This Consumer Health Data Privacy Policy applies to “Consumer Health Data,” as that term has been defined by applicable laws, that UroGen Pharma, Inc. (“UroGen” or “we”) collects from Consumers (collectively referred to as “You”). Any terms appearing in this Consumer Health Data Privacy Policy that has been defined under applicable Consumer Health Data laws shall have the meanings afforded to them therein.

1. The Categories of Consumer Health Data that we may Collect from You

   Depending on the specific service or product offering that you use or receive and your interaction with us and our vendors, we may collect one or more of the following categories of Consumer Health Data from You:

   • Individual health conditions, treatment, diseases, or diagnosis
   • Social, psychological, behavioral, and medical interventions
   • Health-related surgeries or procedures
   • Use or purchase of prescribed medication
   • Bodily functions, vital signs, symptoms, or measurements of health information
   • Diagnoses or diagnostic testing, treatment, or medication
   • Reproductive or sexual health information
   • Biometric data
   • Adverse event information
   • Genetic data
   • Data that identifies a consumer seeking health care services
   • Any inferences of the above categories of health data derived or extrapolated from non-health information
2. How we may use Consumer Health Data

   We may use one or more of the categories of Consumer Health Data listed in Section 1 above for the following purposes:

   • Operate, manage, and maintain our business.
   • Provide, develop, improve, repair, and maintain our products and services.
   • Personalize, advertise, and market our products and services.
   • Conduct research, analytics, and data analysis.
   • Better understand consumer's needs, preferences and interests, and understand how consumers our interacting with our Sites.
   • Undertake quality and safety assurance measures.
   • Conduct risk and security controls and monitoring.
   • Detect and prevent fraud.
   • Perform identity verification.
   • Perform accounting, audit, and other internal functions, such as internal investigations.
   • Comply with law, legal process, and internal policies.
   • Maintain records.
   • Exercise and defend legal claims.
   • Otherwise accomplish our business purposes and objectives.
3. Categories of Sources from Which We May Collect Consumer Health Data

   We may collect these categories of Consumer Health Data directly from consumers, from cookies and other tracking technologies, and from our vendors and third parties when they disclose Consumer Health Data to us.

4. Categories of Consumer Health Data that we may Share

   We may share some or all of the categories of Consumer Health Data that we Collect, as disclosed above in Section 1 above.

5. Third Parties and Affiliates with Whom We May Share Consumer Health Data

   We may share your Consumer Health Data with one or more of the following Third Parties:

   • To third parties, including marketing and analytics service providers.
   • To government or judicial authorities to comply with a subpoena, court order, governmental inquiries, legal process, legal obligation, or to protect the rights, property, safety of others or the public.
   • To third parties we have a reason to believe that such disclosure is necessary to identify, contact, or bring a legal action against someone who may be causing injury to or interference with our rights and property or those of any other person.
   • To a successor entity or purchaser upon a merger, consolidation, or other corporate reorganization in which we participate, a sale of all or a portion of our assets, or pursuant to a financing arrangement. In this situation, if required we will seek assurances that the successor entity or purchaser will process Consumer Health Data collected by us in accordance with this Policy, unless the successor entity provides you with a new notice setting out the new terms of its privacy practices.

   We may share your Consumer Health Data with the following Affiliates:

   • UroGen Pharma Ltd.
6. How to Exercise Your Rights with Respect to your Consumer Health Data

   To exercise your rights with respect to your Consumer Health Data, depending on your state of residence, you may contact us at any time through any of the following methods:

   • Web Form. You may submit a request via our data subject rights webform.
   • Email. Privacy@urogen.com.

Supplement to Consumer Health Data Privacy Policy for Nevada Consumers

This Supplement applies to Nevada Consumers for purposes of providing additional disclosures required by Nevada's Consumer Health Data privacy law. Terms used herein that are defined terms under Nevada's Consumer Health Data privacy law shall have the meanings afforded to them therein.

1. Purposes & Manner of Processing.

   We Collect, use, Process, and Share Consumer Health Data for the purposes and in the manners described in our Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.

2. Review & Revision of Consumer Health Data.

   If You would like to review and/or revise Your Consumer Health Data, You may submit a request to us via the methods listed in our Consumer Health Data Privacy Policy. We will respond to Your requests to exercise Your rights in accordance with applicable law, but in any case, no later than 45 days after receiving Your request. We may extend this period up to 45 days only where doing so is permitted under applicable law.

3. Changes to this Supplement.

   We will notify You before making any changes to our privacy practices with respect to Your Consumer Health Data by posting an updated notice on this page, with an updated effective date.

4. Third Party Collection of Consumer Health Data.

   Please note that some Third Parties may collect Consumer Health Data about You over time and across different websites or online services You may visit.