Introduction

This privacy policy (“Policy”) applies to all UroGen Pharma Ltd. and UroGen Pharma, Inc. (“UroGen,” “we,” or “us”) websites, online resources or digital services, and other online and offline services we provide (collectively, the “Services”), including www.urogen.com and other websites that link to this Policy. This Policy explains how we collect, use, and disclose Personal Data collected through our Services. Please be sure to read this entire Privacy Policy before using the Services.

From time to time we may make changes to this Policy to reflect changes in our legal obligations or the ways in which we process your Personal Data. When changes are made, we will post the updated Policy here with the effective date of its revision. We suggest routinely visiting this page to ensure you have reviewed the current Policy.

Residents of some U.S. states may have certain rights with respect to the collection, processing, and disclosure of their Personal Data. For more information, please see our California Supplemental Privacy Policy posted below and our Consumer Health Data Privacy Policy posted separately.

DISCLAIMER: The content appearing on UroGen websites or web-based resources (the “Sites”) is presented exclusively for informational purposes. You should understand that UroGen does not use the Sites to provide medical advice, financial advice, or legal advice. You should not rely on any statements made on the Site as though it were professional advice. The Sites may provide selected information concerning diseases and their treatment. Such information is not intended or provided as medical advice. Such information is not a substitute for the advice of a trained health care professional. If you have or suspect having any health problems or conditions, you should consult your general practitioner or other qualified health care provider.

1. Contact and Policy Updates

   You may contact UroGen at Privacy@urogen.com. Alternatively, you may contact us at:

   UroGen Pharma, Inc.400 Alexander Park DrivePrinceton, NJ 08540Attention: Legal Department

2. What Personal Data Do We Collect?

   We and our vendors collect two types of Personal Data from you: (1) information provided by you when you interact with us; and (2) information passively collected from you when you use our Services.

   • Information Provided by You. We and our vendors collect Personal Data you voluntarily provided to us, such as when a consumer contacts us via our Services, fills out our forms, sends us an email, interacts with our social media accounts, or otherwise interacts with us. We typically collect the following categories of Personal Data in this manner:
     • Contact information, such as your name, mailing address, telephone number, and email address.
     • Insurance information, such as health insurance information.
     • Characteristics of protected classifications under state or federal law, such as age, gender, and other demographic data.
     • Commercial information, such as contact and product preferences, languages, marketing preferences, and demographic data.
     • Audio/electronic recordings, such as recordings of customer service calls.
     • Sensitive personal information including social security number and health information.
   • Information Passively Collected from You. We collect Personal Data passively through our Services, such as via cookies and other tracking technologies, for our legitimate business interests. This information may include:
     • Identifiers, such as IP address and other unique identifiers.
     • Geolocation data, such as geographic location.
     • Commercial information, such as product preferences, languages, and marketing preferences.
     • Internet or other electronic network activity information, such as browsing history, interaction with our Sites, and other information provided by your web browser or device.

   Further information concerning passive information collection on our Sites can be found below, in the section titled How Do Our Sites Use Cookies and Other Tracking Technologies.

3. Purposes for Processing Personal Data

   We may collect, process, and disclose the Personal Data we collect about consumers to:

   • Operate, manage, and maintain our business.
   • Provide, develop, improve, repair, and maintain our products and services.
   • Personalize, advertise, and market our products and services.
   • Conduct research, analytics, and data analysis.
   • Better understand consumer's needs, preferences and interests, and understand how consumers our interacting with our Sites.
   • Maintain our facilities and infrastructure.
   • Undertake quality and safety assurance measures.
   • Conduct risk and security controls and monitoring.
   • Detect and prevent fraud.
   • Perform identity verification.
   • Perform accounting, audit, and other internal functions, such as internal investigations.
   • Comply with law, legal process, and internal policies.
   • Maintain records.
   • Exercise and defend legal claims.
   • Otherwise accomplish our business purposes and objectives.

   Where permitted by law, we may combine Personal Data you provide with other information you've provided to UroGen through our Services. Where permitted by law, we may also combine Personal Data collected through our Services with information provided to us by vendors and third parties. We may also aggregate and/or anonymize Personal Data and analyze those data for statistical or any other purposes permitted by law.

4. How Do Our Sites Use Cookies or Other Tracking Technologies?

   Cookies. Our Sites may use a tracking technology called a “cookie.” A cookie is a small data file that a website can place on your computer's hard drive, where your internet browser files are kept. Cookies enable us to recognize when a computer being used to browse our websites has previously visited a UroGen Site. Cookies can also be used to enable a site to “remember” the information a visitor has previously inputted. Cookies may be placed on your computer both by us and by third parties with whom we have a relationship, such as web analytic services and advertising network services.

   Web Beacons. On certain web pages or in emails we send to you, we may utilize a technology called a “web beacon” (also known as an “action tag” or “clear GIF technology”). We may use web beacons to help determine which email messages sent by us were opened and whether a message was acted upon. Web beacons also help analyze the effectiveness of websites by measuring the number of visitors to a site or how many visitors clicked on key elements of a site.

   Social Plugins. Our Sites may use social plugins (e.g., the Facebook “Like” button) to enable you to easily share information with others. When you visit our Sites, the operator of the social plugin may be able to place a cookie on your computer, enabling that operator to recognize individuals who have previously visited our Sites. If you have previously logged into the associated social media website (e.g., Facebook) before browsing on our website, the social plugin allows that social media website to receive information about your visit to particular pages on our Site. The social plugin may collect this information for any such visitors who have logged into social networks, whether or not they specifically interact with the plugin on our websites (e.g., by clicking “Like” or “Share”). The social plugin may also allow the social media website to share information about your activities on our Sites with other users of their social media website. For further details about the information shared via a particular social media plugin, you should refer to that social media site's privacy statement.

   Google Analytics. Google Analytics may be used to help make our Sites work better and to help us understand what parts of the Sites are being utilized. Google Analytics uses technical tools such as, first-party cookies and JavaScript code, to collect information about visitors. Google Analytics service tracks visitors to the site who have JavaScript enabled. Google Analytics tracks how visitors interact with a website, including where they came from and what they did on a site. Google Analytics collects the information set forth above from users.

   This information is used to administer and update the website, and we will also assess whether the visitors to the site match the expected site demographics and determine how key audiences are navigating the content. Google's ability to use and share the information collected by Google Analytics about your visits to this Site is addressed in the Google Analytics Terms of Service, available at http://www.google.com/analytics/terms/us.html, and the Google Privacy Policy, available at http://www.google.com/policies/privacy/. You may learn more about how Google collects and processes data specifically in connection with Google Analytics at http://www.google.com/policies/privacy/partners/. You may prevent your data from being used by Google Analytics by downloading and installing the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout/.

   As mentioned above, we may use cookies and other tracking technologies for a number of purposes. For example, we may use cookies to “remember” information you have entered on our site, like your email login to your UroGen account, if any. We may use cookies to track user traffic patterns. We do this in order to determine the usefulness of the information we supply to you and other users and to see how effective our navigational structure is in helping users reach that information.

   What choices do you have about cookies and other tracking technologies?

   The European Interactive Digital Advertising Alliance maintains a website where consumers can opt out from receiving interest-based advertising from some or all of the network advertising companies participating in the program (www.youronlinechoices.eu). In the U.S., the Digital Advertising Alliance and the Network Advertising Initiative maintain two separate website tools where consumers can opt out from receiving interest-based advertising from some or all of their participating members, available at (http://optout.aboutads.info/) and (http://optout.networkadvertising.org/?c=1) respectively.

   In addition, depending on your internet browser, you may be able to change your browser settings to block and/or erase cookies from your device. You can check your browser instructions to learn more about these functions. Please be aware that some functionality on some of our Sites use cookies and may not be available should you choose to refuse all cookies.

   Please note that we make no representations regarding the functionality of any of these external opt-out mechanisms, and further, opting out through these external opt-out mechanisms will not preclude the use of your data by other analytics services that we may use.

5. Does UroGen Disclose Your Personal Data to Other Entities?

   We may disclose your Personal Data in the following situations:

   • To our affiliates, in compliance with applicable laws.
   • To vendors that process Personal Data on our behalf, including service providers who monitor and maintain our websites, provide data hosting services, information technology support, email hosting services, marketing and analytics services, and prepare newsletters and mailings. We generally impose contractual limitations on our vendors' use of Personal Data they collect in conjunction with providing services to us.
   • To third parties who process Personal Data for their own purposes, including marketing and analytics service providers.
   • To third parties when we have a reason to believe that such disclosure is necessary to identify, contact, or bring a legal action against someone who may be causing injury to or interference with our rights and property or those of any other person.
   • To government or judicial authorities to comply with a subpoena, court order, governmental inquiries, legal process, legal obligation, or to protect the rights, property, safety of others or the public.
   • To a successor entity or purchaser upon a merger, consolidation, or other corporate reorganization in which we participate, a sale of all or a portion of our assets, or pursuant to a financing arrangement. In this situation, we will seek assurances that the successor entity or purchase will process Personal Data collected by us in accordance with this Policy, unless the successor entity provides you with a new notice setting out the new terms of its privacy practice.

   We may also disclose aggregated and/or anonymized data to any other entities to the extent permitted by law.

6. Additional Information for Individuals in the European Economic Area (EEA) and Israel

   What is Our Legal Basis for the Collection of Personal Data?

   We may process your Personal Data for the specific purposes listed in Section 3 above pursuant to the following bases:

   • Compliance with applicable laws or performance of a contract: In specific circumstances, we may need to process your Personal Data to comply with a relevant law/regulation or to fulfill our obligations under a contract to which you are subject. Where we process your information to meet our legal obligations, you will likely not be permitted to object to this processing activity, but you will usually have the right to access or review this information unless it would impede our legal obligations. Where we are processing to fulfill our contract obligations under a contract where you are a party, you might not be able to object to this processing, or if you do choose to opt-out or object to our processing, it may impact our ability to perform a contractual obligation that you are owed.
   • Our legitimate interests: We may process your information based on our legitimate interests in communicating with you and managing our interactions with you regarding our products, services, and educational opportunities. In addition to the other rights you may have described below, you have the right to object to such processing of your information. You can register your objection by contacting us as described above.
   • Your consent: In some cases, at the point at which you provide information, we may ask you for your consent to collect and process your information. If you choose to provide us with your consent, you may later withdraw your consent (or opt-out) by contacting us as described in the “how do you contact us” section below. Please note that if you withdraw your consent, it will not affect any processing of your information that has already occurred. Where we process your information based on consent, we will provide more detailed information to you at the time when we obtain your consent.

   Will UroGen Transfer Your Personal Data Internationally?

   UroGen is headquartered in the United States, and we process Personal Data we collect in the United States. Accordingly, if you are located in the EEA or Israel and you use our Services, your Personal Data may be processed in the United States, which may provide a lower standard of privacy protection than your country of residence. Where required by law, we take measures to protect your Personal Data when we transfer it outside the EEA or Israel to the United States or other countries that do not provide an adequate level of privacy protection, including by implementing standard contractual clauses. For more information, you can contact us at Privacy@urogen.com.

   What Are Your Rights With Respect to Your Personal Data?

   Consumers in the EEA and Israel have certain rights with respect to the processing of their data information, as listed below, subject to applicable law and certain exceptions:

   • Access. You can request access to your Personal Data.
   • Correction. You can request corrections to any inaccurate or incomplete Personal Data we maintain about you.
   • Deletion. You can request deletion of your Personal Data.
   • Restriction of Processing. You can request that we limit the processing of your Personal Data in certain contexts.
   • Data Portability. You can request to receive your Personal Data in a structured, commonly-used, and machine-readable format and have the right to transmit that information to another data controller.
   • Object to Processing. You can object to our processing of your Personal Data in certain contexts.
   • Withdraw Consent. To the extent our processing of Personal Data about you is based on your consent, you can withdraw your prior consent, provided that such withdrawal will not affect the lawfulness of processing of your Personal Data prior to such withdrawal.
   • Complain to a Supervisory Authority. You have the right to lodge a complaint with a supervisory authority.

   To exercise any of these rights, please contact us at Privacy@urogen.com.

7. Is this Website Intended for Children?

   Our Services are not intended for children. We do not knowingly collect any Personal Data from children under 16-years old. However, if the parent or the guardian of a child under 16 years old believes that the child has provided us with Personal Data, the parent or guardian of that child should contact us at Privacy@urogen.com to request the information's deletion. Information about anyone under 16 years old should only be provided to UroGen by their parent or guardian voluntarily.

8. What Automated Decisions are Made Using Your Personal Data?

   We do not use your Personal Data to make any automated decisions.

9. How Secure Is the Personal Data You Provide?

   UroGen implements reasonable security measures to protect your Personal Data from unauthorized disclosure or access, as well as accidental or unlawful destruction, loss, or alteration. However, no internet transmission is ever completely secure or error free. Any information you choose to disclose to us is done at your own risk. If you create an account on the Services, it is your responsibility to protect your access credentials from unauthorized access or use.

10. For How Long Does UroGen Retain Your Personal Data?

    All data collected through our Sites is retained for 5 years or until your Personal Data no longer serves our legitimate business purposes, whichever is sooner. We retain Personal Data collected through our other Services for the time needed to fulfill our legitimate and lawful business purposes and comply with applicable laws and regulations.

11. Does this Policy Apply to External Linked Sites?

    Our Services also may contain links to external websites that are owned by other entities. If you decide to use these links, you will leave our Services. We do not endorse and are not responsible for the content or privacy practices of external websites or resources, and this Policy does not apply to any sites that are not affiliated with UroGen, even if you access them via a link on our site. If you decide to leave our Services and share your Personal Data with other sites, it will be at your own risk. You should review the privacy policies of any third-party site before providing any information.

Last updated: June 2026