Privacy Policy

Priovant Therapeutics and its affiliates ("Priovant", "we", "us", or "our") recognize the importance of protecting your privacy. This Privacy Policy ("Policy") explains how Priovant, as a "Data Controller," collects, uses and discloses information in connection with your use of our website at priovant.com, and our brand-specific websites at lisraya.com and lisrayahcp.com (collectively, the "Sites"). This Policy does not apply to our collection, use, or disclosure of data collected through other means.

When you use our Sites, you consent to our Terms of Use and collection, use, and disclosure of information about you as described in this Policy. Before you use or submit any information through the Sites, please carefully review this Privacy Policy and our Terms of Use. IF YOU DO NOT AGREE TO THIS POLICY OR OUR TERMS, PLEASE DO NOT USE THE SITES. We will continue to evaluate this Policy as we update and expand the Sites and our offerings, and we may make changes to this Policy accordingly. Any changes will be posted here and you should check this page periodically for updates. If we make material changes to this Policy, we will provide you with notice as required by law.

Please note, you may also be subject to another privacy policy or other terms and conditions specific to a particular Priovant program or service ("Other Agreement"). Based upon your specific relationship(s) with Priovant, we may collect, use or disclose your information in ways described in more detail in one or more Other Agreements. To the extent the Other Agreement includes additional terms that are not covered by or are inconsistent with this Policy, the terms and conditions of the Other Agreement will supersede this Policy.

Within this Policy you will find covered matters related to the following:

• Information We Collect
• Cookies and Other Tracking Mechanisms
• How We Use Your Information
• Disclosure of Your Information
• Online Analytics
• How Long We Store Your Information
• Legal Basis for Processing Your Information
• Links to Third Party Sites
• Security
• Children's Privacy
• Do Not Track
• Your Rights
• Contact Information

Information We Collect

We collect and store information about you in multiple ways, including when you provide information directly to us and when we passively collect information from you, such as from your browser or device.

Information You Provide Directly to Us
We collect and store all information that you provide to us when using the Sites. You might provide information to us in a variety of ways such as (but not limited to) when you submit any of the following on our Sites: information requests, business proposals, employment inquiries, and responses to surveys.

The information you provide may include, but is not limited to: full name, home address, phone number, e-mail address, professional information (such as specialty, practice affiliation, or license or provider identifiers), marketing and communication preferences, and information submitted through enrollment or consent forms, which may include health-related information, and your answers to background information questions.

Information Collected Automatically
When you visit any page on the Sites, we use a program that monitors and evaluates the Sites' traffic. It automatically records every visitor's host, domain name, pages visited, length of user session, browser type and/or IP address.

When you visit and interact with the Sites, Priovant and third parties with whom Priovant has contracted to provide services to Priovant, may collect information via cookies, pixels, web beacons, or other tracking mechanisms (for example, a catalog of the site pages you visit, or your IP address), described in more detail, below.

Cookies and Other Tracking Mechanisms

We may also collect data about your use of the Sites through the use of Internet server logs, cookies, and/or other tracking technologies. A web server log is a file where Site activity is stored. A cookie is a small text file that is placed on your computer when you visit a Site that enables us to: (a) recognize your computer; (b) store your preferences and settings; (c) understand the web pages of the Site you have visited; (d) perform searches and analytics; and (e) assist with security administrative functions.

As we adopt additional technologies, we may also gather additional information through other methods.

Please note that you can change your settings to notify you when a cookie is being set or updated, or to block cookies altogether. Please consult the "Help" section of your browser for more information (e.g., Internet Explorer, Microsoft Edge, Google Chrome, Mozilla Firefox, or Apple Safari).

How initiative We Use Your Information

We may use the Information we collect from and about you for the following purposes:

• complete any transactions you request online;
• provide, improve, and troubleshoot the Sites;
• improve our products and services, and identify, develop, and offer new or expanded products and services;
• notify you about updates, products, and services from Priovant, its affiliates, and selected third parties; and/or
• generate aggregate statistical studies and conduct research related to our products and services and the use of the Sites.

We may combine information that we collect from you and about you (including automatically collected information) with information we obtain about you from our affiliates and/or non-affiliated third parties, and use such combined information in accordance with this Policy.

We may aggregate and/or de-identify information collected through the Sites. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and/or others.

Please note that, based upon your specific relationship(s) with Priovant, we may use your information in ways described in more detail in one or more Other Agreements.

Disclosure of Your Information

We may disclose your information to certain third parties with whom we have a direct or indirect business or contract relationship, under the following circumstances:

To our affiliates:
We may disclose your information to other companies within the Priovant family of companies.

To our partners:
We may disclose your information to our partners, including other companies and academic institutions.

To service providers:
We disclose your information with third parties who perform services on our behalf, including without limitation market research, data storage, data analysis and processing, and legal services, and support our commercial operations. When you request other services, we will provide your information to third parties with whom we arrange for those services to be provided.

To protect ourselves or others:
We may also disclose information collected on the Sites, in accordance with applicable law, to assert or defend our rights and property, to prevent harm to others, to collect a debt, or in response to legal processes such as subpoenas.

To comply with the law:
We may also provide (or reserve the right to provide) information to regulators, law enforcement authorities, courts, and other governmental authorities, consistent with applicable laws.

For organizational transfers:
As we continue to develop our organization, we may acquire, merge or partner with other organizations. In such transactions, (including in contemplation of such transactions, e.g., due diligence) user information may be among the transferred assets. If any of Priovant's assets are sold or transferred to a third party, customer information (such as your email address) would likely be one of the transferred business assets.

Please note, based upon your specific relationship(s) with Priovant, we may disclose your information in ways described in more detail in one or more Other Agreements.

For transfers outside of the EU or UK:
Transfers of your information outside of the EU or UK will only be made in compliance with GDPR or UK GDPR, respectively.

Online Analytics

We may use third-party web analytics services (such as those of Google Analytics) on our Services to collect and analyze the information discussed above, and to engage in auditing, research or reporting. The information (including your IP address) collected by various analytics technologies described in the "Cookies" section will be disclosed to or collected directly by these service providers, who use the information to evaluate your use of the Services, including by noting the third-party website from which you arrive, analyzing usage trends, assisting with fraud prevention, and providing certain features to you. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on.

If you receive email from us, we may use certain analytics tools, such as clear GIFs, to capture data such as when you open our message or click on any links or banners our email contains. This data allows us to gauge the effectiveness of our communications and marketing campaigns.

How Long We Store Your Information

We will only retain your information for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

Legal Basis for Processing Your Information

The legal basis for processing your information includes your consent, our legitimate business interests, our legal or contractual obligations, and our obligation to communicate any relevant concerns about which you have contacted us.

Links to Third Party Sites

On our Sites, we may link to third party websites, such as our partner companies, academic institutions, or employment listings. For example, to view a job description or apply to an open position, you may be rerouted to a third-party website. Please note, Priovant does not control the privacy policies or practices of these third-party sites. You should review those policies before providing any information.

Security

Priovant has established safeguards to help protect prevent unauthorized access to or misuse of your information, but cannot guarantee that your information will never be disclosed in a manner inconsistent with this Policy (for example, as a result of unauthorized acts by third parties that violate applicable law or relevant Web policies).

Children's Privacy

The Sites are not directed at children and we do not knowingly collect personal information (as defined by the Children's Online Privacy Protection Act) from children under the age of 13. If we become aware that we have collected personal information from children under the age of 13, we will take reasonable steps to delete it as soon as practicable. If a child provides us with this type of information online, please contact us to have the account deactivated by sending us an e-mail at legal@priovant.com.

Do Not Track

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Although our Sites currently do not recognize or respond to the various web browser Do Not Track signals, we do offer you choices to manage your preferences as described in the "Your Choices" section, above.

Your Rights

We will provide you with the ability to exercise the following rights under the conditions and within the limits set forth in the law:

• The right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal.
• The right to opt out of receiving promotional communications from Priovant (remember, however, that even if you opt out of promotional communications, Priovant may still e-mail you in order to provide a product or service that you request).
• The right to be informed about what information we have about you and how we process your information.
• The right to access your information as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating.
• The right to request the deletion of your information.
• The right to object, in whole or in part, to the processing of your information. With certain exceptions, this includes the right to object to your information being used for research.
• The right to request data portability, i.e., that the information you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.

Contact Information

If you have any questions or concerns about this Privacy Policy or our privacy or security practices, or if you wish to exercise your data privacy rights, you may contact our Data Protection Officer or Representative by e-mail at legal@priovant.com or write to us in care of: Priovant Therapeutics, Inc., 1007 Slater Road, Suite 250, Durham, NC 27703. To protect your privacy and security, we will also take reasonable steps to verify your identity before granting access or making corrections.

This Privacy Policy is effective as of: August 28, 2026.
© 2026 Priovant Therapeutics, Inc.

U.S. State Privacy Supplemental Notice

Last Updated: August 28, 2026

This Supplemental Notice applies to U.S. residents and supplements Priovant’s general Privacy Policy. This Supplemental Notice, together with the general Privacy Policy, also applies to Priovant’s brand-specific websites at lisraya.com and lisrayahcp.com (together with priovant.com, the “Sites”). It addresses the privacy rights available to residents of California, Washington, and the additional states identified in Part C below. Where this Supplemental Notice conflicts with the general Privacy Policy with respect to a covered state’s residents, this Supplemental Notice controls.

PART A — California Consumer Privacy Notice (CCPA/CPRA)

This Part applies to California residents pursuant to Cal. Civ. Code § 1798.100 et seq.

A.1 Personal Information We Collect

In the preceding twelve (12) months, Priovant has collected the following categories of personal information from California consumers who interact with our Sites:

Sources
We collect personal information directly from you via forms, contact submissions, automatically through cookies and tracking technologies, from third-party vendors engaged in support of our commercial operations, and from service providers acting on our behalf.

Retention

A.2 Purposes for Collection
We collect and use personal information to: respond to inquiries and operate, improve, and secure our Sites; conduct analytics; send communications where you have consented; comply with legal obligations; and facilitate business transactions.

A.3 Disclosure of Personal Information
In the preceding twelve (12) months, Priovant has disclosed personal information to the following categories of third parties for business purposes:

Priovant does not sell your personal information for monetary consideration. Our use of third-party analytics tools (such as Google Analytics) may constitute “sharing” for cross-context behavioral advertising under the CPRA. You have the right to opt out. See Section A.4.

Priovant collects sensitive personal information (health/medical data) solely for the purposes described in Section A.2 and does not use or disclose it for other purposes beyond those permitted under CPRA Regulations § 7027(m).

A.4 Your California Privacy Rights
California residents have the following rights under CCPA/CPRA:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties to whom we have disclosed it.
• Right to Delete: Request deletion of personal information we have collected, subject to exceptions permitted by law. Use the Data Removal Form or contact us below.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: Opt out of the sale or sharing of your personal information for cross-context behavioral advertising. Use the Privacy Choices Form or contact us below. Priovant honors the Global Privacy Control (GPC) signal.
• Right to Limit Use of Sensitive Personal Information: Direct us to limit use and disclosure of your sensitive personal information to purposes necessary to provide the services you requested. Use the link above or contact us below.
• Right to Data Portability: Receive a copy of your personal information in a portable, readily usable format, to the extent technically feasible.
• Right of Non-Discrimination: Priovant will not discriminate against you for exercising any of these rights.

California residents may also request a copy of this notice in an alternative format by contacting us at legal@priovant.com.

A.5 Cookies and Opt-Out Signals
We use cookies and similar tracking technologies, including Google Analytics. Some activity may constitute “sharing” under CPRA. You may manage preferences through your browser settings. Priovant honors the Global Privacy Control (GPC) signal as an opt-out of sale or sharing.

PART B — Washington Consumer Health Data Privacy Notice (WMHDA)

This Part applies to Washington State residents pursuant to RCW § 19.373 et seq. (“WMHDA”) and covers “consumer health data” as defined under Washington law. To the extent this Part conflicts with the general Privacy Policy with respect to consumer health data, this Part controls.

B.1 Consumer Health Data We Collect
Priovant collects consumer health data only when you choose to provide it. This may happen through a general contact, inquiry form (which may include disease or condition information if you choose to share it), or through the patient and provider enrollment forms.

B.2 How We Use and Share Consumer Health Data
We collect and use personal information to respond to inquiries and operate, improve, and secure our Sites; conduct analytics; send communications where you have consented; comply with legal obligations; and facilitate business transactions.

B.3 Your Rights Under the WMHDA
Washington residents have the right to: confirm whether we collect, share, or sell your consumer health data; access the specific data we hold about you; withdraw consent to processing; request deletion of your consumer health data; and receive a list of specific third parties to whom we have disclosed your data. Priovant will not discriminate against you for exercising any of these rights.

Priovant does not use geofencing technology around medical facilities. Our Sites are not directed to children under 13, and we do not knowingly collect consumer health data from children under 13.

PART C — Multi-State Privacy Rights Addendum

This Part applies to residents of Texas, Oregon, Montana, New Hampshire, Nebraska, Delaware, Minnesota, and Maryland and supplements Priovant’s general Privacy Policy and, where applicable, Parts A and B of this Supplemental Notice.

C.1 Sensitive Personal Data
All covered states listed above require opt-in consent before processing sensitive personal data. Where Priovant collects sensitive personal data from residents of covered states, we will obtain separate affirmative consent prior to processing.

C.2 Rights Available to Residents of All Covered States
Residents of all eight covered states have the following rights, subject to exceptions permitted by applicable law:

• Right to Know / Access: Confirm whether we process personal data about you and access that data.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Delete: Request deletion of personal data you have provided or that we have collected about you.
• Right to Data Portability: Obtain a portable copy of personal data you have provided to us, to the extent technically feasible.
• Right to Opt Out of Sale and Targeted Advertising: Priovant does not sell personal data for monetary consideration. Our use of certain analytics tools may constitute “sale” or “targeted advertising” processing under applicable state law definitions. Opt out by contacting us or using the Privacy Choices Form link.
• Right to Opt Out of Profiling: Opt out of profiling that produces legal or similarly significant effects. Priovant does not engage in such profiling.
• Right of Non-Discrimination: We will not deny services, charge different prices, or provide a different quality of service for exercising these rights.
• Right to Appeal: If we decline to act on your request, you may appeal in writing to legal@priovant.com within 30 days of our response. We will respond within 45 days. If your appeal is denied, you may contact the Attorney General of your state of residence.

GENERAL PROVISIONS

How to Submit a Privacy Rights Request
Residents of any covered state may submit a request by:

• Entity: Priovant Therapeutics, Inc.
• Email: legal@priovant.com
• Toll-Free Number: 1-800-511-9141
• Mail: Priovant Therapeutics, Inc., Attn: Privacy, 1007 Slater Road, Suite 250, Durham, NC 27703
• Opt-Out: Privacy Choices Form
• Data Removal: Data Removal Form

We will verify your identity before processing your request and will not require you to create an account. You may designate an authorized agent or representative; we may require written documentation of that authorization. We will respond within 45 days (or 10 business days to acknowledge, for California residents). If we require additional time, we will notify you within the initial period.

Updates to This Supplemental Notice
We will update this Supplemental Notice as additional state privacy laws come into effect or existing laws are amended, and will update the “Last Updated” date when material changes are made.

This Supplemental Notice is effective as of August 28, 2026 and was last updated on August 28, 2026.