Privacy Policy

Medicenna Therapeutics Corp.

PRIVACY POLICY

(Last updated as of December 20, 2021)

Medicenna Therapeutics Corp. (“Medicenna”, “we” or “us”) is committed to maintaining the accuracy, security and privacy of personal information in accordance with applicable privacy legislation. This privacy policy (the “Privacy Policy”) is a statement of principles and guidelines concerning the protection of personal information of individuals from whom we collect, use, and retain personal information, including our employees and the visitors to our website at https://www.medicenna.com/ (“you”).

By using the website, you confirm that you have read, understood and agreed to this Privacy Policy and agree that Medicenna reserves the right to modify or supplement this Privacy Policy at any time. Any future changes will not affect information that was collected under a previous version of this Privacy Policy. If any changes are made to this Privacy Policy, a copy of the Privacy Policy as amended will be posted on our Website as soon as practicable following that update.

1. Who are we and what do we do?

Medicenna is a clinical stage immunotherapy company that engineers novel, powerful and proprietary interleukins. We are able to modulate, fine-tune or amplify the immune system to tackle the most challenging diseases, including a broad range of cancers with tremendous unmet need.

Should you have any question about this statement, want to be informed of the existence, use, and disclosure of your personal information, or have us modify such information in our records, please contact us at:

2. What personal information do we collect?

Medicenna only collects your personal information when you voluntarily provide it to us directly or through our website. “Personal Information” means any information about an identifiable individual, including information which relates to a natural person that directly or indirectly allows that person to be identified (such as name, address, telephone number, and e-mail address). Personal information does not include aggregated or anonymized information that cannot reasonably be expected to identify an individual. “Personal Health Information” means identifying information about an individual that relates to the physical or mental health of the individual.

Medicenna does not receive any Personal Information or Personal Health Information from clinical trials because Medicenna requires that all such information be de-identified, anonymized or aggregated prior to it being provided to Medicenna for analysis.

Nor does Medicenna collect any “sensitive personal information” or Special Categories of Personal Information (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric information) about you.

From time to time, we may collect, use, store and transfer different kinds of Personal Information about you which we have grouped together as follows:

• “Identity Personal Information” includes your first and last name.
• “Contact Personal Information” includes address, email address and telephone numbers.
• “Employment Personal Information” includes employment history, education and tax information.
• “Technical Personal Information” includes internet protocol (IP) address, your login Personal Information, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website. We collect this personal information by using cookies, pixels, server logs and other similar technologies. We may also receive technical personal information about you if you visit other websites employing our cookies.
• “Marketing and Communications Personal Information” includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• “Aggregated Personal Information” includes statistical or demographic information for any purpose. We collect, use, and share Aggregated Personal Information which could be derived from your Personal Information but is not considered Personal Information in law as this information will not directly or indirectly reveal your identity.

3. Why is Personal Information collected?

Medicenna will only use your Personal Information when the law allows us to do so. Most commonly, we will use your Personal Information in the following circumstances:

• Where you consent to such collection and use, such as by consenting to this Privacy Policy
• Where needed to perform the service you are requesting.
• Where we need to comply with a legal obligation.

Note that we may process your personal information for more than one lawful basis depending on the specific purpose for which we are using your personal information. Please contact us if you need details about the specific legal ground we are relying on to process your personal information where more than one ground has been set out in the table below.

We have set out below, in a table format, a description of all the ways we plan to use your personal information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. 

You may withdraw your consent at any time by contacting us at ir@medicenna.com

Table: Purposes for which we will use your Personal Information

Purpose/Activity	Type of Personal Information	Lawful basis for processing including basis of legitimate interest	Who do we share your Personal Information with for these purposes
To respond to your requests, and to communicate information with you at your request.	(a) Identity (b) Contact (c) Communication	Necessary for our legitimate interests (for responding to your requests, communication with you, transmitting you information requested by you).	We do not share your Personal Information for this purpose.
To improve the performance of level of service and the content of our website.	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical	(a) Where your personal information is completely anonymised, we do not require a legal basis to use it as the information will no longer constitute personal information that is regulated under privacy protection laws. (b) Necessary for our legitimate interests (to ensure that we provide the very best Services to you and our Clients) where your personal information is not in an anonymous form.	We share your personal information with a variety of third party analytics and digital marketing service providers to assist us with these activities such as Google Analytics, SproutSocial, Google Adwords, MailChimp, and Facebook.
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). (b) Necessary to comply with a legal obligation.	We do not share your personal information for this purpose.

(a) Marketing

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. 

We may use your Identity, Contact, Technical, Marketing and Communications, Aggregate and Profile personal information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which Services may be relevant for you.

Where Canada’s Antispam Legislation (CASL) applies to our communications with you, Medicenna is committed to complying with CASL and, in particular, the provisions setting out the requirements for sending commercial electronic messages.

You will receive marketing communications from us if you have requested information from us.

We will get your express opt-in consent before we share your personal information with any third party for marketing purposes.

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, we may continue to use your personal information in order to provide you with the services you have requested from us.

Where our use of your personal information requires your consent, you can provide such consent:

• at the time we collect your personal information following the instructions provided; or
• by informing us by e-mail, post or phone using the contact details set out in this Privacy Policy; or
• by registration through our website

(b) Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

(c) Change of Purpose

We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 

4. How is your Personal Information collected?

We use different methods to collect Personal Information from and about you including through:

(a) Direct Interactions

You may give us your identity, and contact information by filling in contact forms or by corresponding with us by post, phone, email or otherwise.

(b) Automated technologies or interactions

As you interact with our website, we will automatically collect technical Personal Information about your equipment, browsing actions and patterns. We collect this Personal Information by using cookies, pixels, server logs and other similar technologies. We may also receive technical Personal Information about you if you visit other websites employing our cookies.

5. To whom do we disclose your Personal Information? 

We may disclose your Personal Information to the following third parties in the following circumstances:

(a) Disclosure to Service Providers

We may disclose your Personal Information to other companies that provide services on our behalf, including cloud service providers that host or process your Personal Information on our behalf. We will only provide those companies the information they need to perform their duties and deliver the service. Service Providers are prohibited from using that information for any other purpose.

Medicenna uses third-party vendor remarketing tracking cookies including the Google Ads, Facebook remarketing cookie, Twitter pixel, and Linkedln pixel. This means we will continue to show ads to you across the Internet, specifically on the Google Content Network (GCN), Facebook, Twitter, and LinkedIn. As always, we respect your privacy and are not collecting any identifiable information through the use of Google’s or any other third-party remarketing system. The third-party vendors, including Google, whose services we use, will place cookies on web browsers in order to serve ads based on past visits to our website. This allows us to market our services to those who have shown interest in our service. You may opt out of the automated collection of information by third-party ad networks for the purpose of delivering advertisements tailored to your interests, by visiting the consumer opt-out page for the Self-Regulatory Principles for Online Behavioural Advertising at http://www.aboutads.info/choices/ and edit or opt-out your Google Display Network ads preferences at http://www.google.com/ads/preferences/.

(b) Social Media Pixels

Medicenna has social media channels that utilize first and third-party vendor remarketing tracking cookies, including the Google Ads tracking cookie, Facebook, and LinkedIn remarketing cookies. This means we will show ads to you across the Internet, specifically on the Google Content Network (GCN), Facebook, and Linkedln. This data may also be shared with trusted third party vendors that utilize this data to create promotion campaigns for other related companies. As always, we respect your privacy and are not collecting any identifiable information through the use of Google’s or any other third party remarketing system. The first and third-party vendors, including Google, whose services we use —will place cookies on web browsers in order to serve ads based on past visits to our website. This allows us to make major announcements and continue to market our company to those who have shown interest. You may opt out of the automated collection of information by third-party ad networks for the purpose of delivering advertisements tailored to your interests, by visiting the consumer opt-out page for the Self-Regulatory Principles for Online Behavioural Advertising at http://www.aboutads.info/choices/ and edit or opt-out your Google Display Network ads’ preferences at  http://www.google.com/ads/preferences/.

(c) Disclosure to Affiliates

We may disclose your Personal Information to any of the companies and business entities that form part of the Medicenna group (i.e. Medicenna Therapeutics Inc. (British Columbia), Medicenna Biopharma Inc. (Delaware), Medicenna Australia Pty. and Medicenna Biopharma Inc. (British Columbia)) in order to serve you better and to provide you with information about our affiliates’ products and services.

(d) Disclosure in Business Transfers

Medicenna may be involved in the sale or transfer of some or all of its business. As part of that sale or transfer, Medicenna may disclose your Personal Information to the acquiring organization, but will require the acquiring organization to agree to protect the privacy of your Personal Information in a manner that is consistent with this Privacy Policy.

(e) Law Enforcement and Legal Disclosure

Medicenna may disclose your Personal Information to a government institution that has asserted its lawful authority to obtain the information or where Medicenna has reasonable grounds to believe the information could be useful in the investigation of unlawful activity, or to comply with a subpoena or warrant or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with court rules regarding the production of records and information, or to Medicenna’s legal counsel.

If you would prefer for us NOT to share your information as described above in sections 5(b) or 5(c), simply inform us (see “Contacting Us” below).

6. What Non-Personally Identifiable Information Do We Collect?

Medicenna also collects anonymized information and non-personally identifiable information in aggregate form to track data, such as the total number of visits to our website, the number of visitors to each page of our website, and the domain names of our visitors’ internet service providers.

7. Why is Non-Personally Identifiable Information Collected?

We use this information, which remains in aggregate, non-personally identifiable form, to understand how our visitors use our website so that we may improve our website and the services we offer.

8. International Transfers

Your Personal Information is stored in secured locations and on servers controlled by Medicenna or its service providers, located either at our offices or at the offices of our service providers in Canada.

Our service providers may be located outside of your jurisdiction and may be required to disclose your personal information under the laws of their jurisdiction, including the United States. As the case may be, we have taken all reasonable steps to ensure that your information will not be used for purposes not relevant to the object of your file or communicated to third parties without your consent except when authorized by the law. You may contact us for information about our policies and practices regarding service providers to whom we have transferred your personal information and their locations.

9. Your Legal Rights

Subject to certain exemptions, you have the following rights in relation to the personal information we collect about you:

(a) Your right of access

Upon your written request, subject to certain exceptions, Medicenna will inform you of the existence, use, and disclosure of your personal information and will provide you with a copy of that personal information within the timescales provided for by law. You have a right to access and rectify the information held about you. Access requests should be sent to us using the contact information below.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than one month if your request is particularly complex or you have made a number of requests. In these cases, we will notify you and keep you updated. If you require additional copies, we may need to charge a reasonable fee.

(b) Your right to rectification

If the personal information we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If you are entitled to rectification and if we’ve shared your personal information with others, we will let them know about the rectification where possible and where this would not involve disproportionate effort. If you ask us, where possible and lawful to do so, we will also tell you who we have shared your personal information with so that you can contact them directly.

(c) Your right to erasure

You can ask us to delete or remove your personal information in some circumstances such as where we no longer need your information to fulfill the purposes for which it was collected, or if you withdraw your consent (where applicable because your consent was the legal basis on which we were processing your personal information). If you are entitled to erasure and if we have shared your personal information with others, we will take reasonable steps to inform those others where possible and where this would not involve disproportionate effort. If you ask us, where it is possible and lawful for us to do so, we will also inform you about who we have shared your personal information with so that you may contact them directly.

(d) Your right to restrict processing

You can ask us to “block” or suppress the processing of your personal information in certain circumstances such as where you contest the accuracy of that personal information or you object to us. If you are entitled to such restriction and if we have shared your personal information with others, we will let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal information with so that you can contact them directly.

(e) Your right to personal information portability

You have the right, in certain circumstances, to obtain personal information you have provided us with (in a structured, commonly used, and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

(f) Your right to object

You can ask us to stop processing your personal information, and we will do so, if we are either: (a) relying on our own or someone else’s legitimate interests to process your personal information, except if we can demonstrate compelling legal grounds for the processing; or (b) processing your personal information for direct marketing.

(g) Your rights in relation to automated decision-making and profiling

You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or affects you in a significant way, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

(h) Your right to withdraw consent

If we rely on your implicit or explicit consent as our legal basis for processing your personal information, you have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

(i) Your right to lodge a complaint with the supervisory authority

If you have a concern about any aspect of Medicenna’s privacy practices, including the way we have handled your personal information, you can report it to the relevant supervisory authority.

10. Protection of Your Personal Information

To help protect the confidentiality of your personal information, Medicenna employs administrative and technological safeguards appropriate to the sensitivity of your personal information. Where personal information is sent to a third party for processing, we obtain a commitment from such third party, that all customer information is subject to adequate security safeguards and will not be used for any purpose other than to provide services on our behalf. We operate secure data networks protected by password protection systems.

11. How Long Will We Retain Your Personal Information?  

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

In some circumstances we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

12. Contacting Us

For the benefit of EU data subjects, Medicenna is the “data controller” and is responsible for your personal information.

We have appointed a data protection officer who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact our privacy manager using the details set out above.

You have the right to make a complaint at any time to the relevant supervisory authority for personal information protection issues. In Canada, you can contact the Office of the Privacy Commissioner of Canada (“OPC”), see https://www.priv.gc.ca/en/contact-the-opc/, or the relevant provincial privacy commissioner for your province of residence. EU data subjects can contact their relevant data protection supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority so please contact us in the first instance.

13. Links to Other Websites

This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share personal information about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the Privacy Policy of every website you visit.