Privacy Policy

Last updated: 10/19/2021

Phathom Pharmaceuticals (“Phathom”) is committed to protecting your privacy. We have prepared this Privacy Policy to
describe to you our practices regarding the Personal Data (as defined below) we collect from users of our websites,
products and services, and the rights and choices available to individuals with respect to their information with links
or other specific references to this Privacy Policy.

We may provide additional privacy notices to individuals at the time we collect their information. For example, we
provide a specific privacy notice to clinical trial participants that describe our privacy practices in connection with
conducting clinical trials. This type of an “in-time” notice will govern how we may process the information you provide
at that time.

Questions; Contacting Phathom. If you have any questions or comments about our Privacy Policy, please contact us
at the following:

Phathom Pharmaceuticals
100 Campus Drive
Suite 102
Florham Park, NJ 07932
Attn: Privacy Office

Email: privacy@phathompharma.com
User Consent. PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING OUR WEBSITE. By visiting our websites, you
agree to the terms of this Privacy Policy and you expressly consent to the collection, use, and disclosure of
your Personal Data in accordance with this Privacy Policy. If you do not agree with the Privacy Policy, you are
not authorized to access or use or provide information through our websites.A Note About Children. We do not intentionally gather Personal Data from visitors who are under the age of 13.
If we discover that a child under 13 has submitted Personal Data to Phathom, we will attempt to delete the
information as soon as possible. If you believe that we might have any Personal Data from a child under 13,
please contact us at privacy@phathompharma.com
Investors. You may provide information to us when visiting the Investors & Media page of our corporate
website, such as your name and contact information. We use this information to communicate with you and respond
to your requests, to operate our website, to comply with law and for other compliance, fraud prevention, and
safety purposes. We may share this information with our affiliates, service providers, and professional
advisors, to comply with law, for compliance, protection and safety, and in the event of a business transfer,
each as explained below.
A Note to Users Outside of the United States. Your Personal Data may be processed in the country in which it was
collected and in other countries, including the United States, where laws regarding the processing of Personal
Data may be less protective than the laws in your country. By providing your data, you consent to such
processing and transfer.
Whose Personal Information We CollectWe may collect personal information about:
- Clinical trial participants, patients, or patients’ family members
- Physicians and other health care professionals, including clinical trial investigators, researchers, and
  pharmacists
- Representatives of businesses with which we engage
- Job applicants, investors, website visitors and other individuals who interact with us, including
  through social media
How We Collect Personal InformationWe may collect personal information from various sources, such as:
- Directly from individuals
- Through our websites and social media platforms
- From contract research organizations and clinical trial sites
- From government agencies or public records
- From industry and patient groups and associations
- From our third-party service providers who may collect information on our behalf
- From other third parties (e.g., business contact information that we may acquire from data brokers)
Types of Data We Collect. “Personal Data” means data that, by itself, allows someone to identify or contact you
as an individual, including, for example, your name, address, telephone number, e-mail address, as well as any
other non-public information about you that is associated with or linked to any of the foregoing data.
“Anonymous Data” means data that does not, by itself, permit the identification of individual persons and that
is not associated with or linked to Personal Data.We may collect the following types of data:
- Contact information (personal and business), such as your name, address, phone number,
  email address and any other information you provide to us
- Health and medical information, such as medical insurance details, information about
  physical health conditions and diagnoses, treatments for medical conditions, genetic information, family
  medical history, and medications an individual may take, including the dosage, timing, and frequency
  that we collect in connection with managing clinical trials, conducting research, providing patient
  support programs and tracking adverse event reports
- Demographic information, such as date of birth, age, gender and marital status
- Correspondence and other information you provide to us, including in emails, on phone
  calls, and in market research surveys
- Professional credentials, educational and professional history and institutional
  affiliations
- Engagement information, such as information about the programs and activities in which
  you have participated, your prescribing of our products, your use of our products and the agreements you
  have executed with us
- Publicly available information, including comments describing support for and
  experience with Phathom products and information that you or others publish on social media,
  testimonials, blogs or other forums, such as tweets, comments, photographs, or video or audio content
- Information Collected via Technology.
- Information Collected by Our Servers. To make our websites more useful to you, our servers (which may be
  hosted by a third-party service provider) may collect information from your computer or device,
  including but not limited to:
  - The date and time of your visit and the web pages, content, and advertisements you view and
    links you click on while navigating within our websites;
  - Information about the type of content accessed via our websites;
  - The site you visited before and after visiting our websites;
  - Your Internet Protocol (IP) address (a numerical address assigned to your computer by your
    Internet service provider so that other computers connected to the Internet can communicate with
    your browser online) that can sometimes be used to derive your general geographic area;
  - Search terms you enter on a referral site;
  - Information about your device such as your device type, browser type, language, and other
    settings, memory capacity, plug-ins, Internet domain, advertising identifiers, TCP configuration
    parameters, operating system, time zone and the names, versions, and package IDs of software
    installed on your device; and
  - Information collected through cookies and other tracking technologies (see additional
    descriptions of these terms below).
- Like many online services, we use cookies to collect information. “Cookies” are small pieces of
  information that a website sends to your computer’s hard drive while you are viewing the website. We may
  use both session Cookies (which expire once you close your web browser) and persistent Cookies (which
  stay on your computer until you delete them) to provide you with a more personal and interactive
  experience on our websites. We may use cookies to let us know that you are a prior user of the website
  and to retrieve certain information previously provided by you. We also may use cookies to keep track of
  information about your current session which will be discarded as soon as you log out or close your web
  browser. This information also allows us to statistically monitor how many people are using our websites
  and for what purpose. However, if you do not wish to receive cookies, or want to be notified of when
  they are placed, your internet browser may permit you to do so. In many internet browsers, you can
  change the browser settings to warn you before accepting cookies or to block cookies. If you block
  cookies, you may not be able to use certain website features or functions, or the Website may not
  operate in an optimal mode.
- Pixel Tags. In addition, we use “Pixel Tags” (also referred to as clear Gifs, Web beacons, or Web bugs).
  Pixel Tags are tiny graphic images with a unique identifier, similar in function to Cookies, that are
  used to track online movements of Web users. In contrast to Cookies, that are stored on a user’s
  computer hard drive, Pixel Tags are embedded invisibly in Web pages.
- Do Not Track. We do not currently respond to “do not track” signals from web browsers.
- Analytics Services. We use third-party analytics services including Google Analytics (“Analytics
  Services”), to help analyze how users use our websites. The information generated by the Cookies or
  other technologies about your use of our websites (the “Analytics Information”) is transmitted to the
  Analytics Services. The Analytics Services use Analytics Information to compile reports on user activity
  and your use of the website and to provide other services relating to website activity and Internet
  usage. The Analytics Services may also transfer the Analytics Information to third parties where
  required to do so by law, or where such third parties process Analytics Information on their behalf.
  Each Analytics Service’s ability to use and share Analytics Information is restricted by such Analytics
  Service’s terms of use and privacy policy. By using our websites, you consent to the processing of data
  about you by Analytics Services in the manner and for the purposes set out above. For a full list of
  Analytics Services, please contact us at info@phathompharma.com. To learn more about how Google uses
  data, visit google.com/policies/privacy/partners/.
Use of Your Personal DataWe may use personal information for the following purposes and as otherwise described in this Privacy Policy or
at the time of collection:

For our general administrative and quality assurance purposes, including to improve our level of
services.

To perform and administer clinical trials, research and product-improvement
activities, including to:
- Facilitate clinical trials, research, studies, and related activities that support product improvement
- Staff and manage clinical trials, including by recruiting investigators and participants
- Track and respond to safety and product quality concerns
- Support public health initiatives, symposia, conferences, and scientific, educational and volunteer
  events
- Facilitate medication adherence programs
- Define and manage appropriate patient engagement activities, and patient support programs (including to
  provide co-pay and other financial assistance where available)
- Identify and engage thought leaders and external experts
- Award sponsorships and grants
- Attribute authorship to academic and promotional materials
To facilitate access to our products, including to provide financial support when appropriate
in connection with the purchase and/or use of our products

To communicate with you about Phathom, our websites, products and services

To operate our websites, including by personalizing your experience on our websites

For compliance, fraud prevention, and safety, including as we believe necessary or appropriate
to:
- Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or
  requests from government authorities
- Comply with regulatory monitoring and reporting obligations, such as those related to adverse events,
  product complaints, safety, and financial disclosures
- Protect our rights, privacy, safety or property, and/or that of you or others
- Protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity,
  including intellectual property infringements, violations of our terms of use, or other misuse of our
  websites
To market our products and services to you. We may send you Phathom-related marketing
communications. Our marketing communications may be tailored to you and your interests, and we may use your
personal information to improve the content of our advertising and communications. We will not send you any
marketing communication unless you consent to receive such communications from us, and you will always have the
ability to opt out of such communications as described in Paragraph 11(c) below.

To create Anonymous Data. We may create Anonymous Data from your personal information and other
individuals whose personal information we collect. We make personal information into anonymous, aggregated or
de-identified data by excluding information that makes the data personally identifiable to you and use and share
that data for our business purposes.
Disclosure of Your Personal Data. We disclose your Personal Data as described below and as described elsewhere
in this Privacy Policy.
- (a) Third-Party Service Providers. We may share your Personal Data with third-party service providers that provide services on our behalf including, but not limited to:
  - Contract research organizations and investigators
  - Data storage and analytics providers, and other information technology and communications vendors
  - Customer service (including our medical information line) and patient support providers (including for
    product quality and adverse event reporting, patient co-pay assistance, etc.)
  - Product recall administration vendors
- (b) Advertising partners. Our advertising partners may collect information directly from our websites for
  marketing purposes using cookies and other tracking technologies.
- (c) Affiliates. We may share some or all of your Personal Data with our parent company, subsidiaries, joint
  ventures, or other companies under common control with Phathom (“Affiliates”), in which case we will require our
  Affiliates to honor this Privacy Policy.
- (d) Corporate Restructuring. We may share some or all of your Personal Data in connection with or during
  negotiation of any merger, financing, acquisition or dissolution transaction or proceeding involving the sale,
  transfer, or divestiture of all or a portion of our business or assets. In the event of an insolvency,
  bankruptcy, or receivership, Personal Data may also be transferred as a business asset. If another company
  acquires our company, business, or assets, that company will possess the Personal Data collected by us and will
  assume the rights and obligations regarding your Personal Data as described in this Privacy Policy.
- (d) Other Disclosures. Regardless of any choices you make regarding your Personal Data (as described below),
  Phathom may disclose Personal Data if it believes in good faith that such disclosure is appropriate (a) in
  connection with any legal investigation or proceeding; (b) to comply with relevant laws or to respond to
  subpoenas or warrants served on Phathom; (c) to protect or defend the rights or property of Phathom, its
  affiliates or its users; and/or (d) to investigate or assist in preventing any violation or potential violation
  of the law, this Privacy Policy, our applicable Terms of Use Agreement, or any other contractual arrangement.
Third-Party Websites. Our websites may contain links to third-party websites. When you click on a link to any
other website, you will leave our website and go to another site, and another entity may collect Personal Data
or Anonymous Data from you. We have no control over, do not review, and cannot be responsible for, these outside
websites or their content. Please be aware that the terms of this Privacy Policy do not apply to these outside
websites, or to any collection of your Personal Data after you click on links to such outside websites. We
encourage you to read the privacy policies of every website you visit. The links to third-party websites are for
your convenience and do not signify our endorsement of such third parties or their products, content, or
services.
Your Choices Regarding Information. You have several choices regarding the use of information on our Service:
(a) Cookies. If you decide at any time that you no longer wish to accept Cookies for any of the purposes
described above, then you can instruct your browser, by changing its settings, to stop accepting Cookies or to
prompt you before accepting a Cookie from the websites you visit. Consult your browser’s technical information.
If you do not accept Cookies, however, you may not be able to use all portions of the website or all
functionality of the website. If you have any questions about how to disable or modify Cookies, please let us
know at the contact information provided above.

(b) Google Analytics. You may prevent your data from being collected and used by Google Analytics by opting out
through the use of the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout/.

(c) Accessing, Changing or Deleting Your Personal Data. You may request to access, change or correct
inaccuracies in, or delete your Personal Data. All such requests must be made in writing and sent to privacy@phathompharma.com. If you request deletion of your
Personal Data by us, we will use commercially reasonable efforts to honor your request, but please note that we
may be required to keep such information and not delete it (or to keep this information for a certain time, in
which case we will comply with your deletion request only after we have fulfilled such requirements). When we
delete any information, it will be deleted from the active database, but may remain in our archives. We may also
retain your information for fraud prevention or similar purposes.
Risk of Disclosure. No Internet transmission is ever 100% secure or error-free. More specifically, information
transmitted to or from the website may not be via a secure connection. As a result, you should take particular
care in deciding what information you send via our website.
Retention. We will retain your Personal Data as long as necessary to provide you the services offered there
through and the other permitted uses specified herein, and for a reasonable transition time thereafter. We may
store Anonymous Data (i.e., information that is not Personal Data) indefinitely.
Changes to This Privacy Policy. This Privacy Policy may be updated from time to time for any reason. We will
notify you of any changes to our Privacy Policy by posting the new Privacy Policy at www.phathompharma.com/privacyand we will change the
“Last Updated” date above. You should consult this Privacy Policy regularly for any changes.