Rhythm Pharmaceuticals, Inc. and its affiliates and subsidiaries (collectively, “Rhythm,” “we,” “our,” or “us”) has created this Consumer Health Data Privacy Policy (the “Consumer Health Privacy Policy”) as a supplement to our Privacy Policy. The Consumer Health Privacy Policy describes how we collect and process Consumer Health Data as defined in Nevada and Washington law and applies to Consumer Health Data collected from residents of Nevada and Washington.
“Consumer Health Data” is personal information that is linked or reasonably linkable to a consumer and identifies his or her past, present, or future physical or mental health status. It does not include publicly available information, public information used to engage in certain scientific, historical or statistical research de-identified data or data otherwise excluded by applicable laws.
We collect Consumer Health Data only:
- (i) with your affirmative, opt-in consent;
- (ii) when necessary to provide a product or service you request, as permitted by law
- (iii) to engage with you regarding communications you direct to us.
We refer to interactions that occur through Rhythm websites or platforms as the “Online Services” in this Consumer Health Data Privacy Policy.
SOURCES OF CONSUMER HEALTH DATA
Information You Provide. We and our service providers may collect Consumer Health Data that you provide when you use the Online Services or otherwise interact with us, including when you contact us with questions or requests for information, submit data to participate in a study or research initiative, use social media to interact with us, or to share something from our Online Services with others.
Information Automatically Collected. We may collect Consumer Health Data using automated data collection technologies as described in the “COOKIES AND SIMILAR TECHNOLOGIES” section in our Privacy Policy.
Information We Receive from Third Parties. We may collect Consumer Health Data from third parties, including healthcare professionals, patients, patient organizations, industry groups, service providers, and other third parties.
CATEGORIES OF CONSUMER HEALTH DATA COLLECTED
We may collect the following categories of Consumer Health Data:
- Individual health conditions, treatment, diseases, or diagnosis;
- Social, psychological, behavioral, and medical interventions;
- Health-related surgeries or procedures;
- Use or purchase of prescribed medication;
- Bodily functions, vital signs, symptoms, or measurements related to health;
- Diagnoses or diagnostic testing, treatment, or medication;
- Reproductive or sexual health information;
- Biometric data;
- Genetic data;
- Precise location information that could reasonably indicate a Consumer’s attempt to acquire or receive health services or supplies;
- Data that identifies a Consumer seeking health care services;
- Health-related data that have been derived or inferred from the above.
USE OF COLLECTED CONSUMER HEALTH DATA
We may use the information we collect for a number of purposes as described in this Policy and as permitted by applicable law, including to:
- Administer patient support programs;
- Provide you with products, services, or information you request;
- Provide you with information about our services or required notices;
- Respond to your inquiries;
- Deliver educational and promotional materials that may be of interest to you;
- Administer participation in special events, programs, surveys, and other market research;
- Customize your experience when using the Online Services;
- Improve our websites, patient support programs, and other products and services and/or develop new products or services;
- Perform quality control activities, conduct data analyses, and develop references for other users and/or health care providers to better understand symptoms or conditions;
- Modify and combine Consumer Health Data (including by removing or generalizing certain identifiers) and use the resulting information to analyze trends, improve our products, services, programs, communications, and business operations, and support the use of artificial intelligence and machine learning technologies;
- Use analytics, artificial intelligence, machine learning, and similar technologies to improve and optimize our websites, digital properties, patient support programs, products, services, communications, and internal business operations, including by identifying trends and patterns involving Consumer Health Data, where permitted by applicable law and with any required consent;
- Protect our, your, or others’ rights and property;
- Help maintain the security and integrity of our systems, including detection and prevention of security incidents;
- Protect someone’s health, safety, or welfare;
- Comply with a law or regulation, court order, or other legal process;
- Detect, prevent, and respond to fraud, intellectual property infringement, violations of our Terms of Use, violations of law, or other misuse of our services.
CATEGORIES OF CONSUMER HEALTH DATA WE SHARE
We may share the categories of Consumer Health Data that we collect.
ENTITIES TO WHOM WE DISCLOSE CONSUMER HEALTH DATA
We may disclose the Consumer Health Data described above to the following categories of third parties and affiliates:
Categories of Third Parties
- Partners with whom we have contractual data sharing agreements;
- Third parties to whom you or your agents authorize us to disclose your Consumer Health Data in connection with products or services we provide to you;
- Regulators, such as the FDA;
- Law enforcement and government agencies, where required or permitted by law or court order.
- Other entities in instances where you have consented to the disclosure.
Service Providers. We may share your Consumer Health Data with entities that provide services to us (such as vendors) in connection with our business operations. We require our service providers to keep the information confidential and not use the information outside of our business relationship.
Other Parts of Our Business and Our Business Partners. We may share your Consumer Health Data with other parts or departments at Rhythm or with our business partners for events or activities that we conduct jointly, such as a research study. In such cases, our business partners are limited to using your information for the purposes of the joint event or activity.
Mergers, Acquisitions and Bankruptcy. If Rhythm should ever file for bankruptcy or seek similar insolvency protections or merge with another company, or if Rhythm should decide to buy, sell, or reorganize some part or all of its business, Rhythm may disclose your Consumer Health Data to prospective or actual purchasers. It is Rhythm’s practice to seek appropriate protection for Consumer Health Data disclosed in these types of transactions.
As Required by Law and Other Legal-Related Disclosures. We may disclose your Consumer Health Data if we believe in good faith that disclosure is necessary: (a) to comply with the law, such as to report possible adverse events or to respond to legal process (e.g., court order, subpoena, search warrant) or other legal requirements of any governmental authority; (b) to protect the integrity of the Online Services; (c) to protect and defend our, your, or others’ rights, property, safety or interests; or (d) to detect, prevent, or respond to fraud, intellectual property infringement, violations of our Terms of Use, violations of law, or other misuse of the Online Services.
THIRD PARTY DATA COLLECTION
We do not allow third parties to collect your Consumer Health Data across our Online Services.
YOUR RIGHTS AND CHOICES
Nevada and Washington residents have certain rights regarding their Consumer Health Data, subject to certain legal limitations, including:
- Right to Confirm and Access. You have the right to confirm whether we collect, process or share your Consumer Health Data and to obtain information about how we process that data.
- Right to Delete. You have the right to request that we delete your Consumer Health Data. Upon a verified deletion request, we will delete your Consumer Health Data and notify applicable third parties to delete such data.
- Right to Withdraw Consent. If you provided consent for our collection or sharing of your Consumer Health Data, you have the right to withdraw that consent.
- Right to Change. You may have the right to ask that we change the Consumer Health Data that we collect.
You can contact us or exercise your rights by sending an email to [email protected].
CHANGES TO THIS CONSUMER HEALTH PRIVACY POLICY
Rhythm reserves the right to change this Consumer Health Privacy Policy at any time. If we update this Consumer Health Privacy Policy, we will notify you by posting a new Consumer Health Privacy Policy on this page. If we make any revisions that materially change the ways in which we use or share the information previously collected from or about you, we will make reasonable efforts to provide notice to you and obtain any necessary consent to any such new uses as may be required by law.
Effective Date: August 2026
