Privacy Policy

Last updated: 09JUN2025

Please Read Carefully Prior to Using This Website

Ultragenyx Pharmaceutical Inc. with registered offices at 60 Leveroni Court, Novato, CA 94949 (hereinafter “Ultragenyx” or “we” or “us” or “our”) respects the privacy of visitors to its websites and values the confidence of its customers, partners, and patients.

This Privacy Policy sets forth Ultragenyx’s practices regarding the collection, use, and disclosure of personal information through this site (the “Website”), and the rights you have in relation to such information. Please read this entire Privacy Policy before using this Website or submitting personal information to Ultragenyx through this Website.

This Policy does not apply to other websites that do not link to this policy.

I. Collection & Processing of Personal Information

As you visit and navigate this Website, we may collect the following categories of personal information about you, including within the preceding twelve (12) months:

Category	Examples
1. Identifiers and contact information, such as name, alias, online identifiers, account name;	We collect your name, address, phone number, email address, affiliate organization and account name (collectively, “Contact Information”) when you communicate with us or to provide our products and services, including when you register for an account or submit variant information about yourself or on behalf of others.
2. Medical information	We collect medical information to provide and improve our products, services, and communications and for safety, quality and the other business purposes listed below. For instance, we may collect such data when you register a variant in the Rare Disease Genes database.
3. Characteristics of protected classifications under state or federal law, such as age, health conditions;	We obtain information about age, health conditions, and diagnosis codes to provide and improve our product quality and safety and for the other business purposes listed below.
4. Internet or other electronic network activity information, such as browsing history, search history and interactions with our websites or advertisements;	We collect information about how HCPs, patients, and other visitors browse or search our Websites. We use cookies and similar technologies that may identify visitors. (See more about Cookies and Similar Tracking Technologies below.)
5. Geolocation data, such as device location;	We collect and use generalized location information to improve our product offerings, to comply with our legal obligations, and for the other business purposes listed below. (See more about Cookies and Similar Tracking Technologies below.)
6. Professional or employment-related information, such as specialty, education history, professional qualifications, work history and prior employer;	We may obtain information about the institutional affiliations and other professional information of HCPs to provide our products and services and for the other business purposes described below. We may obtain information about employers for instance where HCPs register and list their organization.
7. Inferences drawn from any of the personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.	We may collect information reflecting a person’s preferences, characteristics, or behavior in order to improve or promote our products or services or for the other business purposes described below.

If you choose to register a variant on the Website, that variant may be read, collected, or used by others on the platform. We are not responsible for the information you choose to submit. Please review your submission and confirm it contains no identifying information.

Some of the information we collect may be considered sensitive personal information in some circumstances including, genetic data and health information.

We collect sensitive personal information in accordance with applicable law. For example, we use sensitive personal information to provide the products and services you request, such as to submit variant data and create an account. In the event we collect sensitive personal information, we do not use or disclose sensitive personal information for any purpose other than those permitted by applicable law.

II. Sources from Which We Collect Personal Information

We may obtain the categories of personal information listed above from the following categories of sources:

Directly from you. For example, from forms you complete or products and services you purchase.
Indirectly from you. For example, from observing your actions on our Sites using cookies.
From third-party service providers. For example, we obtain demographic data from a third-party service provider to use for marketing analytics.
From health care providers. We may obtain some personal information if a healthcare provider registers a variant associated with you.
Other Sources. Including internet service providers; data analytic providers; and government entities.

III. Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following purposes:

To provide you with the services offered on our Website (e.g., to allow you to create an account, to maintain your account, to enable you to register a variant)
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
To personalize your Website experience
To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business.
For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
As described to you when collecting your personal information or as otherwise set forth in the applicable laws.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Website users/consumers is among the assets transferred.

IV. Sharing of Personal Information

We are committed to maintaining your trust, and we want you to understand when and with whom we may share the information we collect. The third parties with which we may share your personal information include:

Authorized U.S., and other foreign third-party vendors and service providers. We may share your information with third-party vendors and service-providers that help us with specialized services, including billing, payment processing, customer service, email deployment, business analytics, marketing, advertising, performance monitoring, hosting, and data processing.
Corporate affiliates. We may share your information with our corporate affiliates that are subject to this policy for the purposes set out above.
Business transfers. We may share your information in connection with a completed or proposed corporate transaction, such as the sale of all or part of Ultragenyx, a merger, consolidation, asset sale, or in the unlikely event of bankruptcy.
Legal purposes. We may disclose information to respond to subpoenas, court orders, legal process, law enforcement requests, legal claims, or government inquiries, or as otherwise may be required or permitted by applicable law, and to protect and defend the rights, interests, health, safety, and security of Ultragenyx, our affiliates, users, or the public.
With your consent or at your direction. We may share information for any other purposes disclosed to you at the time we collect the information or pursuant to your consent or direction. Where you choose to post information in the form of public comments, this information shall be accessible by members of the public.

We may transfer any information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, dissolution, liquidation, or other corporate restructuring).

We do not disclose personal information of our users to third parties for their direct marketing purposes.

We do not sell personal information or share personal information for cross-context behavioral advertising (targeted advertising), including for users under 16 years old.

V. Cookies and Tracking Technologies

A. Cookies and Similar Technologies

Our Website also uses cookies and other tracking technologies to automatically collect information about how you use the Website. For more information about how we and third parties use cookies on our Website, please see our Cookie Policy.

We combine the information we receive when you visit our Website with other information we have collected, including other information we have received from you and information received from publicly and commercially available sources.

B. Do-Not-Track Signals and Similar Mechanisms:

Some mobile and web browsers transmit “do-not-track” signals to websites. Because of differences in how web browsers incorporate and activate this feature, it’s not always clear whether users intend for these signals to be transmitted, or whether they’re even aware of them. We currently don’t take action in response to these signals.

VI. Data Subject Rights

You may have certain rights available to you under local laws. These may include:

Right to Access or Know: You may have the right to know what personal information we have collected about you, including, in some cases, in a portable format, and to receive certain information about our collection and use of your personal information to you.
Right to Delete: You may have the right to request that we delete your personal information that we collected from you and retained.
Right to Correction: You may request that we correct any inaccurate personal information we maintain about you.
Right to Withdraw Consent: You may withdraw consent where we rely on it to process your personal information.

To exercise your rights, please submit a request by either:

Calling us at 1-888-756-8657
Emailing us at [email protected]
https://privacyrequest.ultragenyx.com

Only you, or someone legally authorized to act on your behalf, may make a request to exercise a right related to your personal information. These rights are not absolute. For example, we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

If you are not satisfied with how we process your Personal Information, you may address your request to our data protection officer at [email protected], who will investigate your concern. Please enclose a copy of or otherwise specifically reference the decision you want to appeal.

We will not discriminate against you for exercising your rights and choices, although some of the functionality and features available on the Website may change or no longer be available to you. Any difference in the services is related to the value provided.

VII. Retention Period

We will retain your personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the service to you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

VIII. International Data Transfers

Ultragenyx is a company based in the U.S., and your use of our Website and Service will involve the transfer, storage, and processing of your personal information in U.S. Ultragenyx only transfers your personal information to a third party or overseas when it is satisfied that adequate levels of protection are in place to protect the integrity and security of any information being processed, in compliance with applicable privacy and data protection laws.

IX. Use by Minors

We do not knowingly collect any personal information from users under the age of 18. If we learn that a minor has provided us with personal information, we will delete it in accordance with the applicable law. We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under the age of sixteen.

X. Security

Ultragenyx will apply reasonable and appropriate technical, administrative, and physical safeguards designed to protect the information collected through its websites against loss, interference, misuse, unauthorized access, disclosure, alteration, or destruction. However, please be aware that there is always some risk involved when submitting data over the Internet. No such measure is ever 100% effective, we cannot guarantee the security of our database is 100% safe from illegal tampering or “hacking.” If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us in accordance with the “Contact Information” section below.

XI. Links to Third Party Sites

As a convenience to our visitors, our Website currently contain links to a number of other sites that we believe may offer useful information. Such links do not constitute an endorsement by Ultragenyx of those other websites, the content displayed therein, or the persons or entities associated therewith. This Privacy Policy does not apply to those sites. You should contact those sites directly for information on their privacy policies, confidentiality agreements, and data collection/distribution procedures.

Please note that linked non-Ultragenyx sites may also use cookies. Ultragenyx cannot control the use of cookies by these non-Ultragenyx sites. We also want you to know that when you link from this Website to another website, that site may have the ability to recognize that you have come from an Ultragenyx site. If you do not want any other websites to know that you have been on this Website, we recommend that you do not use the links provided in our site. If you have any questions about how third-party sites use cookies, you should contact such third parties directly.

XII. Contact Information

If you have any questions or comments about this notice, the ways in which Ultragenyx collects and uses your information described here, your choices and rights regarding such use, or wish to exercise your rights under California or other laws, please do not hesitate to contact us at:

Phone: 1-888-756-8657
Webform: https://privacyrequest.ultragenyx.com
E-mail: [email protected]
Postal Address:
Ultragenyx Pharmaceutical Inc.
60 Leveroni Court,
Novato, CA 94949

Our data protection officer can also be contacted by email at [email protected] and by post at the same address above, addressed for the attention of the Data Protection Officer.

If you need to access this Policy in an alternative format due to having a disability, please contact [email protected] and 1-888-756-8657.

XIII. Modifications

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on the Website and update the notice’s effective date.

XIV. Addendum for Individuals Resident in the EEA and UK

This Addendum applies in the event the Website is subject to the EU GDPR or its UK equivalent.

A. Legal Bases for Processing

In the table below, we have specified the legal bases we rely upon for specific data processing purposes. Please read this table in conjunction with the section “Collection & Processing of Personal Information” above, which provides additional information on the categories of personal information we collect and process. Where legitimate interests are relied upon, the legitimate interests are to fulfill the processing purpose(s) indicated in that column, or as otherwise specified below.

Processing Purpose(s)	Personal Information Categories	Legal Basis
To provide you with the services offered on our Website (e.g., to allow you to create an account, to maintain your account, to enable you to register a variant)	Identifiers and Contact Information Professional Information Internet or other electronic network activity information Geolocation data Inferences	Our legitimate interests (for example, when we respond to an inquiry you have sent to us; or to allow you to participate in the expansion of our databases)
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.	Contact and financial information Identifiers Internet or other electronic network activity information Professional information Inferences	Our legitimate interests to respond to users and improve our products and services.
To personalize your Website experience .	Internet or other electronic network activity information Identifiers Inferences	Our legitimate interests to personalize your Website experience and to deliver content and product and service offerings relevant to your interests. Consent where legally required.
To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business (including to secure your account).	Internet or other electronic network activity information Identifiers Inferences Professional information Contact Information	Our legitimate interests to keep secure our services and products.
For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.	Internet or other electronic network activity information Identifiers Inferences Professional information Contact Information	Our legitimate interests to improve our products and services.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.	Any information required in a valid request or legally binding order from law enforcement, a court, or other governmental authority.	Compliance with a legal obligation. Legitimate interests to defend our legal rights.
As described to you when collecting your personal information or as otherwise set forth in the applicable laws.	Any of the categories of personal information described above.	As applicable: Our legitimate interests. Contractual necessity. Compliance with a legal obligation. Consent.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Website users/consumers is among the assets transferred.	Any of the categories of personal information described above.	Our legitimate interests. Compliance with a legal obligation (for example, in the event of a bankruptcy or similar proceeding).

B. Your Rights

Besides the rights described in section “Data Subjects Rights” above, you may have additional rights. This includes a right to object to our processing of your data, a right not to be subject to automated decision-making having legal or equivalent effects, and a right to restrict our processing of personal information where certain conditions apply. If you would like to exercise or inquire about such rights, you may contact us as indicated in the “Contact Information” section. We will respond to your request consistent with applicable law.

Where we rely on consent as our legal basis for processing your personal information, you may withdraw your consent at any time, without affecting the lawfulness of the processing that took place before such withdrawal.

You also have the right to lodge a complaint with your data protection authority.

C. Transfers outside of the European Economic Area (“EEA”) and United Kingdom (“UK”)

Some recipients of the information we collect are located outside of the EEA and UK, including in countries that may not provide the same level of data protection as in the country where you reside. Where it is subject to the EU GDPR or its UK equivalent, Ultragenyx shall take appropriate steps to ensure that such recipients are bound to duties of confidentiality and we implement measures such as Standard Contractual Clauses approved by the European Commission (where applicable, as amended in accordance with UK law) to ensure that any transferred personal information, remains protected and secure. A copy of these clauses can be obtained by contacting us at the address listed below in the “Contact information” section.

XV. Supplemental Notice to California Residents

This section supplements the description of our information collection and sharing practices elsewhere in this Privacy Policy to provide additional disclosures to California residents whose personal information Ultragenyx processes pursuant to the California Consumer Privacy Act (“CCPA”). Please note that these disclosures do not apply to information that is not processed under the CCPA.

For information about the categories of personal information we may collect, including in the preceding 12 months, and the sources from which personal information is collected, please see our “Collection & Processing of Personal Information” section above.

For information about the purposes for which we collect personal information, please see our “Use of Personal Information” section above. We may use all the categories of personal information we collect for these purposes, although this may vary based on the nature of the relationship you have with us. You may also learn about our retention practices in our “Retention Period” section above.

For information about the third parties to which we have disclosed personal information, including in the preceding 12 months, please see our “Categories of Personal Information We Disclose to Vendors & Third Parties” section above. We may disclose all the categories of personal information we collect with these third parties, although this may vary based on the nature of the relationship you have with us.

For more information about the rights you have and how you or an authorized agent may exercise these rights, please see the “Data Subject Rights” section above.

XVI. Nevada and Washington Consumer Health Data Privacy Policy

Some of the categories of information we collect, use, and disclose pursuant to this Privacy Policy may be considered “consumer health data.” Please review the sections above for information about these categories of personal information, the sources from which we collect personal information, and the categories of third parties and affiliates with which we disclose personal information.

Consistent with applicable law, Nevada and Washington residents may have the following rights described above under the “Data Subject Rights” section with respect to their consumer health data, including rights to access, delete, and withdraw consent, subject to certain exceptions.

To exercise any right you may have, please submit a request as outlined in the “Data Subject Rights” section above.

Subject to applicable law, you may appeal our decision on your data subject requests. Please contact us at [email protected]. Please enclose a copy of or otherwise specifically reference the decision you want to appeal.

Give us a moment while we fetch the data.