PLEASE READ THIS POLICY CAREFULLY TO UNDERSTAND HOW WE TREAT YOUR PERSONAL INFORMATION AND YOUR RELATED CHOICES AND RIGHTS. IF YOU DO NOT AGREE WITH THE TERMS AND CONDITIONS OF THIS POLICY, YOU SHOULD NOT ACCESS OR USE OUR SITE.

OUR SITE IS INTENDED FOR USERS LOCATED IN THE UNITED STATES AND IS NOT INTENDED FOR USERS LOCATED IN OTHER COUNTRIES, INCLUDING THE EUROPEAN UNION AND THE EUROPEAN ECONOMIC AREA.

INTRODUCTION

Celltrion USA, Inc. (referred to as “Celltrion USA,” “we,” “us,” and “our”) is committed to protecting the privacy and security of the personal information we collect, use, share, and otherwise process as part of our business. We also believe in transparency, and we are committed to informing you about how we treat the data we collect and process.

When Does this Policy Apply? This Privacy Policy (the “Policy”) describes our practices and how we may use information about you (“Personal Information”) in your role as a health care professional, member of a health care organization or institution, pharmacist, government official, non-profit organization, or other non-patient individuals with whom we collaborate (collectively, “health care professional”, “you”, and “your”).

This policy applies to information we collect:

• On the Websites operated by us from which you are accessing this Privacy Policy;

• In email, text, and other electronic messages between you and the Celltrion USA;

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by Celltrion USA or any third-party (including our affiliates and subsidiaries);

• Any software application made available by us for use on or through smartphones or devices; or

• Any third-party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Sites.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, please refrain from using our Site. By accessing or using the Sites, you agree and consent to this Privacy Policy. This policy may change from time to time. Updates to this policy will made apparent to you by the “Last Updated” date listed at the top of this policy. It is your responsibility to monitor for changes to this policy. Your continued use of these Websites after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

WHAT INFORMATION DO WE COLLECT?

We may collect the information listed below for the purposes described in the “How Do We Use and Share Your Information?” section of this Policy.

Category

Description

Name, Contact Information, and Identifiers

Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, username, social security number, tax ID, driver’s license number, state or national identification card number, passport number, or other similar identifiers.

Customer and Other Records

Paper and electronic customer records containing personal data, such as name, signature, physical characteristics or description, address, telephone number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information

Protected Classifications

Characteristics of protected classifications under applicable state or federal law such as race, ethnicity, sex, gender, age, national origin, disability, and citizenship status.

Purchase History and Tendencies

Commercial information, including records of products or services considered, purchased, or owned.

Biometric Information

Physiological, biological or behavioral characteristics that can be used alone or in combination with each other to establish individual identity, including DNA, fingerprint, diagnostic or lab results, imagery of the face from which an identifier template can be extracted, and sleep, health, or exercise data that contain identifying information.

Usage Data

Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a resident’s interaction with an internet website, application, or advertisement.

Geolocation Data

Precise geographic location information about a particular individual or device.

Audio/Visual

Audio, electronic, or visual recordings, or similar information.

Professional or Employment-Related Information

Work experience, name, phone number, email address, performance evaluations.

Education Information

Information that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).

Sensitive Information

As defined under applicable local law, such as certain characteristics of protected classifications, precise geolocation, account login credential and passwords, health information, and financial information.

Communications and Questions

Comments, content, questions, or other information that you choose to provide

Cookies and Similar Technologies

Please see the “Cookies and Similar Technologies” section of this Policy for more information.

Profiles and Inferences

Inferences drawn from any of the information identified above to create a profile about a resident reflecting the resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Cookies and Similar Technologies

First and Third-Party Cookies

A “cookie” is a small file created by a web server that can be stored on your device (if you allow) for use either during a particular browsing session (a “session” cookie) or a future browsing session (a “persistent” or “permanent” cookie). “Session” cookies are temporarily stored on your hard drive and only last until they expire at the end of your browsing session. “Persistent” or “permanent” cookies may remain stored on your hard drive until they expire or are deleted by you. Local shared objects (or “flash cookies) may be used to collect and store information about your preferences and navigation to, from, and on the site. First-party cookies are set by the website you’re visiting, and they can only be read by that site. Third-party cookies are set by a party other than that website.

Other Similar Technologies

In addition to cookies, there are other automatic data collection technologies, such as Internet tags, web beacons (clear gifs, pixel tags, and single-pixel gifs), and navigational data collection (log files, server logs, etc.) that can be used to collect data as users navigate through and interact with a website. For example, web beacons are tiny graphics with unique identifiers that are used to understand browsing activity. In addition, UTM codes are strings that can appear in a URL when you move from one web page or website to another. The string can represent information about browsing, such as which advertisement, page, or publisher sent the user to the receiving website.

What Cookies and Similar Technologies Are in Use and Why Do We Use Them?

We use first-party and third-party cookies and similar technologies for purposes such as to improve Site functionality, to measure and track how users interact with the Site, and to perform similar analytics. We may also use first-party and third-party cookies and similar technologies on the Site in order to otherwise tailor our communications with you.

Other Third-Party Technologies

Some third parties may use automated data collection technologies to collect information about you when you browse the Internet. The information they collect about your online browsing activities over time and across different websites and other online services may be associated with your personal information and used to provide you with targeted content. We do not control these third parties’ technologies or how they may be used. If you have any questions about targeted content, you should contact the responsible party directly or consult their privacy policies.

Choices About Cookies

Most web browsers are set by default to accept cookies. If you do not wish to receive cookies, you may set your browser to refuse all or some types of cookies or to alert you when cookies are being sent by website tracking technologies and advertising. These settings may affect your enjoyment of the full functionality of the Site. In addition, adjusting the cookie settings may not fully delete all of the cookies that have already been created. To delete them, visit your web browser settings after you have changed your cookie settings. Additional information is provided below about how to disable cookies or manage the cookie settings for some of the leading web browsers:

Google Chrome: https://support.google.com/chrome/answer/95647?hl=en

Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Internet Explorer: http://windows.microsoft.com/en-GB/windows-vista/Block-or-allow-cookies

Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac and https://support.apple.com/en-us/HT201265

For more information about how to modify your browser settings to block or filter cookies, visit http://www.aboutcookies.org/. You may learn more about internet advertising practices and related consumer resources at http://www.aboutads.info/consumers/,http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work, or http://www.networkadvertising.org/choices. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe’s website at: https://www.macromedia.com/support/documentation/en/flashplayer/help/help09.html.

HOW DO WE USE AND SHARE YOUR INFORMATION?

How do we use the information described in this Policy? To the extent permitted by applicable law, we may use the information described in the “What Information Do We Collect?” section above for purposes listed below.

● Provide you with services, content, customer service, and functionality;

● Manage your access to and use of our services;

● Honor our terms of service and contracts;

● Process and complete payments and other transactions;

● Operate and improve our operations, business, services, and the Site;

● Develop new products and services;

● Improve our customer service;

● Communicate with you and respond to your feedback, requests, questions, or inquiries;

● Manage our relationship with you;

● Maintain our databases and back-ups, including records of our communications with you;

● Ensure the privacy and security of our Site, and services;

● Detect fraud and prevent loss;

● Support and improve the Site, including evaluations of functionality and features;

● Promote our services;

● Contact you about other products and services;

● Invite you to participate in surveys or to personalize your experience with our services;

● Analyze use of the Site, and our services and prepare aggregate traffic information;

● Provide you with a more personal and interactive experience on the Site;

● Determine and track user interests, trends, needs, and preferences;

● General business support purposes, including but not limited to procurement, financial and fiscal management, risk and compliance management, and external reporting;

● Facilitate corporate mergers, acquisitions, reorganizations, dissolutions, or other transfers;

● Accomplish any other purpose related to and/or ancillary to any of the purposes and uses described in this Policy for which your information was provided to us;

● Accomplish another purpose described to you when you provide the information, for which you have consented, or for which we have a legal basis under law;

● Comply with federal, state, or local laws;

● Comply with a civil, governmental, or regulatory inquiry, order, subpoena, summons, or process;

● Cooperate with law enforcement agencies;

● Exercise or defend legal rights or claims; and

● Create, use, retain, or disclose de-identified or aggregated data.

How do we disclose or share the information described in this Policy? To the extent permitted by applicable law, we may share the information described in the “What Information Do We Collect?” section above for purposes listed below.

Category

Description

Affiliates

We may share your information with our subsidiaries and affiliates and with their respective officers, directors, employees, and agents.

Acquisitions and Similar Transactions

We may disclose your information in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our company assets. If our business is acquired by or merged with another company, your information may be transferred to the new owners.

Disclosures with Your Consent

We may ask if you would like us to share your information with other unaffiliated third parties who are not described elsewhere in this Policy. We will only disclose your information in this context with your consent.

Legal Obligations and Rights (Subpoenas, Court Orders, and Warrants)

We may disclose information in response to subpoenas, warrants, court orders or other legal process, or to comply with relevant laws. We may also share information in order to establish or exercise our legal rights or claims; to defend against a legal claim; and to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our contracts.

Third Parties

We may provide information about you to third parties that may offer products and services specifically requested by you, including authorized representatives and health care providers.

Service Providers

We may share information with our service providers that need access to information to provide operational or other support services on our behalf (e.g., for managing or hosting services and/or underpinning technology for the Services we are providing). Among other things, service providers help us to administer the Site; support our operations; provide technical support; send communications to you; provide payment processing; and assist with other legitimate purposes permitted by law.

Professional Advisors

We may share your information with our and our affiliates’ insurers, auditors, and professional advisors, including attorneys and accountants, that need access to your information to provide operational or other support services on our behalf.

Deidentified or

Aggregated Data

We may disclose aggregated information or de-identified information that does not identify any specific individual, such as groupings of demographic data or customer preferences.

HOW LONG DO WE STORE AND USE YOUR INFORMATION?

We retain and use your information for as long as is necessary to fulfill the purposes for which it was collected, to comply with our business requirements and legal obligations, to resolve disputes, to protect our assets, to operate our business, and to enforce our agreements.

At our sole discretion, we may delete your information if we believe it is incomplete, inaccurate, or that our continued storage of it is contrary to our objectives or legal obligations. When we delete data, it will be removed from our active servers and databases, but it may remain in our archives when it is not practical or possible to delete it.

To the extent permitted by law, we may retain and use anonymous, de-identified, or aggregated information for performance reporting, benchmarking, and analytic purposes and for operational improvement.

HOW DO WE PROTECT YOUR INFORMATION?

We have put security measures in place to protect the personal information that you share with us from being accidentally lost, used, altered, disclosed, or accessed in an unauthorized manner. From time to time, we review our security procedures to consider appropriate new technologies and methods.

While our security measures seek to protect the personal information in our possession, no security system is perfect, and no data transmission is 100% secure. As a result, while we strive to protect your information, we cannot guarantee or warrant the security of any information transmitted to or from the Site. Your use of the Site is at your own risk. We cannot guarantee that your data will remain secure in all circumstances.

If a data breach compromises your personal information, we will notify you and any applicable regulator when we are required to do so by applicable law.

YOUR RIGHTS AND CHOICES REGARDING PERSONAL INFORMATION

Please use the “Contact Us” details provided at the end of this Policy to exercise your rights and choices under this Policy. We honor such requests when we are required to do so under applicable law.

Email Opt-Out. We may send you emails about our services and other updates. If you no longer wish to receive communications from us via email, you may opt-out by clicking the “unsubscribe” link at the bottom of our emails, if applicable, or by submitting a request via the “Contact Us” details at the end of this Policy and providing your name and email address so that we may identify you in the opt-out process. Once we receive your instruction, we will promptly take corrective action. Please note that registered users cannot opt out of receiving transactional e-mails related to their account.

Accuracy and Updating Your Information. Our goal is to keep your information accurate, current, and complete. If any of the information you have provided to us changes, please let us know via the “Contact Us” details at the end of this Policy. For instance, if your email address changes, you may wish to let us know so that we can communicate with you. If you become aware of inaccurate personal information about you, you may want to update your information. We are not responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.

Complaints. If you believe your rights relating to your personal information have been violated, please contact us via the “Contact Us” details provided at the end of this Policy.

California Residents. Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us once per calendar year information about the information we shared, if any, with other businesses for direct marketing uses. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing, if any, will be included in our response.

CPRA gives residents of California the right to opt-out of their personal information being sold to third-parties, the sharing of their personal information for behavioral advertising, and to limit the use of their sensitive personal information. This may include the Celltrion USA’s disclosure of personal information with our clients for certain services. The opt-out right has some exemptions such as sharing of information with necessary service providers will remain unaffected and opt-out requests will not affect the Celltrion USA’s services where personal information is not sold.

If you are a California resident, you can exercise these rights by submitting a request to privacy_usa@celltrionhc.com. When submitting the request, please indicate that you are exercising your California right to opt-out of the sale or sharing of your personal information or limiting the use of your sensitive personal information, as it will help us to honor your request.

Nevada Residents. You may submit a verified request to us at privacy_usa@celltrionhc.com to request that we not make any sale (as defined under Nevada law) of any covered information (as defined under Nevada law) that we have collected or will collect about you. Please provide your name and contact information in your request. We will respond to your request in accordance with Nevada law.

THIRD-PARTY SITES AND SERVICES

This Policy only applies to the Site, and it does not apply to any third-party websites or applications.

The Site may contain links to, and media or other content from, third parties. These links are to external resources and third parties that have their own privacy policies. Because of the dynamic media capabilities of the Site, it may not be clear to you which links are to external, third-party resources. If you click on an embedded third-party link, you will be redirected away from the Site to the external third-party website. You can check the URL to confirm that you have left the Site.

We cannot and do not (1) guarantee the adequacy of the privacy or security practices employed by or the content and media provided by any third parties or their websites, (2) control third parties’ independent collection or use or your information, or (3) endorse any third-party information, products, services or websites that may be reached through embedded links on the Site.

Any information provided by you or automatically collected from you by a third party will be governed by that party’s privacy policy and terms of use. If you are unsure whether a website is controlled, affiliated, or managed by us, you should review the privacy policy and practices applicable to each linked website.

CROSS BORDER TRANSFERS

While the Site is intended for users located in the United States, any information you provide to us through use of the Site may be stored and processed, transferred between and accessed from the United States and other countries that may not guarantee the same level of protection of personal information as the one in which you reside. However, we will handle your personal information in accordance with this Policy regardless of where your personal information is stored/accessed.

CHILDREN UNDER THE AGE OF 18

THIS SITE IS NOT INTENDED FOR CHILDREN UNDER 18 YEARS OF AGE. NO ONE UNDER AGE 18 MAY ACCESS, USE THE SERVICES OF, OR OTHERWISE PROVIDE ANY INFORMATION THROUGH THIS SITE.

The Children’s Online Privacy Protection Act (“COPPA”), the California Consumer Protection Act (“CCPA”), as well as other data privacy regulations restrict the collection, use, or disclosure of personal information from and about children on the Internet. Our Site and services are not directed to children aged 18 or younger, nor do we knowingly collect information from or about children under the age of 18. No one under the age of 18 may access, browse, or use the Site or provide any information to or on the Site. If you are under 18, please do not use or provide any information on the Site (including, for example, your name, telephone number, email address, or username). If we learn that we have collected or received personal information from a child under the age of 18, we will take steps to stop collecting that information and delete it. If you believe we might have any information from or about a child under the age of 18, please contact us via the “Contact Us” details provided at the end of this Policy.

BY ACCESSING THIS SITE, YOU REPRESENT YOU ARE AT LEAST 18 YEARS OF AGE.

For more information about COPPA, please visit the Federal Trade Commission’s website at: https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule. For more information about CCPA’s requirement for a child’s consent to data collection, please see the State of California CCPA website, located at: https://oag.ca.gov/privacy/ccpa.

UPDATES AND CHANGES TO THIS POLICY

We may add to, change, update, or modify this Policy to reflect any changes to how we treat your information or in response to changes in law. Should this Policy change, we will post all changes to this Policy on this page. Any such changes, updates, or modifications will be effective immediately upon posting. The date on which this Policy was last modified is identified at the beginning of this Policy.

You are expected to, and you acknowledge and agree that it is your responsibility to, carefully review this Policy prior to using the Site, and from time to time, so that you are aware of any changes. Your continued use of the Site after the “Last Updated” date will constitute your acceptance of and agreement to such changes and to our collection and sharing of your information according to the terms of the then-current Policy. If you do not agree with this Policy and our practices, you should not use the Site.

CONTACT US

For more information, or if you have any questions or concerns regarding this Policy, you may contact us using the information below, and we will do our best to assist you.

By Postal Mail: Celltrion USA, Inc.

Attn: US Compliance

1 Evertrust Plaza

Jersey City, NJ 07302

By Email: privacy_usa@celltrionhc.com

We will never ask you for credit card information via email. Please do not include credit card or other sensitive financial information in your emails to us.

Sign up for IGNITE