Ironwood Pharmaceuticals Privacy Notice - Ironwood Pharmaceuticals

Updated October 20, 2023

Ironwood Pharmaceuticals, Inc. and its subsidiaries (hereafter “Ironwood”, “we”, “us” or “our”) is committed to protecting the privacy and security of your personal data. This Ironwood Privacy Notice (“Privacy Notice”) describes the types of personal data and other information we collect from and/or about you when you interact with us or use our websites, mobile applications, or other on-line services (collectively, the “Services”), as well as how we use and share your personal data with third parties. This Privacy Statement also describes your rights with respect to your personal data and how you may exercise your rights.

Information We Collect About You

The types of information that we may collect and receive from you while you use the Services are described in this section and includes information that you provide to us, information that we collect automatically when you use the Services and information that we collect from third-party sources.

Personal Data: Personal data is information from which an individual can be identified either directly or indirectly in combination with other information. Personal data also includes information that may be used to locate you or to contact you. Examples of personal data that we may collect about you include:

Contact Data: information such as your name, postal address, telephone number and email address;

Relationship Data: information about health conditions, our products or services, and/or treatment information that are areas of interest to you;

Transaction Data: information about how you use our websites and mobile applications;

Geolocation Data: information that may be transmitted to us by your computer, mobile device, or using one of our mobile applications; and

Job Applicant Data: information such as your contact information, résumé or curriculum vitae, work experience, education, academic transcript, date of birth or age, driver’s license information, Social Security Number or national identification number and information relating to references.

The following chart outlines the types of cookies we use:

1st party cookie	A 1st party cookie is generally placed on your computer or device by the website you are visiting. For example, we may place a 1st party cookie on your computer or device to improve our website’s security.
3rd party cookie	A 3rd party cookie is placed on your computer or device by a source other than the website you are visiting in order to enable third-party features. For example, this may include advertising, analytics, videos, or interactive content.
Session cookie	A session cookie is temporary and lasts only as long as you visit the website. The web browser typically deletes the information contained in a session cookie once you close your browser.
Persistent cookie	A persistent cookie remains on your device after you close your browser and expire based on a predetermined date, length of time, or when you manually delete them.
Essential cookies	Essential cookies are necessary to make the website work and you cannot disable them. For example, these cookies may help you navigate around the website or visit a secure area within the site.
Performance and Functionality cookies	Although these are non-essential cookies, they help the website perform and function as designed. For example, performance and functionality cookies may help the website display videos, enable chat sessions, or recognize whether you visited the website before.
Analytics cookies	Analytics cookies track your usage of a website. The information these cookies collect can be used for various purposes such as understanding how visitors use the website, site and content customization, or advertising and marketing.
Advertising/Marketing cookies	Advertising and marketing cookies may perform functions, such as helping customize your website experience, personalizing ads based on your online activities and interests, measuring the effectiveness of ads, and preventing an ad from reappearing. Information from these cookies may be shared with third parties, or third parties may place these cookies on your computer or device.
Social Media cookies	These cookies permit you to share content from a website on a social media platform. Social media cookies may place third-party cookies on your device for tracking and advertising purposes, including building a profile on you.

Ironwood collects many different types of data and personal information from cookies. For example, we may collect data about the device you use to access our websites, your operating system type, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located and the date and time you visit our websites and the pages you visit. We also use essential cookies on our websites to make the sites function, and we use analytics cookies to understand how you use our websites, to improve functionality on our websites, and for other related purposes. In addition, we use advertising/marketing cookies on our websites to help us with marketing activities. Some of these cookies may follow you when you leave our websites and travel to other websites so that we can serve targeted and relevant ads to you.

We may place some of these cookies on your computer or devices. Third parties, such as our advertising partners or service providers, may also place cookies on your devices when you visit our websites.

This chart includes examples of the cookies we use. Please note this is not an exhaustive list:

Cookie Name	Category	Type	Purpose
_ga	Analytics	First-party; persistent	Google Analytics
_gid	Analytics	First-party; persistent	Google Analytics
_gat_UA-35662908-1	Analytics	Third-party; persistent	Eventbrite cookie used on investor.ironwoodpharma.com
JSESSIONID	Analytics	Third-party; session	This domain is controlled by New Relic, which provides a platform for monitoring the performance of web and mobile applications
1P_JAR	Analytics	Third-party; session	Captcha cookie
_GRECAPTCHA	Necessary	Third-party; persistent	Google reCaptcha sets necessary cookie for risk analysis
__cf_bm	Necessary	First-party; session	Used on investor.ironwoodpharama.com to distinguish between humans and bots
_ga_ZKP4G4CE7K	Performance	First-party; persistent	Google Analytics
_ga_39QZELPZ60	Performance	First-party; persistent	Google Analytics
_gat	Performance	First-party; session	Google Analytics
_ga_534ZTTYQZ8	Performance	First-party; persistent	Google Analytics

You can manage your cookie preferences on our websites via our cookie preferences manager, but some portions of our websites may not work properly if you decline certain cookies.

Pixel Tags: Our websites may also use so-called “pixel tags”, “web beacons”, “clear GIFs” or similar means (collectively, “pixel tags”). These are tiny graphic images placed on website pages or in our emails that allow us to determine whether you have performed a specific action or to compile aggregate statistics about website usage and response rates. Pixel tags allow us to count users who have visited certain pages on our websites, to deliver branded services, and to help determine the effectiveness of promotional or advertising campaigns. When used in HTML-formatted email messages, Pixel Tags can tell the sender whether and when the email has been opened.

Google Analytics: We use Google Analytics, a web analysis service provided by Google, to better understand our website usage. Google Analytics collects information such as how often users visit websites, what pages they visit and what other websites they used prior to visiting. Google uses the data collected to track and examine the use of the websites, to share such data with other Google services, or to personalize the ads of its own advertising network. Google’s ability to use and share information collected by Google Analytics is restricted by the Google Analytics Terms of Service and the Google Privacy Policy. To opt-out of analysis by Google Analytics on our websites, please visit: https://tools.google.com/dlpage/gaoptout.

How We Collect Information About You

Directly From You: We may collect personal data that you provide to us through our Services. For example, you may provide your personal data to us: (1) through setting up accounts on one of our websites or mobile applications; (2) through an enrollment form to register for one of our programs or services; (3) through your requests to receive marketing materials, newsletters or other information about our products or services; or (4) by contacting Ironwood.

Other Sources: We may also collect information about you from other sources, such as public records, and/or third-party data suppliers who enhance our files, and/or from social media sites such as LinkedIn and X (formerly Twitter).

How We Use Your Information

The personal data and other information that we collect about you in connection with our Services may be used in any of the following ways:

To respond to your requests for information about our products or services;
To provide you with marketing communications whether about a particular Ironwood product or concerning general disease information;
To determine if you are eligible for certain products, services or programs (such as patient assistance programs);
To administer promotional programs, such as sweepstakes, rewards, and rebate programs;
To manage or develop our business relationship with you (e.g., to respond to questions, invite you to events, comply with regulatory obligations or determine eligibility for Ironwood programs);
If you apply for a job on our websites, to consider you for employment with Ironwood;
For our research, development, and collaboration efforts;
For regulatory reporting, such as adverse event reporting, to communicate product safety information to you or for pharmaceutical transparency reporting; and
For other everyday business purposes, such as product development, contract management, website administration, fulfillment, analytics, fraud prevention, corporate governance, reporting, and legal compliance.

The information that we collect from your devices is used to better design our websites. We analyze the information we collect to enhance our websites’ security and to track the popularity of certain pages on the websites, the success of our email notifications, traffic levels on the websites, and other usage data, all of which helps us to provide content tailored to your interests and improve our websites and related Services.

How We Share Your Information

We may share your personal data or other information we collected about you if we believe it is necessary: (a) to comply with any law applicable to us, a request from law enforcement, a regulatory agency, or other legal process; (ii) to protect the legitimate rights, privacy, property, interests, or safety of Ironwood, our patients, business partners, personnel, or the general public; (iii) to pursue available remedies or limit damages; (iv) to enforce our Terms of Use; (v) for external auditing purposes, compliance and other corporate governance matters; or (vi) to respond to an emergency. We reserve the right to disclose personal data when we believe in good faith that such action is necessary to comply with a legal obligation.

Third Parties: We may share your personal data or other information we collected about you with third parties with whom we have contracted with, such as our vendors, as well as with our affiliates and/or business partners. We will require these recipients to use your personal data or other information we have collected about you only for appropriate purposes and to take appropriate measures to protect your personal information. For example, we may share your personal data or other information we collected about you with our affiliated companies and/or product co-promotion and co-marketing partners who are contractually bound to only use your personal data and other information we collected about you for the purposes described herein.

Sale or Merger: If we sell or transfer all or a portion of our business or assets to a third-party, such as in the event of a corporate sale, merger, reorganization, dissolution or similar event, we may transfer your personal data and other information that we have collected to such third-party. We will require such third-party to continue to comply with this Privacy Notice.

Other Parties with Your Consent or At Your Direction: In addition to the disclosures described in this Privacy Notice, we may share information about you with third parties when you consent to or request such sharing. For example, we may share your personal data with your doctor as part of an Ironwood program in which you agreed to participate in, or with our business partners to provide patient support services.

Do Not Sell: Ironwood does not sell, share, or otherwise distribute your personal data or other information we collected about you with third parties for their marketing purposes.

Non-Identifiable Information: We may also disclose data about you that is not personally identifiable. For example, we may publish reports that contain aggregate and statistical data about our customers. These reports do not contain any data that would enable the recipient to contact, locate or identify you.

Third Party Advertising

Ironwood has relationships with third-party advertising companies and may place advertisements on some of our websites which may include this website and other websites, and to perform tracking and reporting functions for this website and other websites. These third-party advertising companies may place cookies on your computer when you visit our website or other websites so that they can display targeted advertisements to you. These third-party advertising companies do not collect personal data in this process, and we do not give any personal data to them as part of this process. However, this Privacy Notice does not cover the collection methods or use of the data collected by these vendors. For more information about third-party advertising, please visit the Network Advertising Initiative (NAI) at www.networkadvertising.org.

Video Content: Our websites may contain embedded content (e.g., videos). If so, embedded content may place third-party cookies on your device that track your online activity to enhance your experience or assess the success of their application. We have no direct control over the information these cookies collect and you should refer to their website privacy notice for additional information.

Do-Not-Track: Some web browsers may transmit “do-not-track” signals to websites with which the browser communicates to limit third-party tracking of user activity. If you use Do-Not-Track capabilities to limit third-party tracking of your activity on our websites, please be aware that our websites may not respond to these “do-not-track” signals.

Links To Other Websites

Our websites may contain links to third-party websites, which are not operated or controlled by Ironwood and for which Ironwood is not responsible. The links from the websites do not imply that Ironwood endorses or has reviewed the third-party websites. Once you have left one of our websites, we are not responsible for the protection and privacy of any information you provide. We suggest contacting those third-party websites directly for information on their privacy practices.

Social Media Plug-ins: This website uses social medial plugins (e.g., LinkedIn, X) to enable you to easily share information with others. When you visit our website, the operator of the social plugin can place a cookie on your computer, enabling that operator to recognize individuals who have previously visited our website. If you are logged into the social media website (e.g., LinkedIn, X) while browsing on our website, the social plugins allow that social media websites to share data about your activities on our website with other users of their social media website. Ironwood does not control any of the content from the social media plugins. For more information about social plugins from other social media websites you should refer to those sites’ privacy and data sharing statements.

Global Access and Data Transfers

Our websites are owned and operated by Ironwood in the United States. However, your personal data and other information we collected about you may be accessible or transferred to our business affiliates, vendors, suppliers or other third parties who are in other countries. If you are visiting our websites from a country other than the United States, your communication with us will necessarily result in the transfer of your information across international borders. We have implemented reasonable measures to help protect your personal data. For example, intended recipients are contractually bound to comply with certain data protection standards. However, certain countries and territories may not provide a similar or adequate level of protection as that provided by your home country or region. Therefore, by using our websites or Services or you are otherwise providing your personal data to us, you hereby expressly consent to the collection, storage, and processing of your personal data in the United States and in any country to which we may transfer your personal data in the course of our business operations.

Your Choices and Your Rights

If you would like your personal data and other information we collected about you removed from our database, changed or updated, you can contact us at: [email protected]. If requested, we will promptly verify and delete your personal data and you will no longer receive emails or other materials from Ironwood. Your removal from the mailing list or database will not remove records of past transactions or delete information stored in our data backups and archives where we are required to keep your data for legitimate business purposes or legal requirements. Data on past transactions and data stored in backups and archives will be deleted in the normal course of our business.

You have the right to access or, if required by applicable laws, receive a copy of your personal data held by us by making a written request by sending an email to: [email protected].

You can always limit the personal data you provide to Ironwood, but if you choose not to provide certain requested information, you may not be able to access some of our Services, offers, or content on our websites. You can also limit the communications that Ironwood may send to you by following a simple opt-out process. Simply follow the instructions in our advertisement/promotional emails sent to you to opt-out of receiving future marketing communications.

Please note that even if you opt-out of receiving our promotional emails, we may still need to contact you with important information pertaining to our programs or services. For example, even if you opt-out of advertisement/promotional emails, we will still send you an email if we discontinue a program you are enrolled in, or to send you product safety communications.

Data Subject Rights: Depending on where you live (e.g., in California, the European Economic Area, European Union, United Kingdom or Switzerland, etc.) you may have the following rights with respect to your personal data:

Your right of access. You may have the right to ask us to provide clear, transparent and understandable information on how we process your personal data, as well as for copies of your personal data. There are some exemptions, which means you may not always receive all the information we process;
Your right to rectification. You may have the right to ask us to rectify information you think is obsolete or inaccurate and the right to ask us to complete information you think is incomplete;
Your right to deletion of your personal data. You may have the right to ask us to delete your personal data in certain circumstances;
Your right to restriction of processing. You may have the right to ask us to restrict the processing of your personal data, during a limited period of time, in certain circumstances;
Your right to object to processing. You may have the right to object to processing, in which case, Ironwood will no longer process your personal data unless Ironwood demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as compliance with a legal obligation or for the establishment, exercise or defense of legal claims;
Your right to data portability. You may have the right to ask that we transfer the information you gave us from our organization to another or give it to you; and
Right to withdraw your consent. If we process your personal data based on your consent, you have the right to withdraw your consent, without this withdrawal affecting the lawfulness of the processing operations previously carried out.

Depending on your country of residence and the country where the Ironwood entity processing your personal data is established, you may have additional local rights with respect to our processing of your personal data. Please note that some of the personal data that we collect, use and disclose may be exempt from the rights outlined above.

You can submit your request by sending us an email at: [email protected]. We will always endeavor to fulfill your request to exercise these rights, but sometimes, we may have legal grounds or obligations to reject your request.

We will respond to your requests within the time period prescribed by applicable laws. Under certain circumstances, Ironwood may ask you for specific information to confirm your identity and ensure the exercise of your rights. This is a security measure to safeguard personal data. We will notify you when your request is completed, if we deny your request to exercise your rights (because, for example, an exception applies), or if there is a fee associated with processing your request.

You may designate an authorized agent to exercise your rights on your behalf. In such case, we will also need to verify your agent’s identity and obtain proof of your authorization. We may need to deny a request from an agent whose identity or authorization we cannot verify.

If you believe that Ironwood has processed information in a manner that is unlawful or breaches your rights, or has infringed applicable laws, you may have the right to complain directly to your local data protection authority. Without limiting any rights to complain directly to an authority, we are committed to protecting personal data, and complaints may be made directly to us.

We will not discriminate against you for exercising any data subject right you have under applicable law.

Data Security

Ironwood stores personal data and other information we collect about you using reasonable physical, technical, and administrative safeguards to secure data against foreseeable risks, such as unauthorized use, access, disclosure, destruction, or modification. Please note, however, that while Ironwood has endeavored to create secure and reliable websites for our users, no system is completely secure or error-free. We do not, and cannot, guarantee the complete security of your personal data.

You should take special care in deciding what information you transmit, upload, send, or otherwise submit to Ironwood.

In case of a security incident that involves a data breach, as required by applicable laws, we will inform you in a timely manner and report the incident to the relevant regulatory authorities.

We retain your information for as long as it is necessary for the purposes set out in this Privacy Policy, unless required by our legal obligations to retain it for a longer period.

Children’s Privacy

The privacy of children is especially important to us. We take seriously our obligations under applicable laws concerning the collection of personal data from children. Our Services are not directed at children under the age of 18, and we do not knowingly allow children to communicate with us or use any of our websites or Services. We request that children not provide any personal data through our websites or in connection with the Services. If you are a parent and become aware that your child has provided us with personal data, please contact us at: [email protected].

California Residents

If you are a California resident (“Consumer”) and interact with Ironwood, the information about our collection, uses, and disclosures of your personal data and other information we collect about you can be found in the relevant sections of this Privacy Notice. Specifically:

In the preceding 12 months, we may have collected, and we may have shared the following categories of personal data about you: Contact Data, Relationship Data, Transaction Data, Geolocation Data, and Job Applicant Data. Further information describing these categories of Personal Data is provided above in the Information We Collect About You section of this Privacy Notice;
The sources of the personal data and other information we collect about you is provided above in the How We Collect Information About You section of this Privacy Notice; and
Further information on how we use or share your personal data and other information we collect about you is described above in the How We Use Your Information and How We Share Your Information sections of this Privacy Notice.

We do not sell any personal data or other information collected from California Consumers.

If you choose to exercise any of your rights as outlined above in the Your Choices Your Rights section of this Privacy Notice, we will not discriminate against you for exercising your data subject rights. For example, we will not deny goods or services to you, or charge you different prices or rates, or provide a different level of quality for products or services as a result of you exercising your data subject rights.

For Residents of the European Economic Area (EEA), European Union, (EU), United Kingdom (UK) and Switzerland

Ironwood Pharmaceuticals, Inc. (including its subsidiaries) is the data controller of the personal data we collect from you for the purposes of the EU General Data Protection Regulation (EU) 2016/679, the UK Data Protection Act 2018, and the Swiss Federal Data Protection Act 1992 (collectively for the purposes of this Privacy Notice, the “European Data Protection Laws”).

The European Data Protection Laws require that we inform you of the legal bases upon which we rely on to process your personal data. The legal bases for which Ironwood processes personal data are set forth below:

Ironwood’s legitimate business interests. For example, to maintain system security, communicate with you and fulfill your requests, process job applications, and assess a job applicant’s eligibility, conduct clinical trials, conduct surveys, improve our products and services, and protect our rights and the rights of others.
Performance of a contract with you. For example, when you submit an application, enroll in a program, or register for a program or service.
Compliance with laws. For example, to comply with legal and regulatory requirements or respond to a court order or legal request.
Consent. Where we rely on your consent to process your personal data.

The servers where your personal data are stored may be located in the United States or other countries that have not been deemed by the European Commission to provide an adequate level of protection for personal data. In addition, we may share personal data with our affiliates and external service providers and third parties located outside of the EEA, EU, UK, or Switzerland. When we transfer personal data out of the EEA, EU, UK, or Switzerland to other countries that have not been deemed adequate, we will implement one or more of the approved mechanisms deemed to provide appropriate safeguards by the regulators which may include the use of Standard Contractual Clauses, transfers to organizations that protect personal data under binding corporate rules, or transfers to organizations that operate under an approved code of conduct or certification mechanism.

Our Data Protection Representative for the EEA and UK

We have appointed a Data Protection Representative (DPR) for the EEA and UK. Our DPR is DPO Consultancy. If you have any questions about our Privacy Notice, if you wish to exercise your rights, or if you wish to lodge a complaint, you may either contact Ironwood directly at: [email protected] or contact our DPR at: [email protected] or by sending mail to the following addresses:

DPO Consultancy (EEA)
Australiëlaan 12A
5232 BB ‘s-Hertogenbosch
The Netherlands

DPO Consultancy (UK)
19 The Square
RETFORD Nottinghamshire DN22 6DQ
England

Changes to this Privacy Notice

We may update this Privacy Notice from time to time. At a minimum, we will post an updated version here. Ironwood encourages you to review this Privacy Notice regularly. Any changes will be effective immediately upon posting of the revised Privacy Notice, and your continued use of our websites or our Services will be subject to the then-current Privacy Notice.

Contact Us

If you have any questions about this Privacy Notice or about our handling of your personal data or other information we collect about you, please contact us at: [email protected].

You may also contact us by mail at the address below. If you choose to contact us by mail, please be sure to provide us with your name, address, email address, and/or phone number you would like us to respond to.

Ironwood Pharmaceuticals

Attn: Privacy Officer
100 Summer Street
23rd Floor
Boston, MA 02110