Chugai Pharma USA, Inc. (hereinafter referred to as “CPUSA”, “we” or “our company”) recognizes the importance of protection of Personal Data, complies with Personal Data Protection Laws, and manages and protects Personal Data lawfully and properly, based on the policies set forth in the “Chugai Group Privacy Statement”. This policy informs you how our company handles Personal Data of patients, health care professionals, and other business partners and stakeholders. Personal Data Protection may also be notified separately from this policy by individual notification for each product or service relating to a processing of data. This policy does not apply to the Personal Data of CPUSA employees.

For purposes of this policy “Personal Data” includes information that identifies, relates to, describes, or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, and also as the term personal data is otherwise defined under applicable Data Protection Laws.

TABLE OF CONTENTS

1. Data Collection
2. Where do we get your Personal Data?
3. Automatic Website Data Collection, Cookies, & Other Tracking Technologies
4. Data Use (Purpose of Handling)
5. Disclosure of Personal Data
6. Cross-border Transfer
7. Your Rights
8. Data Security
9. Data Retention
10. Third Party Links
11. Collection of Personal Data from or about Children
12. California Residents: Your Rights
13. Privacy Policy Changes
14. Contact Information

Data Collection

1. Types of Personal Data
Our company will directly or indirectly obtain the Personal Data described below.

• Name, email address, phone number, street address, professional credentials or identifiers, date of birth, and other Personal Data provided by an individual, including an individual vendor, customer, patient, caregiver, provider, job applicant, etc. This type of information may be uploaded, for instance, in conjunction with an employment application, when joining a CPUSA sponsored event or competition, or when requesting additional information about products or services.
• Information provided as part of a patient assistance program provided through CPUSA or in relation to one of its products. This data may include your date of birth, medical records, information related to your medical condition and treatment, financial information, lab values, insurance coverage information, as well as information you provide about your primary contact and your insurance information.
• Information provided as part of an adverse event report, which may include health information.
• Information collected during health care provider, payer, patient, or other advisory board or consulting type activities, which may include health information and financial information.
• Details provided in correspondence with our company about a product, concern, or other topic, which may include health information.
• Health-related information, such as medical history, treatment data, and blood samples of individuals participating in clinical trials or other studies.

2.  Where do we get your Personal Data?

We obtain Personal Data directly from you; in addition, our company may also obtain the Personal Data from the following third parties or media:

• Chugai Pharmaceutical Group Companies.
• Service providers acting on our behalf.
• Media such as social media and the Internet.
• In the case of job applicants, we may obtain personal data from sources such as background screening companies, public records sources, prior employers, references, and educational institutions.
• Healthcare providers and health authorities.

3.  Automatic Website Data Collection, Cookies, & Other Tracking Technologies

We may collect certain information automatically when individuals visit our websites. This information may include: Internet Protocol (IP) address (which is considered Personal Data under some Data Protection Laws), which is a number automatically assigned to a computer by an Internet Service Provider; Location Information, which may include information from the IP address or that may be provided by the type of device an individual is using to access our websites; and other information regarding your use of the Websites such as the date and time of your visit, pages visited, and your web browser and operating system.

We may use cookies and similar tracking technologies on our website. Cookies are small text files that your web browser leaves on your hard drive. Cookies collect user activity information including IP address, geolocation data, browser and device characteristics, operating system, language preferences, referring URLs, information about how and when you use the Site, and other technical details.

You can disable cookies using your Internet browser settings. Please consult your browser’s help function for information on how to disable cookies. Note that if you disable cookies, certain features of our Site may not function properly.

Some internet browsers have “Do Not Track” or “DNT” features which, when turned on, send a signal to the website that the individual visiting the website does not wish to be tracked. Our Site does not honor DNT signals, but you can adjust your browser’s cookies settings to reject cookies as discussed above.

4.  Data Use (Purpose of Handling)

Our company may obtain and use Personal Data from you as needed to conduct business. The Personal Data obtained from you will be used within the purposes set forth below in this policy or for other purposes notified individually.
（1) What is the purpose of using the Personal Data about health care professionals (including physicians, pharmacists, pharmacy/drug store personnel, and other healthcare professionals)?

• Provision/Collection of information on proper use of drugs and medical devices
• Communication such as communication/provision of information
• Confirmation of identity

(2) Purpose of Use of Personal Data on Various Business Partners

• Communication such as communication/provision of information
• Confirmation of identity

(3) What is the purpose of using your Personal Data?

• Provision/collection of information on proper use of drugs and medical devices to healthcare professionals
• Carrying out our relationship with you and providing our products and services
• Providing information such as experiences of patients and their families to raise awareness of the disease
• Investigation/Analysis of actual usage conditions of drugs and medical devices, user needs, demographics, trends, etc.
• Communication such as communication/provision of information
• If you are a job applicant, considering you for employment.

We also may use Personal Data to comply with our legal obligations and exercise and defend against legal claims; to improve our products and services; to prevent, detect or fight fraud or illegal activities; and to create deidentified or aggregate data sets.

5.  Disclosure of Personal Data

• With other Chugai Pharmaceutical Group Companies;
• With third parties that our company uses to administer and provide services on our behalf such as patient preauthorization services, assistance with research and development activities, process management, legal, accounting, and audit services, and website hosting services;
• With our business partners such as clinical research partners and healthcare providers; collaborators, and other third-party entities;
• As required by law or court order or for the exercise or defense of legal claims. This includes adverse event reporting and complying with subpoenas or lawful requests for information from appropriate government health organizations. We may also share information as necessary to protect against legal liability or prevent fraud; or
• As part of a corporate sale, merger, reorganization, dissolution, bankruptcy or similar event.

We do not sell Personal Data or share Personal Data for cross-context behavioral advertising purposes.

6.  Cross-Border Transfer

（1） When our company transfers Personal Data across national borders (hereinafter referred to as “Cross-Border Transfer”), we will implement appropriate safeguards to properly transfer it.
（2） In addition to the above, our company may transfer Personal Data across borders between our group companies to the extent necessary for its business. We have concluded an Intra Group Transfer Agreement to ensure that the transfer of Personal Data within our group is protected to a certain standard under applicable laws.

7.  Your rights

Depending on your jurisdiction of residence, you may have the privacy rights listed below with respect to the Personal Data we collect about you. Please note that these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law. For example, we may decline your request if it conflicts with our legal obligations, it may harm our company’s rights or legal interests, or doing so is necessary to protect a person’s life, property or other rights or interests.

i.   Right to Confirm / Access / Know. You may have the right to request access to Personal Data that we hold about you, including details relating to the ways in which we use and share your information. Residents of California have the right to know the categories of Personal Data we have collected about them, the categories of sources from which the Personal Data is collected, the categories of Personal Data sold, shared, or disclosed, the business or commercial purpose for selling, sharing, or disclosing the Personal Data, and the categories of third parties to whom we have sold, shared or disclosed their Personal Data.

ii.   Right to Delete. You may have the right to request that we delete Personal Data we maintain about you.

iii.   Right to Correct. You may have the right to request that we correct inaccurate Personal Data we maintain about you.

iv.   Right of Portability. You may have the right to receive a copy of the Personal Data we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.

v.   Right to Withdraw Consent to Processing of Sensitive Personal Data. You may have the right to withdraw your consent to the collection, use and disclosure of your sensitive Personal Data, unless legal or contractual reasons prevent you from doing so. However, if you withdraw your consent, we may be unable to offer or provide you with certain goods and services.

vi.   Right to Opt Out. You may have to opt out of certain uses of your Personal Data such as profiling or automated decision-making activities that result in a legal or similarly significant effect on you.

If you wish to make a privacy right request, please contact the number listed in Contact Information section below.

8.  Data Security

We have security measures in place designed to protect against the loss, misuse, and alteration of the information under our control. While we strive to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third parties from intercepting your Personal Data. The transmission of information via the Internet, however, is not guaranteed to be completely secure and we cannot guarantee that our security measures will prevent third parties from intercepting your Personal Data.

9.  Data Retention

CPUSA may store Personal Data for as long as we have a legitimate business need for it. We determine the retention period for each category of Personal Data based on (i) the length of time we need to retain the information to achieve the business or commercial purpose for which it was obtained, (ii) any legal or regulatory requirements applicable to such information, (iii) internal operational needs, and (iv) any need for the information based on any actual or anticipated investigation or litigation.

10.  Third Party Links

Our website may contain links to other websites. Please recognize that we do not control these third party websites and this Privacy Policy will not apply to those websites. You should consult each applicable privacy policy before using another linked website.

11.  Collection of Personal Data from or about Children

CPUSA does not knowingly collect, either online or offline, Personal Data from or about persons under the age of eighteen (18) except for pediatric studies where we have obtained the consent of the child’s parent or guardian. If we learn that a child under the age of eighteen (18) has provided us with Personal Data in cases other than pediatric studies, we will attempt to anonymize or delete this information from our databases, subject to any technical limitations on our ability to do so.

12.  California Residents: Your Rights