Last Updated: March 11, 2026
This Supplemental Notice describes the practices of Legend Biotech USA Inc. and its affiliates (“Legend Biotech,” “we,” “us,” or “our”) regarding our collection, use, and disclosure of Personal Information about residents of California and other states in where a comprehensive privacy law has been enacted, and describes how residents of such states can exercise their privacy rights under each state’s comprehensive privacy legislation (collectively, “U.S. Privacy Laws”). For residents in Connecticut, Washington, Nevada, we have also included additional disclosures about our privacy practices related to your health data.
A. Definitions
- “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household. Personal Information also includes “Sensitive Personal Information” that we specifically describe in this Supplemental Notice.
- “Sell,” “Sale,” or “Sold” means renting, releasing, or transferring an individual’s Personal Information to a Third Party for money or other valuable consideration.
- “Share,” “Shared,” or “Sharing” means transferring an individual’s Personal Information to a Third Party for cross-context behavioral advertising or targeted advertising purposes, whether or not for money or other valuable consideration.
- “Third Party” means any non-affiliated person that is not a Vendor.
- “Vendor” means a service provider, contractor, or processor which collects, stores, or otherwise handles data for us and is bound by contractual obligations to use your Personal Information only as directed by us.
You may be familiar with different terms that are used to describe materially similar concepts in this section by the U.S. Privacy Laws in your state of residence. You can treat them as the same for the purpose of our Supplemental Notice. For example, we intend the term “Personal Information” here to have the same definition as “Personal Data” used in specific U.S. Privacy Laws.
B. Collection & Processing of Personal Information
We collect and have collected in the past 12 months the following categories of Personal Information about you:
- Identifiers, such as name, alias, postal address, unique personal identifier, online identifiers, Internet Protocol address, email address, account name, signatures, physical characteristics or description, telephone number, or other similar identifiers.
- Financial Information, including bank account number, credit card number, debit card number, or any other financial information that does not allow access or withdrawal of funds.
- Insurance Information, including insurance policy number or health insurance information.
- Characteristics of Protected Classifications under state or federal law, such as age, gender, and marital status.
- Biometric Information, such as imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, voice recordings, gait patterns, or rhythms, and sleep, health, or exercise data from which we can extract identifying information.
- Internet or Other Network Information, such as browsing history, search history, information regarding your interactions with our websites or advertisements.
- Geolocation Data, such as device location that is more granular than a city or town.
- Audio, Electronic, Visual and Similar Information, such as call and video recordings.
- Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual’s preferences or characteristics.
- Sensitive Personal Information, including:
- Personal Information that reveals your:
- Social security, driver’s license, state identification card, or passport number;
- Account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials for allowing access to an account;
- Precise geolocation that is used or intended to be used to locate you within a small geographic area;
- Racial or ethnic origin, religious or philosophical beliefs, or union membership;
- Genetic data.
- Biometric data processed for the purpose of uniquely identifying you;
- Personal Information collected and analyzed concerning your health
- Personal Information that reveals your:
C. Purposes for Processing and Disclosing Personal Information
We collect, process, and disclose Personal Information (including Sensitive Personal Information) for the purposes described in our website Privacy Notice.
D. Retention of Personal Information
Our retention practices are set forth on our website Privacy Notice.
E. Categories of Personal Information We Have Disclosed, Sold, or Shared
We have disclosed, sold, or shared the following categories of Personal Information to Vendors and Third Parties for business purposes in the past twelve months. We do not have actual knowledge that we Sell or Share Personal Information of residents who are under 16 years of age.
| Category of Personal Information | Categories of Non-Affiliated Persons to Whom We Have Disclosed This Category of Information for a Business Purpose | Categories of Third parties with Whom This Category of Personal Information is Sold and/or Shared |
|---|---|---|
| Identifiers | Affiliates & Vendors Third Parties |
N/A |
| Financial Information | Affiliates & Vendors | N/A |
| Insurance Information | Affiliates & Vendors | N/A |
| Characteristics of Protected Classifications | Affiliates & Vendors | N/A |
| Biometric Information | Affiliates & Vendors | N/A |
| Internet or Other Network Information | Affiliates & Vendors Third Parties |
N/A |
| Geolocation Data | Affiliates & Vendors | N/A |
| Audio, Electronic, Visual Information | Affiliates & Vendors Third Parties |
N/A |
| Inferences | Affiliates & Vendors Third Parties |
N/A |
| Sensitive Personal Information | Affiliates & Vendors | N/A |
F. Sources from Which We Collect Personal Information
We collect Personal Information directly from you, as well as from Vendors and Third Parties when they disclose Personal Information to us, along with healthcare providers, public databases, providers of demographic data, publications, professional organizations, and social media platforms.
G. Data Subject Rights
Residents who reside in states with U.S. Privacy Laws may have the following rights regarding our collection and use of the Personal Information, subject to certain exceptions:
- You may exercise the data subject rights below by contacting our Global Privacy Office at privacy@legendbiotech.com or by calling +1 (888) 427‑9652 and submitting details regarding your request.
- Right to Know: You may have the right to know the following details about our privacy practice at or before the point of collection. We have provided such information in this Supplemental Notice. You may also request that we provide you with information about the following aspects of how we have handled your Personal Information specifically in the 12 months preceding your request:
- The categories of Personal Information we have collected about you;
- The categories of sources from which we collected such Personal Information;
- The business or commercial purpose for collecting, Selling, or Sharing Personal Information about you;
- The categories of Personal Information about you that we disclosed and the categories of Third Parties to whom we disclosed such Personal Information;
- The categories of Personal Information about you that we sold, shared, or used for targeted advertising purposes, and the categories of Third Parties with whom we sold or shared such Personal Information;
- If we collect Sensitive Personal Information, the categories of Sensitive Personal Information to be collected, the purposes for which it is collected or used, and whether that information is Sold or Shared; and
- The length of time we intend to retain each category of Personal Information, or if that is not possible, the criteria used to determine that period.
- Right to Deletion: You may have the right to request that we delete any Personal Information about you that we collected from you.
- Right to Correction: You may have the right to request that we correct any inaccurate Personal Information we maintain about you.
- Right to Access Specific Pieces of Personal Information and Data Portability: You may have the right to ask to obtain the specific pieces of Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Personal Information to another entity without hindrance. You may not exercise this right more than two times in a calendar year.
- Right to Opt-Out of Sale: You may have the right to opt out of the Sale of your Personal Information.
- Right to Opt-Out of the Sharing of Your Personal Information or the Use of Your Personal Information for Targeted Advertising. You may have the right to opt out of the Sharing of your Personal Information or our use of your personal Information for targeted advertising purposes.
- Right to Revoke Consent for or Limit the Use of Your Sensitive Personal Information. You may also have the right to revoke consent for or limit the use of your Sensitive Personal Information to the purposes authorized by the applicable U.S. Privacy Laws.
- We do not engage in profiling or automated decision making that have legal or similarly significant effects.
- Right to Know: You may have the right to know the following details about our privacy practice at or before the point of collection. We have provided such information in this Supplemental Notice. You may also request that we provide you with information about the following aspects of how we have handled your Personal Information specifically in the 12 months preceding your request:
- Non-Discrimination. We will not discriminate against you for exercising your data subject rights. For example, we will not deny goods or services to you, charge you different prices or rates, or provide a different level of quality for products or services as a result of you exercising your data subject rights.
- Appeals. You may have the right to appeal our decisions on their data subject requests.
H. Other Disclosures
- Disclosure for California Residents
- California Do Not Track Notice. California law requires us to let you know how we respond to web browser Do Not Track (DNT) signals. Because there currently isn’t an industry or legal standard for recognizing or honoring DNT signals, we don’t respond to them at this time.
- Direct Marketing. California Civil Code § 1798.83 permits California residents to annually request certain information regarding our disclosure of Personal Information to other entities for their direct marketing purposes in the preceding calendar year. To make such a request, please send an email to privacy@legendbiotech.com with the subject “Shine the Light Request.”
- Financial Incentives for California Residents. We do not provide financial incentives to California residents who allow us to collect, retain, Sell, or Share their Personal Information. We will describe such programs to you if and when we offer them to you.
- Connecticut, Washington, and Nevada Health Data Disclosures. This section only applies to residents of Connecticut, Washington, and Nevada. We may Collect and Share the below categories of health data from you, and we may process such categories of health data for the purposes and in the manners listed in Section C:
- Individual health conditions, treatment, diseases, or diagnosis;
- Health-related surgeries or procedures;
- Use of prescribed medication;
- Bodily functions, vital signs, symptoms, or measurements of health information;
- Diagnoses or diagnostic testing, treatment, or medication;
- Biometric data;
- Genetic data;
- Data that identifies a resident seeking health care services; and
- Any inferences of the above categories of health data.
We Collect these categories of health data from the sources listed in Section F.
You may exercise your data subject rights, including obtaining access to and requesting changes to your health data by contacting us via the methods listed in Section G.
We limit Third Party Collection of health data over time and across different websites or online services when you use our websites or online services. We do this by ensuring that entities whose cookies, pixels, and other online trackers we use on our websites and online services are our Vendors under applicable laws. Nonetheless, please note that Third Parties may still be able to collect health data from you over time and across different websites depending on your browser, browser add-ons, and associated permissions you set on your device. This collection of health data by those Third Parties is unrelated to our collection of health data from you, and we encourage you to view those Third Parties’ privacy notices for more information about their processing of health data and the methods they provide to allow you to opt out of such processing.
- Disclosure for Nevada Residents. To the extent we collect Personal Information that identifies you through an online website or service among the categories of Personal Information listed in Section B, we do not sell that Personal Information for monetary consideration.