Data Privacy Framework Policy

Last Updated: October 7, 2024.

This Data Privacy Framework Policy (DPF Policy) describes how Keros Therapeutics, Inc. (Keros, we, us or our) collects, uses, shares and safeguards (collectively, processes) Personal Data we receive from or about individuals in the European Economic Area (EEA) and the United Kingdom (UK) under the Data Privacy Framework (as defined below) (such individuals, Individuals). Personal Data means information related to an identified or identifiable natural person.

Where Keros relies on the Data Privacy Framework, this DPF Policy supplements our:

  1. Website Privacy Notice; and
  2. other relevant applicable privacy notices that also address the Data Privacy Framework and are provided to individuals such as in the context of clinical trials in the informed consent forms or privacy notices to clinical trial staff (including investigators) (collectively, “Clinical Trial Privacy Notice“).

To demonstrate our commitment to the protection of Personal Data, Keros complies with (i) the EU-U.S. Data Privacy Framework (EU-U.S. DPF), and (ii) the UK Extension to the EU-U.S. DPF (collectively, the Data Privacy Framework) as set forth by the U.S. Department of Commerce. Keros has certified to the Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the EU in reliance on the EU-U.S. DPF and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF (collectively, the DPF Principles). If there is any conflict between the terms in the Website Privacy Notice and/or the Clinical Trial Privacy Notice and the EU-U.S. DPF Principles, the EU-U.S. DPF Principles shall govern. To learn more about the EU-U.S. DPF program and UK Extension, and to view our certification, please visit https://www.dataprivacyframework.gov/s/.

Adherence to the EU-U.S. DPF Principles and the UK Extension may be limited (i) to the extent required or allowed by applicable law, rule or regulation; and/or (ii) to the extent necessary to respond to lawful requests by public authorities, including to meet national security, law enforcement, legal or governmental requirements. With respect to Personal Data received or transferred pursuant to the Data Privacy Framework, the Federal Trade Commission (“FTC”) has jurisdiction over Keros’ compliance with the Data Privacy Framework, and we are subject to the FTC’s investigatory and enforcement powers.

Personal Data Collection and Purposes of Processing

Website

When we rely on the Data Privacy Framework and you visit our website, http://kerostx.com/, or associated sites or pages (the Website), Keros may collect Personal Data for the purposes described in the Website Privacy Notice including the sections entitled What Personal Data do we collect and how do we collect it? and How do we use your Personal Data?

Clinical Trials

When we rely on the Data Privacy Framework and you participate in a clinical trial as a clinical trial participant or as clinical trial staff (incl. principal investigator), Keros may collect the categories of Personal Data described in the relevant Clinical Trial Privacy Notice.

This Personal Data may include, for example:

  • Personal Data of the clinical trial staff, principal investigator, such as name, email address, and other contact details as well as financial interests.
  • Key-coded Personal Data of the clinical trial participants and their spouses, caregivers and legal guardians, including health and medical history, medical data collected during the study, results from study procedures, genetic data, ethnicity and racial origin, and financial information.

We will use such Personal Data for the purposes set forth in the Clinical Trial Privacy Notice. For example, we may use your Personal Data for purposes of administering and performing the clinical trial and to conduct scientific research.

Third parties who may receive Personal Data

Keros uses a limited number of third parties to assist Keros in providing its Website services and conducting clinical trials.

Website

The types of third parties with which Keros may share Personal Data received in reliance on the Data Privacy Framework and for which purposes with respect to the Website are set out in the section of the Website Privacy Notice entitled With Whom Do We Share your Personal Data?.

Clinical Trials

The types of third parties to which Keros may share Personal Data received in reliance on the Data Privacy Framework and for which purposes with respect to clinical trials are set out in the Clinical Trial Privacy Notice. For example, third parties that may access or receive Personal Data may include:

  • Keros’s affiliates and licensing partners;
  • Sponsors;
  • Contract research organizations;
  • Ethics Committees and Review Boards;
  • Study monitors and duty controllers, auditors and others who may check study records to ensure the clinical trial is being run properly;
  • National and international supervisory/regulatory authorities, including in the context of verifying trial procedures/data and in the context of adverse event reporting;
  • Study authors and collaborators and journal editorial boards;
  • Service providers (e.g., laboratories, data storage companies, other doctors); and
  • Any actual or potential acquirers (including their representatives) of all or part of Keros’ stock/share capital, business or assets or other parties involved in an actual or potential business transaction.

If recipients to whom Keros has disclosed Personal Data in reliance upon the Data Privacy Framework process it in a manner that does not comply with the DPF Principles, Keros shall be liable, unless Keros proves that Keros is not responsible for the event giving rise to the damage.

Your Rights to Access, Correct, Delete, Limit Use, and Limit Disclosure

Individuals have certain rights and choices under the Data Privacy Framework as described in this section. With our Data Privacy Framework self-certification, Keros has committed to respect those rights.

Individuals have rights to access Personal Data about them, including correcting, amending, or deleting that information where it is inaccurate or has been processed in violation of the DPF Principles, to the extent provided for under the Data Privacy Framework and applicable law (you can find more information about these rights here and/or here).

Individuals also have certain choices to limit the use and disclosure of their Personal Data. If Personal Data covered by this DPF Policy is to be used for a new purpose that is materially different from that for which the Personal Data was originally collected or subsequently authorized, or is to be disclosed to a non-agent third party in a manner not specified in this DPF Policy, Keros will provide you with an opportunity to choose whether to have your Personal Data so used or disclosed. Requests to opt out of such uses or disclosures of Personal Data should be sent to us at the email or mailing address specified in the “Recourse, Enforcement, and Liability” section, below.

Certain Personal Data, such as information about medical or health conditions, racial or ethnic origin, political opinions, and religious or philosophical beliefs, is considered “Sensitive Information”. Keros will not use Sensitive Information for a purpose other than the purposes for which it was originally collected or subsequently authorized by the individual unless Keros has received the individual’s affirmative and explicit consent.

Please submit a written request to exercise your rights or choices to the email or mailing address specified in the “Recourse, Enforcement, and Liability” section, below. Keros may request specific information from you to confirm your identity in an effort to respond to your request.

Please note that Keros primarily holds key-coded Personal Data on clinical trial participants and therefore Keros kindly asks you to first contact the clinical trial site or indicate the clinical trial site in your request so that Keros can redirect and respond to the request.

Recourse, Enforcement, and Liability

In compliance with the Data Privacy Framework, Keros commits to resolve DPF Principles-related complaints about our collection or use of your Personal Data. Individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the Data Privacy Framework should first contact us by email at , or please write to the following address:

Keros Therapeutics, Inc.

1050 Waltham Street, Suite 302

Lexington, MA 02421

In compliance with the EU-U.S. DPF and UK Extension to the EU-U.S. DPF, Keros commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you. If your Data Privacy Framework complaint cannot be resolved through the above channels, you may, under certain conditions, invoke binding arbitration under the Data Privacy Framework for some residual claims not resolved by other redress mechanisms. For more information on this option, please see the Data Privacy Framework website.

Changes to this Policy

We reserve the right to modify this Data Privacy Framework Policy from time to time consistent with Data Privacy Framework requirements.