Introduction

This privacy policy (“Privacy Policy”) describes how Aquinox Pharmaceuticals, Inc. (“Aquinox,” “Company,” “we,” and “our”) collects, uses and shares personal data when using this website http://aqxpharma.com/ (the “Site”) and our services (together with the Site, the “Services”). Please read the following information carefully to understand our views and practices regarding your personal data and how we will treat it. We take your privacy and security very seriously.

Questions; Contacting Company; Reporting Violations

If you have any questions or concerns or complaints about our Privacy Policy or our data collection or processing practices, or if you want to report any security violations to us, please contact our Data Privacy Officer at the following address or phone number:

Aquinox Pharmaceuticals, Inc.

Attn:
Shelley McCloskey, Data Privacy Officer

Suite 450 – 887 Great Northern Way

Vancouver, BC

Canada, V5T 4T5

604 629 9223

Changes to this Policy

Our Privacy Policy may change from time to time at our discretion. We will post changes to this policy on this page so you are always fully informed of any changes. The “Last Updated” legend above indicates when this Privacy Policy was last changed. If we make any material change(s) to the Privacy Policy, we will post a notice on our Site prior to such changes(s) taking effect.

1. Purposes of Processing

What is personal data?

We collect information about you in a range of forms, including personal data. Personal data means data that allows someone to identify or contact you, including, for example, your name, address, telephone number, e-mail address, as well as any other non-public information about you that is associated with or linked to any of the foregoing data.

Why do we need your personal data?

We will only process your personal data in accordance with applicable data protection and privacy laws. We need certain personal data in order to provide you with access to the Services. If you are required to provide your personal data, we will ask for your consent. This consent provides us with the legal basis we require under applicable law to process your data. You maintain the right to withdraw such consent at any time. If you do not agree to our use of your personal data in line with this Privacy Policy, please do not use our Services.

2. Collecting Your Personal Data

We collect information about you in the following ways:

Information You Give Us.

This includes:

• Name
• Address
• Email address
• Telephone number
• Occupation

If we collect sensitive personal data about your physical and/or mental health, as part of a separate request, we will provide a separate Privacy Notice to you and get your specific consent to the use of that information.

Information Automatically Collected.

We automatically log information about you and your computer or mobile device when you access our Site. For example, when visiting our Site, we may log your computer or mobile device operating system name and version, manufacturer and model, browser type, browser language, screen resolution, the website you visited before browsing to our Site, pages you viewed, how long you spent on a page, access times and information about your use of and actions on our Site. We collect this information about you using cookies.

How Your Information Will be Used.

By providing your personal data, we may use your information to contact you or to provide you with:

• Information about specific products or services you requested
• Product or service news and/or updates
• Information on how to learn more about diseases and/or conditions
• Other information as outlined on our Site

How Your Information Will be Disclosed.

We may disclose your information to meet the purposes set out above. We may also disclose your information to comply with Court order, respond to government or regulatory request, or protect the rights, property or safety of our organization. In the event of a transaction such as a merger or sale, information may be transferred to the other party in such transaction in which case, the party will be required to adhere to the same privacy practices as described in this policy. We may aggregate or anonymize personal data so that it is not about an identifiable individual, in such case we may share it for lawful purposes.

3. Cookies

Information on Cookies and Other Tracking Services.

We may also collect and process information about your visit to this Site, such as the Site you
came from, pages you visit and the searches you conduct. We use this information to improve your experience with the site as well as to collect aggregate statistics about visitors to our site for internal market research.

To do this, we use internet data packages known as ”cookies,” which can collect information including your internet service provider, your IP address, your operating system, and the date and time you accessed our site. A cookie is a small text file that is placed on your hard disk by a server. Cookies cannot damage your computer. Occasionally we may also use other internet tags such as action tags, single-pixel GIFs, clear GIFs, invisible GIFs and 1-by-1 GIFs. Unlike cookies, which are stored on the hard drive of your computer or mobile device by a website, the preceding types of pixel tags are embedded invisibly on webpages. Pixel tags compile statistics about usage of the Site, so that we can manage our content more effectively. The information we collect using pixel tags is not linked to our users’ personal data.

We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer or mobile device until you delete them) to provide you with a more personal and interactive experience on our Site. We use two broad categories of cookies: (1) first party cookies, described above, which are served directly by us to your computer or mobile device, which are used only by us to recognize your computer or mobile device when it revisits our Site; and (2) third party cookies, which are served by service providers on our Site, and can be used by such service providers to recognize your computer or mobile device when it visits other websites.

Most internet browsers will automatically accept cookies, but you can modify your browser to
decline cookies or to receive a warning if a cookie is stored on your computer. To learn more or to modify your cookie preferences, you should refer to your internet browser’s instructions. However, if you choose not to accept cookies this may compromise the functionality of our Site.

We may also use social media plugins such as the Facebook “Like” or “Share” buttons to enable
you to share relevant information about our Site with others. The operator of the social media platform may also install third party cookies on your computer, which will allow the social media platform to recognize if you have visited our Site previously. The cookie may also enable the social media platform to share information about your activities on our Site with other users of their platform. If this causes you concern, you should refer to the respective social media platform’s privacy policy.

Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to do not track signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

4. Using Your Personal Data

We may use your personal data as follows:

• to operate, maintain, and improve our Site, products, and services;
• to respond to your comments and questions and to provide customer service;
• to send information including technical notices, updates, security alerts, and support and administrative messages;
• with your consent, to send you marketing e-mails with press releases and other updates, including information about services offered by us and our affiliates. You may opt-out of receiving such information at any time: such marketing emails tell you how to “opt-out.”
• as we believe necessary or appropriate (a) to comply with applicable laws; (b) to comply with lawful requests and legal process, including to respond to requests from public and government
  authorities; (c) to enforce our Privacy Policy; and (d) to protect our rights, privacy, safety or property, and/or that of you or others; and
• as described in the “Sharing Your Personal Data” section below.

5. Sharing Your Personal Data

• Aquinox Personnel.

Your personal data may be made available to employees of Aquinox on a need to know basis. We may also employ vendors or service providers to do work on our behalf, such as managing our Site, through which your data may be available. These vendors or service providers may be able to access this data to perform their work but they will not use it for any other purpose. Any third party is governed by contractual obligations between Aquinox and the third party, including obligations of confidentiality and protection of personal data.

• Third Parties Designated by You.

We may share your personal data with third parties where you have provided your consent for us to do so.

• Our Third Party Service Providers.

We may share your personal data with our third party service providers who provide services such as data analysis, information technology and related infrastructure provision, customer service, email delivery, auditing and other similar services. These third parties are only permitted to use your personal data to the extent necessary to enable them to provide their services to us. They are required to follow our express instructions and to comply with appropriate security measures to protect your personal data.

• Corporate Restructuring.

We may share personal data when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business or assets. These deals can include any merger, financing, acquisition, or bankruptcy transaction or proceeding.

• Other Disclosures.

We may share personal data as we believe necessary or appropriate: (a) to comply with applicable laws; (b) to comply with lawful requests and legal process, including to respond to requests from public and government authorities to meet national security or law enforcement requirements; (c) to enforce our Privacy Policy; and (d) to protect our rights, privacy, safety or property, and/or that of you or others.

6. Anonymous Data

When we use the term “anonymous data,” we are referring to data and information that does not permit you to be identified or identifiable, either alone or when combined with any other information available to a third party.

We may create anonymous data from the personal data we receive about you and other individuals whose personal data we collect. Anonymous data might include analytics information and information collected by us using cookies. We make personal data into anonymous data by excluding information (such as your name) that makes the data personally identifiable to you. We use this anonymous data to analyze usage patterns in order to make improvements to our Site.

7. Security

Aquinox uses a variety of security technologies and precautions to protect your personal data
from unauthorized access and use. Unfortunately, personal data transferred over
the internet or via a mobile phone network is not always completely secure. Any
transmission of personal data is at your own risk, including information
relating to your health. Although we do our best to protect your personal data,
you must weigh both the risks and benefits when submitting personal data to Aquinox
through our Site. If we receive notice that your information has been lost or
misused, we will take appropriate technical security measures to appropriately
address these events, and take steps to notify in compliance with any statutory
obligations.

8. Transferring of data abroad

Any information you provide to Aquinox by using our Site may be stored, processed, transferred to
and accessed from Canada, the United States and other countries, where (a) it may be subject to the lawful access requirements of a foreign government and (b) data protection and privacy regulations may not offer the same level of protection as in other parts of the world. By using our Services, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

How long do we keep your data for?

To maximize privacy protection, we delete your personal data after it is no longer required for
legal or business purposes, unless a longer retention period is required or permitted by law (for example for regulatory purposes).

9. Protecting the personal data of children

We are committed to protecting the privacy of children and the services on this Site are intended
for persons over the age of 18. Unless explicitly stated we do not knowingly collect personal data from children under the age of 16. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us. We will delete such information from our files as soon as reasonably practicable.

10. Links to external websites

Our privacy policy only applies to this Site and does not apply to third-party websites. From time
to time we may provide links to other websites that we think may be of interest to you. Due to the nature of the internet, we cannot guarantee that these websites are of the same high standards as this Site, and we cannot take responsibility for the contents of their website or guarantee your privacy on those websites.

11. Your Rights

• Opt-out.

You may contact us anytime to opt-out of: (i) direct marketing communications; (ii) our collection of sensitive personal data; (iii) any new processing of your personal data that we may carry out beyond the original purpose; or (iv) the transfer of your personal data outside of your country. Please note that your use of some of the Site may be ineffective upon opt-out.

• Access.

You may access the information we hold about you at any time by contacting us directly.

• Amend.

You can also contact us to update or correct any inaccuracies in your personal data.

• Move.

Your personal data is portable – i.e. you to have the flexibility to move your data to other service providers as you wish.

• Erase and forget.

In certain situations, for example when the information we hold about you is no longer relevant or is incorrect, you can request that we erase your data.

If you wish to exercise any of these rights, please contact us. In your request, please make clear: (i) what personal data is concerned; and (ii) which of the above rights you would like to enforce. For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable and in any event, within one month of your request. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting such change or deletion.