Privacy Policy

Last updated October 2, 2024

This Privacy Policy describes the types of Personal Information Longboard Pharmaceuticals, Inc. may collect from you or that you may provide when you visit our corporate website, https://www.longboardpharma.com (the “Website”), interact with us as an investor or potential investor, serve as a Board member, serve as a vendor supporting our business, apply for employment, ask us for information on our current or future clinical trials as a potential clinical trial participant or a principal investigator, request “expanded access” to an investigational product candidate, and through other interactions by email, social media, surveys or telephone, or through other Longboard platforms and services and our practices for collecting, using, maintaining, protecting, disclosing, and processing such Personal Information. Please read this Privacy Policy carefully to understand our policies and practices regarding your Personal Information and how we will treat it.

This Privacy Policy does not apply to information gathered from people visiting websites for specific clinical trials sponsored by Longboard when such websites contain their own privacy policies. In addition, where we collect and maintain information in connection with clinical trials or expanded access programs, such data is subject to clinical trial protocols and informed consents executed by individuals participating in those clinical trials or expanded access programs. Clinical trial or expanded access participants should refer to their informed consent (or similar) form for more information about how we receive and process their Personal Information pursuant to the clinical trial or expanded access program in which they participate. Longboard is not a healthcare provider, and communications sent to our Website will not replace your relationship with a healthcare provider.

As used in this Privacy Policy, “Longboard,” “we,” “us” and “our” refer to Longboard Pharmaceuticals, Inc. and our subsidiaries, joint ventures, and other companies under a common control (“Affiliates”), and “you” or “users” refer to people who visit the Website or interact with us as described above. This Privacy Policy is incorporated into and is part of our Terms and Conditions available at https://www.longboardpharma.com. By accessing the Website or interacting with us as described above, you agree to be bound by this Privacy Policy. If you do not agree to the terms of this Privacy Policy, then please do not use the Website or interact with us as described above.

1. The Information We Collect

We gather the following types of information about users:

Personal Information: Information that is about, or relates to, an identified or identifiable individual, or that can be linked to that individual. We may collect the following Personal Information about you:
- Contact information, such as your name, phone number, email address, physical or mailing address, country of residence, company affiliation, occupation or job title
- Demographic information, such as age, date of birth, ethnic origin, race and gender
- Professional information, such as curriculum vitae/resume, education history, work history, or qualifications and other type of information that may be included in a resume
- Medical condition or information
- Information related to transactions you engage in with us
- Financial and government identifying numbers, such as social security numbers
- Online and technical identifiers, such as your IP (Internet Protocol) address and cookies
- Any other information that you provide to us that could be used to identify you
Aggregate Information: Information that cannot be used to identify an individual (such as frequency of visits to the Website and browser type). Please note that we may convert Personal Information into Aggregate Information via one or more processes at our discretion.
Google Analytics: We use Google Analytics to collect statistical information about how the Website is used. Google Analytics services involve the use of cookies that collect information such as your IP address or other identifiers, browser information, and information about the content you view and interact with to record how you use the Website. These analytics services help us to know how many users we have, which parts of the Website are most popular, what browsers are used (so we can maximize compatibility), the country or region where our users are located, and the demographics and interests of our users. This enables us to better understand who is using the Website and to improve how we present content on the Website. To prevent your data from being used by Google Analytics, please visit https://tools.google.com/dlpage/gaoptout.

2. How We Obtain Your Personal Information

Personal Information You Provide Us

We may obtain your Personal Information in the following ways:

Directly from you, such as when you contact us via the Website, interact with us as an investor or potential investor, serve as a Board member, serve as a service provider or vendor supporting our business, ask us for information on our current or future clinical trials as a potential clinical trial participant or a principal investigator, request “expanded access” to an investigational product candidate, sign up for an investor presentation through the Website, when you contact us via e-mail for information or assistance (including the content of your e-mail), or in any way engage with us or our personnel.
In the course of applying for a job with Longboard through the Website, you may provide certain Personal Information to Longboard. See the Applicant Privacy Notice in Section 14 of this Website for more information.
From you when you post any comments or content on our LinkedIn site or other social media sites.
Third-party vendors, such as vendors, suppliers, contractors or business partners that provide services to us.
Physicians or other healthcare professionals.
Government officials or agencies.
Publicly available sources.

Personal Information Collected Automatically

When you use the Website, we may automatically collect technical information and information about your visit, including pages you visited, the order in which they were visited, page interaction information (such as the links you “clicked” or the content you viewed or consumed), the type of device you are using, IP address, operating system, header information and browser software. We may collect information that allows us to associate you with your social media or other accounts that you have on other websites. Further we may collect Personal Information through the use of cookies as described within Section 6 (Functions and Use of Cookies) of this Privacy Policy, or the section regarding Google Analytics above. Where such information meets the definition of Personal Information, such as IP address, we will treat it as such.
Through your use of social media platforms, including if you use social media plug-ins, link to our social media platforms, or when you “like” or “follow” us, we may automatically receive information about you such as your name, email address, and any comments or content you post relevant to us. The data we receive is dependent upon an individual’s privacy user settings and that of the social medium platform. Individuals should review and, if necessary, adjust their privacy settings on third-party websites and networks before sharing information with us or the social media platform.

3. How We Use Your Personal Information

We are required to have a legal basis in order to process your Personal Information in certain jurisdictions. The legal basis that applies will depend on your relationship to us and the particular use and processing activity:

We may collect and use your Personal Information with your consent for the specific purpose identified in a written notice given to you at the time we collect the information.
We may process your Personal Information or in order to manage or perform our contractual relationships with you.
We may process your Personal Information for our legitimate business interest. Where we rely on legitimate interests, we have conducted legitimate interest assessments to ensure that our interests and yours are balanced.
We may need to collect and process your Personal Information to comply with our legal obligations.

For further information about how we use your Personal Information, see the following table:

Category	Examples	Purpose
Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Social Security number, Internet Protocol address, email address, or other similar identifiers.	(a) Necessary for our legitimate business interests, including to engage and interact with actual or prospective investors and Board members, transact and communicate with vendors and consultants. (b) Necessary for our legitimate business interests, including to maintain records regarding potential clinical trial participants who ask to be contacted or those who request expanded access. (c) Necessary for legitimate business interests in making recruitment decisions and to comply with legal obligations in recruiting activities. (d) Necessary for our legitimate business interests to deliver information, content or services you request.
Protected classification characteristics	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information.	(a) Necessary for our legitimate business interests, including diversity disclosures regarding Board makeup as part of Longboard’s proxy statement or other public report. (b) Necessary to comply with a legal obligation, including mandatory reporting requirements. (c) Necessary for our legitimate business interests, including to maintain records regarding potential clinical trial participants who ask to be contacted or those who request expanded access
Internet or other similar network activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	(a) Necessary for our legitimate interests, including to maintain records of potential clinical trial participants who ask to be contacted or those who request expanded access (b) Website functionality, analytics, and advertising.
Professional or employment-related information.	Current or past job history or performance evaluations.	(a) Necessary for our legitimate business interests, including to evaluate service providers, consultants, and potential clinical trial participants
Non-public education information	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	(a) Necessary for our legitimate business interests, including to evaluate service providers, consultants, and potential clinical trial participants
Sensitive Personal Information	Personal information that reveals government IDs; racial or ethnic origin; personal information collected and analyzed concerning a consumer’s health.	(a) Necessary for our legitimate business interests, including diversity disclosures regarding Board and employee makeup as part of the Company’s proxy statement or other public report. (b) Necessary to comply with a legal obligation, including mandatory reporting requirements. (c) Necessary for our legitimate business interests, including to maintain records regarding potential clinical trial participants who ask to be contacted or those who request expanded access

We may also use one or more processes to de-identify information that contains your Personal Information so that it can no longer be used to identify you such that only aggregate information remains. We may collect, use, store, and transfer aggregate information without restriction and it will no longer be subject to this Privacy Policy.

4. How We Share Your Personal Information

We may share your Personal Information in the following circumstances:

We may share your Personal Information with third party service providers necessary to help us run and manage our business. We include provisions within our contracts with these businesses to ensure that they: (i) use your Personal Information only as necessary to provide these services to us; and (ii) establish safeguards to protect the confidentiality of the information that we provide them.
We may share some or all of your Personal Information with our Affiliates, in which case we will require our Affiliates to honor this Privacy Policy.
We may share some or all of your Personal Information to evaluate or conduct a financing, merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Longboard’s business or assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding.
We may share your Personal Information with other companies with which we collaborate regarding particular products or services. These may include our co-promote partners for products that we jointly develop and/or market.
We may disclose Personal Information if Longboard believes in good faith that such disclosure is necessary: (i) to comply with any law applicable to us, a request from law enforcement, a regulatory agency, or other legal process; (ii) to protect the legitimate rights, privacy, property, or interests of Longboard, our business partners, personnel, or the general public.

5. Our Website Not Available to Those Under 18

Access to and use of the Website are not intended for use by anyone younger than the age of 18 and we do not knowingly collect Personal Information from individuals younger than the age of 18. If you have reason to believe that an individual under the age of 18 has provided Personal Information to us outside of the clinical trial context, please contact us. We will take reasonable steps to investigate and if it is confirmed that we possess Personal Information of an individual under 18 years of age, we will delete the Personal Information. We may require additional information to confirm that the request is a bona fide request from an appropriate person concerning an individual under the age of 18, as allowed by applicable law.

6. Functions and Use of Cookies

We use “cookies”. Cookies are small files that are placed on your desktop, notebook or mobile device by a website you visit. From this we can, for example, recognize whether there has already been a connection between your device and the Website, or which language or other settings you prefer. Cookies may also contain Personal Information, such as your IP address. You may visit the Website without consenting to the use of cookies. This means that you can refuse such use and delete cookies at any time by making the appropriate settings on your device. If you decide against the use of cookies, it is possible that not all functions of the Website are available to you or that individual functions are only available to you to a limited extent.

Cookies do not typically contain any information that directly identifies a user, but other information that we hold about you may be linked to the information stored in, and obtained from, cookies. We categorize cookies as follows:

Strictly Necessary. These cookies are absolutely necessary for the functions of the web pages. Without these cookies we may not be able to offer you certain services.
Functional. These cookies facilitate the operation and improve the functions of the web pages. For example, we store your language settings in functional cookies.
Performance. These cookies collect information about how you use the Website. This enables us to identify which parts of the Website are particularly popular and thus make improvements to the Website.
Targeting and Advertising. These cookies are set by third parties, e.g. social networks such as Twitter and LinkedIn, whose content you can integrate via “social plug-ins” offered on the Website.

There are two types of functional cookies, session cookies and persistent cookies. Session cookies expire when you close your browser or if you stay inactive for a certain period of time. Persistent cookies will remain even after the browser is closed. Both of these types of cookies can be deleted by you through your browser settings.

Cookie Name	Duration	Purpose	Provider
wp_lang	Session	Functional	WordPress – https://wordpress.org/about/privacy/cookies/
wp-settings-time-7	Session	Functional	WordPress – https://wordpress.org/about/privacy/cookies/
wp-settings-7	Session	Functional	WordPress – https://wordpress.org/about/privacy/cookies/
wordpress_test_cookie	Session	Functional	WordPress – https://wordpress.org/about/privacy/cookies/
_ga_P8BJ56G2LT	1 years	Analytics / Functional	Google Analytics – https://policies.google.com/privacy
_ga	1 years	Analytics / Functional	Google Analytics – https://policies.google.com/privacy
1P_JAR	1 month	Advertising	Google Analytics – https://policies.google.com/privacy

7. US Data Privacy Rights

Your state or jurisdiction may impose specific legal requirements and create privacy rights with respect to Personal Information, and we will comply with restrictions and any requests you submit as required by applicable law.

When you make a request, we may require that you provide information (such as your name, email address and/or zip code) and follow procedures so that we can verify a request you make and your jurisdiction before responding to it. The verification steps we take may differ depending on your jurisdiction and the request you make. We will match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us verify your request.

We will respond to your request within the time period required by applicable law. However, we may not always be able to fully comply with your request, and we will notify you in that event when required.

Certain privacy laws permit consumers to use an authorized agent to make privacy rights requests. We require the authorized agent to provide us with proof of the consumer’s written permission (for example, a power of attorney or other legal documentation) that shows the authorized agent has the authority to submit a request for the consumer. An authorized agent must follow the process described below to make a request, and we will additionally require the authorized agent to verify his/her own identity and we will confirm the agent’s authority with the consumer about whom the request was made.

You may have specific rights regarding your Personal Information. This section describes your rights and explains how to exercise those rights.

U.S. Data Subjects

Right to Know and Data Portability Rights

In certain circumstances, you have the right to request that we disclose certain information to you about our collection and use of your Personal Information.

Right to Delete

You may have the right to request that we delete the Personal Information that we collected from you and retained, subject to certain exceptions.

Right to Correct

You may have the right to request that we correct any inaccurate Personal Information we may hold about you. We will use commercially reasonable efforts to correct inaccurate Personal Information, taking into account the nature of the Personal Information and the purpose for our processing.

Right to Appeal

You may have a right to appeal a refusal to take action on a request by contacting us by email at [email protected].

Non-Discrimination

We will not discriminate against you for exercising any of your rights.

8. International Visitors

Our Website is hosted in the United States. If you use this Website from other regions of the world with laws governing data collection and use that may differ from United States law, then by sending an email or other communication containing Personal Information or by providing Personal Information through our Website, you are voluntarily transferring your Personal Information outside of your country to the United States.

Name of data controllers and contact details	Longboard Pharmaceuticals, Inc. 4275 Executive Square, Suite 950 La Jolla, CA 92037, USA Attn: Data Protection Officer Email: [email protected]
Purposes of the processing	The purposes of the processing are described in Section 3 of this Privacy Policy.
Lawful basis for the processing	Generally, we process personal data on the basis that the processing is necessary for purposes of our legitimate interest in conducting our business in a manner typical in the US pharmaceutical industry, having taken into account any risks to your fundamental rights and freedoms (including your right to privacy). We also may process personal data on other bases permitted by the European Union Data Protection Regulation (GDPR) and other applicable laws, such as when the processing is necessary for us to comply with our legal obligations.
The legitimate interests of the controller or third party, where applicable	Our specific legitimate interests, such as improving the Website, providing you with support, processing and responding to any employment application, and/or responding to your questions, comments or requests, are described in Section 3 of this Privacy Policy.
The categories of personal data concerned	The categories of personal data that we process are described in Sections 1 and 3 of this Privacy Policy.
The recipients or categories of recipients of the personal data	The potential recipients of the personal data that we collect via the Website are described in Section 4 of this Privacy Policy.
Information regarding the transfers of personal data outside of the European Economic Area (EEA) and the United Kingdom (UK)	Longboard Pharmaceuticals, Inc. is headquartered in the USA and the Website is hosted in the USA. The laws of the USA have not been deemed by the European Commission to provide an adequate level of protection to personal data. When you provide your personal data to us via the Website or contact us by email, you are providing your personal data directly to the USA. Before you provide your personal data to us via the Website, we request your explicit consent to the transfer of your personal data to the USA. When you e-mail us, the fact that you have chosen to e-mail us knowing that we are located in the USA will be understood to constitute your express consent to the transfer of the personal data in your e-mail (including your e-mail address) to the USA. Regardless of the differences in US privacy laws, we safeguard your personal data as described in this Privacy Policy. If we transfer your personal data to a third party, we require the third party to commit contractually to process your personal data only in ways that are consistent with this Privacy Policy.
The period for which the personal data will be stored, or the criteria for determining the retention period	How long we retain personal data varies according to the type of data in question and the purpose for which it is used. We delete personal data within a reasonable period after we no longer need to use it for the purpose for which it was collected or for any subsequent purpose that is compatible with the original purpose. This does not affect your right to request that we delete your personal data before the end of its retention period. We may archive personal data (which means storing it in inactive files) for a certain period prior to its final deletion, as part of our ordinary business continuity procedures.
Your rights to access, correct, restrict or delete your personal data and object to processing	You have the right to request access to your personal data, to have your personal data corrected, restricted or deleted, and to object to our processing of your personal data. Your rights may be subject to various limitations under the GDPR. If you wish to exercise any of these rights, or if you have any concerns about our processing of your personal data, please contact us in any of the ways listed in the section “Contact Us”. The GDPR’s data portability rights are not relevant to the kinds of processing that we do.
The right to lodge a complaint with a supervisory authority	You have the right to file a complaint concerning our processing of your personal data with your national (or in some countries, regional) data protection authority. The EU Commission has a list here: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
Statutory or contractual requirement or other obligation to provide any personal data	Users of the Website are under no statutory or contractual requirement or other obligation to provide personal data to us via the Website.

9. Protection and Retention of Personal Information

Longboard is committed to protecting the security of your Personal Information. We use a variety of technical and organizational security measures and procedures to help protect your Personal Information from unauthorized access, use or disclosure. However, no method of electronic transmission or storage is 100% secure. Therefore, while Longboard uses reasonable efforts to protect your Personal Information, Longboard cannot guarantee its absolute security.

As a general matter, we only keep information for as long as necessary to fulfill the purposes for which it was collected, as stated in our retention policies, and permitted or required by law, such as to comply with recordkeeping and other legal obligations. There may also be residual information that will remain within our backup files, databases, and other records, which will not be removed or changed, except in accordance with retention policies. The criteria used to determine our retention periods include:

The length of time we have an ongoing relationship with you (for example, for as long as you are a vendor or continue interacting with us) and the length of time thereafter during which we may have a legitimate need to reference your Personal Information to address issues that may arise;
Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records for a certain period of time before we can delete them); or
Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

10. Your Choices Regarding Your Information

All users may request to review, update, correct or delete their Personal Information by contacting us as described in Section 12 (Contact Us) of this Privacy Policy, where the right to do so is provided by applicable law, including as described elsewhere in this Privacy Policy. We will use commercially reasonable efforts to honor your request, and in all events, we will comply with applicable laws relating to your request. We may be required to maintain some or all of your Personal Information in accordance with a legal obligation or our legal position as described in Section 9 (Protection and Retention of Personal Information).

11. Third-Party Pages and Websites

This Website may contain links to other websites, and other websites may link to this Website. This Privacy Policy does not apply to Personal Information that you submit to the websites of our business partners, or any other third-parties, or that are collected by them from you, even if those third-party websites are linked to our Website or listed in Section 6 (Cookies). We are not responsible for the privacy practices of such other websites. When you visit another website – via a link from this Website or otherwise – you should review the privacy policy of that other website. This Privacy Policy applies solely to information provided or obtained on our Website or through interactions with us as described in this Privacy Policy.

12. Contact Us

If you have any questions regarding this Privacy Policy, or to exercise your rights as described above, please contact us using any of the following methods:

Longboard Pharmaceuticals, Inc.
4275 Executive Square, Suite 950
La Jolla, CA 92037, USA

E-mail: [email protected]

Longboard’s Data Protection Officer at: [email protected].

European Data Protection Representative: PharMarketing, 8 Rue Roublot, 94120 Fontenay-sous-Bois, France, Attn: Caroline Josse, [email protected]

UK Data Protection Representative: Andrei Danila, Flat 202, 20 Calvin St, E16HF, London, United Kingdom, [email protected]

13. Changes to This Privacy Policy

This Privacy Policy may be amended from time to time for any reason. Each time you use the Website or interact with us as described in Section 1, the current version of this Privacy Policy will apply. We will notify you of any changes to our Privacy Policy by posting a new Privacy Policy on this Website as indicated by changing the “Last Updated” date above. You should consult this Privacy Policy regularly for any changes.

14. Applicant Personal Information Privacy Notice

Introduction

Longboard Pharmaceuticals, Inc. (“Longboard”) respects the privacy of job applicants and strives to keep your Personal Information secure and confidential. This Applicant Personal Information Privacy Notice (“Applicant Notice”) explains the categories of Personal Information we collect about you as a job applicant, why we collect it, and how we use and disclose it.

Processing Your Personal Information

What Personal Information do we collect?

Personal Information that you provide when applying for a position through Longboard’s open positions portal, such as first and last name, contact information (e.g., residential address, email address, phone number), confirmation of eligibility to work in the United States, and voluntary information regarding equal opportunity employment and self-identification of disabilities.

Why do we collect your Personal Information?

To fulfill our obligations as a prospective employer or to update records if you become a Longboard employee.
To make recruitment or employment decisions.
For access control and company security.
To prevent or detect fraudulent or other unlawful activities.
To comply with a law, regulation or valid legal process and, in appropriate circumstances, to cooperate with law enforcement.
To advance or defend Longboard’s legal rights.

Who else might receive your Personal Information?

We may share your Personal Information with service providers that help Longboard administer or improve the recruitment and hiring experience and processes. For example, we work with service providers that offer hosting services for our open positions portal. We also work with independent recruiters to help identify potential candidates for job openings. Your Personal Information would only be shared with our service providers on a need to-know basis. Such service providers are expected to process your Personal Information only to perform services for us based upon our contracts with them and for no other purposes.
We may disclose your Personal Information to any institution, government, court, agency, or authority (including law enforcement agencies) as required by law or as necessary to protect our legal rights or the rights of others, to prevent harm, or in accordance with your instructions.

How long do we keep your Personal Information?

We will not retain your Personal Information longer than necessary. In determining how long to retain your Personal Information, we are guided by this Applicant Notice, internal Longboard record retention schedules, and applicable legal obligations.

Security

We use commercially reasonable physical, procedural, and technical safeguards to deter unauthorized use, modification, disclosure, or destruction of, or access to, your Personal Information.

Whom to Contact

Please feel free to contact Longboard at [email protected] if you have any questions regarding this Applicant Notice or about the use of your Personal Information as a job applicant.

Changes to This Applicant Notice

It may be necessary from time to time for us to modify this Applicant Notice, including to reflect changes in the way we collect and use Personal Information or changes in privacy-related laws, regulations, and industry standards.

Effective Date

This Applicant Notice is effective as of October 2, 2024.