Adverse Event Reporting

Oranda Therapeutics Ltd (“we”, “us”, or “our”) is committed to protecting the privacy and security of your personal data. This privacy notice describes how we collect and use personal data about you during and after your working relationship with us, in accordance with the EU General Data Protection Regulation (GDPR).

For the purposes of this processing, Oranda Therapeutics Ltd is the Data Controller.

Company address: Wicklow House, Market Square, Wicklow, Dublin A67 W589.
Contact email: [email protected]

This Privacy Notice is addressed to:

• individuals reporting adverse events, providing safety information concerning our products, requesting medical information, and submitting product quality complaints; and
• individuals that are the subject of adverse events, medical information queries, and product quality complaints.

We invite you to read this Privacy Notice carefully, as it contains important information for you.

We collect and use personal information in connection with adverse event reports, product complaints, and medical information enquiries for the following purposes and legal bases:

In connection with adverse event reports, product complaints, and medical information enquiries, we may process special category personal data, including information concerning an individual’s health. We process such information only where permitted by applicable data protection laws and where an appropriate additional condition for processing applies, including where processing is necessary for reasons of public interest in the area of public health and to ensure high standards of quality and safety of medicinal products and medical devices.

We do not use your personal information to make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

When you submit an adverse event report, product complaint, or medical information enquiry, we may collect and process the following categories of personal information:

• Identification information, such as your name or initials.
• Contact information, such as your email address, telephone number, postal address, or other contact details.
• Information about your role in relation to the report, such as whether you are a patient, healthcare professional, caregiver, pharmacist, or other reporter.
• Information relating to the adverse event, product complaint, or medical information enquiry.
• Product-related information, such as the product name, batch or lot number, purchase details, and information about product use.
• Correspondence and communications between you and us, including any follow-up information provided.
• Information required to investigate and manage the report or enquiry and to comply with our legal and regulatory obligations.

We may also collect and process special category personal data, including health-related information that is provided as part of a report or enquiry. This may include:

• Medical conditions and diagnoses.
• Symptoms, adverse reactions, side effects, and health outcomes.
• Details of medications, treatments, therapies, or medical devices used.
• Medical history and relevant family medical history.
• Information relating to pregnancy, breastfeeding, or reproductive health.
• Laboratory test results, clinical measurements, and diagnostic information.
• Information regarding disabilities, injuries, or physical and mental health.
• Details of hospitalisations, medical procedures, or healthcare interventions.
• Other health information relevant to the assessment, investigation, or response to a report or enquiry.

We only collect personal information, including special category personal data, that is necessary to investigate, assess, and respond to adverse event reports, product complaints, and medical information enquiries, and to fulfil our legal and regulatory obligations relating to product safety, quality, and medical information services.

We will not sell, share or otherwise transfer personal information to third parties other than those indicated in this Privacy Notice. Personal information may be accessed by or transferred to:

• our personnel (including those in our Patient Safety, Pharmacovigilance, Medical Information, Quality Assurance, and Legal departments) and other Oranda Therapeutics Group companies;
• other pharmaceutical and medical device companies, if the adverse event, request for information, or complaint relates to one of their products; and
• service providers acting on behalf of Oranda Therapeutics companies, such as IT system and data hosting providers, and adverse event processing service providers (including call centre providers if any in your local country). These third parties are contractually obliged to protect the confidentiality and security of personal information, in compliance with applicable law.

Personal information may also be shared with:

• healthcare professionals involved in an adverse event, request for information, or complaint; and
• national and/or international regulatory bodies, for example the MHRA, enforcement or public bodies, or a court, where we are required to do so by applicable law or regulation or at their request.

Your personal information may be processed by Oranda Therapeutics in Ireland and the United Kingdom in connection with our pharmacovigilance, medical information and product quality activities. Personal data may be transferred between Ireland and the United Kingdom where this is necessary for these purposes.

Both Ireland and the UK benefit from mutual adequacy decisions under applicable data protection law. As a result, these transfers do not require additional transfer safeguards.

If, in the future, it becomes necessary to transfer your personal information to a country outside the EU or the UK that does not benefit from an adequacy decision, we will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation.

We maintain appropriate technical and organisational safeguards to protect personal information, including special category personal data, processed in connection with adverse event reporting, product complaint handling, and medical information services. Access to personal information is limited to authorised personnel and third parties who require access to fulfil their responsibilities and who are subject to appropriate confidentiality and security obligations.

We have implemented measures designed to protect personal information from unauthorised access, disclosure, alteration, loss, misuse, or destruction, and regularly review these measures to ensure they remain effective and appropriate.

We retain adverse event records for the period required by applicable pharmacovigilance legislation and regulatory requirements. Currently this is as long as the product is authorised, and for at least 10 years after the Marketing Authorisation (MA) has ceased to exist.

For product complaints, records are stored for the period required by applicable batch laws, usually 5 to 15 years after the enquiry is closed.

For medical information queries, data is typically held for 5 to 10 years after the enquiry is closed, if no safety issues were identified.

Otherwise, we will only store personal information for as long as we reasonably consider necessary for achieving the purposes set out in this Privacy Notice and as required under applicable laws.

Under applicable data protection laws, you may have certain rights in relation to your personal information. These rights may include:

• The right to request access to the personal information we hold about you.
• The right to request correction of inaccurate or incomplete personal information.
• The right to request the restriction of processing of your personal information in certain circumstances.
• The right to object to the processing of your personal information in certain circumstances.
• The right to request the deletion of your personal information.
• The right to receive a copy of certain personal information in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact us using the details provided in the “How can you contact us?” section of this Privacy Notice, or email us at [email protected].

Please note that these rights are not absolute and may be subject to limitations under applicable law. In particular, where personal information is processed for adverse event reporting, product safety monitoring, pharmacovigilance, product complaint handling, or other regulatory compliance purposes, we may be required by law to retain and process certain information, despite a request for deletion, restriction, or objection. This is necessary to meet our legal, regulatory, and public health obligations and to help ensure the ongoing safety and quality of our products.

If you have any concerns about how we collect, use or protect your personal information, you have the right to make a complaint to us. You can contact us at [email protected]. We will acknowledge your complaint within 30 days and respond without undue delay. If you remain dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

If you are dissatisfied with how we process your personal information, you also have the right to lodge a complaint with the relevant data protection authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO).

If you have a question or want to exercise the above rights, please email us at [email protected] or write to:

Oranda Therapeutics Ltd, Wicklow House, Market Square, Wicklow, A67 W589, Ireland.

If you are not satisfied with the processing of personal information, please address your request to [email protected] who will investigate your concern.

This Privacy Notice was last updated in August 2026. Changes or additions will be notified through our usual communication channels, for example via our website.