This Privacy Notice explains how Congruence Therapeutics Inc., including all of its subsidiary companies (collectively “Congruence”, “we”, or “us) collects, uses, shares, and protects personal information when you interact with us through our website or online resources (collectively, the “Services”). It also describes the rights you may have under applicable data protection laws and how you can exercise them.

 

Congruence is responsible for the processing of your personal information as it determines the purposes and means of processing your personal information. This Privacy Notice explains how we process your personal information and protect your privacy when you use the Services. Congruence also processes personal information for purposes outside the scope of the Services, and you will receive a separate privacy notice for those activities, including but not limited to recruitment, employment, third party management, or clinical research.

 

By continuing using the Services, you agree to the processing of your personal information in accordance with this Privacy Notice. We take privacy seriously and encourage you to read this Notice carefully.

 

 

Meaning of personal information

“Personal information” means any information which relates to a person and allows that person to be identified either directly or indirectly. This information may include, but is not limited to, your name, mailing address, e-mail address and telephone number.

 

Personal information does not include information that has been anonymized or aggregated in such a way that there is no serious possibility it can be used to identify an individual, whether on its own or in combination with other information.

 

Consent to collection and use of personal information

 

We collect and process your personal information with your consent where required, or as permitted by law. The form of consent (express or implied) depends on the nature of the interaction and the sensitivity of the information collected.

 

If you provide personal information to us voluntarily, we will treat this as your consent to process it for the purposes described in this Policy.

 

You may withdraw your consent to our collection, use or disclosure of your Personal information at any time by contacting us using the contact information in the “Contact Us” section below.  However, before we implement the withdrawal of consent, we may require proof of your identity. In some cases, withdrawal of your consent may mean that we will no longer be able to provide certain products or services.

If you provide personal information about another individual to us, it is your responsibility to obtain the consent of that individual to enable us to collect, use and disclose his or her information as described in this Privacy Policy.

 

What personal information do we collect and for which purposes?

Depending on how you interact with us, we may collect and process personal information that directly identifies you such as your name, contact details and email address. We may also collect certain personal information that does not directly identify you, but which makes identification possible through the combination of other information or identifiers such as your company name and position or ID number. Personal information may also include information such as computer or device serial numbers, IP addresses or information relating to a company (“legal person”). If you submit personal information relating to other people to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

 

For inquiries via our contact form, in addition to providing your name, e-mail address and organization name, you may also provide your message which may contain additional personal information. If you interact with us through social media platforms, your social media profile information including name, email address, contact details, comments and reactions will also be processed.

We process and save the personal information provided in the contact request only to process and answer your request regarding our products and services and to get in touch with you.

How do we share your personal information?

 

We may transfer personal information to third parties who act on our behalf, for further processing in accordance with the purpose(s) for which the data were originally collected or may otherwise be lawfully processed, such marketing, advertising, data management, or technical support.

We will not sell, share, or otherwise transfer your personal information to third parties other than those indicated in this Privacy Policy.

In the course of our activities and for the same purposes as those listed in this Privacy Policy, your personal information can be accessed by, or transferred to the following categories of recipients on a need-to-know basis to achieve such purposes:

 

  • our personnel;
  • our suppliers and services providers that provide services to us;
  • our IT systems providers, cloud service providers, database providers and consultants;
  • any third party to whom we assign or novate any of our rights or obligations; and
  • our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.

 

These third parties have contracted with us to only use personal information for the agreed upon purpose, and not to sell personal information to third parties, and not to disclose it to third parties except as may be permitted by us, as required by law, or as stated in this Privacy Policy.

We may disclose your Personal information to a third party in the event that the business or a part of it and the customer data connected with it is sold, assigned or transferred, in which case we would require the buyer, assignee or transferee to treat personal information in accordance with this Privacy Policy.

Also, we may disclose your personal information to a third party if we are required to do so because of an applicable law, requests from public and government authorities (including court order, subpoena, or governmental regulation), even outside your country of residence; if we need to enforce our terms and conditions; when we believe in good faith that the disclosure is necessary to protect legal rights, the security or integrity of this website; to protect your safety or the safety of others; as part of any criminal or other legal investigation or proceeding in your country or in other countries; or to third parties, advisors, and other entities to the extent reasonably necessary for development of or to proceed with the negotiation or completion of a corporate or commercial transaction.


International and interprovincial Transfer and Storage Information

Your personal information may also be processed, accessed, or stored in a country outside the country or the province where you are located. Such countries may offer a different level of protection of personal information. If we transfer your personal information to external companies in other jurisdictions, we will make sure to protect your personal information by applying the level of protection required under applicable data privacy laws by implementing adequate technical and organizational measures.

In the event that your personal information is transferred to a service provider based in a third country and processed there, Congruence ensures the protection of your personal information in accordance with Applicable Privacy Laws. In the event that your personal information is transferred outside Quebec, Congruence will ensure the protection of your personal information is made in compliance with the law.

How do we protect your personal information?

We have implemented physical, organizational, contractual and technological security measures with the goal of protecting your personal information from loss, theft, unauthorized access, disclosure, copying, use or modification.  We have taken steps to ensure that the only personnel who are granted access to your personal information are those with a business ‘need-to-know’ or whose duties reasonably require such information.

The purpose of these measures is to protect personal information against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.

 

Despite the measure outlined above, no method of transmission or storage is completely secure or error-free, so we cannot guarantee absolute security.  If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any information that you provided to us has been compromised), please contact us immediately using the contact information in the “Contact Us” section below.

How long do we store personal information?

We will only retain your personal information for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory.

 

What are your rights and how can you exercise them?

Whenever we process personal information, we take reasonable steps to keep your personal information accurate and up to date for the purposes for which it was collected. We will provide you with the ability to exercise the following rights under the conditions and within the limits set forth in the Applicable Privacy Laws.

 

  • the right to be informed about what personal information we have about you and how we process your personal information;
  • the right to access your personal information as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
  • the right to request the erasure or the de-indexation of, of your personal information or the restriction thereof to specific categories of processing;
  • the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
  • the right to request a data portability, i.e. that the personal information you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations; and

 

If you have a question, want to exercise the above rights, or are not satisfied with how we process your personal information please refer to our “Contact us” section.

Children’s Information

We do not knowingly collect any personal information about the children under the age of 14 on our website or for the purposes mentioned in this Privacy Policy. If personal information about children has been mistakenly provided to us and you would like to request that such personal information be removed, please refer to our “Contact us” section.

 

 

How frequently do we update this policy?

 

We keep our Privacy Policy under regular review and update it as and when required. The last version of the Policy was last updated on September 1, 2024.

When changes are made to this Privacy Policy, they will become immediately effective when published in a revised Privacy Policy posted on our website.

 

Contact us

If you wish to contact us regarding how we use your personal information or you wish to exercise your data privacy rights, please email our Data Protection Officer (DPO) at dataprivacy@congruencetx.com

or write to us to the following address:

Congruence Therapeutics Inc.

6666 Saint-Urbain, Suite 450, Montreal, Quebec, Canada, H2S 3H1

 

 

EU & UK Data Protection Law

 

For compliance with EU & UK Data Protection Law obligations, Congruence has appointed the following representatives:

 

EU Data Protection Representative: Research and Development Privacy Consultancy S.L.; C/ José Abascal 44, 4th floor, 28003 Madrid – Spain

 

UK Data Protection Representative: RD Privacy UK Limited – 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ