Cypress Bioscience, Inc. (“Cypress”) is committed to developing and commercializing pharmaceutical products and personalized medicine laboratory services that allow physicians to serve unmet medical needs. In conducting our business, it may be necessary for us to have certain information about you and your health. We understand that your personal information and your health are very personal, private subjects and we want you to feel as comfortable as possible visiting our web site and using our services. Therefore, we are dedicated to protecting the privacy of your personal and health information.

Personal information collected via a website is protected by privacy laws.  Additionally, the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) protects patients’ medical records and other personal information provided by patients in connection with health care diagnosis and treatment.  Cypress has policies and procedures in place to comply with these laws and to protect the confidentially of both personal information and protected health information.

This Privacy Policy describes what information we collect online, how we protect it and what choices you have about how that information is used.  It also provides information about how your personal health information may be used and disclosed.  We encourage you to read this entire Privacy Policy carefully so that you will understand both our commitment to you and your privacy, and how you can participate in that commitment.

Our Privacy Policy covers two areas which are explained in detail below: 

1. ONLINE PRIVACY:  Collection and use of personal information provided by you while using our website, and

2. NOTICE OF PRIVACY PRACTICES: Possible disclosure and use of medical information

By using this site, you agree with the terms of this Privacy Policy and you are subject to our Legal Disclaimer.

1.  ONLINE PRIVACY:  Collection and Use of Personal Information Provided by You While Using our Website.

THIS NOTICE DESCRIBES HOW PERSONAL INFORMATION ABOUT YOU MAY BE COLLECTED AND USED AND HOW YOU CAN CONTACT US.  PLEASE REVIEW IT CAREFULLY.

What Personal Information We Collect
On our website, we will collect information that identifies you ("personal information") online only when you voluntarily provide it to us through our site. For example, when you choose to register on our site, we may ask you to provide some personal information, such as your first and last name, mailing address, telephone number and/or e-mail address. Also, we may collect information that will allow you to establish a username and password. In addition, we may collect information that you voluntarily provide to us through responses to questionnaires, such as customer satisfaction surveys.

How We Use Personal Information That We Collect Online
Internal Uses
We may use your personal information within Cypress (1) to provide you with the services and products you request, (2) to assist with your questions about our services, billing, payment methods or use of our web site, (3) to process or collect payments made in connection with our services to you, and (4) to evaluate our services and products and to improve our website to serve you better.

Privacy Choices
When you register online for one of our services, you may be given the option of receiving periodic informational/promotional mail or email from Cypress. You choose whether or not to receive correspondence when you provide this information or by changing your preferences within your registration profile at any time.

Disclosure of Personal Information to Third Parties
We will not give, sell, rent, loan or otherwise disclose any of your personal information to any third party, unless (1) you have authorized us to do so, (2) we are legally required to do so, for example, in response to a governmental subpoena, court order or other legal process, and/or (3) it is necessary to do so in order to protect and defend our rights or property.
We will also make full use of all information acquired through this site that is not personally identifiable.

About Minors
Our web site is not directed at or intended for use by minors. Therefore, we do not wish to receive, nor do we knowingly collect, personal information from minors via this web site.

Collection of Information
Cookies
You should be aware that in some cases, your computer needs to accept cookies from a site to take full advantage of its services. This is especially true on sites that require a user ID or a password. In order to provide better service, Cypress may use a "cookie." Cookies are small files that your web browser places on your computer's hard drive. We may use cookies to let us know that you are a prior customer and to retrieve certain information previously provided by you. We also may use cookies to keep track of information about your current "session" which will be discarded as soon as you log out or close your web browser. This information also allows us to statistically monitor how many people are using our site and for what purpose.

However, if you do not wish to receive cookies, or want to be notified of when they are placed, your internet browser may permit you to do so. In many internet browsers, you can change the browser settings to warn you before accepting cookies or to block cookies. If you block cookies, you may not be able to use certain web site features or functions, or this web site may not operate in an optimal mode.

Internet tags
Internet tags (also known as single-pixel GIFs, clear GIFs, invisible GIFs, and 1-by-1 GIFs) are smaller than cookies and tell the web site server information such as the IP address and browser type related to the visitor's computer. This site may or may not use Internet tags.

How We Protect Information Online
It is our policy to protect your account information against unauthorized access or release.  To accomplish this protection, we use services that encrypt your account information.

In addition, we have procedures that limit Cypress’s employees and contractors' access to personal information. Only those employees and contractors with a business reason to know have access to such information. We educate our employees about the importance of confidentiality and customer privacy through standard operating procedures, mandatory training programs, and internal policies on data privacy and corporate integrity. We take appropriate disciplinary measures to enforce employee privacy responsibilities.

Security
Please bear in mind that no Internet transmission is ever 100% secure or error-free. More specifically, e-mail sent to or from this site may not be secure. As a result, you should take particular care in deciding what information you send via e-mail. Any passwords, ID numbers, or other special access numbers you might use to access any part of this site are your responsibility; take care to safeguard them.

Links to Other Sites
We want to provide users of our site with information, services and products that are valuable to them. Therefore, links or references to other web sites may appear on Cypress’s website.  Cypress does not control these websites and is not responsible for the content or the privacy policies or practices of any third-party site. If you link to third party sites from Cypress, we encourage you to consult the privacy policy of each site you visit.

Your Consent
By using our web site, you consent to the collection, use and disclosure of information as described in this policy.

How to Contact Us
If you have any questions, comments, or concerns about this Privacy Policy as it pertains to the collection and use of your personal information provided to us online, please contact us at:

Cypress Bioscience, Inc.
Attn: General Counsel
4350 Executive Drive, Suite 325
San Diego, CA  92121
Telephone:  858-452-2323

Changes to this Privacy Policy

Cypress reserves the right to change this privacy policy from time to time, so please check back often. We will let you know that the policy has been changed by changing the effective date listed below:
Effective Date: August 1, 2008

2.  NOTICE OF PRIVACY PRACTICES:  Possible Disclosure and Use of Medical Information

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Notice of Cypress’s Privacy Practices
Cypress is committed to obtaining, maintaining, using and disclosing patient protected health information (“PHI”) (also known as “personal health information”) in a manner that protects patient privacy. PHI is current, past or future information created or received by Cypress from physicians about patients for whom testing is ordered from Cypress. It may include patient condition, diagnosis, treatment, medication, and payment information.  We will only use or disclose the minimum amount of your PHI we consider necessary to provide laboratory services as ordered by a physician and to collect payment for such services.  This Notice only applies to the PHI that we maintain. Your doctor or other healthcare provider, including other laboratories, may have different notices regarding their use and disclosure of PHI created by them.

Cypress is required by certain laws to provide you with this Notice of Privacy Practices with respect to PHI, to maintain the privacy of PHI, to state the uses and disclosures of PHI that Cypress may make, and to list the rights of individuals and our legal duties with respect to their PHI. Your PHI at Cypress includes personal and medical information (such as your name, address, date of birth, social security number, medical history, provider identification, test ordered, payment information, insurer, financial responsibility, etc.) that we obtain from you, your physician, health plan, or other sources. Your PHI also includes the laboratory testing results that we create.

Cypress creates, through its testing services, information to be used by a physician, within the context of other clinical and laboratory findings, to aid in the diagnosis and treatment of a disease, syndrome or condition.

Cypress is required to abide by the terms of our current Notice of Privacy Practices.  We reserve the right to change our Notice of Privacy Practices as necessary and to make any new Notice of Privacy Practices effective for the PHI that we maintain. The most current Notice will be displayed on our website and a paper copy is available upon request.

Cypress will not use or disclose your PHI, other than for the purposes listed below, without your written authorization.  In the event of our request to use PHI for some other purpose, we would contact you with information about the possible disclosure and request your authorization.  You would have the right to revoke your authorization at any time, except if we have already made a disclosure based on that authorization. We do not need your authorization to use or disclose your PHI for the following purposes.  And, keep in mind that whenever it is necessary to provide your PHI to third parties, they are required by law, and often by contract, to keep PHI confidential and to use it only in connection with the performance of the requested services.

For Treatment
As a health care provider that provides laboratory testing for ordering physicians, Cypress uses your PHI as part of our testing process and discloses your PHI to physicians and other authorized health care professionals who need access to your laboratory results in order to diagnosis or treat you. In addition to your treating physician, we may provide a specialty consultant with information about your results to further validate or clarify the results. Occasionally, we may contact you to arrange for a redraw of your specimens.

For Payment
We will use your PHI in our billing and collections departments (and vendors for such services) and disclose your PHI to insurance companies, hospitals, physicians, governmental health plans and other health plans for payment purposes, or to third parties to assist us in creating bills, claim forms, or getting paid for our services. In some cases, we may have to contact you directly to obtain billing information or for other billing purposes.

For Healthcare Operations
We may use or disclose your PHI in the course of activities necessary to support our health care operations, such as internal administration and planning, performing quality checks on our testing, for teaching purposes, or for developing normal reference ranges for tests that we perform.

As Permitted or Required by Law
We may use or disclose your PHI for various public policy purposes that are authorized or required by federal or state law. For example, we are required to disclose your PHI to the Secretary of the U.S. Department of Health and Human Services ("HHS") upon request. 

For Public Safety
When the appropriate conditions apply, we may use or disclose PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

To Avert a Serious Threat to Health or Safety
We may use or disclose your PHI when necessary to prevent a serious threat to your health and safety or that of another person or the general public. Any use or disclosure for this purpose would only be made to someone able to help prevent the threat. For example, we may disclose your PHI in an investigation regarding a physician's license.

For Health Oversight
We may disclose your PHI in connection with governmental oversight, licensure, auditing, and other purposes. For example, governmental agencies periodically review our records to ensure compliance with the rules of various regulatory and licensing agencies.  Other agencies may audit our billing and laboratory records to verify that the health care was provided as claimed or that we were paid correctly.

For Judicial and Administrative Proceedings
We may disclose your PHI as required to comply with court orders, discovery requests or other legal process in the course of a judicial or administrative proceeding.

For Law Enforcement
We may also disclose PHI for law enforcement purposes. For example, to identify or locate a suspect, fugitive, material witness, or missing person.

For Specialized Government Functions

We may disclose your PHI for military and veterans activities, national security or intelligence purposes, or to correctional institutions, or to law enforcement officials having custody of an inmate.

For Workers Compensation
We may disclose your PHI as necessary to comply with requirements of workers' compensation or similar programs that provide benefits for work-related injuries or illness without regard to fault.

For Research and Promotions (if de-identified)
We use and disclose PHI in connection with research performed by Cypress and by contracted researchers.  This research generally is subject to the oversight of an Institutional Review Board.  In most cases, while PHI may be used to help prepare a research project or to contact you to ask whether you want to participate in a study, it will not be further disclosed for research without your authorization.  Sometimes, however, where permitted under federal law and institutional policy, and approved by an Institutional Review Board or a privacy board, PHI may be used or disclosed.  In addition, PHI may be used or disclosed to compile “limited or de-identified data sets” that do not include your name, address, social security number or other direct identifiers.  These data sets may, in turn, be used for research and promotional purposes.

To Family and Friends
Under certain appropriate circumstances, we may disclose PHI to family members, other relatives, or close personal friends or others that you identify to the extent it is directly relevant to their involvement with your care or payment related to your care.

Note Regarding State Laws
For all of the above purposes, in cases where state law is more restrictive than federal law, we are required to follow the more restrictive state law. For example, some states require physician authorization to release laboratory test results to patients, and other states prohibit a laboratory from releasing test results directly to a patient.

Your Rights Concerning Privacy and Confidentiality
Under the privacy laws and this Privacy Policy, you have the right to:

Restrict Use
You have a right to ask us in writing to restrict use or disclosure of your PHI related to your treatment, related to your payment or related to routine health care operations.  In addition, you may request PHI disclosure restrictions to family members, other relatives or close friends involved in your care.  We are not required to agree to such a restriction, but if we do agree, we will honor our agreement except in case of an emergency.  Any restriction we agree to is not effective to prevent uses or disclosures of PHI required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with federal privacy regulations adopted under HIPAA or for certain activities permitted or required by law.

Ask for Special Requests for Communications

You may request, in writing, to receive confidential communications containing your PHI from us in ways or at locations that are outside our usual process. We will make every effort to accommodate reasonable requests.

Ask for Review and Copies of Your PHI
You have a right to review and obtain a copy of existing PHI maintained by Cypress.  You must make your request in writing and this right is limited to existing records that are maintained, collected, used or disseminated by Cypress.  This right does not apply to results of our clinical testing.  Clinical testing results are explicitly excluded from disclosure by law.  You also do not have the right to obtain information we compile in reasonable anticipation of, or for use in, civil, criminal or administrative actions or proceedings.  We may charge a fee for any copies you request.

Ask to Amend Records
You have a right to request that we amend the records described above for as long as we maintain them.  You must make the request in writing and give us a reason for the amendment.  We may deny your request if: (1) we determine that we did not create the record, unless the originator of the PHI is no longer available to act on the requested amendment; or (2) if we believe that the existing records are accurate and complete.  Note that an amendment may take several forms; for example we may add an explanatory statement to a record rather than changing it.

Request Accounting of Disclosures
You have a right to receive an accounting of disclosures made by Cypress to any third party in the six years prior to the date on which the accounting is requested.  This right does not apply to certain disclosures, including, but not limited to, disclosures made for the purposes of treatment, payment or health care operations; disclosures made to you or to others involved in your care; disclosures made with your authorization; disclosures made for national security or intelligence purposes or to correctional institutions or law enforcement purposes; or disclosures made prior to April 14, 2003.  You must make any request for an accounting in writing and we may charge a fee to fill more than one request in any given year.

Request Copy of this Notice
You have the right to request a paper copy of this Notice.

File a Complaint
If you believe your privacy rights have been violated, you have the right to register a complaint with Cypress or the Secretary of the U.S. Department of Health and Human Services. Cypress will not retaliate against any individual for filing a complaint in good faith. You may file a complaint by calling us or by writing to us using the information listed below.

How to Contact Us
If you have any questions, comments, or concerns about this Notice of Privacy Practices as it pertains to the collection and use of your PHI, please contact us at:

Cypress Bioscience, Inc.
Attn: General Counsel
4350 Executive Drive, Suite 325
San Diego, CA  92121
Telephone:  858-452-2323

Changes to this Notice of Privacy Practices
Cypress reserves the right to change this notice of privacy practices from time to time, so please check back often. We will let you know that the policy has been changed by changing the effective date listed below:

Effective Date: August 1, 2008