Privacy Notice

Privacy Statement

Arcutis Canada, Inc., and its affiliates (“Arcutis”, “we”, “our” or “us”) recognize the importance of privacy. The purpose of this Privacy Statement is to inform you about our privacy practices, including how we collect, use, and disclose your personal information in connection with our products, services, apps, and websites (collectively, the “Services”). This Privacy Statement applies to all personal information received and processed by Arcutis in connection with individuals located in Canada.

What This Privacy Statement Covers

This Privacy Statement covers the following topics:

• Personal Information We Collect
• How We Use Your Personal Information
• How We Share Your Personal Information
• Your Consent to the Collection, Use and Disclosure of Your Personal Information
• Opting Out of Marketing Communications
• Retention, Storage, and International Transfer of Personal Information
• Information Security
• Accessing and Updating Your Personal Information
• Third-Party Websites and Services
• Children’s Personal Information
• Changes to this Privacy Statement
• How to Contact Us

Personal Information We Collect

“Personal information” means information about an identifiable individual as described under Canadian privacy laws.

Generally, personal information does not include any business contact information that is solely used to communicate with you in relation to your employment, business or profession, such as your name, position name or title, work address, work telephone number, work fax number or work email address.

We may collect, use, and disclose different types of personal information, depending on our relationship with you. Generally, we collect the following types of personal information (not all of which may apply to you):

• identity information, such as your name, marital status, title, date of birth and gender
• contact information, such as your billing address, delivery address, email address and telephone numbers
• financial information, but only in connection with our patient assistance program
• technical and usage information when you use our website, such as the URL of the website you just visited, your internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, mobile phone service provider, operating system and platform and other technology on the devices you use to access our website
• health information, such as your health history, health insurance information (including prescriptions), accident reports, healthcare programs and Services you receive from us, and the names of your healthcare providers
• professional information, such as your professional designations and the name of your employer
• marketing and communications information

We may also collect, use, and share aggregated and anonymized data for any purpose. Aggregated and anonymized data is not considered personal information because it cannot be used to identify you.

How We Use Your Personal Information

We generally use your personal information for the following purposes:

• to determine your eligibility for our Services in accordance with applicable laws and our policies
• to administer your use of the Services;
• to respond to your inquiries, complaints or requests;
• to communicate with you;
• to improve the effectiveness and efficiency of our operations, Services, and programs;
• where you opt in, for marketing and promotional purposes;
• to investigate legal claims and protect our rights, operations or property;
• for such other purposes as you may consent to from time to time; and
• as otherwise required or permitted by law.

We use certain technical information to help us better understand activity on our website and improve our services and the quality of our website, including by using cookies. You have a variety of tools to control the information collected by cookies and similar technologies when you use our website. For example, you can use controls in your Internet browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies.

How We Share Your Personal Information

We generally identify to whom, and for what purposes, we will disclose your personal information (and we obtain your consent to such disclosure) at the time we collect your personal information.

If you are a patient, we may disclose your personal information to healthcare providers, such as pharmacists, physicians, nurses, naturopaths or lab technicians, to facilitate the provision of your healthcare. This helps to coordinate care and ensure that everyone involved in your healthcare has the right information to meet your healthcare needs.

We may disclose your information when we believe such disclosure is required to enforce the terms and conditions that apply to use of the Services and where it is required or permitted by law. In addition, we may disclose your personal information to a third party in the event of any significant business transaction, such as a merger or reorganization.

We rely on service providers to perform a variety of services on our behalf, such as technical support providers, and data storage and processing service providers. If we transfer your personal information to a service provider, we require that they maintain the confidentiality of your personal information and keep it secure. We also require that our service providers comply with applicable privacy laws and only use your personal information for the limited purposes for which it is provided.

Your Consent to the Collection, Use and Disclosure of Your Personal Information

We collect, use, and disclose your personal information with your consent or as permitted or required by law. How we obtain your consent, including whether it is express or implied, will depend on the circumstances and the sensitivity of the personal information in question. Generally, we will seek your consent at the time we collect your personal information, either orally, electronically, or in writing.

If you provide personal information about another individual to us, it is your responsibility to obtain the consent of that individual to enable us to collect, use and disclose their information as described in this Privacy Statement.

If you wish to withdraw your consent to our collection, use or disclosure of your personal information, please contact us using the contact information in the “How to Contact Us” section below. We will accommodate your request to withdraw consent, subject to legal or contractual restrictions. Withdrawal of your consent may mean that we will no longer be able to provide you with certain Services.

Opting Out of Marketing Communications

If you no longer want to receive marketing-related emails from us, you may opt out of receiving marketing-related emails by clicking the “unsubscribe” link at the bottom of any email you receive from us. You may also opt out by contacting us directly using the contact information in the “How to Contact Us” section below.

Please note that if you opt out from receiving marketing-related emails, we may still need to send you communications about your use of our Services, or other matters.

Retention, Storage, and International Transfer of Personal Information

We will retain your personal information for as long as necessary to fulfill the purposes for which we collected it, and as permitted or required by law.

We may transfer your personal information outside of Canada to fulfill the purpose for which we collected it, including for processing and storage by service providers. While your personal information is outside of Canada, it is subject to the laws of the country in which it is located, which may have different data protection laws than Canada. Those laws may require disclosure of your personal information to authorities in that country. For more information about our policies and practices regarding service providers outside of Canada, contact us using the contact information in the “How to Contact Us” section below.

Information Security

We have implemented organizational and technological security measures in an effort to protect your personal information from loss or theft, unauthorized access, use, or disclosure. For example:

• we train our employees and agents on the importance of safeguarding personal information
• we restrict access to your personal information to those employees or agents who need access for authorized purposes
• we protect personal information in electronic form using technological means such as firewalls, access controls, and encryption

Despite these measures, we cannot guarantee that our safeguards will always be effective. A breach of security safeguards can result in such risks as phishing and identity theft. In such cases, we will act promptly to mitigate the risks and to inform you where there is a real risk of significant harm, or as otherwise required by law.

If you have reason to believe that your personal information is no longer secure, please contact us immediately using the contact information in the “How to Contact Us” section below.

Accessing and Updating Your Personal Information

We expect you to supply us with updates to your personal information, when required. We will not routinely update your personal information unless such a process is necessary.

You may make a request to review any personal information about you that we have collected, used, or disclosed, and we will provide you with any such personal information to the extent required by applicable laws.

You may also challenge the accuracy or completeness of your personal information in our records. If you demonstrate that your personal information in our records is inaccurate or incomplete, we will amend your personal information as required.

We may require that you provide sufficient identification to fulfill your request to access or correct your personal information. Any such identifying information will be used only for this purpose. We will not charge you any fees to access your personal information in our records without first providing you with an estimate of the approximate fees, if any.

If you object to how we handle your request, you may have the right to make a complaint to the Privacy Commissioner of Canada or the applicable provincial privacy commissioner.

If we are processing your personal information on behalf of our customer, we may refer your access or correction request to that customer.

Third-Party Websites and Services

We may provide links to third-party websites for your convenience and information. We may also make opportunities available to you to purchase, subscribe to, or use other products or services from third parties with different privacy practices. Those other websites, products, or services are governed by the privacy statements and policies of the respective third party. This Privacy Statement does not extend to any websites, products, or services provided by third parties. We do not assume responsibility for the privacy practices of third parties, and we encourage you to review all third-party privacy statements prior to using third-party websites, products, or services.

Children’s Personal Information

Our Services are not intended for children under the age of majority, and we do not knowingly collect personal information from children under the age of majority. Children under the age of majority should not use our Services and should not provide us with their personal information. If you are a parent or guardian and suspect that your child may have provided us with Personal Information, please contact us at privacy@arcutis.com.

Changes to this Privacy Statement

The Privacy Statement was last revised as of the date that appears at the top of this page.

From time to time, we may make changes to this Privacy Statement. When changes are made, they will become immediately effective when published in a revised Privacy Statement posted on our website, unless otherwise noted. We may also communicate the changes to this Privacy Statement by other means.

How to Contact Us

All comments, questions, concerns, or requests regarding your personal information or our privacy practices should be forwarded to our Privacy Officer by email to privacy@arcutis.com.

Alternatively, letters may be sent to the following address:

Arcutis Canada, Inc.
Attn: Privacy Officer
3027 Townsgate Road, Suite 300
Westlake Village, CA 91361