Last Revised: February 10, 2025

 

I. Introduction

Dermavant, an Organon Company (“Dermavant”, “we”, “us”, or “our”) recognize the importance of protecting your privacy. This Privacy Policy (“Policy”) explains how we collect, use and disclose information about you when you use our websites that link to this policy, including but not limited to www.Dermavant.com (collectively, the “Sites”). This Policy does not apply to our collection, use, or disclosure of data collected through other means. If we have collected information from or about you subject to a separate Dermavant privacy policy, consent, or other agreement, such as an informed consent to participate in a study or an authorization in connection with a patient assistance program (collectively, “Other Agreement”), to the extent the Other Agreement includes additional terms that are not covered by or are inconsistent with this Policy, the terms and conditions of the Other Agreement will supersede this Policy.

When you use our Sites, we collect, use, and disclose information about you as described in this Policy. Before you use or submit any information through a Site, please carefully review this Privacy Policy and the Terms of Use for that Site.  If you do not agree to this Privacy Policy, you should not access or use that Site.

If we decide to make changes to this Policy, we will post an updated version of the Policy on the Sites. Your use of a Site following the posting of an updated version of the Policy constitutes your acceptance of the updated Policy, so please check the Policy periodically to be sure you are still comfortable with its terms.

The principal focus of the Policy is our practices and policies with respect to your personally identifiable information (“PII”). For purposes of this Policy, PII about you means data or information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household.

DISCLAIMER:  The content appearing on our websites or web-based resources is presented exclusively for informational purposes.  You understand and agree that we do not use these Sites to provide medical advice or legal advice and you should not assume that information submitted through these sites are subject to health, financial or legal privacy laws or regulations.  You will not rely on any statements made on these Sites as though it were professional advice.  Our Sites may provide certain information concerning diseases and their treatment.  Such information is not a substitute for the advice of a trained healthcare professional and is not intended or provided as medical advice.  If you have or suspect having any health problems, concerns or conditions, you should consult your personal health provider.

 

II. Who Is the Controller for Processing Your Data?

Dermavant, an Organon Company, is the controller for Dermavant’s processing under this Policy, unless we tell you otherwise in individual cases.

You may contact us for any data protection concerns under the contact details provided in Section XV below.

 

III. How Does Dermavant Collect Your PII and What Types of PII Does It Collect?

Depending on your relationship with Dermavant, you may provide, and we may collect, different types of PII. Dermavant collects PII about you when you actively provide it to us, such as by completing an online form, responding to a request for information or a survey, signing up to receive communications from us, submitting employment inquiries, responding to our social media posts, or contacting our call center. We also collect some PII from you automatically through your browser when you visit a Site, such as your Internet Protocol (IP) address.

We also may collect PII about you from other sources, such as our business partners; the Internet, including social media websites; the press or other print media; publicly available sources, and other organizations or individuals as permitted under applicable law.

Listed below are the types of PII that we may collect about you. Some of these types of information may not be PII, depending on other information about you to which we have access. Each type of information listed below is PII only if the information identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household.

• Identifiers such as: your name, postal address, online identifier, Internet Protocol (IP) address, email address, Social Security number, driver’s license number, or other similar identifiers.
• “Customer Records” information (some of which may be identifiers or professional/employment-related information as well), such as your name, Social Security number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, date of birth, gender, insurance policy number, education, employment, employment history, bank account number, other financial information, medical information, health insurance information, caregiver information, or communications exchanged with you.
• Commercial information, such as records of products or services purchased, obtained, or considered, other purchasing or consuming histories or tendencies, or communications exchanged with commercial partners or authorities.
• Internet or other similar network activity, such as information on your interaction with our Sites, mobile application(s), or an advertisement. This may include information about your hardware and browser information from your computer or other online device. Additionally, when you visit certain pages on the Sites, we may use a program that monitors and evaluates the Site’s traffic. This type of program automatically records PII about every visitor such as their host, domain name, pages visited, length of user session, browser type, and/or IP address.
• Professional or employment-related information, such as your current or past job history.
• Personal characteristics that are related to classifications legally protected from discrimination, such as race, national origin, ethnicity, marital status, age, and gender.
• Inferences drawn from other PII, such as a summary we might make based on your apparent personal preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes.

PII does not include anonymized, aggregate, or statistical information from which such identification cannot be reconstituted.

 

IV. Our Business Purposes for Collecting PII; How We Use the Information

We may use the PII we collect from you for a variety of purposes permitted by law, including:

• To communicate with you, including to invite you to participate in surveys, to respond to your inquiries, and to fulfill your requests — this is necessary for our legitimate interests in running our business and to comply with our legal obligations;
• To provide you with information about our products and services, and to provide you with our products and services — this is necessary for our legitimate interests in running our business and to take steps to enter into agreements with you;
• To improve our services as well as the content of the Site, including to customize the Site to your preferences — this is necessary for our legitimate interests in running our business effectively and efficiently;
• For our data analysis, product development, and marketing and research purposes — this is necessary for our legitimate interests in running our business effectively and efficiently;
• To prevent fraud, including by confirming your identity — this is necessary to comply with our legal obligations;
• To maintain and upgrade the security of any data or information collected — this is necessary for our legitimate interests in data security and to protect the vital interests of you or other data subjects;
• For risk management and compliance purposes, including to comply with law enforcement and other legal processes — this is necessary to comply with our legal obligations;
• For any other purpose you may agree to at or before the time the personal information is collected from you.

Where permitted by our arrangements with service providers, we may combine the PII you share through our Sites with other information you have shared with us, both online and offline.  We may also combine this PII with records provided by third parties.  We use this consolidated information to help better design our products, communicate information to you, enhance our marketing and research activities and to facilitate other business functions.  Based upon your specific relationship with Dermavant, we may use your PII in ways described in more detail in one or more Other Agreements.

 

V. On What Legal Basis Do We Process Your PII?

Where we ask for your consent for certain processing activities, we will inform you separately about the relevant processing purposes. You may withdraw your consent at any time with effect for the future. Once we have received notification of withdrawal of consent, we will no longer process your PII for the purpose(s) you consented to, unless we have another legal basis to do so. Withdrawal of consent does not, however, affect the lawfulness of the processing based on the consent prior to withdrawal.

Where we do not ask for consent for processing, the processing of your PII relies on initiating or performing a contract with you (or the entity you represent) or on our or a third-party’s legitimate interest in the specific processing, in particular in pursuing the purposes and objectives set out in Section IV and in implementing related measures. This also includes the marketing of our products and services, the interest in better understanding our markets, and in managing and further developing our company, including its operations, safely and efficiently. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by applicable data protection law.

We may process your PII on any legal basis, for example, in the event of a dispute, as required in relation to a potential litigation or for the enforcement or defense of legal claims. In some cases, other legal bases may apply, which we will communicate to you separately as necessary.

 

VI. How We May Share Personally Identifiable Information

We may share or disclose the PII we collect as follows:

• With our service providers, whom we engage to assist us with technology support, operational support and other forms of assistance, including for the various purposes identified in Section IV above, and whom we bind by contract to protect the confidentiality and security of the PII we share with them — this is necessary for our legitimate interests in running our business effectively and efficiently;
• With third-party advertising providers to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may also collect information directly from a browser or device when an individual visits our Sites through cookies, pixels, or other data collection technologies. Depending on where you live, you may have the right to opt in or opt out of targeted advertising. For more information, please see Section XII, Your Privacy Rights and Choices.
• To our affiliated entities within the Dermavant corporate family, for legally permissible purposes — this is necessary for our legitimate interests in running our business effectively and efficiently;
• In the event of a proposed or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our company or its assets, to the proposed or actual acquiring party or assignee — this is necessary for our legitimate interests in achieving our business objectives and to comply with our legal (contractual) obligations;
• As we believe to be appropriate: (i) when required by applicable law, including laws outside your country of residence; (ii) to comply with legal process; (iii) to respond to requests from public and government authorities; (iv) to enforce the terms and conditions for use of the Sites, including this Policy; (v) to protect and defend our rights and property; (vi) to protect the interests of Dermavant or others; and (vii) to permit us to pursue available remedies or limit the damages that we may sustain — all to fulfill our legal obligations and protect our legal rights.
• For any other purpose with any other persons or entities consistent with your consent at or before the time the PII is shared.

Absent your consent, we do not sell or share your PII and do not share your PII with non-affiliated entities for them to use for their own direct marketing purposes. We may aggregate your PII with that of others and, to the extent the aggregation de-identifies the information such that it is no longer PII, we may use and share the de-identified data for any purpose, without limitation.

 

VII. Other Information Collection, Use, and Sharing

Our Sites use cookies and similar technologies to help us distinguish access by you (through your system) from access by other users, so that we can ensure the functionality of the website and carry out analysis and personalization. To learn more about cookies, please visit http://www.allaboutcookies.orghttp://www.allaboutcookies.org. We do not intend to determine your identity, even if that is possible where we or third-party service providers can identify you by combination with registration data or other identifiers. However, even without registration data, the technologies we use are designed in a way that you may be recognized as an individual visitor each time you access the website, for example by our server (or third-party servers) using cookies. Depending on the purpose of these technologies, we may ask for consent before they are used. You can also set your browser to block or deceive certain types of cookies or alternative technologies, or to delete existing cookies; however, you must enable cookies to access certain information on the Sites. You can also add software to your browser that blocks certain third-party tracking. You can find more information on the help pages of your browser (usually with the keyword “Privacy”).

• We use Google Analytics v4 to help us monitor performance and usage patterns on the Sites. Google collects information about the behavior of visitors to our website (duration, page views, geographic region of access, etc.) through cookies and on this basis creates reports for us about the use of our website. We have turned off the “Data sharing” option that would enable Google to access, analyze and use data for its own purposes and deactivated the “Signals” option. Although we can assume that the information we share with Google is not personal data for Google, it may be possible that Google may be able to draw conclusions about the identity of visitors based on the data collected, create personal profiles and link this data with the Google accounts of these individuals for its own purposes. In any event, if you consent to the use of Google Analytics, you expressly consent to any such processing, including the transfer of your personal data (in particular website and app usage, device information and unique IDs) to the United States and other countries, where it may be accessible to authorities not subject to adequate privacy protections. Information about data protection with Google Analytics can be found here: https://support.google.com/analytics/answer/6004245. Additionally, when you visit certain pages on the Sites, we may use a program that monitors and evaluates the Site’s traffic. This type of program automatically records PII about every visitor such as their host, domain name, pages visited, length of user session, browser type, and/or IP address.

 

VIII. Data Retention; Security

We will retain PII about you for the period necessary for us to fulfill the legitimate purposes for which we collect PII as outlined in this Policy, and in accordance with our legitimate business interests and applicable law.

We endeavor to use reasonable organizational, technical, and administrative measures to protect the PII we maintain within our organization.

We have established safeguards to help prevent unauthorized access to or misuse of your PII, but we cannot guarantee that your PII will never be disclosed in a manner inconsistent with this Policy (for example, as a result of unauthorized acts by third parties that violate applicable law or relevant Web policies).  We make no guarantees as to the security of your PII and disclaim, to the fullest extent permitted by law, all liability and damages caused by loss, misuse and/or unauthorized access, disclosure, alteration or destruction,

If you register for a Dermavant account, you will be asked to select a password to help protect your information. These passwords help us verify your identity before granting access or making corrections to any of your Personal Information. You should never disclose your password to anyone. Dermavant will never ask you for your password in an unsolicited phone call or e-mail. You are responsible for maintaining the secrecy of your passwords and any account information.

 

IX. Updates to Your PII

If you would like to update PII that you have provided to us, you may contact us through one of the means listed in Section XV (“How to Contact Us”) at the end of this Policy.

 

X. Site Use Limitations and International Data Transfers

We disclose PII to other parties (see Sections VI and VII) that are not necessarily located in the European Union, the United Kingdom or in Switzerland. Also, most of our Sites are designed for users from the United States, the United Kingdom, and Switzerland, and are controlled and operated by us from the United States. Your PII may therefore be processed both in Europe and in the United States, and in certain cases, in any country in the world.

If a recipient is located in a country without adequate statutory data protection, we require the recipient to undertake to comply with appropriate data protection practices (for this purpose, we generally use the revised European Commission’s standard contractual clauseshttps://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless the recipient is subject to other legally accepted rules to ensure data protection or we can rely on an exception. An exception may apply for example in case of legal proceedings abroad, but also in cases of overriding public interest or if the performance of a contract requires disclosure, if you have consented or if data has been made available generally by you and you have not objected against the processing.

 

XI. Links to Other Websites

Our Sites may provide links to third-party websites. We provide these links solely for the convenience and information of our visitors. When you click on one of these links, you will be accessing content that is not subject to this Policy. We are not responsible for the content or information- collection practices of the other websites that you visit, and advise you to review their privacy policies before you provide them with any PII. Such third parties are responsible for their use of your PII and Dermavant does not control their privacy policies or practices.

 

XII. Your Privacy Rights and Choices

When you create an account, or request one of our other services, you will have the ability to opt-out of receiving certain communications from Dermavant, including voicemail, texts or e-mail. If you do not opt-out at registration, but later decide that you would prefer not to receive communications from Dermavant, please contact privacyoffice@organon.com. Remember, however, that Dermavant may still send e-mail or call you in order to provide a product or service that you request.

In addition to the above communications preferences, you may have the right to request the below privacy rights. We will respond to your request to the extent required by law, which will depend on where you live, and will endeavor to honor your request in all other cases. You have the right not to be discriminated against for exercising these rights. However, we may charge a reasonable fee to comply with your request(s) as legally permitted.

You may have the right to:

1. know what personal information we collect, use, disclose, and sell;
2. request that we delete your personal information;
3. access and obtain a copy of your personal information that we collect;
4. request that we update or correct your inaccurate personal information;
5. opt out of targeted advertising;
6. limit the use and disclosure of certain sensitive information; and/or
7. correct personal information about you.

In order to protect your PII from unauthorized disclosure or deletion at the request of someone other than you or your legal representative, Dermavant requires identification verification before granting any request to provide copies of, know more about, edit or delete your PII. We take special precautions to help ensure this. We cannot respond to your request or provide you with PII if we cannot verify your identity or authority to make the request and confirm that the PII relates to you. We will only use PII collected in connection with a request from you to verify your identity or authority to make the request.

You may make a request on your own behalf, and if you are the parent or guardian of someone under the age of 18, you also may make a request related to that person’s PII. If you wish to designate an authorized agent to make a request on your behalf, please provide us with a signed declaration stating that your intent is to permit that individual to act on your behalf and include such individual’s full name, address, email address, and phone number. That way we will be sure you have fully authorized us to act in accordance with the requests of that individual.

If you or your authorized agent wish to request any of the above, please send an e-mail to privacyoffice@organon.com and include the phrase “Privacy Request” in the subject line, and provide your name.

Alternatively, you may request the above rights by calling or writing to us at:

+1 844-674-3200

30 Hudson Street, Jersey City, NJ 07302

If you disagree with our response to your request, you may appeal the request by contacting privacyoffice@organon.com.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt; however, we will respond sooner where required by law. If we require more time, we will inform you in writing of the reason(s) and the number of additional days we need to respond.

 

XIII. EU, UK and Swiss Residents’ Data Protection Rights

If you reside in the European Economic Area, Switzerland, or the United Kingdom, you have the following rights in relation to your PII (referred to in these jurisdictions as “Personal Data”), depending on the applicable data protection law:

Access. You have the right to request details about the Personal Data that we hold about you and copies of that Personal Data.

Right to Withdraw Consent. Where you have consented to our processing of your Personal Data, you have the right to withdraw such consent at any time. In the event you wish to withdraw your consent to processing, please contact us as described in Section XIV (“How to Contact Us”) below.

Data Portability. In certain circumstances, you may request us to port (i.e., transmit) your Personal Data directly to another organization or to you.

Rectification. You have the right to ensure that the Personal Data about you that we hold is accurate and up to date. If you think that any information we have about you is incorrect or incomplete, please contact us as described in Section XV (“How to Contact Us”) below.

Deletion. You have the right to have your Personal Data deleted in certain specified situations.

Restriction of processing. You have the right in certain specified situations to require us to restrict processing your Personal Data.

Object to processing. You have the right to object to specific types of processing of your Personal Data, such as, where we are processing your Personal Data for the purposes of direct marketing, for profiling carried out for direct marketing purposes and for other legitimate interests in processing.

Prevent automated decision-taking. In certain circumstances, you have the right not to be subject to decisions about you being made solely on the basis of automated processing.

If you wish to enforce any of your rights under data protection laws applicable in the EU, UK, or Switzerland, please contact us as indicated in Section XV (“How to Contact Us”) below. In order for us to be able to prevent misuse, we need to identify you (for example by means of a copy of your ID card, if identification is not possible by other means). We will respond to your request without undue delay and by no later than one month from receipt of any such request, unless a longer period is permitted by applicable data protection laws. Please note that conditions, exceptions, or restrictions apply to these rights under applicable data protection law (for example to protect third parties or trade secrets). We will inform you accordingly where applicable. We may charge a reasonable fee for dealing with your request, and if we choose to do so, we will notify to you. Please note that we will only charge a fee where we are permitted to do so by applicable data protection laws. If you are concerned that we have not complied with your legal rights under applicable data protection laws, you may contact your local supervisory authority.

A list of the supervisory authorities of the European Union, along with their contact details can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. The Information Commissioner’s Office http://www.ico.org.uk/ is the data protection regulator in the UK. The Federal Data Protection and Information Commissioner https://www.edoeb.admin.ch/edoeb/en/home.html is the data protection regulator in Switzerland.

 

XIV. Minors

Our Sites are not designed or intended for use by children under the age of 13.  Moreover, we do not knowingly collect any Personally Identifiable Information from anyone under the age of 13 without the prior, verifiable consent of a parent or guardian in accordance with the appropriate verification mechanisms under the Children’s Online Privacy Protection Act rules. If you are a parent or guardian and believe we have collected information from your child, please contact at privacyoffice@organon.com.  Anyone under 18 years old should seek their parent’s or guardian’s permission prior to using or disclosing any Personally-Identifiable Information on our Sites.

 

XV. How to Contact Us

If you have any questions regarding this Policy or want to exercise your data protection rights under Sections XII or XIII, please send an email to at privacyoffice@organon.com or write to us at: 30 Hudson Street, Jersey City, NJ 07302.

 

This Privacy Policy is effective as of: February 10, 2025.