Data Privacy Framework Policy

Effective as of September 20, 2023.

This Data Privacy Framework Policy (“DPF Policy“) describes how Keros Therapeutics, Inc. (“Keros,” “we“, “us” or “our“) collects, uses, shares and safeguards (collectively, processes) Personal Data we receive from or about individuals in the European Economic Area (“EEA“) and the United Kingdom (“UK“) under the Data Privacy Framework (as defined below) (such individuals, “Individuals“). “Personal Data” means information related to an identified or identifiable natural person.

Where Keros relies on the Data Privacy Framework, this DPF Policy supplements our:

  1. Website Privacy Notice; and
  2. other relevant applicable privacy notices that also address the Data Privacy Framework and are provided to individuals such as in the context of clinical trials in the informed consent forms or privacy notices to clinical trial staff (including investigators) (collectively, “Clinical Trial Privacy Notice“).

To demonstrate our commitment to the protection of Personal Data, Keros complies with (i) the EU-U.S. Data Privacy Framework (EU-U.S. DPF), and (ii) the UK Extension to the EU-U.S. DPF (collectively, the “Data Privacy Framework“) as set forth by the U.S. Department of Commerce. Keros has certified to the Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the EU in reliance on the EU-U.S. DPF and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF (collectively, the “DPF Principles“). If there is any conflict between the terms in the Website Privacy Notice and/or the Clinical Trial Privacy Notice and the EU-U.S. DPF Principles, the EU-U.S. DPF Principles shall govern. To learn more about the EU-U.S. DPF program and UK Extension, and to view our certification, please visit https://www.dataprivacyframework.gov/s/.

Adherence to the EU-U.S. DPF Principles and the UK Extension may be limited (i) to the extent required or allowed by applicable law, rule or regulation; and/or (ii) to the extent necessary to respond to lawful requests by public authorities, including to meet national security, law enforcement, legal or governmental requirements. With respect to Personal Data received or transferred pursuant to the Data Privacy Framework, the Federal Trade Commission has jurisdiction over Keros’ compliance with the Data Privacy Framework.

Personal Data Collection and Purposes of Processing

Website

When we rely on the Data Privacy Framework and you visit our website, http://kerostx.com/, or associated sites or pages (the “Website“), Keros may collect Personal Data for the purposes described in the Website Privacy Notice including the sections entitled “What Personal Data do we collect and how do we collect it?” and “How do we use your Personal Data?”

Clinical Trials

When we rely on the Data Privacy Framework and you participate in a clinical trial as a clinical trial participant or as clinical trial staff (incl. principal investigator), Keros may collect the categories of Personal Data described in the relevant Clinical Trial Privacy Notice.

This Personal Data may include, for example:

  • Personal Data of the clinical trial staff, principal investigator, such as name, email address, and other contact details as well as financial interests.
  • Key-coded Personal Data of the clinical trial participants and their spouses, caregivers and legal guardians, including health and medical history, medical data collected during the study, results from study procedures, genetic data, ethnicity and racial origin, and financial information.

We will use such Personal Data for the purposes set forth in the Clinical Trial Privacy Notice. For example, we may use your Personal Data for purposes of administering and performing the clinical trial and to conduct scientific research.

Third parties who may receive Personal Data

Keros uses a limited number of third parties to assist Keros in providing its Website services and conducting clinical trials.

Website

The types of third parties with which Keros may share Personal Data received in reliance on the Data Privacy Framework and for which purposes with respect to the Website are set out in the section of the Website Privacy Notice entitled “With Whom Do We Share your Personal Data?“.

Clinical Trials

The types of third parties to which Keros may share Personal Data received in reliance on the Data Privacy Framework and for which purposes with respect to clinical trials are set out in the Clinical Trial Privacy Notice. For example, third parties that may access or receive Personal Data may include:

  • Keros’s affiliates and licensing partners;
  • Sponsors;
  • Contract research organizations;
  • Ethics Committees and Review Boards;
  • Study monitors and duty controllers, auditors and others who may check study records to ensure the clinical trial is being run properly;
  • National and international supervisory/regulatory authorities, including in the context of verifying trial procedures/data and in the context of adverse event reporting;
  • Study authors and collaborators and journal editorial boards;
  • Service providers (e.g., laboratories, data storage companies, other doctors); and
  • Any actual or potential acquirers (including their representatives) of all or part of Keros’ stock/share capital, business or assets or other parties involved in an actual or potential business transaction.

If recipients to whom Keros has disclosed Personal Data in reliance upon the Data Privacy Framework process it in a manner that does not comply with the DPF Principles, Keros shall be liable, unless Keros proves that Keros is not responsible for the event giving rise to the damage.

Your Rights to Access, Limit Use, and Limit Disclosure

Depending upon the context in which Keros processes Personal Data received in reliance upon the Data Privacy Framework, Individuals may have rights to access Personal Data about them, and choices to limit the use and disclosure of their Personal Data. With our Data Privacy Framework self-certification, Keros has committed to respect those rights. Please submit a written request to exercise your rights or choices to the contact information provided in this DPF Policy. Keros may request specific information from you to confirm your identity in an effort to respond to your request.

Please note that Keros primarily holds key-coded Personal Data on clinical trial participants and therefore Keros kindly asks you to first contact the clinical trial site or indicate the clinical trial site in your request so that Keros can redirect and respond to the request.

Recourse, Enforcement, and Liability

In compliance with the Data Privacy Framework, Keros commits to resolve DPF Principles-related complaints about our collection or use of your Personal Data. Individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the Data Privacy Framework should first contact us by email at , or please write to the following address:

Keros Therapeutics, Inc.
1050 Waltham Street, Suite 302
Lexington, MA 02421

Keros has also appointed an alternative dispute resolution provider based in the United States that will be responsible for investigating any unresolved complaints regarding Keros’s compliance with the Data Privacy Framework. JAMS’ contact information is located at https://www.jamsadr.com/eu-us-data-privacy-framework. If any request remains unresolved, you may, under certain circumstances, have a right to invoke binding arbitration under the Data Privacy Framework. For more information on this option, please see the Data Privacy Framework website: Annex I.

Changes to this Policy

We reserve the right to modify this Data Privacy Framework Policy from time to time consistent with Data Privacy Framework requirements.