Privacy Policy

Last Updated DATE

Umoja Biopharma, Inc. (“Umoja,” “we,” “our,” or “us”) respects your privacy and are committed to handling Personal Data responsibly.

This Privacy Notice explains how we collect, use, disclose, protect, and retain Personal Data, and is meant to help you understand our privacy practices when you visit and interact with us through our website, when you participate in business interactions with us that reference this Privacy Notice, collectively referred to as “Interactions.” It also explains the choices and rights that may be available to you.

Personal Data We Collect and Use

When you Interact with us, we collect information that alone or in combination with other information in our possession could be used to identify you (“Personal Data”).

The type of Personal Data we collect depends on the nature of your Interactions with us and the legal and business context of the relationship. We may collect the following categories of Personal Data:

Contact information, such as your first and last name, address, telephone number, email address, and other contact information you choose to provide to us

Demographic information, including your gender, age or date of birth
Professional and educational details such as affiliations, specialty, NPI, education details or other information found on a resume
Electronic and sensory data: such as recordings for data requests or customer service purposes
Network Activity Data: Information collected through tracking technologies such as IP address or other online identifiers
Inferences derived from the Personal Data described above, such as social media profiles or other public records or websites

We may use this information to:

Recruit for employment purposes, employee onboarding or other administration of Umoja Personnel
Respond to questions on recruitment to our clinical trials or refer you to specific organizations that may provide information on how to participate in clinical trials or to facilitate clinical trials
Address questions related to products in development, or in market
Deliver requested information on resources available related to the therapeutic areas or other medical or scientific areas that Umoja provides
Develop new products and services
Staff, facilitate, and manage market research, studies, and related activities
Create aggregated analytics for research purposes
Process grants and sponsorship applications
Fulfill our obligations to you under an applicable contract or to conduct business with you
Provide support-related activities, such as customer service
Comply with regulatory monitoring and reporting obligations, such as those related to adverse events, product complaints, spend transparency, and patient safety
Protect against, identify, investigate, and respond to fraudulent, harmful, unauthorized, unethical or illegal activity
Conduct other legitimate business activities, as allowed by applicable law

We may combine the Personal Data we collect about you online with the Personal Data we collect about you from our offline interactions with you (for example, our interactions by telephone or in person). We may also combine any of the information we collect about you with information we lawfully obtain from other sources, such as public records or websites, or other third parties (e.g., health care professionals, patient groups, government agencies). When required, we will request your consent or provide you with an opportunity for you to opt- out of this type of processing of your Personal Data.

Sensitive Data

In course of our Interactions we may also collect and process Personal Data that is of a sensitive nature, for example:

Username and password that you may select in connection with establishing an account related to our Interactions
Precise geolocation
Disciplinary actions and/or criminal proceedings and/or sanctions
Identification information, such as identity cards, passport, visa, social security number or other taxpayer/government identification number like driver license details
Financial information, such as your bank account number for employment credit checks
Information related to your health and medical condition(s), which may include genetic data or biometric information, medical treatments, medications, test results; and/or information about your insurance
Other protected characteristics, such as your race or ethnicity, should you choose to share this information with us

We may use Sensitive Data, as necessary, to:

Facilitate recruitment, evaluate candidates for employment purposes and conduct employee-related activities, such as payroll and benefits
Provide and manage clinical research opportunities, patient support programs and other Interactions we offer
Process and manage safety and quality concerns
Conduct other legitimate business activities, as allowed by applicable law

We will only process Sensitive Personal Data when we have your express consent, or as required or permitted under applicable law, for example, when necessary to comply with applicable law, respond to legitimate requests from government authorities, including authorities that may be outside of your country of residence, to protect or defend our legal interests, and if necessary, to protect the safety of our employees and other stakeholders. You may request to opt-out or limit the processing of your Sensitive Data by contacting us using the details found in the “Contact Us” section of this Notice.

Use of Cookies and other similar Technologies

We use cookies and similar technologies (such as web beacons, tags, scripts and device identifiers) to collect and store analytics and other information when you visit our website or otherwise Interact with us. The cookies we use include both first party and third-party cookies.

Cookies, or similar technologies, may provide us the following information:

The type of web browser software you use
The name of the domain from which you access the Internet (including client and server IP addresses, usernames, ports, queries, or other status-related information)
The Internet address of the website from which you linked directly to our website
The date and time you access our website
Which pages you have visited on our website

In most cases we will not be able to identify you directly from the information we collect using these technologies. You can manage your cookie consent preferences or choose to opt-out of sharing your Information for analytical or advertising purposes (if applicable) via our Cookie Preference Center. If you disable cookies you may be unable to access or utilize certain parts of our website, or your experience may be altered.

Sources of Personal Data

We may collect Personal Data from:

You directly
Your browser or device
Our affiliates and business partners
Third parties you ask or authorize to share information with us
Public third-party sources, such as social media platforms
Information generated through your browsing and website usage
Information lawfully obtained from other third parties (e.g., health care professionals, patient groups, government agencies)

Legal Basis for Processing

Where applicable law requires us to identify a legal basis for processing, we generally rely on one or more of the following bases, depending on the context, such as:

With your consent where required by law, including for certain marketing communications, cookies and similar technologies, and specific programs or activities. Where we rely on consent, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
Where necessary to take steps at your request before entering into a contract or, where applicable, to perform a contract with you.
Where necessary for our legitimate interests which may include operating, securing, improving, and personalizing our website and related services; understanding how users engage with our website and communications; maintaining and improving our content and communications; preventing fraud, misuse, and unauthorized activity; protecting our legal rights and business operations; and communicating with you about our business, products, services, scientific research, educational opportunities, or events where permitted by law.
Where necessary for compliance with applicable legal, regulatory, reporting, recordkeeping, pharmacovigilance, safety, or compliance obligations.

International Data Transfers

Umoja operates globally, and your Personal Data may be collected, stored, accessed, used, or otherwise processed in countries other than the country in which you are located, including countries where Umoja, its affiliates, service providers, partners, or regulators operate. These countries may have data protection laws that differ from those of your country of residence.

Where required by applicable law, we implement appropriate safeguards for cross-border transfers of Personal Data. Depending on the circumstances, these safeguards may include adequacy decisions, standard contractual clauses, international data transfer agreements, or other lawful transfer mechanisms recognized under applicable law.

If you are located in the EEA, the United Kingdom, or Switzerland and your Personal Data is transferred to a country that is not recognized as providing an adequate level of protection, we will rely on appropriate safeguards or another valid transfer mechanism as required by law.

You may contact us using the details below to request additional information about the safeguards we use, where available.

Please note that courts, law enforcement authorities, regulators, or national security authorities in other jurisdictions may be able to access Personal Data in accordance with applicable law.

Data Retention

We retain Personal Data for as long as reasonably necessary for the purposes described in this Notice, in line with applicable law and our records retention practices.

In determining retention periods, we consider factors such as:

The nature of the data and the purpose for which it was collected
Whether the data is needed to provide requested services or respond to inquiries
Marketing preference and suppression recordkeeping needs
Event, program, and website administration needs
Legal, regulatory, tax, accounting, safety, and compliance obligations
The need to establish, exercise, or defend legal claims

When Personal Data is no longer needed, we delete it or anonymize it, subject to applicable legal or regulatory retention obligations.

Data Security

We maintain administrative, technical, physical, and organizational safeguards designed to protect Personal Data against loss, theft, misuse, unauthorized access, unauthorized disclosure, and unauthorized modification. We also require appropriate safeguards from service providers that process Personal Data on our behalf.

Children’s Privacy

This website is not intended for children under 18, and Personal Data should not be submitted through the website by individuals under 18. If we learn that Personal Data relating to a person under 18 has been submitted without appropriate authorization, we will take steps to delete it in accordance with applicable requirements and our deletion practices.

Third-party websites

This website may contain links to third-party websites or services for your convenience. Those third parties operate under their own terms and privacy notices. This Notice does not apply to non-Umoja websites, and we are not responsible for their content or privacy practices.

Your Privacy Rights and Choices

You may contact us at privacy@umoja-biopharma.com to request access to the Personal Data we have collected about you, or to update or correct Personal Data that you have provided to us, to limit use of, delete, export or opt-out of certain processing of your Personal Data.

In some cases, we may need to collect additional Information from you in order to verify your identity before providing you access to or deleting your data, such as a government-issued identification. Umoja will not discriminate against you for exercising your rights, but we may not be able to Interact with you as you have requested if we are not able to use your data. These rights are not absolute and may only apply in certain circumstances. This means that we may be unable (e.g., due to legal requirements) or not obligated to satisfy your request. If you submit and we deny an appeal, we will provide information about how you may contact the applicable state Attorney General or other regulator, where required by law.

Complaints

Depending on your location, you may have the right to lodge a complaint with a data protection supervisory authority or other applicable privacy regulator if you believe your Personal Data has been handled in violation of applicable law.

In the EEA and UK, this generally includes the supervisory authority in your residence, place of work, or place of the alleged infringement, and in the United States, your state’s attorney general.

We encourage you to contact us first so we can try to address your concerns directly.

Changes to This Notice

We may update this Privacy Notice from time to time. When we do, we will post the revised version and update the “Last Updated” date at the top of the Notice.

Contact Us

If you have questions about this Notice or our privacy practices, please contact:

Umoja Biopharma, Inc.
701 Dexter Ave N
Suite 300
Seattle, WA 98109

Email: privacy@umoja-biopharma.com

Phone: (206) 705-7687