Consumer Health Data Privacy Notice

Last Updated: April 29, 2025

This Consumer Health Data Privacy Notice (“Notice”) describes how Ardelyx, Inc. (“Ardelyx”, “we”, “us”, or “our”) collect, use, and disclose consumer health data, and the rights available to consumers with respect to their consumer health data.

This Notice only applies to “consumer health data” as that term is defined under applicable consumer health data privacy laws that require us to maintain this Notice, such as Washington’s My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. This Notice does not govern health-related data that we or our partners collect or use in connection with clinical trials or other research, or any other health information that is not governed by applicable consumer health data privacy laws.

This Notice supplements the information in our general Privacy Policy and only applies to individuals from Washington, Nevada, or other states which may in the future require us to provide disclosures specific to consumer health data. If there are any differences between the practices described in our Privacy Policy and what we explain in this Notice relating to your consumer health data, this Notice will control.

1. COLLECTION OF CONSUMER HEALTH DATA

Depending on how you interact with us, including whether your healthcare provider contacts us related to our patient assistance program or for other purposes, we may collect different types of consumer health data about you. Examples of the categories of consumer health data we may collect include:

  • Individual health conditions, treatment, diseases, or diagnosis, such medical diagnoses, clinical data, health care provider, health conditions, or adverse events associated with the use of certain medications as symptoms.
  • Use or purchase of medication, such as records relating to your use of Ardelyx medicines.
  • Bodily functions, vital signs, symptoms, or measurements, such as feedback you may provide relating to your use of our medicines.
  • Diagnoses or diagnostic testing, treatment, or medication, such as medications, medication history, and laboratory values.
  • Other consumer health data that you may choose to share with us, including when applying for patient assistance, such as past procedures, why you are using our medicines, or other information.

2. PURPOSES FOR PROCESSING CONSUMER HEALTH DATA AND HOW WE USE IT

We may use the consumer health data identified above for the purposes of:

  • Providing our products and services, such as to administer our patient assistance programs; to verify your identity; to contact you from time to time; to provide you with information about our company and the medicines we have developed; for support; to respond to your inquiries; to customize your experience; to operate our IT systems and secure our systems; and to obtain professional advice about legal and accounting matters.
  • Research and development, such as to monitor and improve our products and services and for internal reporting and analysis.
  • Artificial Intelligence (AI), including the use of AI-supported services to help us review and analyze the consumer health data that we have collected from you or your health care provider to better understand your needs or help us assess our relationship.
  • Compliance, protection, and safety, such as to prevent fraud, activities that violate our Terms of Service or other contracts, or that are illegal; and to protect our rights and the rights and safety of our users or others.

3. SOURCES OF CONSUMER HEALTH DATA

The sources from which we collect consumer health data include:

  • Consumer health data you provide, such as when you contact us with questions, express interest in our products or services including our patient assistance programs, complete a contact form, or otherwise interact with us.
  • Consumer health data collected automatically when you visit our websites, sign into an account you have with us, or if you consent to recording when calling our assistance lines.
  • Consumer health data from third parties, such as when your healthcare provider contacts us to support your enrollment in our patient assistance programs or third parties that help us assess eligibility for our patient assistance programs.

4. DISCLOSURE OF CONSUMER HEALTH DATA

We may share the categories of consumer health data described above with the following entities or persons as necessary for the purposes above:

  • Service providers, such as companies that help us manage customer information, assist in providing our patient assistance programs, facilitate email communications, provide security services and cloud-based data storage, host our website and assist with other IT-related functions, promote our products and business, or provide analytics and business intelligence information and analysis.
  • Affiliated entities, such as our parent company(ies), affiliates, or subsidiaries.
  • Professional advisors, such as persons, companies, or professional firms providing us with advice and consulting in accounting, administrative, legal, tax, financial, debt collection, or other matters, to the extent such information is necessary in their provision of services to Ardelyx.
  • Law enforcement, government authorities, and other parties as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others. We may also disclose your consumer health data to third parties to help detect and protect against fraud or data security vulnerabilities.
  • Business transaction participants in connection with any business transaction (or potential transaction) such as a merger, acquisition, sale of shares or assets, financing, acquisition, consolidation, reorganization, divestiture, or dissolution of all or a portion of our business (including in connection with a bankruptcy or similar proceedings).

5. YOUR RIGHTS REGARDING CONSUMER HEALTH DATA

If you are covered by an applicable consumer health data privacy law, you may have certain rights with to respect to your consumer health data, such as the rights describe below.

  • Right to Know. The right to know if we are collecting, using, or disclosing your consumer health data, to access your consumer health data, or to receive a list of the categories of third parties with whom we have shared your consumer health data.
  • Right to Withdraw Consent. If we are processing your consumer health data based upon consent, the right to withdraw that consent.
  • Right to Delete. The right to request that we delete your consumer health data.

Please note, these rights are not absolute and, in some cases, we may not be able to respond to your request, such as when a legal exemption applies or if we are not able to verify your identity.

To exercise any of these rights, please contact us at privacy@ardelyx.com. If you have reviewed your consumer health data and would like to request changes, please privacy@ardelyx.com.

If we decline to act on your request, you may appeal by emailing us within a reasonable period of time after we send you our decision. If your appeal is denied, you may contact the relevant government authority in your state. For Washington residents, the Washington State Attorney General may be contacted at www.atg.wa.gov/file-complaint. For Nevada residents, the Nevada State Attorney General may be contacted at https://ag.nv.gov/Complaints/File_Complaint/.

6. CHANGES TO THIS NOTICE

We reserve the right, at any time, to modify this Notice. If we make material changes, we will update the “Last Updated” date at the top of this Notice  to indicate the effective date and may send you direct notice of the update, such as where required by law. We will do this by sending you an email or using other contact information that we have for you.

7. CONTACTING US

If there are any questions regarding this Notice or to request a copy of this Notice in another format you may contact us at:

privacy@ardelyx.com.

You can also contact us at the following address:

Ardelyx, Inc. – Privacy Officer
400 Fifth Ave., Suite 200
Waltham, MA 02451 USA