General Privacy Notice for External Stakeholders

We collect various types of personal data about you, including:

• your general and identification information (e.g. name, first name, last name, gender, email and/or postal address, fixed and/or mobile phone number);
• your function and professional activities (e.g. title, position, name of company/organization, publications, congress activities, media and social media activities, awards, biography, education, links to universities, expertise and contributions, and organizations);
• your electronic identification data where required for our interactions (e.g. login, access right, passwords, badge number, IP address, online identifiers/cookies, logs, access and connection times, image recording or sound such as badge pictures, CCTV or voice recordings);
• information regarding your responses and/or preferences including in terms of types of messages discussed, channels of communication and frequency;
• data you provide to us for example when you fill in forms or during events you attend, or when you answer questions during a conversation or in a survey;
• data collected in connection with our products and services; and
• information about the activities/interactions you have with us, including potential future interactions.

This information is provided by you directly, by our partners (which may be the entities for which you work) or by third parties (for example, consulting companies, public authorities), or obtained through reliable public sources (such as governmental internet websites, social media, university or congress websites).

If you intend to provide us with personal data about other individuals (e.g. your colleagues), you must provide a copy of this Privacy Notice to the relevant individuals, directly or through their employer.

Purposes of the processing

We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data for the following purposes:

• manage our relationship with you (e.g. through our databases);
• provide you with appropriate, adequate and updated information about disease, drugs as well as our products and services;
• improve the quality of our interactions, answer your requests and provide you with efficient support;
• send you general communications and information (e.g. Footprint of Novartis France), send you communications regarding products, therapeutic areas or services that we promote as well as surveys (e.g. to help us improve your future interactions with us);
• manage, plan and execute communications and interactions with you, mapping your connections with other stakeholders who are relevant to us;
• invite you to events or promotional meetings sponsored by us (e.g. medical events, speaker events, conferences);
• implement tasks in preparation of or to perform existing contracts;
• manage our IT resources, including infrastructure management and business continuity;
• preserve the company’s economic interests and ensure compliance and reporting (such as complying with our policies and local legal requirements, tax and deductions, managing alleged cases of misconduct or fraud; conducting audits and defending litigation);
• manage mergers and acquisitions involving our company;
• archiving and record keeping; and
• any other purposes imposed by law and authorities.

Legal basis for the processing

We will not process your personal data if we do not have a proper justification foreseen in the law for that purpose. Therefore, we will only process your personal data if:

• the processing is necessary to comply with our legal or regulatory or contractual obligations; or
• the processing is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.

Please note that, when processing your personal data on this last basis, we always seek to maintain a balance between our legitimate interests and your privacy. Examples of such ‘legitimate interests’ are data processing activities performed:

• to identify key-stakeholders, to develop a better understanding of their activities, and to initiate further contacts with them;
• to develop a proximity and trustful professional relationship with external stakeholders;
• to promote Novartis innovations in the pharmaceutical field and to understand the markets;
• to manage Novartis human and financial resources and optimize the interactions with our stakeholders;
• to ensure that the right medicine reaches the patient according to a well-informed technical and professional opinion of our external stakeholders;
• to prevent fraud or criminal activity, to ensure security of our IT systems, architecture and networks;
• to sell any part of our business or its assets or to enable the acquisition of all or part of our business or assets by a third party; and
• to meet our corporate and social responsibility objectives.

For more information on our specific interests, please contact us as indicated below.

We will not sell, share, or otherwise transfer your personal data to third parties other than those indicated in this Privacy Notice.

In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data can be accessed by, or transferred to the following categories of recipients, on a need to know basis to achieve such purposes:

• our personnel (including personnel, departments or other companies of the Novartis group);
• our independent agents or brokers (if any);
• our suppliers and services providers that provide services and products to us;
• our IT systems providers, cloud service providers, database providers and consultants;
• our business partners who offer products or services jointly with us or with our subsidiaries or affiliates;
• any third party to whom we assign or novate any of our rights or obligations; and
• our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.

The above third parties are contractually obliged to protect the confidentiality and security of your personal data, in compliance with applicable law.

Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.

The personal data we collect from you may also be processed, accessed or stored in a country outside the country where Novartis Pharma AG is located, which may not offer the same level of protection of personal data.

If we transfer your personal data to external companies in other jurisdictions, we will make sure to protect your personal data by (i) applying the level of protection required under the data protection/privacy laws applicable to Novartis Pharma AG, (ii) acting in accordance with our policies and standards and, (iii) unless otherwise specified, only transferring your personal data on the basis of standard contractual clauses approved by the European Commission or the Swiss Federal Data Protection and Information Commissioner respectively. You may request additional information in relation to international transfers of personal data and obtain a copy of the adequate safeguard put in place by exercising your rights as set out below.

For intra-group transfers of personal data to our group companies, the Novartis Group has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection relating to transfers of personal data outside the EEA and Switzerland. Read more about the Novartis Binding Corporate Rules here.

We have implemented appropriate technical and organisational measures to provide an adequate level of security and confidentiality to your personal data. These measures take into account:

• the state of the art of the technology;
• the costs of its implementation;
• the nature of the data; and
• the risk of the processing.

These measures protect against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.

Moreover, when handling your personal data, we:

• only collect and process personal data which is adequate, relevant and not excessive, as required to meet the above purposes; and
• ensure that your personal data remains up to date and accurate.

For the latter, we may request you to confirm the personal data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your personal circumstances so we can ensure your personal data is kept up-to-date.

We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

Personal data we hold in our database about you which is not related to a specific contract will be stored for 36 months from the date when the reason for collecting the data has ceased, e.g. from the date you retire from your public activities.

For contracts, the retention period is the term of your (or your company’s) contract with us, plus the period of time until the legal claims under this contract become time-barred, unless overriding legal or regulatory schedules require a longer or shorter retention period. When this period expires, your personal data is removed from our active systems.

Personal data collected and processed in the context of a dispute is deleted or archived (i) as soon as an amicable settlement has been reached, (ii) once a decision in last resort has been rendered or (iii) when the claim becomes time barred.

You may exercise the following rights under the conditions and within the limits set forth in the law:

• the right to access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
• the right to request the erasure of your personal data or the restriction thereof to specific categories of processing;
• the right to object, in whole or in part, to the processing of your personal data;
• the right to object to a channel of communication used for direct marketing purposes; and
• the right to request its portability, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.

If you have a question or want to exercise the above rights, please click here.

If you are not satisfied with how we process your personal data, please address your request to our data protection officer at [email protected], who will investigate your concern.

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.

Any future changes or additions to the processing of your personal data as described in this Privacy Notice will be notified through our usual communication channels (e.g. by email or via our internet websites).