.

Allowing you to participate in clinical trials.
- We may communicate with you about the potential to participate in a clinical trial and provide you with additional information about the trial.
- To validate licensure and eligibility to access or use certain Services.

We use this information to manage our contractual relationship with you.

Evaluating your application for employment and make recruiting and hiring decisions.

We use this information to manage our contractual relationship with you and/or to comply with a legal obligation.

Aggregating and/or anonymizing Personal Information.
- We may aggregate and/or anonymize Personal Information so that it will no longer be considered Personal Information. We do so to generate other data for our use, which we may use and disclose for any purpose, as it no longer identifies you or any other individual.
Accomplishing our business purposes.
- For data analysis, including to improve the efficiency of our Services. For example, we may analyze your preferences as a healthcare professional and those of other healthcare professionals to identify aggregated trends in developing, improving, or modifying our products, services, and business activities.
- For audits, to verify that our internal processes function as intended and to address legal, regulatory, or contractual requirements.
- For enhancing, improving, repairing, maintaining, or modifying our current products and services, as well as undertaking quality and safety assurance measures.
- To develop new features, functionality, and offerings.
- To prevent potentially prohibited or illegal activities or other activity that is not in accordance with our Terms of Use.

We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, and/or based on our legitimate interest.

For any other purposes disclosed to you at the time we collect your Personal Information or with your consent.

WHEN WE DISCLOSE PERSONAL INFORMATION

We disclose Personal Information:

To our authorized service providers and vendors, to facilitate services they provide to us: We disclose Personal Information to service providers, vendors, agents, partners, contractors, consultants and others who help us provide, maintain and improve our Services, such as website hosting, maintenance and security services, responding to queries, conducting data analysis and creating reports, supporting the functionality and improving the Services and helping to create new features and offerings.
To our corporate affiliates for the purposes described in this Privacy Policy: We may share your information with affiliated companies.
With co-branding partners: We may partner with other companies to provide you with content or services on a joint or “co-branded” basis. When websites or services are co-branded, you will see both the Cytokinetics logo and the logo of our co-branding partner. When you register for a co-branded website or service, your registration information may be shared with one or more of Cytokinetics’ co-branding partners. You may avoid sharing your information with our partners on co-branded sites or in relation to co-branded services by choosing not to use them. Each co-branding partner will have its own privacy policy and its privacy practices may differ from this Privacy Policy.

Other Uses and Disclosures

We also use and disclose your Personal Information as necessary or appropriate, in particular when we have a legal obligation or legitimate interest to do so:

To comply with legal obligations: We will disclose Personal Information if we believe that it is necessary to comply with a law, regulation, legal process or legitimate governmental request and to protect and defend the rights, interests, safety and security of our business, our employees, affiliates, users or the public. We may disclose information in response to subpoenas, court orders, legal process, law enforcement requests, legal claims or government inquiries that have been received by Cytokinetics. We may provide information to law enforcement when we receive a request we believe is important. This may include laws outside your country of residence.
For other legal reasons: For example, to enforce our terms and conditions and to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others.
In connection with a sale or business transaction: We have a legitimate interest in disclosing or transferring your Personal Information to a third party in connection with a corporate transaction, such as a sale, merger, acquisition, consolidation, divestiture, restructuring, reorganization, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
With Your Consent: There may be situations where you are asked to consent to us sharing Personal Information with third parties for additional reasons not included in this Privacy Policy.

OTHER INFORMATION

“Other Information” is any information that does not reveal your specific identity or does not directly relate to an identifiable individual. The Services collect Other Information such as:

Browser and device information,
App usage data, and
Information collected through cookies, pixel tags and other technologies.

Collection of Other Information

We and our service providers collect Other Information in a variety of ways, including:

Your browser or device: When you access or use our Services on any device or open one of our emails, we may automatically record your Internet Protocol address (“IP Address”), unique user ID, software version, system type, the content and webpages you access, webpages you visit before you came to our website and the dates and times that you access or use the Services.
Cookies: Cookies are pieces of information stored directly on the computer that you are using. Cookies allow us to collect information such as browser type, time spent on the Services, pages visited, language preferences, and other traffic data. For more details about the cookies utilized by Cytokinetics and your choices related to cookies, please see our Cookie Policy. Please note that we do not currently respond to browser do-not-track signals. If you do not want information collected through the use of cookies, most browsers allow you to automatically decline cookies or be given the choice of declining or accepting a particular cookie (or cookies) from a particular website. You may also wish to refer to http://www.allaboutcookies.org/manage-cookies/index.html. If, however, you do not accept cookies, you may experience some inconvenience in your use of the Services.
Pixel tags and other similar technologies. Pixel tags (also known as web beacons and clear GIFs) may be used to, among other things, track the actions of users of the Services (including email recipients), measure the success of our marketing campaigns, and compile statistics about usage of the Services and response rates.
Physical location. We may collect the physical location of your device by, for example, using satellite, cell phone tower or WiFi signals.

Uses and Disclosures of Other Information

We may use and disclose Other Information for any purpose, except where we are required to do otherwise under applicable law. If we are required to treat Other Information as Personal Information under applicable law, we may use and disclose it for the purposes for which we use and disclose Personal Information as detailed in this Policy. In some instances, we may combine Other Information with Personal Information. If we do, we will treat the combined information as Personal Information as long as it is combined.

THIRD-PARTY LINKS

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating any website or service to which the Services link. The inclusion of a link on the Services does not imply endorsement of the linked site or service by us or by our affiliates. We encourage you to read the privacy statements of every website you visit.

In addition, we are not responsible for the information collection, use, disclosure, or security policies or practices of other organizations, such as Facebook, Apple, Google, Microsoft, RIM, or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer, including with respect to any Personal Information you disclose to other organizations through or in connection with our Social Media Pages.

OUR COMMITMENT TO CHILDREN’S PRIVACY

The Services are not directed to individuals under the age of 18, and we do not knowingly collect Personal Information from individuals under 18. Consistent with the requirements of the Children’s Online Privacy Protection Act (COPPA), if Cytokinetics learns that a child under the age of 18 has provided us with Personal Information, Cytokinetics will delete this information or otherwise comply with applicable law. If you are a parent or guardian and believe that your child may have provided us with personal information, please contact us at [email protected] to request removal.

SENSITIVE INFORMATION

Unless we request it, we ask that you not send us, and you not disclose, any sensitive Personal Information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Services or otherwise to us.

DATA SECURITY

We seek to use reasonable and appropriate organizational, technical and administrative safeguards to protect the integrity and security of Personal Information within our organization. However, no data storage system or transmission of data over the internet or any other public network can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact Us” section below.

DATA RETENTION

We retain Personal Information for as long as is reasonably necessary and relevant for the specific business purpose or purposes for which it was collected and the duration of your use of our Services. In addition, we retain personal information to comply with applicable law, prevent fraud, resolve disputes, troubleshoot problems, assist with investigations, enforce our Terms of Use and other reasons permitted by law. The criteria used to determine our retention periods include:

The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account with us or keep using the Services);
Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

JURISDICTION AND INTERNATIONAL TRANSFERS

Cytokinetics is based in the United States and, regardless of where you use our Services, your Personal Information may be transferred to servers located in the U.S. and other territories as necessary for the purposes described above, including to territories that may not provide the same level of data protection as your home country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.

ADDITIONAL INFORMATION REGARDING THE EEA and UK: Some non-EEA countries are recognized by the European Commission and the UK as providing an adequate level of data protection according to EEA/UK standards (the full list of these countries for the EEA is available here https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. For transfers from the EEA or the UK to countries not considered adequate, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission and the UK International Data Transfer Addendum to protect your Personal Information. You may obtain a copy of these measures by contacting us in accordance with the “Contact Us” section below.

YOUR PRIVACY CHOICES

Your choices regarding our use and disclosure of your Personal Information

We give you choices regarding our use and disclosure of your Personal Information for marketing purposes, including the following:

Marketing or Newsletter Email Opt-Out: At times, you may be presented with the option of receiving marketing communications that we think will be of interest to you. Recipients of such communications can unsubscribe by following the specific instructions included in the communication, or you may “opt-out” of receiving any marketing emails from Cytokinetics by sending an email to us at [email protected] describing your request.

Please note that “opt-out” and “unsubscribe” requests may not take effect immediately and may require a reasonable amount of time to process and apply. If you opt-out of receiving marketing communication, we will still send you non-marketing emails for our business purposes, such as for responses to your requests or communications about your account. Additionally, you should be aware that any information provided to us prior to your election to opt-out or unsubscribe will not be retrieved or rescinded, unless required by law.

How you can access, change, or delete your Personal Information

If you would like to request to access, correct, update, suppress, restrict, or delete Personal Information that you have provided to us, withdraw your consent, object to or opt out of the processing of Personal Information, or if you would like to request to receive a copy of your Personal Information for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), you may contact us in accordance with the “Contact Us” section below. We will respond to your request consistent with applicable law. If you are a California resident, please refer to the “California Privacy Rights” section at the end of this Policy for more information about the requests you may make under the CCPA.

In your request, please make clear what Personal Information you would like to have changed or whether you would like to have your Personal Information suppressed from our database.

For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to respond to your request without undue delay. Please note that we may need to retain certain information for recordkeeping purposes.

CALIFORNIA PRIVACY RIGHTS

Pursuant to the California Consumer Privacy Act of 2018 (CCPA), we are providing the following additional details regarding the categories of Personal Information that we collect, use, and disclose about California residents. This section supplements the information provided in this Privacy Policy and applies only to California residents.

If you have questions about your California privacy rights or the information provided in this section, please contact us at [email protected].

Collection and Disclosure of Personal Information: For purposes of this section, Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household. Personal Information does not include:

information that is lawfully made available from federal, state or local government records;
anonymous, de-identified or aggregated information; and
information excluded from the scope of the CCPA, such as health or medical information covered under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and financial information covered under the Fair Credit Reporting Act (FCRA) or Gramm- Leach Bliley Act (GLBA).

While the information we may collect from you depends on your relationship and interactions with Cytokinetics, the chart below is a summary of (1) the categories of Personal Information, as identified and defined by the CCPA, that we plan to collect and have collected and disclosed within the last twelve (12) months; and (2) the categories of third parties to which we disclosed Personal Information for our operational business purposes within the last twelve (12) months:

Categories of Personal Information	Disclosed to Which Categories of Third Parties for Operational Business Purposes
identifiers such as a name, address, unique personal identifier, email, phone number, your device’s IP address and software and identification numbers associated with your devices	authorized service providers and vendors and affiliates; marketing and advertising service providers; co-branding partners; legal authorities
characteristics of protected classifications including medical information such as your medical history, mental or physical condition or treatment	authorized service providers and vendors and affiliates; legal authorities
commercial information such as records of products or services purchased, obtained or considered by you	authorized service providers and vendors and affiliates; co-branding partners; legal authorities
internet or other electronic information regarding you browsing history, search history, the webpage visited before you came to our website, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions and system configuration information	authorized service providers and vendors and affiliates; marketing and advertising service providers; co-branding partners; legal authorities
your geolocation, to the extent you have configured your device to permit us to collect such information	authorized service providers and vendors and affiliates; marketing and advertising service providers; co-branding partners; legal authorities
audio recordings of your voice to the extent you call us, as permitted under applicable law	authorized service providers and vendors and affiliates; legal authorities
professional or employment-related information	authorized service providers and vendors and affiliates; legal authorities
education-related information	authorized service providers and vendors and affiliates; legal authorities
inferences about your preferences, characteristics, behavior and attitudes	authorized service providers and vendors and affiliates; marketing and advertising service providers; co-branding partners; legal authorities
Sensitive Personal Information, such as social security number, passport number, personal information collected or analyzed concerning an individual’s health	authorized service providers and vendors and affiliates; legal authorities

We may also disclose your Personal Information to a third party in the event of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

To learn more about the Personal Information we collect and how we collect it, please refer to Personal Information We Collect above.

Sources of Personal Information: As described above, we collect Personal Information from the following sources:

directly from consumers;
indirectly from consumers through automatic means; and
third parties.

To learn more about the sources from which the Personal Information is collected, please refer to Personal Information We Collect above.

Purposes for the Collection, Use and Disclosure of Personal Information: We collect Personal Information for the business purposes described above in How We Use Personal Information. We disclose Personal Information as described in When Cytokinetics Discloses Personal Information.

Purposes of Use of Sensitive Personal Information: We may collect, use, and disclose Sensitive Personal Information for purposes of performing services for our business, providing goods or services as requested by you, ensuring security and integrity, short term transient use such as displaying first party, non-personalized advertising, order processing and fulfillment, servicing accounts, providing customer service, verifying customer information, processing payments, providing financing, and activities relating to quality and safety control or product improvement.

CCPA Privacy Rights and Requests:

If you are a California resident, you may make the following requests:

Right Against Discrimination: You have the right not to be discriminated against for exercising any of the rights described in this section. This means we will not treat you differently for exercising any of these rights.
Right to Know: You may request that we disclose to you the following information covering the 12 months preceding your request: (i) the categories of Personal Information we have collected about you and the categories of sources from which personal information is collected, (ii) the business or commercial purposes for collecting or selling the Personal Information about you, (iii) the categories of third parties with whom we have shared Personal Information, (v) the specific pieces of your Personal Information we collected about you, and (vi) the categories of your Personal Information we have sold.
Right to Delete: You may request that we delete Personal Information we have collected from you. Please be aware that we may not always be able to delete your Personal Information. For example, there may be business or operational reasons why we need to retain Personal Information. If we deny your request to delete Personal Information, we will explain the basis for our denial in our response to you.
Right to Opt-Out of Selling/Sharing: We do not sell Personal Information, and we do not share or otherwise process Personal Information for purposes of cross-context behavioral or targeted advertising, as defined under applicable law. We have not engaged in such activities in the 12 months preceding the date this Privacy Policy was last updated. Without limiting the foregoing, we do not sell or share the Personal Information of minors under sixteen (16) years of age.

How to Exercise Your California Privacy Rights: To make a request to know or delete, please contact us at [email protected] or 1-888-914-9661 (Pin: 714392). Alternatively, you can submit your request via the Cytokinetics Privacy Request Web Form or submit a hardcopy of the Cytokinetics Privacy Rights Request Form and mailing it back to us at the following address:

Cytokinetics, Incorporated
350 Oyster Point Blvd.
South San Francisco, CA 94080
Attn: Chief Compliance Officer

We will verify and respond to your request consistent with applicable law, considering the type and sensitivity of the Personal Information subject to the request. To verify your identity, we may ask you to confirm Personal Information we already have on file for you. If we cannot verify your identity from the information we have on file, we may request additional information from you, which we will only use to verify your identity and for security or fraud-prevention purposes. If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information.

You may designate an authorized agent to submit a request on your behalf using the submission methods detailed above. Cytokinetics reserves the right to deny a request from an agent that does not submit proof that they have been authorized directly by you to act on your behalf. If you are using an authorized agent to exercise your rights, as part of our verification process, Cytokinetics may require that the authorized agent provide, as applicable, proof of the agent’s status as an authorized agent, which also may include:

Proof of the agent’s registration with the California Secretary of State to conduct business in California;
Proof of a power of attorney from the resident pursuant to Probate Code sections 4121-4130.

If you are an authorized agent and have not provided us with a power of attorney from the California resident pursuant to Probate Code sections 4121-4130, we may also require the resident to:

Verify the resident’s own identity directly with us; or

Directly confirm with us that the resident provided you permission to make the request.
NOTICE TO NEVADA RESIDENTS

Nevada Residents as Covered by Nevada Privacy Law: Cytokinetics does not sell Covered Information as defined under Nevada law. If you would like to make a further inquiry regarding the selling of your Covered Information, as defined under Nevada law, please contact us using the contact information in the Contact Us section below.

ADDITIONAL INFORMATION REGARDING THE EEA

You may also:

Contact the Data Protection Officer (DPO) responsible for your country or region, if applicable. For more details on the DPO, contact us at [email protected].
Lodge a complaint with an EU/EEA data protection authority for your country or region where you have your habitual residence or place of work or where an alleged infringement of applicable data protection law occurs. A list of data protection authorities is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we update the Privacy Policy, we will revise the “last updated” legend above and post a link to the new Privacy Policy on our website. If we make any material changes, we will provide you with notice as required under applicable law. Changes to this Privacy Policy are effective when they are posted on the Services.

CONTACT US

To contact Cytokinetics with any questions or comments about this Privacy Policy, obtain access to your information or withdraw consent, please contact us at: Cytokinetics, Incorporated, 350 Oyster Point Blvd., South San Francisco, CA 94080 or by email: [email protected].