Medical Information Call Center Privacy Policy

Effective Date: September 23, 2024

This Privacy Policy (“Policy”) only applies to the medical information call center operated by Savara Inc. that allows healthcare providers to contact us with any questions or comments regarding autoimmune pulmonary alveolar proteinosis (aPAP), molgramostim, or our products and services. The medical information call center is intended as a resource to answer any questions related to Savara’s expanded access program, medical product studies, therapeutic areas and further developments. If you want to know more about Savara’s website privacy practices, please visit https://savarapharma.com/privacy-policy/.

When we say “we,” we mean Savara, Inc., who will act as a data controller for your personal information. The address for Savara, Inc. is One Summit Square, 1717 Langhorne Newtown Road, Suite 300, Langhorne, PA 19047, United States of America.

This Policy is to help you to understand how we process your personal information from our call center, what categories of information we process, why we process them, how long we keep them and who can access this information, including your rights and how you can exercise them.

This Privacy Policy explains the following:

• How We Collect Your Personal Information
• The Information We Collect
• Our Legal Basis for Collecting Personal Information
• How We Use Your Information
• How We Share Your Information
• How We Protect and Store Your Information
• Our Retention of Your Information
• Your Privacy Rights
• Cross-Border Transfer of Personal Information
• Updates to this Privacy Policy

1. How We Collect Your Personal Information
   • Call Recordings: For calls that we receive from you, before the telephone connection is established, Savara provides a welcome message that will mention that the call is recorded and you will be asked to express your consent for the call recording. Should you state your refusal to have the conversation recorded, the recording is to be immediately interrupted by our phone operator, with the initial conversation, until the time of manual interruption of the recording, will be subsequently erased.
   • Live Call Monitoring: For calls that we receive from you, before the telephone connection is established, Savara provides a welcome message that will mention that the call is recorded and might be live monitored and you will be asked to express your consent for the call recording and live monitoring. Should you state your refusal to have the conversation recorded and/or live monitored, the recording and monitoring is to be immediately interrupted by our phone operator, while the initial conversation until the time of manual interruption of the recording is to be subsequently erased.
   • Non-Recorded Calls: If you express your refusal to have the conversation recorded or/and live monitored, the phone operator will continue the call, continue the identification process and proceed to answer your questions or comments.
2. The Information We Collect

   We may collect the following categories of information when you speak with our phone operator:

   • Contact information such as name when you identify yourself on the call, email address, phone number and mailing address, including city, state and country.
   • Provider Information such as medical specialty, medical credentialing information, National Provider Identifier number, and institution.
   • Product information and any other information related to molgramostim and Savara’s product candidate(s).
   • Legally Required Information and other information we may collect about you that is related to patient safety and adverse events, or that may be required by laws that apply to Savara.

   We do not ask for nor do we collect any medical history or health information about individuals through the medical information call center. While this medical information call center is intended for Savara’s medical partners and healthcare providers, Savara understands that some patients may attempt to contact us through the medical information call center. Savara does not ask for or solicit health or medical information from individuals who may call the medical information call center.

3. Our Legal Basis for Collecting Personal Information

   Whenever we collect Personal Information from you, we may do so on the following legal bases:

   • If we have your consent;
   • Our legitimate interest, including but not limited to the following circumstances where collecting or using Personal Information is necessary for:
     • Intra-organization transfers for administrative purposes; and
     • Product development and enhancement, where the processing enables Savara to enhance, modify, personalize, or otherwise improve our services and communications for your benefit;
   • General business operations and diligence;
   • To comply with a legal obligation to which Savara is subject.

   By “legitimate interests” we mean our interests in conducting and managing our business activities and to ensure that we are guaranteeing the best service for you. Where we use your information for our legitimate interests, we make sure that we take into account the potential impact that such use may have on you. We won’t use your information if we believe your interests should override ours, unless we have other lawful grounds to do so (such as your consent or if we have a legal obligation).

4. How We Use Your Information

   We may use the information we collect from you for the following purposes:

   • Respond to your questions and comments concerning molgramostim, aPAP and other Savara products and services;
   • Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Savara, you, or others;
   • Monitor the quality, safety and efficacy of our testing kits that are used to aid in the diagnosis of aPAP.
5. How We Share Your Information
   • Vendors and Service Providers. We may share information with service providers that we believe need the information to assist us with our professional services.
   • Merger, sale, or other asset transfers. We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets, or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Policy.
   • Legal. We share information where necessary to comply with applicable law, to respond to requests from law enforcement agencies or other government authorities or third-parties, as permitted by law and without your consent when it is necessary to protect our customers, employees, or property; in emergency situations; or to enforce our rights under our terms of service and policies.
6. How We Protect and Store Your Information

   We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the medical information call center. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks and phone systems.

7. Our Retention of Your Information

   We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, or reporting requirements. Generally, call recordings are retained for ninety (90) days and then deleted. To determine the appropriate retention period for personal information we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

8. Your Privacy Rights

   Certain jurisdictions have specific legal requirements and grant privacy rights with respect to personal information, and we will comply with restrictions and any requests you submit as required by applicable law. For example, you may have the right to: (1) obtain a copy of personal information we maintain about you in a portable format; (2) correct inaccuracies or incompletion in your personal information; (3) object to the continued processing or use of your personal information; (4) complain to a supervisory authority; (5) or request that personal information be deleted. In addition, if you believe that personal information we maintain about you is inaccurate, subject to applicable law, you may have the right to request that we correct or amend the information by contacting us as indicated in the “How to Contact Us” section below. You may also have the right to not be discriminated against for exercising your privacy rights. If you are a resident of the European Economic Area or United Kingdom, see our “Jurisdiction-Specific Notices” section below for additional information as to how to exercise rights under the laws of those jurisdictions. If you are located outside that jurisdiction and seek to exercise your rights under the law of another jurisdiction, please contact us by emailing info@savarapharma.com.

   To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. When you make a request, we may require that you provide information and follow procedures so that we can verify your identity (and the applicable jurisdiction). The verification steps we take may differ depending on your jurisdiction and the request. Where possible, we will attempt to match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us do so. We will respond to your request within the time period required by applicable law. However, we may not always be able or required to comply with your request, in whole or in part, and we will notify you in that event.

   • Jurisdiction Specific Notices – EEA and UK Residents

   The European Union’s General Data Protection Regulation (“GDPR”), and corresponding legislation in the UK, provide EEA, and UK residents with certain rights in connection with personal information you have shared with us. If you are resident in the EEA, or UK, you have the following rights:

   1. The right to be informed. You are entitled to be informed of the use of your personal information. This Privacy Policy provides such information to you.
   2. The right of access. You have the right to request a copy of your personal information which we hold about you.
   3. The right of correction. You have the right to request correction or changes of your personal information if it is found to be inaccurate or out of date.
   4. The right to be forgotten. You have the right to request us, at any time, to delete your personal information from our servers and to erase your personal information when it is no longer necessary for us to retain such data. Note, however, that deletion of your personal information will likely impact your ability to use our services.
   5. The right to object (opt-out). You have the right to opt-out of certain uses of your personal information, such as direct marketing, at any time.
   6. The right to data portability. You have the right to a “portable” copy of your personal information that you have submitted to us. Generally, this means your right to request that we move, copy or transmit your personal information stored on our servers / IT environment to another service provider’s servers / IT environment.
   7. The right to refuse to be subjected to automated decision making, including profiling. You have the right not to be subject to a decision and insist on human intervention if the decision is based on automated processing and produces a legal effect or a similarly significant effect on you.
   8. The right to lodge a complaint with a supervisory authority. You may also have the right to make a GDPR complaint to the relevant Supervisory Authority. A list of Supervisory Authorities is available here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

   To exercise your rights, please submit your request to info@savarapharma.com or by using the contact information provided below and we will consider your request in accordance with applicable law. For your protection, we may need to verify your identity before responding to your request, such as verifying that the email address from which you send the request matches your email address that we have on file. If we no longer need to process personal information about you in order to provide our services, we will not maintain, acquire or process additional information in order to identify you for the purpose of responding to your request. In some cases, our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

   We endeavor to respond to a verifiable consumer request within 30 days of its receipt consistent with applicable law. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

9. Cross-Border Transfer of Personal Information

   Savara provides a global service, and transferring data internationally is essential to the services provided to health care providers. If you use the medical information call center, you understand that we may transfer your personal information outside the United Kingdom (UK) or the European Economic Area (EEA), including to the United States and other countries that do not have the same level of protection for personal information. When we do this, we will ensure that the personal information has the appropriate level of protection and that any such transfers comply with safeguards as required by relevant law. These safeguards include agreeing to standard contractual clauses or model clauses for transfers of personal information among suppliers and affiliates. We may also rely on your explicit oral consent to conduct the transfer.

10. Updates to this Privacy Policy

    Our Medical Information Call Center Privacy Policy may change from time to time. We will post any privacy policy changes on this page and, if the changes are material, we may provide a more prominent notice (including, email notification of privacy notice changes) for a reasonable period of time. Nevertheless, you should review this Policy from time to time to be sure you are aware of the most recent version.