Privacy Policy

Arbutus Medical Inc. is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard personal information through our website and business operations. By using this website, you agree to the practices described in this policy.

Effective Date: March 31, 2026
Last Updated: March 31, 2026

1. INTRODUCTION
   1. Arbutus Medical Inc. (“Arbutus”, “Company”, “we”, “us”, or “our”) is committed to protecting personal information and maintaining transparent and responsible data handling practices.
   2. This Privacy Policy describes how Arbutus collects, uses, discloses, and safeguards personal information in connection with its website, business relationships, and internal operations.
   3. This Policy is intended to comply with applicable Canadian privacy laws, including PIPEDA, and relevant U.S. privacy frameworks.
2. ACCOUNTABILITY AND GOVERNANCE
   1. Arbutus maintains internal policies and procedures to protect personal information.
   2. A designated Privacy Lead oversees compliance and governance.
   3. Data handling practices are periodically reviewed.
3. INFORMATION COLLECTED
   1. The Company may collect identifiers (name, email, phone), commercial data (orders, transactions), technical data (IP address, usage), and employment-related information.
4. PURPOSE OF USE
   1. Personal information is used to manage relationships, process transactions, respond to inquiries, improve systems, and comply with legal obligations.
   2. Arbutus does not sell personal information.
5. DISCLOSURE OF INFORMATION
   1. Personal information may be disclosed to service providers, advisors, logistics partners, and authorities as required by law.
   2. Third parties are required to maintain confidentiality and appropriate safeguards.
6. COOKIES AND TRACKING
   1. The Website uses cookies and analytics tools to monitor usage and improve functionality. We use cookies and similar technologies to ensure our website functions properly, understand how visitors use our site, and improve user experience. Cookies are small text files stored on your device. You can control or disable cookies through your browser settings; however, doing so may affect website functionality.
   2. Users may disable cookies through browser settings.
7. CROSS-BORDER TRANSFERS
   1. Personal information may be processed in Canada and the United States.
   2. Individuals consent to such transfers subject to safeguards.
8. DATA SECURITY
   1. Arbutus implements reasonable safeguards including access controls, secure systems, and limited access
   2. While no system is fully secure, commercially reasonable measures are in place.
9. DATA RETENTION
   1. Information is retained only as long as necessary for business and legal purposes.
   2. Data is securely deleted or anonymized when no longer required.
10. INCIDENT RESPONSE
    1. In the event of a data breach, Arbutus will investigate, contain, assess, and notify as required by law.
11. HIPAA POSITION
    1. Arbutus does not collect or process Protected Health Information (PHI).
    2. The Company is not a HIPAA covered entity or business associate.
12. INDIVIDUAL RIGHTS
    1. The Company is not a HIPAA covered entity or business associate.
13. CONTACT INFORMATION
    

    Privacy Lead
    Livleen Veslemes
    office@arbutusmedical.ca
    Arbutus Medical Inc.