Global Candidate Privacy Notice

BridgeBio Global Candidate Privacy Notice

Last Updated: September 1, 2026

What does this Notice cover?

BridgeBio Pharma, Inc., along with its affiliates and subsidiaries worldwide (collectively, “BridgeBio”, “we,” “us,” or “our”), is committed to handling personal information responsibly and in accordance with applicable law. This Global Candidate Privacy Notice (“Notice”) applies only to our processing of your personal information as acandidate for an employment opportunity with us. BridgeBio Pharma Inc. is the data controller of your personal information and is responsible for providing this Notice. Your personal information may also be processed by the BridgeBio affiliate with which you are in contact, who may act as a separate or joint data controller. This Notice also describes the rights that candidates may have in relation to the personal information that we process about them. Please note that this Notice does not cover website visitors, consumers, HCPs, patients, research and clinical trial participants, investors, or employees.

What personal information do we collect?

When you apply for opportunities at BridgeBio, we process the following types of personal information:

Information about your identify and contact data, such as your name, address, phone number, email address, gender, picture, government-issued identification numbers;
Information about your nationality, entitlement to work in any given country (e.g., work permit and visa information), family status, military or civil service information, desired salary, location preferences, and other job preferences;
Information we obtained during the application process, such as information relating to experience, education, right to work, CV, resume, qualifications, skills, referrals,references, employment history;
Information that you make publicly available in connection with your application, such as contact information, your education, and work experience information (e.g., when you share information via job search and career social networking sites);
Information collected about you as a result of an interview, including but not limited to interview details, notes, outcomes of any recruiting exercises you complete, and CCTV footage or information collected in visitor logs if you attend an in-person interview;
If you're being referred, information that the person referring you provides about you;
Any information that applicable local laws require us to collect in connection with the recruiting process; and
Depending on your location, and if voluntarily disclosed, special categories of personalinformation, such as information about your health, special needs, and disabilities if we need to make reasonable accommodations during the recruiting process; we may also collect equal opportunities monitoring information, including demographic information about your ethnic origin, gender, sexual orientation, and veteran status.

Where do we get personal information from?

We collect most of this information from you directly when you apply to a role at BridgeBio. We also collect information about you through interviews, meetings, or other forms and assessments. Where authorized, we may also collect information about you from third parties, such as references, previous employers, recruiting and executive search firms, social media, and from our background screening providers (where legally permissible).

How do we use personal information?

We process and use candidate personal information for the following purposes:

For recruiting activities, such as to determine your qualifications for employment, verify your identity, and make hiring decisions. We may process your information when evaluating your candidacy and communicating with you about the hiring process.
To send you communications about the recruitment process, BridgeBio job postings, opportunities, newsletters, and related communications.
To inform you about BridgeBio recruitment events in which you choose to participate.
To provide accommodations during the recruitment process (where applicable).
For the purpose of equal opportunities monitoring, compliance with anti-discrimination laws, or government-reporting obligations.
To establish, exercise, or defend against legal claims.
To protect the safety, security, and integrity of our employees and property, including to protect the rights of those who interact with us or others, and to detect, prevent, and respond to security incidents or other malicious, fraudulent, or illegal activity.
To fulfill a referral request when you are referred for a role with BridgeBio by a BridgeBio employee using our referral process, as permissible, including by using the provided contact information to reach out to you.
To perform a contract to which you are a party or to take steps at your request prior to entering into a contract. For example, to take steps prior to entering an employment contract with you.
To understand and improve our recruitment process, including efforts to analyze and understand recruiting trends and operations.
Where you have voluntarily agreed to have your personal information processed.

What is our legal basis for processing personal information?

Where required by applicable data protection law, such as the European and United Kingdom General Data Protection Regulation (“GDPR”), we process your personal information only when we have a valid legal basis. The legal basis for our processing depends on the specific context for which we use your personal information. Below are the legal bases that we rely on.

Consent: Consistent with specific consents that you may provide (if applicable), and which you may revoke at any time. For example, we use your consent in the submittal of your application, including any resume or other documentation you provide, to determine your suitability as a candidate for any job openings and during the interview and pre-employment period; to perform pre-employment background checks; and to contact you about future career opportunities at BridgeBio.
Contractual Necessity: To perform a contract to which you are a party or to take steps at your request prior to entering into a contract (e.g., to take steps prior to entering an employment contract with you).
Legal Obligation: Where processing is necessary to comply with our legal obligations (e.g., local laws may require us to submit reports about our recruiting processes).
Legitimate Interests: Where processing is necessary for our legitimate business interests or those of a third party, provided those interests do not override your fundamental rights and freedoms. Our legitimate interests in the recruiting context include: assessing your suitability for a particular role; facilitating the recruiting and interview process, including travel and booking; verifying information provided in connection with your application; presenting you with an offer of employment if your application is successful; and managing and improving our application process.

Who do we share personal information with?

We share job candidate personal information with third parties for limited purposes, such as:

Within the BridgeBio family of companies – We may share your information among the different BridgeBio affiliates and entities if your application is relevant to roles across the entities or to collaborate on candidate and employment activities and goals.
With service providers and vendors – These are entities that help us manage and improve the recruiting process and who perform services on our behalf, such as recruitment providers, interview and assessment providers, interview travel booking and expense providers, relocation entities, immigration advisors, reporting and analytics services, and pre-employment screening services.
With regulators and other government entities – We may access, preserve, and share your information with regulators, law enforcement, or others in response to a valid legal request; or if we conclude that such sharing is necessary to detect, prevent, and address fraud, unauthorized use of our systems, prevent violations of our terms, or protect our rights or the rights of others.
With other organizations in a business merger or transaction - If we merge with another organization or form a new entity, your personal information may be transferred to that new entity.

How do we handle international data transfers?

BridgeBio is an international organization with affiliates and subsidiaries in and outside the United States. We transfer the information we collect about you to other BridgeBio affiliates and third parties globally. Such data transfers include the transfer of personal information to countries that may not have the same level of data protection as the country in which the personal information initially originated. Where cross-border data transfers occur, we ensure that an adequate level of data protection exists in the recipient country, by executing with third parties, including our affiliates, appropriate contractual arrangements for cross-border data transfers to third-party countries for controllers or processors as applicable. For transfers governed by UK GDPR and EU GDPR, measures include transfers based on adequacy decisions, EU standard contractual clauses (SCCs), and supplementary measures.

How do we protect your personal information?

BridgeBio implements appropriate technical, physical, and organizational security controls to protect your personal information from unauthorized access, use, and disclosure. However, please note that no method of internet transmission can be completely secure and we cannot guarantee absolute security of your personal information.

How long do we retain your personal information?

We will retain personal information we collect from job applicants for as long as necessary for the purposes described in this Notice, as required to comply with our legal obligations, to resolve disputes, and to enforce our contractual agreements. If you're successful in your application for a position at BridgeBio, we retain the information you provide during the application process as part of your employee records. If your application is not successful, and to the extent that you give us consent to do so, we may also keep your personal information for the purpose of considering your application for future recruitment processes.

What are your privacy rights?

Depending on where you live and the local laws, you may have certain rights regarding your personal information. These may include the following:

Right of Access: You can request confirmation of whether we process your personal information and obtain a copy of the personal information.
Right to Rectification: You can request correction of inaccurate or incomplete personal information.
Right to Erasure: You can request deletion of your personal information in certain circumstances, such as when the data is no longer necessary or you withdraw consent.
Right to Restriction: You can request that we restrict processing of your personal data in certain circumstances.
Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, machine-readable format and have it transmitted to another controller.
Right to Object: You can object to processing of your personal information based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.
Right to Limit Use of Sensitive Personal Information: You may request that we limit our use and disclosure of sensitive personal information to certain permitted purposes.

Authorized Agent: You may designate an authorized agent to submit a privacy rights request on your behalf by providing a signed and authenticated letter that identifies your agent and the purposes for your appointment of an agent. If you are an authorized agent, you must provide your full name, email address, city, state of residence, and a letter, signed by the individual that authorized you, that appoints you as their agent.

Non-Discrimination: BridgeBio will not discriminate against you, including by denying or providing different quality of services, if you choose to exercise your privacy rights.

Automated Decision-Making: We do not engage in automated decision-making, including profiling, in connection with your personal information.

Please contact us at dataprivacy@bridgebio.com or by calling us at our U.S. toll-free phone number at 1-877-595-8877 if you would like to exercise your privacy rights. We may ask for additional information as necessary to validate your identity before responding to your request. If we are unable to comply with your request in full or part, we will confirm this with you and provide the reasoning behind our position.

Contact

Please contact us if you have questions about our notice or our data protection practices. You may send an email to dataprivacy@bridgebio.com or send mail to:

Attn: Legal Department c/o BridgeBio Pharma, Inc.
Suite 250, 3160 Porter Drive
Palo Alto, CA 94304 (USA)

Our appointed Data Protection Officer for the EEA and the UK is as follows:

Bird & Bird DPO Services SRL
Avenue Louise 235 b
11050 Brussels, Belgium
Email: DPO.BridgeBio@twobirds.com

Our appointed Data Protection Representatives for the EEA and the UK are as follows:

BridgeBio Europe BV
Weerdestein 97
1083 GG Amsterdam The Netherlands
Email: EU.datarepresentative@bridgebio.com
Bird & Bird (UK)
12 New Fetter Lane, London
EC4A 1JP, United Kingdom
Email: DPO.BridgeBio@twobirds.com

Our appointed Data Protection Officer for Brazil is as follows:

Prado Vidigal Advogados, CNPJ
Rua Gomes de Carvalho, n. 1069
15 Andar, Vila Olímpia
São Paulo - SP, Brasil, CEP 04547-004
Email: paulo@pradovidigal.com.br

Updates to this Notice

This Notice may change from time to time. As a result, we may update this Notice at any time and when we do, we will post an updated version on this page and change the “Last Updated” date.