CLINICAL TRIALS PRIVACY POLICY

We are committed to protecting your privacy.

Overview

Travere Therapeutics, Inc., and its subsidiaries (“Travere Therapeutics” or “Company”) is a biopharmaceutical company specializing in identifying, developing, and delivering life changing therapies to people living with rare diseases. In order to fulfill our mission, it is necessary that the Company engages in research and conduct clinical trials. Travere Therapeutics is committed to respecting the rights to privacy and data protection of all individuals that are involved in our clinical trials and the Company follows applicable privacy and data protection legislation. For our general approach to privacy, please see Travere Therapeutics’ Privacy Policy which is posted on our website.

This policy addresses how Travere Therapeutics ensures individuals’ privacy when conducting clinical trials. Travere Therapeutics will contract with service providers, such as Contract Research Organizations (“CROs”), or other service partners to collect and analyze clinical trial data. To enhance privacy, individual’s names and other direct identifiers are not attached to records or samples collected by Travere Therapeutics or our service providers during the research process.

Who We Are

You may contact us,  Travere Therapeutics, Inc., via mail at 3611 Valley Centre Drive, Suite 300, San Diego, CA 92130, Attn: Chief Compliance Officer, via email at dataprotection@travere.com, or you can call us at +1-888-969-7879.

For the purposes of European Economic Area (“EEA”) and other data protection laws, Travere Therapeutics establishes the legitimate reasons to use an individual’s data for clinical trials and have established the means/methods of processing this data for research purposes.  Chosen service partners, including CROs, are selected based on qualifications that include ensuring patient privacy.  Travere Therapeutics maintains an audit schedule for approved vendors involved in the clinical trials and reviews privacy adherence during these inspections. CROs are often involved in managing patient data for clinical trials. Depending on the nature of each trial, Travere Therapeutics is either the controller or joint-controller of the processing operations associated with the clinical trial.

Patients enrolled in Travere Therapeutics clinical trials can contact the Company, as noted above, if there are questions related to how a patient’s data is being collected or processed within the trial.

Types of Personal Data Travere Therapeutics Collects and Uses

“Personal data” or “data” is defined as any information related to an identified or identifiable individual. Depending on the context in which Travere Therapeutics processes personal data, Travere Therapeutics will collect and otherwise process:

The pseudonyms of trial subjects (unique codes assigned to every subject); Professional profiles, identification data and contact information of healthcare providers that participate in the trial as investigators; Information related to clinical trial execution by investigators and supporting staff during the trial; Financial disclosure information, CVs and medical licenses for principal and sub-investigators conducting the clinical research.

What Travere Therapeutics Does With Personal Data

In the pre-trial phase, through the CROs, Travere Therapeutics collects identification and contact information of healthcare professionals that are considered for study participation. Travere Therapeutics collects this data from our own or the CROs’ databases, from public sources, referrals or third-party vendors.

Through the Company’s CROs, Travere Therapeutics collects, uses, stores, and analyzes data and bio-medical samples related to clinical trial subjects. The subjects’ names and other direct identifiers are not attached to records or samples. Instead, each subject is assigned a unique code (pseudonym). An individual’s identity is maintained by the clinical trial investigators and authorized study personnel at the clinical trial sites.  Only authorized individuals including study staff, CROs, and monitors may access named subject records at the source under limited conditions.

As a trial sponsor, Travere Therapeutics may occasionally request access to certain data directly. Travere Therapeutics does so only when this is necessary to comply with legal obligations, legal requests from authorities or for accountability purposes.

Our Policy Towards Children

Some of Travere Therapeutics’ clinical trials involve participants that are children. Travere Therapeutics only processes a child’s personal data with parental consent or the consent of a legal representative and in accordance with the laws where the clinical trial is being conducted.

Purposes for Collecting and Processing Data

Travere Therapeutics processes the personal data enumerated above for the following purposes: Research; Identify potential investigators to participate in a clinical trial; Pharmacovigilance; Evaluating the patient recruitment performance of clinical research centers.

Grounds for Processing

Travere Therapeutics’s clinical trials are conducted with the informed consent of the clinical trial participants.

In cases where applicable data protection laws require lawful bases for processing of personal data, such as processing in the EEA, United Kingdom and Switzerland, our lawful basis for processing may vary depending on the jurisdiction, the types of personal data being processed, and the nature of the processing being undertaken.  In some cases, the clinical trial participant’s consent serves as our lawful basis for processing personal data, including health data and other categories of special/sensitive data.  In other cases, our processing of personal data for research may be our legitimate interest as a controller in conducting research or our compliance with our legal obligations, including reliability and safety purposes in connection with our administration of clinical trials.  Research for secondary research purposes typically is undertaken on the basis of the clinical trial participant’s consent.

Our processing of special/sensitive categories of personal data, including health data, biometric and genetic data, as well as any other sensitive information, such as race, ethnicity, sexual orientation and gender identity that may be collected pre-trial or revealed through the clinical trial, may be based on the legal bases of the clinical trial participants consent, for reasons of public interest in the area of public health, or for scientific purposes in accordance with applicable law.

Our processing of personal data about investigators and others in the clinical trial process (other than clinical trial participants) may be our legitimate interests as a controller, to comply with our legal obligations, or where necessary to enter into or carry out our agreements with clinical trial investigators or other persons/entities involved in the clinical trial process.

Who Has Access to The Data

Due to the inherent sensitivity of the activity and information quality surrounding a clinical trial, access to personal data is very limited and it is granted on a “need to know” basis for the purpose of managing and conducting clinical trials. Travere Therapeutics will also give access to personal data following legal requests for access made by government and enforcement authorities, or to comply with any other legal requirement. Clinical trial auditors can also obtain access to personal data as necessary.

Data Integrity

Travere Therapeutics takes reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and is current. Travere Therapeutics also ensures personal data is limited to the information relevant for purposes of processing.

Transfers of Data Overseas & Privacy Shield Principles

If a clinical trial participant is located outside the United States (“U.S.”) and participates in one of Travere Therapeutics’ clinical trials, their personal data would be transferred to the U.S.

If the clinical study participant is based in the EEA, United Kingdom or Switzerland, the United States has not obtained an adequacy decision for the level of protection afforded to personal data. When transferring personal data from the EEA, United Kingdom or Switzerland to the United States, Travere Therapeutics utilizes standard contractual clauses or other lawful grounds for transfers since the United States has not been found to have adequate data protection laws by these jurisdictions.  Travere Therapeutics also participates in the EU-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield programs (“Privacy Shield”). Participation in Privacy Shield served as a legal basis for transfers of personal data to the United States prior to July 16, 2020 (September 8, 2020 for Switzerland).  While Privacy Shield no longer serves as a basis for transfers of personal data to the United States, Travere Therapeutics continues to participate in Privacy Shield to demonstrate its support for additional protections for personal data transferred from these jurisdictions.

How Clinical Trial Participants Control Their Data

If clinical trial participants reside or otherwise find themselves in the territory of the EEA, United Kingdom or Switzerland, Travere Therapeutics is committed to facilitate the exercise of their rights granted by applicable data protection law in a timely manner – the right of clinical trial participants to access their data, to ask for erasure, correction, portability of their data or to object to the processing of their data. In order to be able to reply to their request and if Travere Therapeutics is not certain of the clinical patient’s identity, Travere Therapeutics may need to ask them for further identification data to be used only for the purposes of replying to the request. If the clinical trial participant has any inquiries, or would like to exercise any rights, they can contact us via this form or call us at +1-888-969-7879 and ask for the chief compliance officer.

For clinical trials, Travere Therapeutics will ensure contractually that the CROs provide all required support to comply with lawful requests made by persons whose data Travere Therapeutics controls or processes.

Automated Decisions

Travere Therapeutics does not use personal data to engage in automated decision-making as part of the clinical trial process.

Data Security

Travere Therapeutics is committed to processing data in a secure manner. The Company has put in place specific technical and organizational measures to prevent research data from being accidentally or deliberately compromised, including requirements for high security standards from service providers contracted by Travere Therapeutics.

Clinical trial participants can withdraw consent at any time suspending further data collection efforts.  All data collected and processed prior to the withdrawal of consent is lawful to be used by Travere Therapeutics.

Concerns

Clinical trial participants can contact Travere Therapeutics’ Chief Compliance Officer at dataprotection@travere.com or via phone or postal mail as noted above to discuss concerns or questions about how their personal data is used, or if they want to exercise their rights granted under the applicable data protection law. Travere Therapeutics will promptly respond to address the concern.

Clinical trial participants should also consider contacting their investigative site directly.

If, after attempting to address privacy questions or concerns with Travere Therapeutics directly you still have a specific privacy concern that has not been resolved, you may utilize any of the following methods for resolution:

Choose to mediate your concern by the neutral third party, the American Arbitration Association, for the personal data that falls under the EU-U.S. Privacy Shield and/or the Swiss-U.S. Privacy Shield. Submit your unresolved privacy concern to the American Arbitration Association for resolution.

American Arbitration Association

Case Filing Services

877.495.4185: Toll free

877.304.8457: Fax

casefiling@adr.org

Contact your Data Protection Authority: If you are based in the EEA or the United Kingdom, you may choose to contact your local Data Protection Authority (“DPA”), or the Swiss Federal Data Protection and Information Commissioner (“FDPIC”), if you are based in Switzerland.  Your DPA or the FDPIC may refer your complaint directly to the U.S. Department of Commerce on your behalf. In this case, the Privacy Shield Team will then work to resolve your concern.

U.S. Department of Commerce’s Privacy Shield Framework: you may also have the option to select binding arbitration for the resolution of your complaint under certain circumstances. For more information on binding arbitration, see U.S. Department of Commerce’s Privacy Shield Framework.

For purposes of enforcing compliance with Privacy Shield, Travere Therapeutics is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission. For more information about Privacy Shield and to view Travere Therapeutics’ certification page, please visit https://www.privacyshield.gov.

Changes to This Notice

Travere Therapeutics reserves the right at any time, to modify, alter, or update this policy as warranted. The date of last revision is indicated by the date stamp on the policy.

This Policy was last updated on December 3, 2020.