Privacy Policy

Privacy Notice

Effective date: 2026-09-07
Last updated: 2026-09-07

Mesoblast Limited and its subsidiaries and affiliates (collectively, “Mesoblast”, “we”, “are” or “us”) value your privacy and are committed to protecting your personal data. Mesoblast operates globally through entities in Australia, the United States, Switzerland and Singapore, each responsible for processing personal data in accordance with applicable laws.

This Privacy Notice (“Notice”) explains how Mesoblast collects, uses, discloses, transfers, retains, and protects Personal Data through:

  1. the corporate website at https://www.mesoblast.com/ (the “Corporate Website”); and
  2. the Ryoncil US HealthCare Professionals website at https://www.ryoncilhcp.com/ (the “HCP Website”).

(Collectively: “Corporate Website” and “HCP Wesbsite”: “Website(s)”)

Certain processing activities described in this Notice apply only to one of the Websites, as indicated below.

Who Is Responsible for Your Personal Data

The relevant Mesoblast entity acts as the controller responsible for the processing described in this Notice, as applicable under local law.

Website / Activity Responsible Entity Contact Details
Corporate Website, investor communications, and general inquiries Mesoblast Limited [email protected]
HCP Website and product-related activities Mesoblast, Inc. [email protected]

Personal Data We Collect and Why

The categories of Personal Data collected, the purposes of processing, and the technologies used vary by Website. Where applicable law requires us to identify a legal basis or a business/commercial purpose, the relevant legal basis/purpose is stated below.

“Personal Data” means information, in electronic or other form, that identifies, relates to, describes, or can reasonably be linked to an individual, directly or indirectly. Examples include a name, contact details, professional information, identification numbers, online identifiers, device information, and Internet or electronic activity information.

Applicable Website Purpose Categories of Personal Data Examples of Personal Data Business purpose or legal basis, as applicable
Corporate Website Respond to general requests or inquiries submitted through the Website or by email. Identifiers; contact, professional, and communications information. Name, contact details, professional affiliation, and information included in the communication. Legal basis: legitimate interest in communicating with you and responding to your request; steps taken at your request; and compliance with legal obligations.
Corporate Website Manage subscriptions and send requested investor-relations news and announcements. Identifiers, contact information, and communication preferences. Email address, subscription status, and preferences. Legal basis: consent.

You may unsubscribe or withdraw consent at any time.

Business purpose: providing requested communications and managing subscriptions.
Websites Operate, maintain, troubleshoot, and secure the Websites. Identifiers and Internet or electronic activity information. IP address, device and browser details, security identifiers, website activity, and information about potential security threats. Legal basis: legitimate interest in providing functional and secure Websites and compliance with legal obligations.

Business purpose: website operation and security
HCP Website Respond to requests and inquiries concerning product availability, ordering, supply, or support. Identifiers; contact, professional, and communications information. Name, email address, telephone number, preferred contact method, NPI, professional credentials and affiliations, and communication content. Business purpose: verify HCP identity and professional status; respond to inquiries; facilitate product-related requests; provide support; maintain records; and comply with legal and regulatory requirements.
HCP Website Assess transplant-center eligibility and operational readiness and support product ordering, delivery, receipt, storage, handling, and administration. Identifiers; contact and professional or employment-related information. Name, business contact details, role, affiliation, qualifications, responsibilities, training, and product-handling experience of the submitter and other identified personnel. Business purpose: verify center eligibility and readiness; assess qualifications and capabilities; support safe distribution and handling; coordinate supply and support; maintain quality and safety records; and comply with applicable requirements.
HCP Website Send requested product information and professional communications. Identifiers; contact and professional information; communication preferences. Name, email address, telephone number where applicable, professional affiliation, subscription status, preferences, and communication history. Business purpose: provide requested information and manage professional communications. Consent is used where required. You may unsubscribe at any time.
HCP Website Analyze and improve Website use, measure traffic, referrals and advertising performance, and personalize content and advertising. Identifiers; Internet or electronic activity; approximate geolocation; IP address, cookie and device identifiers, device and browser details, interactions, pages viewed, referral and campaign information, advertising interactions, preferences, approximate location. Business and commercial purposes: analytics, Website improvement, advertising measurement, and personalization. Consent is used where required;

How We Collect Personal Data

Depending on the Website and your interaction with us, we collect Personal Data:

  • directly from you, including when you subscribe to investor communications, submit an request, complete a form, request product information or support, or otherwise communicate with us;
  • automatically through the Websites, including through cookies, pixels, local storage, server logs, and similar technologies;
  • from your employer, transplant center, healthcare institution, or other personnel who provide professional information about you;
  • from public and professional sources, including the NPI Registry and professional licensing or accreditation databases; and
  • from service providers and business partners

Cookies and Similar Technologies

The Websites use cookies and similar technologies for different purposes. The Corporate Website uses technologies necessary to operate and secure the Website. The HCP Website also uses analytics, performance, advertising, and measurement technologies. These technologies may collect online identifiers, device information, browsing activity, referrals, campaign information, advertising interactions, approximate location, and security-related information.

Further information about the technologies used, their providers, purposes, and retention periods is available in the Cookie Notice on the relevant Website.

How We Disclose Personal Data

We may disclose Personal Data to the following categories of recipients as necessary for the purposes described in this Notice:

  • Mesoblast affiliates and authorized personnel who require access to perform their responsibilities;
  • service providers supporting Mesoblast;
  • governmental, regulatory, judicial, or law-enforcement authorities where required or permitted by law, or where reasonably necessary to protect rights or safety, investigate unlawful activity, or maintain security; and
  • prospective or actual purchasers, investors, lenders, or other parties involved in a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to appropriate confidentiality protections.

International Transfers

Personal Data may be transferred to, accessed from, or stored outside the jurisdiction in which it was collected. Destination countries may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law, Mesoblast uses appropriate safeguards and lawful transfer mechanisms. These may include adequacy decisions, approved standard contractual clauses, contractual requirements providing a comparable standard of protection, and other legally recognized mechanisms or statutory exceptions. You may request information about applicable safeguards using the contact details below.

How We Protect Your Personal Data

Mesoblast uses administrative, technical, and organizational measures designed to protect Personal Data collected through our Website against loss, misuse, unauthorized access or disclosure, alteration, and destruction. However, no system or method of electronic transmission is completely secure. You should therefore take reasonable precautions when submitting Personal Data online and avoid including information that is not necessary for your request.

How Long Will We Retain Your Personal Data

We retain Personal Data only for as long as reasonably necessary to fulfil the purposes for which it was collected, or as required to comply with legal obligations, resolve disputes, or establish, exercise, or defend legal claims. When Personal Data is no longer required, we securely delete or anonymize it in accordance with our retention policies and applicable laws. Where records must be retained for longer periods, we will take reasonable steps to minimize the Personal Data they contain.

Your Rights

Depending on your location and subject to the conditions and limitations set out in applicable data protection laws, you may have certain rights in relation to your personal information, including the right to:

  • Access. You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, information related to the processing of data and a copy of the data being processed.
  • Rectification. You have the right to require rectification of inaccurate or incomplete data about you.
  • Deletion. To obtain the deletion of your personal data under certain specified circumstances.
  • Restriction. You have the right to restrict processing of data under certain specified circumstances.
  • Portability. You have the right to request for the receipt or the transfer to another organization, in a machine-readable form, of your personal data.
  • Objection. You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data.
  • Consent Withdrawal. When you have given your consent for the processing of your data, you can withdraw it at any time without any cost nor justification.

Depending on where you are located, you may have additional rights under applicable laws. The availability of specific rights may vary depending on your jurisdiction.

These rights are not absolute and may not apply in every circumstance. We may decline or limit a request where permitted or required by law and will explain our decision where required.

If you would like to exercise your rights, please let us know by contacting our DPO at [email protected]

You may unsubscribe from marketing communications at any time using the unsubscribe link in the relevant communication.

You have also the right to lodge a complaint if you consider that your personal data is not processed in accordance with the applicable data protection law.

If you are an EEA resident: You have the right to lodge a complaint with the Supervisory Authority in your country.

If you are a UK resident: you may file a complaint with the Information Commissioner’s Office (“ICO”).

If you are a Swiss resident: you may lodge a civil claim in case of personality rights’ infringements, in particular, regarding the exercise of your rights of access, rectification and object but also regarding infringements related to data privacy principles. The competent Supervisory Authority in Switzerland is the FDPIC.

If you are an Australian resident: If you are not satisfied with our response to your complaint, you can file a complaint to the Office of the Australian Information Commissioner.

Please find the contact information of all Authorities below in section “Contacts”.

Links to Other Sites

Third-Party Websites

This Notice applies only to the Corporate Website and HCP Website identified above. Our Website may contain links to websites, platforms, or services operated by third parties. We do not control the privacy practices of those third parties, and this Notice does not apply to their processing of Personal Data. We encourage you to review the privacy notice of any third-party website or service before providing Personal Data.

Social Media

We maintain company pages on [identify platforms]. When you interact with our pages, we may process information associated with your profile and interaction, including comments, messages, reactions, and aggregated audience or engagement information. We process this information to manage our pages, communicate with users, understand engagement, and improve our communications.

The relevant social-media platform also processes Personal Data under its own privacy notice. Depending on the platform, activity, and applicable law, we and the platform may act as independent controllers or, for certain audience-measurement or insights activities, as joint controllers. Further information about the platform’s processing and the allocation of responsibilities is available in the platform’s privacy notice and applicable controller terms.

Children

The Websites are not directed to individuals under 18, and we do not knowingly collect Personal Data directly from children through the Websites. If we learn that a child has provided Personal Data, we will take appropriate steps to delete it unless retention is required or permitted by law. The transplant-center assessment may ask whether product is requested for a pediatric patient, but the form does not request and should not be used to provide the patient’s Personal Data.

Contacts

Mesoblast, acting as Controller

Website https://www.mesoblast.com/
Address:

MESOBLAST LIMITED
55 Collins Street Level 38
Melbourne 3000

Email [email protected]

Data Protection Officer

Email [email protected]

For the Office of the Australian Information Commissioner (“OAIC)”

Tel:

Within Australia: 1300 363 992
Outside Australia: +61 2 9942 4099

Website: https://www.oaic.gov.au/contact-us

For EU Data Protection Authorities

https://edpb.europa.eu/about-edpb/about-edpb/members_en

For UK Supervisory Authority (“ICO”)

Tel: +44 (0)3 03 12 31 11 3
Website: https://ico.org.uk/global/privacy-notice/your-right-to-complain/

For Swiss Federal Data Protection and Information Commissioner (“FDPIC”)

Tel: +41 (0)58 462 43 95 (mon.-fri., 10-12 am)
Fax: +41 (0)58 465 99 96
Website: https://www.edoeb.admin.ch/edoeb/en/home.html

Updating this Privacy Policy

Mesoblast’s website will be continually improved and enhanced with new services, which may change the way we manage information. The content of this Notice may be updated from time to time to reflect this, so we suggest that you return to this Notice on a regular basis and carefully read the information provided. Minor changes to the policy may occur that will not affect our use of individually identifiable or personal health information. We will post Privacy Policy changes on our website in a timely manner. This Notice is effective as of the date stated at the top of this page.