Skip to main content

‎TAIHO ONCOLOGY CALIFORNIA BUSINESS CONTACT PRIVACY NOTICE

Last Updated: 09/22/2026

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”), gives California residents certain rights and requires businesses to make certain disclosures regarding their collection, use, and disclosure of Personal Information. This California Business Contact Privacy Policy (the “Policy”) provides such notice to Taiho Oncology, Inc.’s and its affiliates’ (“Taiho,” “we,” “us,” “our”) business contacts, including our vendors, third parties with whom we interact, healthcare professionals, and all other California residents with whom we interact in a business-related capacity (collectively, “Business Contacts”).

Please note that this Policy only addresses Taiho’s collection, use, and disclosure of Business Contact Personal Information and only applies to residents of California. This Policy does not apply to individuals who are residents of other U.S. states or other countries and/or who do not interact with Taiho in a Business Contact capacity. For further details about our privacy practices pertaining to non-Business Contact Personal Information, please see our Privacy Notice .

As a Business Contact, you have the right to know what categories of Personal Information Taiho collects, uses, discloses, Sells, and Shares about you. This Policy provides that information and other disclosures required by California law.

A. DEFINITIONS

  • Personal Information: As used in this Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household. Personal Information also includes “Sensitive Personal Information” to the extent we collect it, except where otherwise noted.
  • Service Provider: As used in this Policy means a vendor, service provider, contractor, or processor which collects, stores, or otherwise handles data for us and is bound by contractual obligations to use your Personal Information only as directed by us.
  • Third Party: As used in this Policy means any non-affiliated person that is not a Service Provider.
  • Other CCPA Definitions: As used in this Policy, the terms “Collect,” “Processing,” “Sale,” “Share,” “Consumer,” and other terms defined in the CCPA and their conjugates, have the meanings afforded to them in the CCPA, whether or not such terms are capitalized herein, unless contrary to the meaning thereof.

B. Collection & Processing of Business Contact Personal Information

We, and our Service Providers, collect and process the following categories of Personal Information about Business Contacts. We also have collected and processed the following categories of Business Contact Personal Information in the preceding 12 months:

  • Identifiers, such as name, alias, postal address, unique personal identifier, online identifiers, Internet Protocol address, email address, account name, social security number, physical characteristics or description, or other similar identifiers;
  • Contact and financial information, including phone number, address, email address, and payment or bank account information;
  • Characteristics of protected classifications under state or federal law, such as age and gender;
  • Commercial information, such as transaction information and purchase or prescription history for our products;
  • Internet or other electronic network activity information, such as browsing history and interactions with our websites or advertisements;
  • Audio, electronic, visual and similar information, such as call and video recordings;
  • Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.

C. Purposes for Collecting, Processing, & Disclosing Business Contact Personal Information

We, and our Service Providers, collect, process, and disclose, and in the past 12 months have collected, processed, and disclosed, the categories of Personal Information (excluding Sensitive Personal Information) listed in Section B to:

  • Respond to requests for information about our products and services and communicate with you about our products and services;
  • Communicate with you as appropriate given the nature of our business relationship;
  • Communicate other information that we think may be of interest to you through our websites and via e-mail, mail, and other channels, including promotional communications about our products and services;
  • Provide you with a service or take an action that you request;
  • Assess and analyze our current interactions with you and personalize your website experience and other interactions with Taiho;
  • Monitor and improve our website functionality, and otherwise manage our information technology resources and obligations;
  • Process and report adverse event information and product complaints;
  • Identify, engage, and communicate with service providers, scientific experts, conference speakers, and Third Parties to provide various products and services to us;
  • Conduct business and marketing research to better understand the market for our existing products and services, and potential new products and services, and adjust our research, development, and marketing strategies accordingly;
  • Track and report payments and other transfers of value to healthcare professionals in accordance with financial disclosure transparency requirements;
  • Manage our relationships with our Service Providers and with Third Parties with whom we interact, including ensuring compliance with contractual obligations, performing auditing activities, and managing billing and invoicing;
  • Manage our relationship with healthcare professionals and research partners and investigators, including planning, organizing and reviewing the research we perform;
  • Meet our contractual obligations to you, if applicable;
  • Detect security incidents and other fraudulent activity;
  • Provide this Policy and other informational forms to you in an accessible format as needed; and
  • Process contracts and other written agreements into which we may enter with you.

In addition to the purposes identified above, Taiho may use and disclose any and all Business Contact Personal Information that we collect as necessary or appropriate to:

  • Comply with laws and regulations, including, without limitation, applicable tax, health and safety, anti-discrimination, immigration, labor and employment, and social welfare laws;
  • Monitor, investigate, and enforce compliance with and potential breaches of Taiho policies and procedures and legal and regulatory requirements;
  • Comply with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and
  • Exercise or defend the legal rights of Taiho and its employees, affiliates, customers, contractors, and agents.

Note that Taiho may combine Business Contact Personal Information with any other data we collect to accomplish this or any of the other purposes indicated in this Policy, where permitted by law. We may also deidentify any Personal Information, including any Sensitive Personal Information, that we collect about you. When we do so, we take reasonable measures to ensure that the information cannot be associated with a Business Contact or household, and we maintain and use the information in deidentified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements. After it has been deidentified, the information is no longer Personal Information and is not subject to this Policy.

D. PROCESSING SENSITIVE PERSONAL INFORMATION

We, and our Service Providers, collect, process, and disclose the Sensitive Personal Information we collect about Business Contacts only as reasonably necessary for:

  • Performing the services or providing the goods reasonably expected by an average Business Contact who requests those goods or services;
  • Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information;
  • Resisting malicious, deceptive, fraudulent, or illegal actions directed at us and prosecuting those responsible for those actions;
  • Ensuring the physical safety of natural persons;
  • Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a Business Contact’s current interaction with us, provided that we will not disclose the Business Contact’s Personal Information to a Third Party and/or not build a profile about the Business Contact or otherwise alter the Business Contact’s experience outside the current interaction with the business;
  • Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
  • Verifying or maintaining the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us;
  • Collecting or processing Sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about a Business Contact.

E. RETENTION OF BUSINESS CONTACT PERSONAL INFORMATION

We retain each of the categories of Personal Information listed in Section B for the period reasonably necessary to provide goods and services to you, as applicable, and longer as may be required by applicable laws or necessary for our legitimate business purposes listed in Sections C and D of this Policy.

F. SALE & SHARING OF BUSINESS CONTACT PERSONAL INFORMATION

We may sell or share Personal Information that we collect about Business Contacts. Under the CCPA, “sell” or “sold” means the disclosure of Personal Information to Third Parties for monetary or other valuable consideration, and “share” or “shared” means disclosure of Personal Information to Third Parties for cross-context behavioral advertising, regardless of whether the disclosure is made for monetary or other valuable consideration.

We do sell and share, and we have sold and shared in the past 12 months, Personal Information in other contexts. This includes Personal Information collected via cookies and other tracking technologies, such as internet and other electronic network activity information including browsing history and interactions with our websites and advertisements, to third-party marketing and analytics providers for targeted advertising, including cross-context behavioral advertising, and for marketing and analytics purposes.

California Business Contacts have the right to opt out of sale and sharing.

We do not knowingly sell or share Personal Information of consumers under the age of 16.

G. DISCLOSURE OF BUSINESS CONTACT PERSONAL INFORMATION

We disclose, and in the past 12 months have disclosed, the categories of Personal Information listed in Section B in the following contexts:

  • Affiliates & Service Providers. We may disclose Business Contact Personal Information to our affiliates and Service Providers for the purposes described in Sections C and D of this Policy. Our Service Providers provide us with website services, web hosting, data analysis, customer service, infrastructure services, technology services, email delivery services, legal services, marketing services, and other similar services. We grant our Service Providers access to Business Contact Personal Information only to the extent needed for them to perform their functions, and require them to protect the confidentiality and security of such information.
  • Third Parties. We may disclose Business Contact Personal Information to the following categories of Third Parties:
    • Marketing and Analytics Providers. We may disclose Personal Information we collect via cookies and other online tracking technologies to third-party marketing and analytics providers for targeted advertising, including cross-context behavioral advertising, for marketing and analytics purposes.
    • At Your Direction. We may disclose your Personal Information to any Third Party with your consent or at your direction.

In addition, Taiho may also disclose Business Contact Personal Information:

  • To a successor organization or prospective purchaser as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
  • To government, regulatory, and legal authorities including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.
  • In aggregated or de-identified form, for our business purposes or any other purposes permitted by applicable law.

H. SOURCES FROM WHICH WE COLLECT BUSINESS CONTACT PERSONAL INFORMATION

We collect Business Contact Personal Information directly from Business Contacts, as well as from cookies and other tracking technologies, joint marketing partners, public databases, providers of demographic data, publications, professional organizations, educational institutions, social media platforms, and Service Providers and Third Parties when they disclose information to us.

I. DATA SUBJECT RIGHTS

California Business Contacts have the following rights regarding our collection and use of their Personal Information, subject to certain exceptions.

You may exercise the following rights by contacting us at privacyofficer@taihooncology.com or by calling 1-844-688-2446. You may also authorize an agent to make data subject requests on your behalf via the above-listed methods. We may ask you to provide information that will enable us to verify your identity in order to comply with the data subject rights listed below. In particular, for authorized agents, we may require the agent to provide proof of signed permission from the Business Contact to submit the request, or we may require the Business Contact to verify their own identity to us or confirm with us that they provided the agent with permission to submit the request. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.

Rights that Require Verification

  • Right to Know: You have the right to know the following:
    • The categories of Personal Information we have collected about you;
    • The categories of sources from which such Personal Information was collected;
    • The business or commercial purpose for collecting, selling, or sharing Personal Information collected about you;
    • The categories of Third Parties to whom we disclose Personal Information collected about you;
    • The categories of Personal Information about you that we have sold, and for each category, the categories of Third Parties to whom we sold that particular category of Personal Information;
    • The categories of Personal Information about you that we disclosed for a business purpose to a service provider or contractor, and the purposes for such disclosures; and
    • The specific pieces of Personal Information that we have collected about you.
  • Right to Delete: You may request that we delete any Personal Information about you that we collected from you.
  • Right to Correct: You may request that we correct any inaccurate Personal Information we maintain about you.
  • Right to Access Specific Pieces of Personal Information: You may ask to obtain the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Personal Information to another entity without hindrance. You may not exercise this right more than two times in a calendar year.

Rights that Do Not Require Verification

  • Right to Opt-Out of Sale & Sharing: You have the right to opt out of the sale and sharing of your Personal Information.
  • Right to Limit the Use of Your Sensitive Personal Information: We do not use Sensitive Personal Information that we collect about Business Contacts for purposes other than those that are permitted by the CCPA regulations. If we did, you would have the right to limit the use of your Sensitive Personal Information to the purposes permitted by the CCPA.
  • Right to Non-Discrimination: You have the right not to be discriminated against for exercising your data subject rights. We will not discriminate against you for exercising your data subject rights. We also will not deny goods or services to you, charge you different prices or rates, or provide a different level of quality for products or services as a result of you exercising your data subject rights.

Opt-Out Preference Signals

Some web browsers or devices offer settings where you may pre-set a signal to websites that you do not want to have your online activity and behavior tracked, sold, shared, or otherwise used for targeted advertising purposes. We recognize the opt-out preference signals that we are required to recognize for compliance with applicable law. Where required by applicable law, we treat the opt-out preference signals we are required to comply with as a valid request to opt-out of sale and sharing for the browser or device through which the signal is sent and any consumer profile we have associated with that browser or device, including pseudonymous profiles. Further, if we know the identity of the consumer from the opt-out preference signal, we will also treat the opt-out preference signal as a valid request to opt out of sale and sharing for such consumer. Consumers may use opt-out preference signals by downloading or otherwise activating them for use on supported browsers and setting them to send opt-out preference signals to websites they visit. Please note, however, that our sites are not currently configured to recognize the “Do Not Track” signal.

J. OTHER DISCLOSURES

  • California Residents Under Age 18. If you are a resident of California under the age of 18 and a registered user of our website, you may ask us to remove content or data that you have posted to the website by writing to privacyofficer@taihooncology.com or by calling 1-844-688-2446. Please note that your request does not ensure complete or comprehensive removal of the content or data, as, for example, some of your content or data may have been reposted by another user.
  • Financial Incentives. Under California law, we do not provide financial incentives to California Business Contacts who allow us to collect, retain, Sell, or Share their Personal Information. We will describe such programs to you if and when we offer them to you.
  • Changes to this Policy. We reserve the right to amend this Policy at our discretion and at any time. When we make material changes to this Policy, we will notify you by posting an updated Policy on our website and listing the effective date of such updates.
  • Contact Us: More information about our privacy practices can be found in our Privacy Policy. If you have any questions regarding this Policy or Taiho’s collection and use of Business Contact Personal Information, or would like to exercise your data subject rights, please email our Privacy Office at privacyofficer@taihooncology.com or call us at 1-844-688-2446. If you are unable to review or access this Policy due to a disability, you may contact us at privacyofficer@taihooncology.com or call us at or 1-844-688-2446 to access this Policy in an alternative format.