Consumer Health Data

This Consumer Health Data Privacy Policy (“Privacy Policy”) applies to Washington residents (“Consumers” or “you”) and provides information regarding what consumer health data Autolus and its affiliated entities (referred to collectively as “Autolus,” “we,” “our,” or “us”) collect about you, in connection with our products, services, apps and websites both online and offline (collectively, the “Services”) the sources from which we collect such data, the purposes for which we use and disclose this information, and how you can exercise certain rights with respect to such data.

1. Categories of Consumer Health Data We Collect

As part of the information we may collect or receive about you (as further described in the Autolus Privacy Policy) we may collect and process certain information about you that could identify past, present or future physical or mental health status (“Consumer Health Data”). This Consumer Health Data generally includes:

• Biographical and demographic information to the extent related to physical or mental health status, diagnosis, disease, or treatment.
• Health and medical information (such as information about physical and mental health conditions and diagnoses, treatments for medical conditions, genetic information, family medical history, medications an individual may take, including the dosage, timing, and frequency, and information about an individual’s healthcare providers) we collect in connection with recruiting for clinical trials, conducting certain types of research activities (e.g. market research), providing patient support and access programs, and distributing and marketing our products and Services.
• Location data including precise location information about a particular individual or device.
• Financial information and transaction data, including purchase history (such as insurance, billing, payment and other transactional information, income, and information to determine eligibility for patient assistance programs and services).
• Records of your communications and other requests. For example, if you email, call, or otherwise communicate with us or with members of our team (e.g., when you fill out a form on one of our websites or sign up for news and updates from us).
• Registration information. When you register for certain Services (such as if you participate in promotions or register for events or programs that we sponsor or administer).
• Information we may collect via automated means or derive about you, which could include inferences about your health or medical status derived or extrapolated from non-Consumer Health Data. Such information may include your device and browser information, activities, and usage data about your use of our Services, and location information derived from your IP address or (with your permission) your mobile device.

2. Sources of Consumer Health Data

We collect your Consumer Health Data from the following sources:

• Directly from you when you access or use our Services or communicate with us about our business or our Services.
• When permitted and through our use of cookies and other automatic data collection technologies, when you visit our websites, use our mobile applications, open or click on emails we send you, or interact with our advertisements. We or third parties we work with may automatically collect certain information using technologies such as cookies, web beacons, clear GIF, pixels, internet tags, web server logs, and other data collection tools.
• From healthcare professionals.
• From government agencies and/or public records.
• From service providers, data brokers, or business partners.
• From industry and patient groups and associations.
• From publicly available sources, including information provided on websites, social media channels, public forums or platforms, and other third-party sources.

3. How We Use Consumer Health Data

In general, Autolus uses Consumer Health Data for the following purposes:

• Providing Services and support. To provide and make available our Services, to communicate with you about your use of and interactions with our Services, to respond to your inquiries, to fulfill your orders and requests, and for other customer and patient support purposes. For example:
  • Where you have requested information regarding participation in a clinical trial with Autolus or one of Autolus’s partners
  • To support disease management, education, or decision support systems related to the use of our products and Services
  • Where you have requested a Service from Autolus, assisting you in the completion of your application, the assessment of your eligibility for any such requested Services, the fulfillment of the Services, as well as any applicable renewal of such Services
  • Making proposals for future Service needs
• Quality, safety and regulatory reporting. We may record and report on the health and other information that we collect associated with product safety or quality, and other adverse incident reports in compliance with our legal regulatory obligations. We may also contact you to seek additional information from individuals who report or communicate such product safety, quality, and other adverse incident information, in order to fulfill our legal and regulatory obligations. The information you provide Autolus is very important and will be used in the safety monitoring of our products for reporting and public health purposes. Please visit the Adverse Event Reporting page to learn more about our practices related to such information.
• Research and analytics. For purposes of conducting research and analytics to understand, improve, evaluate, and develop our Services and business processes and to develop other insights. For example, we may conduct primary and secondary research related to our clinical products and treatments and related Services, including by recruiting for and conducting clinical trials and to research and develop new products and treatments and other Services. We may administer surveys and questionnaires for market research or quality and satisfaction purposes. We also use Consumer Health Data that we collect about your use of our Services to better understand how users access and use these Services and for other research and analytical purposes, such as to evaluate and improve our Services and business operations, to develop new Services and features, and for internal quality control and training purposes. We may also analyze public sources, such as websites and social media channels, for information related to or reported about us and our Services.
• Customization and personalization. To tailor content we may send or display on our Services, including to offer location customization and personalized help and instructions, and to otherwise personalize your experiences.
• Marketing and advertising. As permitted under applicable law, we use certain Consumer Health Data for marketing and advertising purposes, in accordance with applicable law. For example, to send you information about our Services, such as offers, promotions, newsletters and other information we think may interest you, as well as any other information that you sign up to receive. We also may use certain information we collect to manage and improve our marketing and advertising.
• Planning and managing events. For event planning and management, including registration, attendance, connecting you with other event attendees, event feedback, and contacting you about relevant events and Services.
• Security and protection of rights. To protect our business and our Services; to prevent and detect fraud, unauthorized activities and access, and/or other misuse; and where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our terms of services and other agreements with you.
• Compliance with law and legal process. To respond to legal processes and related to legal proceedings, as well as for regulatory reporting and recordkeeping purposes (such as adverse event reporting and tracking or to ensure that we are not precluded from doing business with you).
• General business and operational support. To operate our business, consider and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions, and otherwise related to the administration and/or planning of our general business, accounting, auditing, compliance, recordkeeping, and legal functions.

4. The Categories of Consumer Health Data that We Share

We share or disclose all of the categories of Consumer Health Data that we collect, as disclosed above in section 1.

5. The Parties With Whom We Share or Otherwise Disclose Consumer Health Data

Generally, and as permitted, we share or disclose the Consumer Health Data we collect as described in this section with:

• Service providers who assist us in the provision of programs and Services
• Third party business partners with whom we conduct joint business activities
• Third parties with whom we have marketing arrangements
• Third parties that help administer, manage, and analyze our programs and Services
• Third party platforms, providers and networks
• Third parties in connection with business transactions
• Third parties for product quality and safety and adverse incident reporting
• Third parties to comply with our general legal obligations
• Third parties for security and protection of rights
• Third parties that process your Consumer Health Data at your direction

6. Your Privacy Rights

If this Privacy Policy is applicable to you, you may have certain rights with respect to Autolus’s use and disclosure of your Consumer Health Data:

• Right of Access
  You have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and access such data, including a list of all third parties (which does not include authorized service providers) and affiliates with whom Autolus has shared or sold (if applicable) Consumer Health Data and an active email address or other online mechanism that you may use to contact these third parties.
• Right to Withdraw Consent
  You have the right to withdraw your consent previously provided with regard to our collection and sharing of your Consumer Health Data.
• Right to Deletion
  You have the right to request that we delete your Consumer Health Data we collect from you.

To help us respond to your request, all communications to Autolus should include the sender’s name and contact information (such as email address, phone number or mailing address), and a detailed explanation of the request. In addition, communications related to Autolus websites should include, as applicable, the email address used for registration and the Autolus website address on which Consumer Health Data was provided (e.g., www.autolus.com). Autolus will endeavor to respond to all reasonable requests in a timely manner, and in any case, within any time limits prescribed by applicable local law.

You may also contact us by telephone at +44 (0)20 3829 6230

If you request an appeal of a denial of rights under the Washington My Health My Data Act and the appeal is denied, you may raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Supplement to Consumer Health Data Privacy Policy for Nevada Consumers

This Supplement applies to Nevada consumers for purposes of providing additional disclosures required by Nevada’s Consumer Health Data privacy law.

Purposes and Manner of Processing.
We collect, use, process, and share Consumer Health Data for the purposes and in the manners described in sections 1 through 5 of our Autolus Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.

Review and Revision of Consumer Health Data.
If you would like to review and/or revise your Consumer Health Data, you may submit a request to us via any of the methods listed in our Autolus Consumer Health Data Privacy Policy. We will respond to your request to exercise your rights in accordance with applicable law.

Changes to this Supplement.
We will notify of changes to our privacy practices with respect to your Consumer Health Data by posting an updated Privacy Policy on this page, with an updated effective date.

Third Party Collection of Consumer Health Data.
We may use third parties, including cookie providers and other online trackers, to collect your Consumer Health Data over time and across different websites or online services when you use our websites or online services. Please see our Cookie Statement for more information regarding our use of cookies and your choices.