Privacy Statement
1. Introduction
Prilenia Pharmaceuticals B.V. (“Prilenia”) is committed to protecting your privacy. We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (EU GDPR) and the UK GDPR. This Privacy Statement explains how we collect, use, and share personal information, and outlines your rights. It applies to all individuals whose personal data we handle, including clinical trial participants (current, potential, and former), website visitors, healthcare professionals, job applicants, and vendors. We aim to be transparent and privacy-forward in our practices, ensuring that your data is used responsibly and securely.
2. Data Controller and Contact Information
The data controller for your personal data is Prilenia Pharmaceuticals B.V., located at Gooimeer 2-35, 1411 HD Naarden, the Netherlands.
If you have any questions or requests regarding your personal data, you can contact us at privacy@prilenia.com. Prilenia may also have affiliates or partners involved in data processing (as described below), but Prilenia remains responsible for deciding how your personal data is used.
3. Scope of this Privacy Statement
This Privacy Statement covers all personal data processing activities by Prilenia in the context of:
Clinical Trial Participants – individuals participating in Prilenia’s clinical trials, as well as those who have expressed interest in participating (potential participants) or have participated in the past (former participants).
Healthcare Professionals and Scientific Collaborators – doctors, medical professionals, researchers, and similar experts with whom Prilenia interacts (for example, when providing medical information, research updates, or educational materials).
Website Visitors, office visitors and Inquiry Contacts – individuals who visit our websites or digital platforms, or who contact us (e.g. via website forms, email, or phone) for information, including those who sign up for newsletters or email alerts.
Job Applicants – individuals who apply for employment or contractor positions with Prilenia.
Vendors and Business Partners – individuals acting in a professional capacity as service providers, suppliers, consultants, or other business partners to Prilenia (this may include sole proprietors or contact persons of vendor companies).
By consolidating all user groups in one comprehensive notice, Prilenia ensures that all individuals understand how their data is handled, no matter their relationship with us. We avoid redundancy while covering all necessary details for compliance.
4. Personal Data We Collect and How We Use It
Healthcare Professionals and Scientific Collaborators
What we collect: If you are a healthcare professional (HCP) or researcher interacting with Prilenia, we may collect your contact details and professional information. This can include your name, business contact information (phone number, email address, work address), your professional qualifications, job title, institutional affiliation, areas of expertise, and other relevant background (e.g. years of experience, involvement in clinical studies, and fields of interest). We may obtain this information directly from you or from third-party sources. For example, Prilenia has received HCP contact data from a third-party provider that maintains an updated database of healthcare professional contact. We ensure any third-party sources have a lawful basis to share your information with us.
How we use it: We use HCP data to manage our professional relationship and to provide you with scientific or educational communications. With your permission, we may send you materials such as medical and scientific updates, newsletters, or information on neurodegenerative diseases and Prilenia’s products and service. We may invite you to professional events (symposia, webinars, conferences) or research collaboration. We also maintain a record of interactions (e.g. meetings or correspondence) and any services you provide to us (for instance, if you serve as a consultant or investigator). We may also communicate with you to invite you to research projects. All communications to HCPs for marketing or educational purposes will only be sent with your prior consent and according to your preferences. You can opt-in to different types of updates (for example, scientific newsletters, product updates, event invitations) and choose the channels (email, messaging, etc.) through which you receive them. We honor the choices you have indicated and you may update your preferences or withdraw consent at any time. If you withdraw consent for communications, we will stop sending you such materials. (Should you unsubscribe, we may retain minimal contact information to ensure we respect your no-contact request.)
Legal basis: For optional communications and marketing to HCPs, we rely on your consent as the legal basis (GDPR Article 6(1)(a)). Where we maintain HCP data for general relationship management or to invite collaboration (not involving regulated promotional content), we may rely on our legitimate interests in engaging with experts in our field. In all cases, we will ensure compliance with applicable direct marketing laws. You have the right to withdraw consent or object to processing of your data for these purposes at any time. Prilenia will not use HCP personal data for any purposes incompatible with those described without obtaining further consent or providing notice.
Website Visitors and Inquiry Contacts
What we collect: When you visit Prilenia’s websites, we may collect limited data about your device and usage of our site. This can include your IP address, browser type, operating system, and browsing behavior on our site (pages viewed, time spent, etc.), typically collected through cookies or similar technologies. Please see our separate Cookie Statement for details on what cookies we use and your choices. If you choose to contact us through a web form or sign up for updates, we will collect the information you provide (such as your name, email address, organization, and the content of your inquiry). For example, if you subscribe to our email alerts or newsletter, we will collect your email and any preferences you indicate for the subscription.
How we use it: We use website usage data to maintain and improve our websites, ensure their security, and understand what content is of interest to visitors (legitimate interests in running an effective website). This data helps us optimize user experience and troubleshoot technical issues. If you fill out a contact form or request information, we will use your provided data to respond to your inquiry or send the requested materials. For instance, if you sign up for news updates or press releases, we will use your email to send you those communications. Any marketing or informational emails you receive from us will be based on your request or consent (for example, by providing your email and opting in to receive updates, you consent to us sending you those updates news.prilenia.com). We include an “unsubscribe” link in such emails, and you can opt out at any time. We do not use website visitor data for profiling or automated decisions about individuals, and we do not sell your personal information.
Legal basis: The collection of basic website data via necessary cookies or logs is based on our legitimate interest in maintaining a functional and secure website. For any non-essential cookies or analytics, we will ask for your consent via the cookie consent banner. When you submit information through the site (e.g. to request information or subscribe to alerts), the legal basis for processing that personal data is your consent or our legitimate interest in responding to your request. In the context of email subscriptions, sending you communications is based on consent (which you provide when signing up). You can withdraw that consent at any time by unsubscribing.
Job Applicants
What we collect: If you apply for a job or consulting role at Prilenia, we will collect the personal data you provide in your application. This typically includes your contact details (name, address, phone, email), background information (CV/resume details such as education, work history, qualifications), and any other information you choose to share (like references or cover letter content). We may also collect information during interviews or assessments (notes from interviews, test results, etc.). In some cases, we may collect information from third parties with your consent or as permitted by law – for example, from references you’ve provided or from background checks (if relevant for the role and allowed under law). We will clearly inform you in advance if we conduct any background screening.
How we use it: We use applicant data to evaluate your candidacy for employment or partnership with Prilenia. This includes reviewing qualifications, verifying information, conducting interviews, and making hiring decisions. If you are selected, your information will be used to prepare an employment contract or contractor agreement and onboard you (at which point additional information may be collected, but that would be covered under an internal employee privacy notice). If you are not selected, we may retain your application to consider you for future opportunities – but we will only do so if allowed by law, and we will obtain your consent if required. Typically, unsuccessful candidate data is kept for a limited period in case of legal challenges (e.g. discrimination claims) or to notify you of suitable new openings, after which it is securely deleted.
Legal basis: Processing job applicant data is necessary to take steps at your request prior to potentially entering into an employment contract (GDPR Article 6(1)(b)). We also rely on Prilenia’s legitimate interest in selecting qualified personnel for our operations. Certain processing may be based on legal obligations (for instance, verifying your right to work or fulfilling equality monitoring requirements, as applicable in some jurisdictions). If we wish to retain your details for future job opportunities beyond the immediate hiring process, we will seek your consent for that retention (you are free to decline). Providing your application data is voluntary, but if you choose not to provide information, we may not be able to consider you for a position.
Vendors and Business Partners
What we collect: For vendors, service providers, and other business partners who are individuals (or representatives/contacts of companies we do business with), Prilenia collects business contact information and any necessary personal data to manage the business relationship. This may include your name, business contact details (address, work email, phone number), job title/position, and any identification or qualification information needed (for example, if you are a consultant or contractor, we might collect your CV/resume or professional license to verify credentials). We also collect financial details necessary for payments (such as banking information, tax identification numbers, if you are an independent contractor). Typically, most information we have about vendors or partners relates to their role and organization rather than private life details.
How we use it: We use vendor and partner data to communicate and manage our contracts/relationships. This includes using contact information to place orders, receive services, and make payments. We may also use this information for due diligence (e.g. anti-corruption, sanctions, or background screening, where required by law or company policy) and to maintain records of the work or services provided. For example, if you are a supplier, we’ll use your contact info to liaise about deliverables and use your banking details to pay your invoices. If you are a scientific or research partner, we will use your info to coordinate project activities. We also retain records of our agreements and transactions for legal and financial auditing purposes.
Legal basis: The primary legal basis for processing vendor or business partner data is the necessity to perform a contract or to take steps prior to entering a contract (GDPR Article 6(1)(b)), since we need to use the data to carry out our agreements with you or your company. We also process certain information to comply with legal obligations (for instance, keeping financial records for tax and accounting). Additionally, we rely on legitimate interests for some processing – for example, our interest in managing our supply chain, ensuring service quality, and protecting our legal rights (such as retaining proof of transactions and communications). Where we conduct legally required due diligence (e.g. to comply with anti-money laundering or sanctions laws), the legal basis will be that legal obligation. We only collect and use the minimum data necessary for these purposes.
5. Sharing of Personal Data
Prilenia may need to share your personal data with third parties in certain situations, always under appropriate safeguards. The categories of recipients who might receive your data include:
Affiliates and Partners: Prilenia may share data with its affiliated companies and business partners. In particular, Prilenia has entered into a collaboration and license agreement with Ferrer in April 2025 for the co-development and commercialization of Prilenia’s lead product. As part of this partnership, relevant personal data (for example, clinical trial data or scientific research data) may be shared with Ferrer or jointly accessed, solely for the purposes of furthering the research, obtaining regulatory approvals, or commercializing the therapy. Any such sharing will be done in compliance with GDPR/UK GDPR and under contractual agreements that protect your information. Similarly, if Prilenia enters into agreements with other co-development partners, licensees, or collaborators, we will ensure they protect your data and use it only as permitted.
Service Providers (Processors): We employ trusted third-party companies to perform services on our behalf – for example, contract research organizations (CROs) that help conduct clinical trials, laboratories, data storage providers, IT support, email delivery services, cloud platforms, and consultants. These service providers will have access to personal data only as needed to perform their tasks for us (e.g. a CRO handling trial data or an IT provider hosting a database) and are contractually obligated to act only on our instructions and protect the data. We perform due diligence and put GDPR-compliant Data Processing Agreements in place with all such vendors.
Regulatory Authorities and Ethics Committees: If you are a clinical trial participant or if the context requires, we may disclose necessary data to regulators, ethics boards, or other official bodies. For example, we must report safety information (like serious adverse events in trials) to health authorities. We may also need to share personal data during inspections or audits by regulators to demonstrate compliance with laws. Such disclosures are made under legal obligation and in a secure manner.
Healthcare Professionals and Institutions: In clinical trials, personal data of participants (often in coded/pseudonymized form) might be shared with the doctors and institutions conducting the study (investigators) and with those monitoring the study. This is inherent to running the trial (for instance, your study doctor and the study site staff will have your identifiable data, and Prilenia’s monitors/auditors may review it at the site). All parties involved are bound by confidentiality and legal duties to protect your privacy.
Advisors and Legal Entities: We may share information with our professional advisors (lawyers, accountants, auditors) if necessary for obtaining advice or defending our legal rights. For example, if there is a legal claim or inquiry, relevant data may be provided to legal counsel. We may also share data if required to enforce our agreements or to protect the rights, property, or safety of Prilenia, our users, or others.
Corporate Transactions: In the event of a merger, acquisition, financing, or sale of business assets involving Prilenia, personal data might be transferred to the acquiring or merging organization as part of the transaction. If this happens, we will ensure the receiving party agrees to handle the data in a manner consistent with this Privacy Statement and applicable law. You would be notified of any change in data control where required.
Prilenia does not sell your personal data to third parties for their own marketing. We only share data with the parties and for the reasons outlined above. Whenever we share data, we share the minimum necessary and always with a legal basis (such as your consent, a legal requirement, or a contract with the service provider). Where needed, we anonymize or pseudonymize data before sharing, especially for research or analysis purposes.
6. International Data Transfers
Your Personal Data will be processed within the European Economic Area (EEA) and stored on servers located within the EEA whenever possible. However, Your Personal Data may be transferred to and stored by us or by our affiliates and third parties described in Section 5 above, located in countries outside the EEA. Consequently, your Personal Data may be processed outside your jurisdiction, and in countries that may not provide for the same level of data protection as your jurisdiction. However, we ensure that the recipient of your Personal Data provides an adequate level of protection, for example by entering into appropriate data processing agreements and, if necessary, standard contractual clauses or an alternative lawful data transfer mechanism.
7. Data Retention
Prilenia will retain your Personal Data for as long as is necessary in order to fulfil the purposes for which we have collected your Personal Data, including any legal requirements. When the Personal Data is no longer needed for its original processing goal, and there are no further legal requirements or you have withdrawn your consent, we will delete or anonymize your Personal Data.
8. Your Rights as a Data Subject
Under GDPR and UK GDPR, you have several rights regarding your personal data. Prilenia is committed to respecting these rights and has processes to enable you to exercise them. Your rights include:
Right of Access: You have the right to request confirmation if we are processing your personal data, and if so, to receive a copy of that data along with information about how we use it.
Right to Rectification: If any of your personal data we hold is inaccurate or incomplete, you have the right to have it corrected or updated without undue delay.
Right to Erasure: You can ask us to delete your personal data in certain circumstances – for example, if the data is no longer necessary for the purposes it was collected, or if you withdraw consent and no other legal basis for processing applies. This is sometimes known as the “right to be forgotten.” Please note that this right is not absolute; we may need to retain certain information where we have a compelling legitimate reason or a legal obligation (for instance, we generally cannot delete data that has been collected as part of a clinical trial that is necessary for regulatory purposes, except by anonymizing it, nor can we delete information we must keep for legal compliance).
Right to Restrict Processing: You have the right to request that we limit the processing of your data in certain scenarios. For example, if you contest the accuracy of your data, you can request we restrict use of it until the issue is resolved; or if you object to our processing based on legitimate interests, we may need to restrict processing while we consider your request. When processing is restricted, we will still store your data but not use it for the time being.
Right to Data Portability: For data that you provided to us and which we process by automated means based on your consent or on a contract with you, you have the right to request a copy in a structured, commonly used, machine-readable format (for example, a CSV file), and you can ask that we transmit it directly to another data controller where technically feasible. This right would typically apply, for instance, to information you directly submitted via our website or to HR during a job application, if processed electronically. It does not apply to most data we process in other contexts (e.g. it wouldn’t apply to most clinical trial data since that is not processed based on consent or contract with the participant in the GDPR sense).
Right to Object: You have the right to object to our processing of your personal data when that processing is based on our legitimate interests or on public interest tasks. If you file an objection, we will assess whether our reasons for processing override your privacy rights. If your objection is to processing for direct marketing purposes, we will honor it absolutely – this means if you object to any direct marketing or newsletters from us (or withdraw consent, as applicable), we will stop those communications.
Right to Withdraw Consent: When we rely on your consent to process data (for example, sending optional updates to healthcare professionals or to individuals who signed up on our website), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing already carried out, but it will stop the future processing of your data for the purpose you originally consented to. We make it as easy as possible to withdraw consent – for instance, by providing “unsubscribe” links in emails or by allowing you to contact us at any time to opt out. As noted in our HCP section, you can change your communication preferences or withdraw consent at any time.
Rights Related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significant effects for you, unless certain exceptions apply. Prilenia does not currently make any such automated decisions about individuals without human involvement. In other words, you will not be subject to hiring or service decisions, clinical trial eligibility, or marketing outreach purely by a computer algorithm without human review. If this policy changes in the future, we will update this Privacy Statement and ensure all GDPR safeguards are in place (including obtaining your consent for any profiling where required).
To exercise any of these rights, please contact us at privacy@prilenia.com with your request. We may need to verify your identity to ensure we do not disclose or change information to the wrong person. We will respond to requests within one month, or inform you if an extension is needed. There is no fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case a reasonable fee may be charged (as permitted by law).
Please note that some rights may be limited in certain situations – for example, if fulfilling your request would reveal personal data about another person, or if you request deletion of data that we are legally required to keep, we might not be able to fully comply. However, we will always explain our reasoning and inform you of any such limitations in our response.
Finally, you have the right to lodge a complaint with a data protection supervisory authority if you believe your data has been handled unlawfully or your rights have not been respected. You may do so in the EU member state or UK country where you reside, work, or where the issue arose. For example, in the Netherlands you can contact the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), and in the UK you can contact the Information Commissioner’s Office (ICO). We encourage you to contact us first to attempt to resolve any concern, but you are entitled to contact the regulator directly.
9. Data Security
Prilenia takes data security seriously. We have implemented appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, alteration, or disclosure. These measures include access controls to personal data (so only necessary personnel can see it), encryption and secure storage for sensitive information, and policies and training for our staff on data protection. We also require our service providers to implement strong security measures and we contractually bind them to protect your data. While we strive to use industry-standard security, no method of transmission or storage is 100% secure; however, we continuously monitor and improve our security practices to safeguard your information. If a data breach ever occurs that poses a high risk to your rights, we will inform both you and the relevant authorities as required by law.
10. Changes to this Privacy Statement
We reserve the right to amend this Privacy Statement at any time and from time to time. We encourage you to review it periodically. If you use this website after the amended Privacy Statement has become effective, you will be deemed to have agreed to the amended Privacy Statement.
11. Contact and Questions
If you have any questions, concerns, or requests regarding this Privacy Statement or how Prilenia handles your personal data, please do not hesitate to reach out to us. You can contact our Data Protection Officer at privacy@prilenia.com, or write to us at:
Prilenia Pharmaceuticals B.V.
Gooimeer 2-35,
1411 HD Naarden,
The Netherlands.
Last updated: June 2025