Privacy Policy

Last Updated: August 31, 2023

Pliant Therapeutics, Inc. (“Pliant“, “we“, “us“, “our“) respects your right to privacy. This Privacy Notice explains who we are, how we collect, share and use personal information (i.e., information that directly or indirectly identifies you) in the context of our BEACON-IPF website (beacon-ipf.com) and general conduct of our business as it relates to Beacon-IPF, and how you can exercise your privacy rights. It does not cover our processing activities: (i) should you enroll or otherwise participate in a Pliant-sponsored clinical trial; (ii) when you apply for a job with Pliant; or (iii) in the course of your employment with Pliant, whether as an employee or independent contractor.

If you have any questions or concerns about our use of your personal information, then please contact us using the details provided in the ‘How to contact us’ section at the bottom of this Privacy Notice.

What does Pliant do and what is BEACON-IPF?

Pliant is a clinical stage biopharmaceutical company, headquartered at 260 Littlefield Avenue, South San Francisco, CA 94080, United States of America. We focus on discovering, developing and commercializing breakthrough treatments for fibrotic diseases. One such treatment is being investigated in our BEACON-IPF Phase 2b clinical study (the “Study”). For more information about Beacon-IPF, please see the “ABOUT BEACON-IPF” section of our website.

What personal information does Pliant collect and use and why?

Information that we collect directly from you

Study-Related Communications. The website provides an email address which you can use should you require more information on participating in the Study. In doing so you may provide us with contact information, such as your name, company name, phone number, and email address. Pliant will use such information to contact and engage with you about the Study. It is in Pliant’s legitimate interests to process your personal information for these purposes i.e., to respond to your Study-related communications.

Information that we collect automatically

When you visit our website, we may also collect certain information automatically from your device. This information includes your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g., country or city-level location) and other technical information. We may also collect information about how your device has interacted with our website, including the pages accessed and links clicked.

Collecting this information enables us to better understand the visitors who come to our website, where they come from, and what content on our website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our website to our visitors. As required, we will obtain your consent for this processing or otherwise rely on the fact that such processing is necessary for our legitimate interests i.e., to ensure you have a seamless experience when using the website.

Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies and similar technologies” section below.

Right to Object

Subject to applicable privacy laws, you have a right to object to the processing of your personal information where that processing is carried out for our legitimate interests (see above).

Who does Pliant share my personal information with?

We may disclose your personal information to the following categories of recipients:

• to our group companies, third parties, services providers and partners who provide services to us (e.g., website hosting, IT services, analytics services), or who otherwise process personal information for purposes that are described in this Privacy Notice;
• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person; and
• to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business. Personal information may also be disclosed in the event of insolvency, bankruptcy or receivership.

A cookie is a small piece of data (text file) that a website or app – when visited by a user – asks your browser to store on your device in order to remember information about you. We use the following third-party cookies on our website to track visitor usage from time to time:

On your first visit to our website and every six months thereafter, on the homepage you will see a cookie banner informing you why cookies are used, and asking you to consent to each non-essential cookie if you agree with us using them. You can change your cookie preferences through the cookie banner, where you have the option of opting-in or opting-out to the use of non-essential cookies on your device. However, you can also update your cookie preferences at all times by clicking on the Manage Cookie Preferences link which is included at the bottom of our website.

If you wish to opt-out from the use of Google Analytics, please also see here for further information – https://tools.google.com/dlpage/gaoptout

How does Pliant keep my personal information secure?

The security of your personal information is important to us, and we maintain reasonable, commercially acceptable security procedures and practices appropriate to the nature of the personal information we process, in order to protect it from unauthorized access, destruction, use, modification, or disclosure.

However, please be aware that no method of transmission over the Internet, or method of electronic storage is 100% secure and we are unable to guarantee the absolute security of the personal information we process about you.

International data transfers

Your personal information may be transferred to and maintained on computers or servers located outside of your state, province, or jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located outside United States and choose to provide personal information to us, please note that data will be entered into a web user interface whose servers are located in the United States, where it is processed.

Where your personal information is transferred to third parties, we take appropriate safeguards to require that your personal information will remain protected in accordance with applicable laws. This may include entry into Standard Contractual Clauses with third parties as required.

If you have questions about the cross-border transfer of your personal information or would like to request a copy of any Standard Contractual Clauses entered into by us, please contact us using the contact details provided under the “How to contact us” heading below.

Children’s privacy

Our website and Products are not intended for anyone under the age of 18 (“Children”).

We do not knowingly collect personal information from Children. If you are a parent or guardian and you learn that Children have provided us with personal information, please contact us. If we become aware that we have collected personal information from Children without verification of parental consent, we will take steps to delete such information.

Data retention

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to engage with you in relation to the Products or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store such information and isolate it from any further processing until deletion is possible.

To determine the appropriate retention period, the amount, nature and sensitivity of the personal information are considered, together with the necessity and purposes for the processing (including, whether such purposes can be achieved through other means) and the potential risk of harm from unauthorized use or disclosure of the personal information. In exceptional cases (e.g., in pending litigation matters or where the law requires us to) your personal information may need to be kept for longer periods of time.

Your data protection rights

Pliant acknowledges that, if you are located in certain geographic regions / countries, including the EEA, the United Kingdom and/or Switzerland you may have one or more of the following rights in respect of the personal information:

• The right of access;
• The right of deletion;
• The right to correct or update;
• The right to object to processing or request restriction of processing;
• The right to data portability i.e. having your personal information transferred to a third party; and
• If we have collected and process your personal information in reliance on your consent, you have the right to withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

If you wish to exercise any of the above rights, please contact us at privacy@pliantrx.com. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

You also have the right to complain to a data protection authority.

Third party websites

Our website may contain links to websites and services that are owned or operated by third parties (each, a “Third-Party Service”) which may include features that collect your IP address, which page you are visiting on our website, and may set up a cookie to enable the links to function properly. Any information that you provide on such sites is provided directly to the Third-Party Service and we are not responsible for their respective content, privacy or security practices and policies. To protect your information, we recommend that you carefully review the privacy policies of all Third-Party Services that you access.

Updates to this Privacy Notice

We reserve the right to update or change our Privacy Notice at any time and so you should check this Privacy Notice periodically. If we make changes that materially affect our uses of personal information or your privacy rights, we will announce the changes by providing a notice through our website and/or, if deemed appropriate, by email.

The controller of your personal information is Pliant Therapeutics, Inc. If you have any questions or concerns about our use of your personal information, please contact our Data Protection Officer at dpo@mtdata-trust.info

If you want to exercise your rights in respect of your personal data, please contact our Data Protection Representative:

• DataRep at datarequest@datarep.com quoting in the subject line,
• contacting us on our online webform at www.datarep.com/data-request,
• mailing your inquiry to DataRep at the most convenient of the addresses in the subsequent pages.