The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”), gives California residents certain rights and requires businesses to make certain disclosures regarding their collection, use, and disclosure of Personal Information. This California Job Applicant Privacy Notice (the “CCPA Notice”) provides such notice to UroGen Pharma, Inc., (UroGen, “we,” “us,” “our”) job applicants and prospective job applicants who are residents of California.

Please note that this CCPA Notice only applies to UroGen's collection, use, and disclosure of Personal Information in the job application context and only applies to residents of California. This CCPA Notice does not apply to individuals who are residents of other U.S. states or other countries and/or who do not interact with UroGen as an Applicant. For further details about our privacy practices pertaining to non-Applicant Personal Information, please see our Privacy Policy.

As an Applicant, you have the right to know what categories of Personal Information UroGen Collects, uses, discloses, Sells, and Shares about you. This CCPA Notice provides that information and other disclosures required by California law.

1. Definitions
   • Personal Information: As used in this CCPA Notice, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household. Personal Information includes Sensitive Personal Information, but does not include protected health information covered by the Health Insurance Portability and Accountability Act (“HIPAA”), nonpublic personal information under the Gramm-Leach-Bliley Act (“GLBA”), or any other information which is exempt from the CCPA.
   • Sensitive Personal Information: As used in this CCPA Notice, “Sensitive Personal Information” includes Personal Information that reveals an Applicant's (i) social security number, driver's license, state identification card, or passport number, (ii) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, (iii) precise geolocation, (iv) racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership, (v) mail, email, and text messages contents, unless UroGen is the intended recipient of the communication, (vi) genetic data, or (vii) neural data. Sensitive Personal Information also includes biometric information for the purpose of uniquely identifying an Applicant, Personal Information concerning an Applicant's health, and Personal Information concerning the Applicant's sex life or sexual orientation.
   • Other CCPA Definitions: As used in this CCPA Notice, the terms “Collect,” “Processing,” “Service Provider,” “Third Party,” “Sale,” “Share,” “Consumer,” and other terms defined in the CCPA and their conjugates, have the meanings afforded to them in the CCPA, whether or not such terms are capitalized herein, unless contrary to the meaning thereof.
2. Applicant Personal Information We Collect

   We collect and have collected in the past 12 months the following categories of Personal Information about Applicants:

   1. (1) Identifiers, such as name, alias, online identifiers, account name, physical characteristics or description;
   2. (2) Contact and financial information, including phone number, address, email address, and financial information;
   3. (3) Characteristics of protected classifications under state or federal law, such as age, gender, race, physical or mental health conditions, and marital status;
   4. (4) Internet or other electronic network activity information, such as browsing history and interactions with our websites or advertisements;
   5. (5) Audio, electronic, visual and similar information, such as call and video recordings;
   6. (6) Professional or employment-related information, such as work history and prior employer;
   7. (7) Education information, as defined in the federal Family Educational Rights and Privacy Act, such as student records and directory information;
   8. (8) Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual's preferences and characteristics; and
   9. (9) Sensitive Personal Information, including:
      • Personal Information that reveals:
        • Social security, driver's license, state identification card, or passport number;
        • Racial or ethnic origin.
3. Purposes for Collecting, Processing, & Disclosing Applicant Personal Information

   We collect, process, and disclose, and we have collected, processed, and disclosed in the past 12 months, the categories of Personal Information listed in Section B above for the following purposes:

   • Evaluate a potential employment relationship with you;
   • Perform background checks and verify past employment, educational history, professional standing, disqualifications, debarments, exclusions, and other qualifications;
   • Evaluate, determine, and arrange compensation, payroll, and benefits;
   • Assess your fitness and physical capacity for work; and
   • Contact you regarding your application.

   In addition to the purposes identified above, UroGen may use and disclose Applicant Personal Information that we collect as necessary or appropriate to:

   • Comply with laws and regulations, including, without limitation, applicable tax, health and safety, anti-discrimination, immigration, labor and employment, and social welfare laws;
   • Monitor, investigate, and enforce compliance with and potential breaches of UroGen policies and procedures and legal and regulatory requirements;
   • Comply with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and
   • Exercise or defend the legal rights of UroGen and its employees, affiliates, customers, contractors, and agents.

   We may also deidentify any Personal Information, including any Sensitive Personal Information, that we collect about you. When we do so, we take reasonable measures to ensure that the information cannot be associated with an Applicant or household, and we maintain and use the information in deidentified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements. After it has been deidentified, the information is no longer Personal Information and is not subject to this CCPA Notice.

4. Purposes for Collecting, Processing, & Disclosing Sensitive Personal Information

   We, and our Service Providers, collect, process, and disclose the categories of Sensitive Personal Information described in this CCPA Notice only as reasonably necessary for:

   • Performing the services or providing the goods reasonably expected by an average Applicant who requests those goods or services;
   • Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information;
   • Resisting malicious, deceptive, fraudulent, or illegal actions directed at us and prosecuting those responsible for those actions;
   • Ensuring the physical safety of natural persons;
   • Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of an Applicant's current interaction with us, provided that we will not disclose the Applicant's Personal Information to a Third Party and/or not build a profile about the Applicant or otherwise alter the Applicant's experience outside the current interaction with the business;
   • Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
   • Verifying or maintaining the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us;
   • Collecting or processing Sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about an Applicant.
5. Retention of Applicant Personal Information

   We retain each of the categories of Personal Information listed above for the duration of your Applicant (and, if applicable, subsequent employee or contractor) relationship with us, as applicable, and longer as may be required by applicable laws or necessary for our legitimate business purposes.

6. Sale & Sharing of Applicant Personal Information

   We generally do not sell or share Personal Information that we collect about our Applicants. Under the CCPA, “sell” or “sold” means the disclosure of Personal Information to third parties for monetary or other valuable consideration, and “share” or “shared” means disclosure of Personal Information to third parties for cross-context behavioral advertising, regardless of whether the disclosure is made for monetary or other valuable consideration.

   However, we do sell and share, and we have sold and shared in the past 12 months, Personal Information that we collect in other contexts. This includes sale and sharing of online identifiers and browsing history of individuals, including our Applicants, who visit our websites to third party marketing and data analytics providers via cookies and other tracking technologies in order to personalize, advertise, and market our products and services; and to conduct research, analytics, and data analysis to and better understand consumer's needs preferences and interests and understand how consumers our interacting with our websites (collectively, “Cookies”).

   When we sell and share online identifiers and browsing history to third party marketing and data analytics providers, those third parties may then use the information they collect to provide you with personalized content.

   California Applicants have the right to opt out of the Sale/Share of their Personal Information and can do so by clicking the “Cookie Preferences” link on the footer of our websites and switching the “Do Not Sell or Share My Personal Information” toggle to the right and clicking “save”.

   We do not knowingly sell or share the Personal Information of consumers under the age of 16.

7. Disclosure of Applicant Personal Information

   We disclose and have disclosed in the past 12 months the categories of Personal Information listed in Section B, above, in the following contexts:

   • To our Affiliates and Service Providers. UroGen discloses the categories of Personal Information we collect to our affiliates and to our service providers who act on our behalf. For example, we use service providers to provide us with Applicant selection and related hiring services, benefits and wellness services, website services, as well as other products and services, such as web hosting, data analysis, customer service, infrastructure services, technology services, email delivery services, legal services, and other similar services. These service providers may need Personal Information about you to perform their obligations. We contractually require our service providers to keep the Personal Information they process on our behalf confidential and to use it only to provide services on our behalf.
   • As Described in a Privacy Notice or With Your Consent. We may disclose Personal Information as described in any privacy notice we provide to you, or with your consent if we obtain it from you in a particular context.
   • In Aggregate or De-Identified Form. We may aggregate or de-identify the Personal Information we collect, and we may disclose aggregated and/or de-identified information to our vendors, and to third parties for our business operational purposes and for any other purposes permitted by applicable law.

   In addition to the purposes identified above, UroGen may also disclose Applicant Personal Information in the following contexts:

   • As Part of a Business Transfer. We may disclose Personal Information to a successor organization if, for example, we transfer the ownership or operation of all or a portion of our business to another organization, we merge with or are acquired by another organization, or if we liquidate our assets. If such a transfer occurs, we will seek assurances that the successor organization will treat the Personal Information we disclose to it in accordance with this CCPA Notice.
   • To Comply with Laws and Protect Our Rights and the Rights of Others. We may disclose Personal Information when we, in good faith, believe disclosure is appropriate to comply with the law, a court order, or a subpoena. We may also disclose Personal Information to prevent or investigate a possible crime, such as fraud or identity theft; to protect the security of our services; to enforce or apply our other agreements; or to protect our own rights or property or the rights, property, or safety of our users or others.
8. Sources from Which We Collect Applicant Personal Information

   We may Collect Personal Information directly from Applicants as well as from joint marketing partners, public databases, providers of demographic data, publications, professional organizations, educational institutions, social media platforms, consultants that assist with screening and onboarding, and service providers and third parties when they disclose information to us.

9. Data Subject Rights

   California Applicants have the following rights regarding our collection and use of their Personal Information, subject to certain exceptions.

   • Rights that Require Verification. You may exercise the data subject rights below via our data subject rights webform, by calling 855-987-6436, or by emailing us at Privacy@urogen.com. You may also authorize an agent to make data subject requests on your behalf. In such instances, authorized agents may use the same methods as you to submit the requests on your behalf. To help us protect your privacy and maintain security, we will take steps to verify your identity, by attempting to match your identity to the information stored in our files. If we cannot verify your identity based on this information, we will ask you to provide additional identifying information, and only use such additional information for the purposes of verifying your identity. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.
     • Right to Know: You have the right to know the following:
       • The categories of Personal Information we have collected about you;
       • The categories of sources from which such Personal Information was collected;
       • The business or commercial purpose for collecting, Selling, or Sharing Personal Information collected about you;
       • The categories of Third Parties to whom we disclose Personal Information collected about you;
       • The categories of Personal Information about you that we have Sold, and for each category, the categories of Third Parties to whom we Sold that particular category of Personal Information;
       • The categories of Personal Information about you that we disclosed for a business purpose, and for each category identified, the categories of Third Parties to whom we disclosed that particular category of Personal Information; and
       • The specific pieces of Personal Information that we have collected about you.
     • Right to Delete: You may request that we delete any Personal Information about you we that we collected from you.
     • Right to Correct: You may request that we correct any inaccurate Personal Information we maintain about you.
   • Rights that Do Not Require Verification
     • Right to Opt-Out of Sale & Sharing: You have the right to opt out of the sale and sharing of your Personal Information. click the “Cookie Preferences” link at the footer on every page of our website and switch the “Do Not Sell or Share My Personal Information” toggle to the right and click “save”.
     • Right to Limit the Use of Your Sensitive Personal Information: We do not use Sensitive Personal Information that we collect about Applicants for purposes other than those that are permitted by the CCPA regulations. But if we did, you would have the right to limit the use of your Sensitive Personal Information to the purposes permitted by the CCPA.
   • Opt-Out Preference Signals. We recognize opt-out preference signals that we are required to recognize for compliance with applicable law. Where required by the CCPA, we treat such opt-out preference signals as a valid request to opt-out of Sale/Sharing for the browser or device through which the signal is sent and any consumer profile we have associated with that browser or device, including pseudonymous profiles. Further, if we know the identity of the consumer from the opt-out preference signal, we will also treat the opt-out preference signal as a valid request to opt out of sale and sharing for such consumer. Consumers may use opt-out preference signals by downloading or otherwise activating them for use on supported browsers and setting them to send opt-out preference signals to websites they visit. However, our sites do not respond to “Do Not Track” signals sent by browsers, which are different from the opt-out preference signals described above.
   • Non-Discrimination. We will not discriminate against you for exercising your data subject rights. For example, we will not make hiring or similar decisions based on your exercise of your privacy rights.
10. Financial Incentives for California Consumers

    We do not provide financial incentives to California Applicants who allow us to collect, retain, sell, or share their Personal Information. We will describe such programs to you if and when we offer them to you.

11. Contact Us

    For general information on our privacy practices outside of the Applicant context, please see our Privacy Policy. If you have any questions regarding this CCPA Notice please contact us by calling us at 917-810-5537 or emailing us at privacy@urogen.com.

    If you are unable to review or access this notice due to a disability, you may contact UroGen at privacy@urogen.com to access this notice in an alternative format.

12. Changes to This CCPA Notice

    UroGen reserves the right to change this CCPA Notice at any time. When we make material changes to this CCPA Notice, we will notify you by posting an updated version of the CCPA Notice on this page and listing the effective date of such updates.

Last Updated: April 1, 2026