Updated September 8, 2023

HUTCHMED (China) Limited and its affiliates (“HUTCHMED”, “we”, “our”) are committed to protecting and respecting your privacy and ensuring that your personal data is processed fairly and lawfully in line with all relevant data protection legislation. This Privacy Notice is intended for users of HUTCHMED’s services, products or Websites (as defined below), healthcare professionals, and other business partners with whom HUTCHMED wish to collaborate with or who already work with HUTCHMED. This Privacy Notice sets out the principles governing the use of your personal data that may be collected, received, used, stored and disclosed in connection with your use of our websites and online properties (the “Websites”) and through other means that expressly reference this Privacy Notice. By using the Websites, you are acknowledging and accepting the practices set out in this Privacy Notice.

Please note that if you are a participant enrolled in a clinical trial sponsored by HUTCHMED, you will receive a separate notice at the time you enroll in the trial that applies to the processing of personal data collected about you in the course of the trial, and if you use the Websites to apply for a job with HUTCHMED, you will receive a separate notice at the time you make the application that applies to the processing of personal data collected about you during the recruitment process. In the event you report an adverse event you have experienced whilst taking a HUTCHMED product, request medical information or make quality complaints about any HUTCHMED product you are taking through the Websites, mail, hotlines or other means, please review the Privacy Notice for Pharmacovigilance, Medical Information and Product Quality Complaints, available via this link to get further information on how we process your personal data in those specific contexts.

HUTCHMED’s processing of your personal data may be subject to data protection laws in the European Economic Area (the “EEA”), the United Kingdom (the “UK”) and People’s Republic of China (“China”), including the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the UK General Data Protection Regulation (the “UK GDPR”), the UK Data Protection Act 2018 (the “DPA18”) and the Personal Information Protection Law (the “PIPL”) (as the case may be). The controller of your personal data is HUTCHMED (China) Limited, whose contact information is provided below in the “Contact Us” section of this Privacy Notice.  If you are a California resident, HUTCHMED’s use of your personal data may be subject to the California Consumer Privacy Act (“CCPA”), which is discussed in more detail below under the Notice to California Residents.

WHAT PERSONAL DATA DO WE USE?

HUTCHMED may collect, receive, use, store, transfer and otherwise process the following personal data (including certain sensitive personal data) about you in connection with the Websites:

• Identity Data includes your name, surname, salutation, username, preferred language, geographic location and similar identifiers.
• Contact Data includes your address, email address, telephone number, company name, job type and social media profile information.
• Profile Data includes your username and password, your interests, feedback and survey responses. Your password can be considered sensitive personal data.
• Usage Data includes information about how you use our Websites, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Technical Data includes internet protocol address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Websites. Your web browsing history can be considered sensitive personal data.

HOW IS YOUR PERSONAL DATA COLLECTED?

We use different methods to collect personal data, including sensitive personal data, from and about you, including through:

• Direct interactions.You may give us your Identity Data, Contact Data, Profile Data and Marketing and Communications Data by filling in forms and free text boxes or by corresponding with us by post, phone or email. This includes personal data you provide when you: respond to any questionnaires; create an account on the Websites; subscribe to our publications; request marketing to be sent to you; and give us feedback or contact us.
• Automated technologies or interactions.As you interact with the Websites, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies.
• Third parties or publicly available sources. We will receive personal data about you from various third parties, including Technical Data from analytics providers such as Google, advertising networks such as Facebook and social media platforms; and Identity Data and Contact Data from data brokers, aggregators and publicly available sources (such as websites of medical institutions that healthcare professionals work for).

You may be requested to provide some or all of the personal data described in this Privacy Notice in connection with your use of the Websites. If you fail to provide certain information when requested, and this personal data is necessary for us to comply with our legal and regulatory obligations, to perform the contract we have entered into with you or to manage our relationship with you, we will not be able to continue your involvement with the Websites. In all other cases the provision of your personal data is voluntary.

COOKIES

We use cookies and related technologies (“Cookies”) to gather information when you use the Websites and to enhance and personalise the experience, to understand usage patterns, and to improve the Websites and our products and services. Cookies on the Websites are generally divided into the following categories:

• Essential Cookies: These cookies are strictly necessary to provide you with services available through the Websites and to use some of their features, such as access to secure areas. Because these cookies are strictly necessary to deliver the Websites, you cannot refuse them without impacting how the Websites function.
• Performance and Functionality Cookies: These cookies are used to enhance the performance and functionality of the Websites but are non-essential to their use. However, without these cookies, certain functionality may become unavailable.
• Analytics and Customisation Cookies: These cookies collect information that is used to help us understand how the Websites are being used or how effective our marketing campaigns are, or to help us customise the Websites for you in order to enhance your experience.
• Targeting Cookies: These record your visit to the Websites, the pages you have visited and the links you have followed to recognise you as a previous visitor and to track your activity on the Websites and other websites you visit. These cookies qualify as persistent cookies, because they remain on your device for us to use during a future visit to the Websites. You can delete these cookies via your browser settings. See below for further details on how you can control third-party targeting cookies.

You can review your Internet browser settings, typically under the sections “Help” or “Internet Options,” to exercise choices you have for certain Cookies. If you disable or delete certain Cookies in your settings, you may not be able to use features of the Websites. To learn more about the use of Cookies by Google for analytics and to exercise choice regarding those Cookies, please visit the Google Analytics Opt-out Browser Add-on.

The opt-outs described above are device- and browser-specific and may not work on all devices. If you choose to opt-out through any of these opt-out tools, this does not mean you will cease to see advertising, but the advertisements you see will not be based on your interests as identified through information collected through the Websites.

HOW WILL WE USE YOUR PERSONAL DATA?

HUTCHMED only processes personal data where we have a legal basis for doing so. Most commonly, we will rely on one or more of the following legal bases to process your personal data:

• Where we need to perform the contract or services agreement we are about to enter into or have entered into with you, including for the following purposes:
  • Registering you as a new user of the Websites and providing services to you.
  • Sending you information about changes to our policies, terms of service and other relevant documentation relating to HUTCHMED and the Websites.
• Where it is necessary for our legitimate interests (or those of a third party) and where consistent with applicable laws:
  • Arranging insurance; operating and planning our business; managing our intellectual property, equipment and facilities; and investigating any complaints received from you or from others.
  • Providing you with access to content and features in the Websites.
  • Protecting our, your and others’ rights, privacy, safety or property (including by making and defending legal claims, responding to sudden public health incidents under emergency situations); investigating and deterring against fraudulent, harmful, unauthorised, unethical or illegal activity; and answering your data protection requests.
  • News reporting, public opinion supervision, and other such activities for the public interest.

• Where we need to comply with a legal or regulatory obligation:
  • Administering and protecting our business, including troubleshooting, data analysis, testing, system, maintenance and support, reporting and hosting data.
  • Regulatory record-keeping and reporting obligations, including those relating to complaints and product safety.
  • In response to requests from government law enforcement authorities conducting an investigation.

• Where you have given your consent:
  • Delivering relevant Website content and advertisements to you and measuring and understanding the effectiveness of the advertising we and our partners serve to you.
  • Using cookies and data analytics to improve the Websites and our products and services, marketing, customer relationships and experiences.
  • Making suggestions and recommendations to you about goods or services that may be of interest to you.

• With respect to data subject to PIPL, when we use personal data that is already disclosed by you in the public domain voluntarily or otherwise already lawfully disclosed, within a reasonable scope in accordance with all applicable laws.

HOW WILL WE SHARE YOUR PERSONAL DATA?

Your personal data, including sensitive personal data, may be shared with or accessed by the following parties:

• Our corporate entities, subsidiaries and affiliates for purposes consistent with this Privacy Notice.
• Our suppliers and other relevant third parties, such as data storage and analytics providers, technology services companies, and professional advisors such as auditors, lawyers and accountants.
• Governmental authorities and agencies, quasi-governmental organisations, regulatory authorities or law enforcement bodies for purposes required or permitted by applicable law.

We may also sell, transfer or otherwise share some or all of our business or assets, including personal data, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganisation or sale of assets, or in the event of bankruptcy or dissolution.

HUTCHMED may store in and transfer your personal data to the United States, the EEA, the UK, China and other jurisdictions, including to facilitate our third-party processors’ access to and/or processing of personal data, and these jurisdictions may have data protection laws that are not as protective as those in your jurisdiction. When we transfer your personal data outside the EEA, the UK and China, and to the extent required by the GDPR, the UK GDPR and the DPA18 and the PIPL, we rely on appropriate or suitable safeguards to transfer your personal data, including:

• Using standard contractual clauses or its equivalents approved by relevant authorities as ensuring adequate safeguards for personal data.
• Obtaining your consent to transfer personal data after first informing you about the possible risks of such a transfer.
• Passing any mandatory security assessments or its equivalents required by relevant authorities (if applicable) and conducting any personal information protection impact assessment or its equivalents before such transfer outside the applicable jurisdictions.
• When the transfer is necessary for the performance of a contract between you and us or if the transfer is necessary for the performance of a contract between us and a third party that is entered into in your interest.
• Where the transfer is necessary to establish, exercise or defend legal claims.

Please note if your personal data is located in China, HUTCHMED will not disclose such personal data to foreign judicial or law enforcement authorities without the approval of the competent authorities of China.

For more information, including to obtain a copy of the documents used to protect your personal data, please contact us using the information provided in the “Contact Us” section of this Privacy Notice.

HOW LONG WILL WE RETAIN YOUR PERSONAL DATA?

HUTCHMED seeks only to retain personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, safety or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. In all cases, to determine the appropriate retention period for personal data we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

WHAT ARE YOUR RIGHTS?

HUTCHMED intends to keep your personal data accurate and up to date. Please notify us of any changes to your personal data as soon as they occur. From time to time, we may ask you to submit updated personal data to ensure our records are up to date. You also have certain rights with respect to your personal data:

• You can ask to be provided with a copy of your personal data.
• You can ask for your incomplete or inaccurate personal data to be corrected.
• You can ask for your personal data to be deleted.
• You can ask for the processing of your personal data to be suspended.
• You can ask for your personal data to be transferred to another organisation.
• You can object to processing of your personal data in certain cases.
• Where you have consented to the processing of your personal data, you can withdraw consent at any time.

Your rights under the GDPR, the UK GDPR and the DPA18 and the PIPL may be limited, such as where fulfilling your request would affect the accuracy or reliability of the research, where doing so would reveal personal data about another person or would infringe the rights of a third party (including our rights), or if you ask us to erase personal data that we are required by law to keep or have compelling legitimate interests in keeping. You will be informed of any relevant exemptions we rely upon when responding to your request.

You have the right to complain to an EEA, UK or Chinese data protection authority in the place you live, work or where you believe a breach of the GDPR, the UK GDPR or the DPA18, or the PIPL occurred. You also have the right to lodge a complaint with the competent data protection supervisory authority. We would, however, appreciate the opportunity to deal with your concerns before you approach a supervisory authority, and so ask you to please contact us in the first instance.

SECURITY

We have implemented reasonable technical and organizational measures and procedures designed to protect your personal information against accidental or unlawful destruction, loss or alteration and against unauthorised disclosure or access. We implement classification-based management of personal data. We have established a department responsible for personal data protection and related management systems. We hold regular trainings for our staff to keep them updated on changes in personal data protection related laws and regulations. However, we cannot guarantee the protection of your personal data as no data transmission over the Internet can be guaranteed to be completely confidential or 100% secure. If our physical, technical, or organizational measures are circumvented, compromised, or destroyed, it may be possible for unauthorized persons to access, disclosure, alter, or destroy your personal data, and your rights and interests regarding your personal data may be impaired or damaged as a result.

In the event of an unfortunate security incident involving your personal data in our custody, we will comply with our legal obligations to inform you of the type of personal data involved, the mitigation measures we have taken or will take, and our suggestions for how you can prevent and mitigate any harm to your rights and interests. We will promptly inform you of the circumstances of the incident by mail, letter, telephone, push notification, etc. When it is difficult to individually inform all impacted individuals, we will give an announcement in a reasonable and effective manner. We will also comply with our legal obligations to report the security incident to relevant regulatory authorities as required by the relevant regulatory authorities and applicable laws.

CHILDREN

Our website is not directed to children under the age of sixteen, and we do not knowingly collect personal data from children under the age of sixteen, nor do we knowingly sell or share such information.  If we discover that we inadvertently collected personal data from a child under the age of sixteen, we will promptly delete it.

LINKS TO OTHER WEBSITES

The Websites may reference or provide links to third-party websites. We are not responsible for the privacy practices or the content of other websites. This Privacy Notice applies only to the personal data we collect through the Websites or through other means that expressly reference this Privacy Notice. We encourage you to read the privacy statements of all of the destination websites which you visit.

NOTICE TO CALIFORNIA RESIDENTS

If you are a California resident, then this section of our Privacy Notice may apply to you. This section is intended to describe our practices and your rights under the California Consumer Privacy Act of 2018 (“CCPA”) and applies to Personal Information of California residents.  For purposes of this section, the term “Personal Information” means information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

CCPA Notice at Collection

The CCPA requires us to provide certain disclosures before our collection of Personal Information from California residents, as summarized below. We collect sensitive Personal Information in the context of clinical trials, which is exempt from the CCPA.

Purposes for Collecting, Selling or Sharing, or Disclosing Personal Information

As discussed above, we may collect, use, sell or share, and disclose Personal Information for the following purposes:

• Where we need to perform the contract or services agreement we are about to enter into or have entered into with you, including for the following purposes:
  • Registering you as a new user of the Websites and providing services to you.
  • Sending you information about changes to our policies, terms of service and other relevant documentation relating to HUTCHMED and the Websites.
• Where it is necessary for our legitimate interests (or those of a third party) and where consistent with applicable laws:
  • Arranging insurance; operating and planning our business; managing our intellectual property, equipment and facilities; and investigating any complaints received from you or from others.
  • Providing you with access to content and features in the Websites.
  • Protecting our, your and others’ rights, privacy, safety or property (including by making and defending legal claims); investigating and deterring against fraudulent, harmful, unauthorized, unethical or illegal activity; and answering your data protection requests.

• Where we need to comply with a legal or regulatory obligation:
  • Administering and protecting our business, including troubleshooting, data analysis, testing, system, maintenance and support, reporting and hosting data.
  • Regulatory record-keeping and reporting obligations, including those relating to complaints and product safety.
  • In response to requests from government law enforcement authorities conducting an investigation.

• Where you have given your consent:
  • Delivering relevant Website content and advertisements to you and measuring and understanding the effectiveness of the advertising we and our partners serve to you.
  • Using cookies and data analytics to improve the Websites and our products and services, marketing, customer relationships and experiences.
  • Making suggestions and recommendations to you about goods or services that may be of interest to you.

CCPA Consumer Rights

California residents may have certain consumer rights. These rights may include:

• The right to know what Personal Information we collect, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we collect about you.
• The right to delete Personal Information that we collect from you, subject to certain exceptions.
• The right to correct inaccurate Personal Information that we maintain about you.
• The right to opt-out of the sale or sharing of Personal Information.

We will not discriminate against you for exercising any of these rights, for example, by charging a different price or denying goods or services. However, we may charge a different price or rate or provide a different level or quality of goods or services when that difference is reasonably related to the value provided to us by the data.

To exercise any of these rights, please email dpo@hutch-med.com with the phrase “California Privacy Rights” in the subject line, call us toll-free at (855) 557-0909, or send us a letter at the postal address listed below. Once we have received your request, we will need to verify your identity. To do so, you may be required to supply a valid means of identification or other information as a security precaution. If you make a request through an authorized agent, we will require written proof that the agent is authorized to act on your behalf. We will process your request within the time provided by applicable law.

Other California Privacy Rights

California’s “Shine the Light” law permits California residents to annually request and obtain information free of charge about what Personal Information is disclosed to third parties or among our affiliated companies for their direct marketing purposes. We do not distribute your Personal Information to outside parties without your consent for their direct marketing.

CHANGES

We may update this Privacy Notice from time to time. If any update has a material change to the way we treat your personal data and/or Personal Information, we will inform you of that change via e-mail or by posting a notice on relevant areas of the Websites. Any updated version of this Privacy Notice will be effective as of the date at the top of the Privacy Notice.

CONTACT US

HUTCHMED
Attention:  Legal Department
Level 18, The Metropolis Tower
10 Metropolis Drive
Hung Hom, Kowloon, Hong Kong

+852 2121 8200 (Tel)
+852 2121 8281 (Fax)

By email: dpo@hutch-med.com
By telephone: +852 2121 8200