×

Important Information

This section of the website (the “Microsite”) of Mereo BioPharma Group plc (the “Company”) has been prepared solely for your information and for the purpose of providing background information on the Company, its business, the upcoming general meeting of the Company’s shareholders, and the industry in which the Company operates or any particular aspect thereof. For further information, please see the shareholder circular published by the Company in connection with the General Meeting which is available at www.mereobiopharma.com/GeneralMeeting2022 or at sec.gov.

The information contained in the Microsite has not been independently verified and no representation or warranty, express or implied, is made or given by or on behalf of the Company or any of its subsidiaries, or any of any such person’s directors, officers, employees, agents, affiliates or advisers, as to, and no reliance should be placed on, the accuracy, completeness or fairness of the information or opinions contained in the Microsite and no responsibility or liability is assumed by any such persons for any such information or opinions or for any errors or omissions. All information presented or contained in the Microsite is subject to verification, correction, completion and change without notice. In making available the Microsite, none of the Company or any of its subsidiaries, or any of any such person’s directors, officers, employees, agents, affiliates or advisers, undertakes any obligation to amend, correct or update the information contained in the Microsite or to provide the recipient with access to any additional information that may arise in connection with it. Accordingly, undue reliance should not be placed on any of the data contained in the Microsite.

Forward-Looking Statements

The Microsite and the information in it contain “forward-looking statements.” All statements other than statements of historical fact are forward-looking statements within the meaning of Section 27A of the United States Securities Act of 1933, as amended, and Section 21E of the United States Securities Exchange Act of 1934, as amended. Forward-looking statements relate to future events, including, but not limited to, statements regarding future clinical development, efficacy, safety and therapeutic potential of clinical product candidates, including expectations as to reporting of data, conduct and timing and potential future clinical activity and milestones and expectations regarding the initiation, design and reporting of data from clinical trials. Forward-looking statements are often identified by the words “believe,” “expect,” “anticipate,” “plan,” “intend,” “foresee,” “should,” “would,” “could,” “may,” “estimate,” “outlook” and similar expressions, including the negative thereof. The absence of these words, however, does not mean that the statements are not forward-looking. These forward-looking statements are based on the Company’s current expectations, beliefs and assumptions concerning future developments and involve risks and uncertainties that could cause actual results, performance, or events to differ materially from those expressed or implied in such statements. You should carefully consider the foregoing factors and the other risks and uncertainties that affect the Company’s business, including those described in the “Risk Factors” section of its latest Annual Report on Form 20-F, reports on Form 6-K and other documents furnished or filed from time to time by the Company with the Securities and Exchange Commission. You should not place undue reliance on any forward-looking statements, which speak only as of the date hereof. The Company undertakes no obligation to publicly update or revise any forward-looking statements after the date they are made, whether as a result of new information, future events or otherwise, except to the extent required by law. The Microsite and the information in it also contain estimates, projections and other information concerning the Company’s business and the markets for the Company’s product candidates, including data regarding the estimated size of those markets, and the incidence and prevalence of certain medical conditions. Information that is based on estimates, forecasts, projections, market research, or similar methodologies is inherently subject to uncertainties and actual events, or circumstances may differ materially from events and circumstances reflected in this information. Unless otherwise expressly stated, the Company obtained this industry, business, market and other data from reports, research surveys, clinical trials studies and similar data prepared by market research firms and other third parties, from industry, medical and general publications, and from government data and similar sources.

OK

HCP Privacy Notice

Contents

1. Introduction

 This Privacy Notice (this “Notice”) is made available by Mereo Biopharma Group plc and its affiliated entities (referred to as “Mereo”, “we”, “us” or “our”), and is intended to assist you in understanding how we collect, process, secure, and transfer personal data. We also describe how you can contact us to learn more information about our privacy practices. The terms “you”, “your” or “user”. This Notice is intended to assist (i) HCPs and (ii) HCPs acting as a representative or contact person for a healthcare organisation (HCOs) in understanding how we collect, process, secure, and transfer your personal data. We also describe how you can contact us to learn more information about our privacy practices. 

2. Link with other Privacy Notices

Other individuals interacting with Mereo (job applicants/ candidates, vendors and business partners) are provided with separate information about how we handle their personal information.

It is important that you read this Notice together with any other privacy notice that we may provide you with so that you are fully aware of how and why we are using your data. This Notice supplements any other privacy notices and privacy policies that we may provide to you and is not intended to supersede them.

3. Who we are

Mereo Biopharma Group Plc is the Data Controller and is responsible for the processing of your personal data.

4. The data we collect about you

Mereo will collect and may utilize your personal data for the purposes described below:

Category of Data

Purpose for Data Processing

Contact details (Example, your name, nationality, postal address, telephone number, e-mail address)
  • Facilitating communications.
  • Communicating to provide you with information.
  • Responding to your requests or communications.

Compensation data, such as bank account detials 
  • Payment of salary and invoices
  • Facilitating compliance with applicable laws, regulations, or other requirements.

Employment history, (including job titles, location of employment/workplace, work history, working hours, research interests and output, training records, qualifications and professional memberships.
  • To maintain database of professionals working in areas of interest related to our research.
  • To contact relevant professionals with a view to future collaboration.
  • To ask relevant professionals and institutions if they wish to participate in clinical trials.
  • To obtain feedback and professional insights (including through advisory boards, market research and survey tools) on (i) what is important to you and your patients, (ii) important trends in patient management in your area of expertise, (iii) how merio and our products are perceived by you; and (iv) how we can further evolve and customise our services and products. 

We also collect, use and share Aggregated Data for various purposes. For example, your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Notice.

We may receive information about you from other sources including business partners, third parties, affiliates, and publicly available information.

5. Legal basis for processing your personal data

We process your personal data using the follow lawful bases:

  • Processing necessary for the purpose of the legitimate interests pursued by Mereo BioPharma to conduct its business (including for research and development of new medicines creating value for people living with diseases in Mereo BioPharma’s therapeutic areas of interest), to manage our human and financial resources efficiently and to maintain a professional relationship with you.
  • To comply with legal and regulatory obligations.
  • To establish, exercise or defend our legal rights and/or for the purpose of (or in connection with) legal proceedings (including for the prevention of fraud); and
  • With your consent. Where we do rely on your consent, you have the right to withdraw it at any time in the manner indicated when your consent was provided.
  • Processing necessary for performance of a contract with you or in order to take steps at your request prior to entering into a contract.

6. Disclosures of your personal data

Where necessary to fulfil the purposes described in this Notice, Mereo may disclose your personal data to certain third-parties, vendors and service providers or affiliated employees, contractors and entities as described below.

Whenever Mereo shares your personal data with companies acting as our authorized agents and service providers, these companies agree to use your personal data only for specified purposes. Furthermore, the recipient will implement and maintain reasonable security procedures and practices appropriate to the nature of your information to protect your personal data from unauthorized access, destruction, use, modification or disclosure.

We will transfer and disclose your personal data to the following categories of recipients where it is lawful to do so, and subject to the implementation of appropriate protections: 

Category of Third-Party

Purpose for Disclosure

Subsidiaries and affiliated entities
  • Internal business requirements.
  • To perform our obligations to you.

Service Providers

who work for, or provide services to us (including their employees, sub-contractors, directors, officers or any professional service provider, such as accountants, auditors, lawyers, IT systems providers and IT contractors, payroll and HR system providers, employee expense management providers, pension administration / providers, benefits providers).
  • To support Mereo’s commercial/business objectives.
  • IT performance-related monitoring, maintenance, or security.
  • Where we use third party service providers who process personal information on our behalf or provide services to us. 

Cloud storage solutions
  • To store Mereo data.
  • To ensure the safety and security of our data.

Law enforcement, government, courts or regulators, or fraud prevention agencies, governmental or quasi- governmental organisations, courts, tribunals and arbitrators. 
  • To verify your identity.
  • Mereo’s public or legal duty to assist with detecting fraud and tax evasion, financial crime prevention, regulatory reporting, litigation or defending legal rights.
  • Where required to do so by law. For example, Mereo is required to provide tax-related information to HMRC, immigration information to the Home Office and any information for the purposes of preventing and detecting fraud or crime (if necessary) to the police.

Professional Consultants
  • To provide professional/expert advice in connection with Mereo’s business objectives.

Other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents.
  • To meet our legal, regulatory and compliance obligations.

Any prospective or new Mereo companies (e.g. if we restructure, or acquire or merge with other companies) or any businesses that buy part of or all of a Mereo company.
  • In relation to compliance / due diligence.

If this occurs the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice.

Potential or future employers
  • Where you have requested that we provide a reference to you

7. International cross-border data transfers

Because Mereo operates globally, your data may be transferred outside of the country in which you interact with Mereo, including to countries whose data protection laws substantially differ from the country in which you work or reside. To accomplish the purposes described in this Notice, we may also disclose and transfer personal data to personnel and other departments throughout Mereo. For example, your personal data may be transferred or accessed by Mereo and its affiliate entities in the United States of America.

Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards is implemented:

  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see here.
  • Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see here or here, for transfers from the United Kingdom.

Please contact us here if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

8. Data security

Mereo will implement appropriate technical and organizational security measures necessary to adequately safeguard your personal data. These safeguards will include, for example:

Security Measures

  • Access to Personal Data is limited and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need to know.
  • All employees handling Personal Data receive security and privacy awareness training, will only process your personal data on our instructions and are subject to a duty of confidentiality.
  • Employees with access to Personal Data are given the least privilege necessary
  • We have robust procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
  • A disciplinary policy is enforced to prevent unauthorized access
  • Where technically feasible, data is encrypted in transit and at rest

9. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Any personal information will be deleted in accordance with the relevant section of our
Data Protection Policy.In some circumstances you can ask us to delete your data: see your legal rights below for further information.

In some circumstances we will anonymise your personal data (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

10. Your legal rights

You may have rights relating to your Personal Data. Depending on the applicable data privacy law, you may have the right to direct Mereo to take certain actions related to your personal data. You may have the right to request confirmation as to whether Mereo is processing your personal data, and if so:

  • You may have the right to request information relating to the categories of data involved, purposes of processing, recipients of your data, retention periods/criteria, and your rights as a Data Subject.
  • You may have the right to access any of your personal data that Mereo is processing.
  • You may have the right to rectify any inaccurate or incomplete personal data that Mereo is processing.
  • You may have the right to request erasure or restriction of any personal data that Mereo is processing, subject to certain exceptions.
  • You may have the right to obtain a copy of your personal data in a commonly-used and machine-readable format.
  • You may have the right to request your information not be sold or otherwise disclosed to a third-party.
  • You may have the right to lodge a complaint with your local Data Protection Authority or Supervisory Authority.

To exercise the rights described above, please email [email protected] with a description of your request.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

11. Changes to the Notice

We keep our privacy notices under regular review. This version was last published in March 2023. 

We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact Mereo for more information. 

12. Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.

13. Consequences of not providing Personal information to us

Providing your personal data to Mereo is voluntary for you. Should you choose not to provide your personal information to us, your interaction with us may be adversely impacted. Also, the provision of your personal information may be necessary to allow us to perform a contract with you and/or to provide services to you.

14. Providing Mereo with other people’s data

If you give us any personal information that does not relate to you (e.g., information about your financial adviser and/or your employees), you must ensure that you have the required legal basis to collect and share such personal information. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this policy. You must also tell them how they can see what information we have about them and correct any mistakes. 

15. Third-party links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

16. Questions

If you have any questions about this Notice, the use of your data, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.

Email: [email protected] and mark your query “For the urgent attention of the Data Protection Officer”.

Post: Data Protection Officer, Mereo Biopharma Group Plc, 1 Cavendish Place, London, W1G 0QF, United Kingdom.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

17. Glossary

“Data Controller” means the person or organisation that determines how and why your data is being collected and used.

“Personal data” refers to any information relating to an identified or identifiable natural person, whether that information can be used alone or in conjunction with other information to identify a natural person.

“Aggregated Data” means summarised data derived from your personal data. Examples are statistical or demographic data. It is not considered personal data in law as this data will not directly or indirectly reveal your identity.

“Process” (or “Processing”) means any operation or set of operations which is performed on personal data or sets of personal data, whether by automated means, such as collection, use, and erasure.

REVISION HISTORY

Effective Version

Description of changes

Effective date

1.0

First Version.

21-Mar-2023