Privacy Policy
Introduction
MIRATI THERAPEUTICS, INC. (“we”, “us”, “our”, “Mirati”, and “organization”) is committed to andrecognizes the importance of respecting and protecting your privacy. This Privacy Policy applies toour collection and use of personal information through our websites or mobile applications(together, the “Site”) and through our offline business-related interactions with you. We encourage
you to carefully read this Privacy Policy and click on the available links below if you are interested inadditional information on a particular topic. Mirati wants you understand how and why we process
personal information. After review, if you do not agree with our use of your personal information as
described in this Privacy Policy, please do not use the Site or otherwise provide personal
information to us.
The protection of your personal information is a commitment we take seriously. We evaluate our
privacy policies and procedures to implement enhancements and improvements on a consistentbasis. In the event we do make significant alterations to this Privacy Policy, we will place a noticeprominently on this Site before the changes become effective. This Privacy Policy is incorporated
into and made a part of Mirati’s Terms of Use.
Below is a list of topics related to privacy and the collection of personal information. Please review
each item and if interested, click on a topic.

How does Mirati obtain your Personal Information?
Mirati collects Personal Information from numerous sources, including:
•

•
•

•
•

Directly from you, your references or other sources provided by you. For example, when you
enquire about our targeted oncology therapeutics, contact us via the Site, apply for
employment, ask to be a clinical study participant or a principal investigator in one of ourclinical studies, or in any way engage with us or our personnel;
Cookies and automated technologies, such as when you interact with our website;
Third party vendors, which may include those vendors, suppliers, contractors or business
partners that provide services for us (e.g. market research vendors or adverse event
reporting);
Government officials or entities; andPublicly available sources.

What type of Personal Information does Mirati collect?
“Personal Information” is defined as any information that relates to you directly or indirectly, byreference to an identifier, location, or factors specific to physical, physiological, genetic, economic,
cultural or social identity. Mirati may collect and process the following Personal Information about
you:

•
•
•
•
•
•
•
•
•
•
•
•
•
•

Contact information, such as your name, email address, phone number, address, company
affiliation, or job title;
Access information, such as your log-in username and password details;
Online and technical identifiers, such as your IP (Internet Protocol) address and cookies;
Professional credentials, such as curriculum vitae/resume, work history, qualifications or
any other type of information that may be included on a resume or curriculum vitae;
Demographic and health data information;
Communication and correspondence information, such as the content of communications
you send us to report a problem or to submit a query, or your response to a survey;
Financial and government identifying numbers, such as U.S. social security numbers forpayment processing purposes in the U.S.;
Identification information, including biographical and contact data;
Banking information collected for payment processing purposes;
Health data collected for the conduct of clinical studies;Your unique patient identifier which is assigned to you in the event you participate in one of
our clinical studies;
Genetic data;
Biometric data, which is data relating to physical or biological characteristics; andAny other information that you or an authorized party provides to us that can be used to
identify you.

How will Mirati share your Personal Information?
Mirati will share your Personal Information within our organization, at your direction, as disclosed to
you at the time of collection, or in the following circumstances:
•

•

•
•
•
•
•
•
•
•

Services by Third Party Providers: We may provide your Personal Information to our service
providers that help us run and manage our organization and process Personal Information
solely on our behalf. The categories of service providers may include delivery services,financial institutions, clinical research organizations, central laboratories, clinical database
companies, payroll and benefit companies, and specialty pharmacies, among others.
Corporate Transaction: In the event Mirati is involved in a merger, reorganization, acquisitionor sale of all or a portion of our assets, or other corporate transaction, we may disclose your
Personal Information as part of that transaction.
Third Party Collaborators: We may share your Personal Information with other companies
with which we collaborate regarding your participation in a clinical study as follows:
contract research organization services;safety and pharmacovigilance software and related services;
data storage and archiving software and related services;
data analytics and reporting software and services;
services related to the collection, storage, testing, and transportation of biological material;
software that randomly decides which treatment you will receive during the clinical study;
andelectronic data capture software and hardware.

Some of these third party collaborators may be located outside of the United States, European
Union or the European Economic Area. In some cases, data protection authorities may not havedetermined that those countries’ data protection laws provide a level of protection equivalent toU.S. or European Union law. We will only transfer your Personal Information to third parties in thesecountries when there are appropriate safeguards in place. These may include the European
Commission-approved standard contractual data protection clauses. To access these standard
contractual data protection clauses, please contact our Data Protection Officer.
•

As Required By Law: We may disclose your Personal Information if we determine that thedisclosure is necessary: (i) to comply with any law applicable to us, a request from law
enforcement, a regulatory agency, or other legal process; (ii) to protect the legitimate rights,
privacy, property, interests or safety of Mirati, our business partners, personnel, or thegeneral public; (iii) to pursue available remedies or limit damages; (iv) to enforce our Termsof Use ; or (v) to respond to an emergency.

How do we use your Personal Information?
We may collect and use your Personal Information with your consent for the specific purpose
identified in the individual notice given at the point of collection or in order to manage or fulfill ourcontractual relationships. For example, in some circumstances, processing of your Personal
Information is necessary to fulfil our or your (at your request) obligation in an employment orservice contract. In addition, we may need to collect and process your Personal Information tocomply with our legal obligations and/or fulfill our legitimate interests.
We are committed to collecting and processing your Personal Information in a lawful andtransparent manner. For further details on the legal bases Mirati assigns for data collection and use,please reference the below table.
Use of your Personal
Information

Categories of Personal
Information we Process

Obtain your subscription
preferences and send
surveys, questionnaires,
event related materials,
or commercial
communications

Contact information andother information you
provide, such as yourtopic preferences andareas of interest

Respond to inquiries andfulfill requests

Contact information andother information you

Source of the
Personal
Information
You

You

Legal Basis
Consent: To obtainyour subscription
preferences and send
you commercial
communications
Legitimate interests:
To provide you withsurveys,questionnaires,information you needand services you
requestLegitimate interests:
To provide you with

provide, such as yourrequests

Enter into or perform acontract
Comply with applicablelaws, regulations, codes,
court order or other legal
obligations (e.g.,
pharmacovigilance
obligations, financial
disclosure requirements)
Fraud and security
monitoring
Register you for eventsand deliver event-relatedmaterials

Contact information andother information you
provideContact information andother information you
provideYou

IP address

You and yournetwork
providerYou

Contact information andother information you
provide, such as yourpreferences for the event

You

Perform website
analytics

Technical informationand other information wecollect, such as
demographics, behavior
tracking, and event
tracking

First and thirdparty analytics
cookies

Reviewing requests toparticipate in clinicalstudies and screening
eligibility for enrollment

Contact information,clinical study participant
qualification information,and other information
relevant to your eligibility
and qualifications toparticipate in clinicalstudies sponsored or
conducted by us.

You and yourhealthcare
providerinformation you needand other services you
request and toefficiently
communicate withyou
Contract: To conduct
our normal course ofbusiness
Legal obligation: To
comply withapplicable legal
obligations

Legitimate interests:
To protect yourinformation
Legitimate interests:
To enable yourattendance at our
events and to deliver
you event materials
Contract: As may bedescribed in a writtenagreement or on theregistration page forthe eventConsent: To
understand more
about our Site visitors(what pages you view,
how long you visit,
your devices, etc.) inorder to improve ourservices
Legitimate interest: To
ensure researchsubjects are eligible
and appropriate forthe studies wesponsor or conduct
Consent: Forcollection of healthYour participation in aclinical study

Recruiting personnel for
employment

Sharing for the provisionof information about ourtargeted oncology
therapeutics
Management of the
Expanded Access
Program toinvestigational
medicines prior to
regulatory approval

Identification
information, including
biographical and contact
data; health data; yourunique patient identifier
which is assigned to you
for the clinical study;
genetic data; andbiometric data, which isdata relating to physicalor biologicalcharacteristics
Contact information,
recruitment information,and other information
relevant to potential
recruitment by Mirati

You, yourhealthcare
provider or athird party weengage to assist
in conducting
the clinicalstudy

You, yourreferences,
your former
employers

Contact information andother information you
provideYou

Contact information andother information you
provideYou

data to assess youreligibility toparticipate in clinicalstudies
Consent: Informed
consent form signed
prior to any study
related activities

Pre-contractual
Measures: To recruitand evaluate potential
candidates to join
Mirati
Legal obligations: To
comply withapplicable legal
obligations, including
for employment law
purposes
Contract: To allow for
the secure transfer
and processing of
personal data
Legitimate Interests:
to provide you with theinformation you needabout applying for the
Expanded Access
Program

We may also aggregate or de-identify your Personal Information so that it can no longer be used to
identify you. This aggregated or de-identified information may be used for any purpose permitted bylaw and is no longer subject to this Privacy Policy.

Technical Information and Do Not Track Policy
Our Site automatically collects certain information when you use our Site, such as your IP address,
browsing history (including without limitation search terms and clickstream data), device type,
operating system information and other usage information about your use of the Site. We collectthis information to analyze trends and statistics as well as for site administration purposes. We use
cookies and other similar technologies to manage and customize your experience through our Site.
If any of this information can be used to identify you because, for example, we link it to your
Personal Information, we will treat such information as Personal Information. You may choose to
decline cookies. You have the ability to delete cookie files from your hard drive at any time.
Some web browsers incorporate a “Do Not Track” (“DNT”) or similar feature that signals to
websites that a user does not want to have his or her online activity and behavior tracked. If a
website that responds to a particular DNT signal receives the DNT signal, the browser can blockthat website from collecting certain information about the browser’s user. Mirati leverages thirdparty analytics and market performance tools in the administration of its websites. As a result, wehave employed best practices and policies to respect browsers using the DNT signal. Mirati
respects this tag through applied policies in software developed for us as well as our use of tools to
help provide better services and messaging to clinical data subjects and healthcare professionals.
Mirati assumes no liability for policies of or failure to comply with the DNT signal by our partners orvendors.
Please read our Cookies Policy for more information about our collection of your data throughcookies and other technical processes.

Retention of Personal Information
We will keep your Personal Information for as long as necessary to fulfill the purposes for which wecollected it, including any legal, professional, accounting or reporting requirements. We will notkeep your data longer than what is authorized by the law. To determine the appropriate retention
period, we consider the amount, nature, and sensitivity of Personal Information, the potential riskof harm from unauthorized use or disclosure of your Personal Information, the purposes for which
we process your Personal Information, whether we can achieve those purposes through othermeans, and all applicable legal requirements. If you would like to know more about how long wekeep your Personal Information, you can contact our Data Protection Officer using the information
listed below.

How can you access your Personal Information?
You may request access and modifications to the Personal Information, other than information
described under Legal Requirements below, we maintain about you by contacting us using thecontact information below. We will respond to your inquiry within 30 days. If you wish to exercise
any of your rights (including the rights of individuals in the European Economic Area (“EEA”)
discussed below) or advise us of any changes to your Personal Information, please contact our
Data Protection Officer using the contact information provided below. Under the European Union’s
General Data Protection Regulation (“GDPR”), a response to a Data Subject Access Request will beprovided free of charge, unless the request is deemed to be manifestly unfounded, excessive or
repetitive in character. We may charge you a reasonable fee if you request additional copies of your
Personal Information or make other requests that are manifestly unfounded or excessive. If we areunable to honor your request, or before we charge a fee, we will let you know why.

Legal Requirements
In order to comply with applicable law, you understand that we may not be permitted to comply
with your request to amend or remove Personal Information that was provided to us by you or ahealthcare provider regarding your participation in a clinical study, an adverse event or reaction
involving our targeted cancer therapeutics, or required disclosures of your Personal Information as
required by court order or other legal or regulatory process.

Third Party Websites and Services
When interacting with us, you may come across links or references to third party websites andservices that we do not operate or control. If you provide your Personal Information to that third
party through its websites or services, you will be subject to that third party’s privacy practices andpolicies and terms of use. This Privacy Policy does not apply to any Personal Information thatyou provide to a third-party website or service. We recommend that you read the privacy policythat applies to that third party website or service. A link or reference to a third-party website orservice does not mean that we endorse that third party, or the quality or accuracy of the information
presented on its website or service.

Special Notice to California Residents
California Civil Code Section 1798.83 permits individual California residents to request certain
information regarding our disclosure of certain categories of Personal Information to third parties
for those third parties’ direct marketing purposes. To make such a request, please contact us using
the information in the “Contact Us” section below. This request may be made no more than once
per calendar year, and we reserve our right not to respond to requests submitted other than to theemail or mailing addresses specified below.

International data transfers
Mirati is committed to complying with this Privacy Policy and data protection laws, including thoseoutside of the United States, that apply to our collection and use of your Personal Information. Your
personal information could be transferred to countries located outside your country or region,
including to countries that may not provide a similar or adequate level of protection to thatprovided by your country or region. For example, if you are located in the EEA, we may transfer yourpersonal information to the United States or other countries outside of the EEA. By providing uswith your Personal Information and using our Site, you acknowledge that your Personal Information
may be transferred and processed outside your country or region. Mirati will take all the necessary
measures to ensure that any transfers of your personal information comply with those dataprotection and privacy laws as well as with specific rules included in European data protection
laws. If you would like to know more about how we protect your Personal Information, you cancontact us using the information in the section “Contact Us” at the end of this Privacy Policy.

For the transfer of personal information from the EEA and Switzerland to any countries notrecognized by the European Commission as providing an adequate level of data protection
according to EEA standards, we have implemented adequate measures to protect the personal
information, such as by ensuring the recipient is bound by standard contractual clauses (“SCCs”)
adopted by the European Commission. If you are located in the EEA or Switzerland, you canrequest more information about these measures by contacting us at the address or email addressin the “Contact Information” section below.

Standard Contractual Clauses Framework
Mirati has entered into contractual relationships that adhere to the SCCs as adopted by theEuropean Commission regarding the processing of personal information transferred fromorganizations in the European Union and Switzerland to the U.S. To learn more about data transfers
under the SCCs click here.
The SCCs cover both “personal information,” which means any information from which anindividual can be directly or indirectly identified, as well as “sensitive personal information,” whichmeans personal information revealing an individual’s racial or ethnic origin, political opinions or
membership of political parties or similar movements, religious or philosophical beliefs,
membership of a professional or trade organization or union, physical or mental health, including
any opinion thereof, sex life, and, where permitted by applicable law, criminal offences and alleged
offences, criminal records or proceedings with regard to criminal or unlawful behavior. Where theindividual is based in Switzerland, the definition of sensitive personal information also includes
personal information revealing an individual’s ideological views or activities, information on social
security measures or administrative or criminal proceedings and sanctions, which are treatedoutside pending proceedings.
The SCCs apply to personal information both in electronic or paper form, including personal
information and sensitive personal information from agents, consultants, contractors, vendors,
service providers, business associates, healthcare professionals, patients, clinical study
participants and others.
Mirati shall remain liable under the SCCs if an agent uses or discloses personal information
received from Mirati in a manner inconsistent with the SCCs, unless Mirati proves that it is not
responsible for the event giving rise to the damage.
With respect to personal information transferred or received pursuant to the SCCs, Mirati is subject
to the investigatory and enforcement powers of various privacy protection authorities. In certain
instances, Mirati may be required to disclose personal information in response to lawful requests
by public authorities, including to meet national security or law enforcement requirements.

What are the special rights of individuals in the European Economic
Area?
If you are located in the EEA and we maintain your Personal Information, you have the following
additional rights (under the GDPR) with regard to your Personal Information. Note that some of

these rights may not be exercisable if you are a patient or may only be exercisable for reasons
related to your particular situation.
•

•
•
•
•
•

•

•

Right to be informed: You have the right to obtain from our Data Protection Officer
confirmation as to whether or not personal data concerning you are being processed and,
where that is the case, all necessary information to make the process transparent.
Right to access and receive: You may request a copy of or access to the Personal
Information we hold about you.
Right to portability: You may request that we transfer your Personal Information to a third
party in a machine-readable format.
Right to correct: You may ask us to update or correct inaccurate or incomplete Personal
Information we hold about you.
Right to limit or restrict: You may have the right to request that we stop using all or someof your Personal Information or to limit our use of it.
Right to erase: You may have the right to request that we delete all or some of your
Personal Information. This right may be limited if we have collected your Personal
Information for research purposes.
Right to withdraw consent: You have the right to withdraw any consent you havepreviously given to Mirati at any time. Your withdrawal of consent does not affect thelawfulness of our collecting, using, and sharing of your Personal Information prior to thewithdrawal of your consent. Even if you withdraw your consent, we have the right to use
your Personal Information if it has been fully anonymized and cannot be used to personallyidentify you.
Right to complain: You have the right to lodge a complaint with your Supervisory Authority
or with the Supervisory Authority where the alleged violation took place.

Changes to Privacy Policy
Mirati reserves the right to modify this Privacy Policy at any time. Any changes to this Privacy Policy
will become effective when we post the revised Privacy Policy on the Site.

Security
We implement technical and organizational measures designed to ensure your Personal
Information is protected from unauthorized access, use, disclosure, alteration or destruction, in
accordance with applicable laws and regulations. For example, we limit our collection and use ofyour Personal Information to the extent necessary to provide you with our services. If you would liketo know more about how we protect your Personal Information, you can contact our Data
Protection Officer using the information listed below.

Contact Us
MIRATI THERAPEUTICS, INC. is the data controller of the Personal Information collected under thisPrivacy Policy. We welcome your questions and comments about this Privacy Policy or how weprocess your Personal Information. Please contact us using the information below and we will
respond to you within 30 days.

MIRATI THERAPEUTICS, INC.
3545 Cray Court
San Diego, CA 92121 USA
Email: privacy@Mirati.com
If you are located in the EEA and have a question about your Personal Information, please contact:
Name: BMS DPO
Address: Bristol Myers Squibb, Engineering Building, Cruiserath Drive, Mulhuddart, Dublin
15, Ireland
Email: DPO@bms.com
If you are a patient in a clinical study and have a question about your Personal Information, pleasecontact your healthcare provider.