SANDOZ CAC
PRIVACY NOTICE

DATA CONTROLLERS
Sandoz Chile SpA. With address at Av. Apoquindo 5950, 17th floor, unit 1701, comuna de Las Condes, Santiago and e-mail dpo@sandoz.com. Personal Data Protection Delegate: Darren Scott.
Sandoz Ecuador S.A. with address at Av. Amazonas N37-29 y Unión Nacional de Periodistas, Edificio Eurocenter, Piso 2, Quito, Republic of Ecuador and e-mail dpo@sandoz.com. Personal Data Protection Officer: Darren Scott.
Sandoz Pharmaceuticals Panamá S.A. with address at Costa del Este, Calle Paseo del Mar, Nro, Lote H 55, Condominio P.H. MMG Tower, Panama, Panama and e-mail dpo@sandoz.com. Personal Data Protection Officer: Darren Scott.
For the purpose of this document.
• Personal Data: is any information that identifies a person/individual or that may by itself or in conjunction with another identify him/her.
• Processing: is the collection, use, protection, storage and/or transfer of personal data.

THE PERSONAL DATA COLLECTED BY SANDOZ WILL BE USED FOR THE FOLLOWING PURPOSES:
DATA OF PATIENTS OR BENEFICIARIES OF HEALTH SERVICES:
Primary Purposes, these are those necessary to be able to concretize the relationship with you and that meet the main purpose of the collection, in case of not agreeing with these the described actions cannot be carried out: (i) So that you can participate in patient and/or clinical research programs; (ii) So that you can participate and/or collaborate in various health-related and/or cultural events or forums, whether in person or digital (remote); (iii) To integrate databases in accordance with the other purposes described herein; (iv) To comply with applicable legislation; (v) To maintain the legal relationship that may be generated; (vi) In some cases, Sandoz may perform the actions it deems necessary, in order to verify directly or through third parties, the accuracy of the data provided and; (vii) Allow access to any of our facilities and / or perform video surveillance actions within them.
Secondary or complementary purposes, not necessary to fulfill the main purpose of the collection: Additionally, your Personal Data may be used: (i) to invite you to participate in different health-related and/or cultural programs, events, forums and conferences, either in person or remotely; (ii) to offer and/or send you health-related information and, in some cases, to deliver medical samples and/or follow up on the delivery thereof; (iii) to, after encryption and/or anonymization of the data, aggregate it with other data and perform statistical analysis, information modeling and/or current and predictive behavioral profiling and/or clinical or scientific research; (iv) to participate in surveys; (v) to comply with our internal processes and; (vi) to follow up on adverse events that have had to be reported in accordance with applicable law.

DATA OF PROFESSIONALS RELATED TO HEALTH SERVICES:
Primary Purposes, these are those necessary to be able to concretize the relationship with you and that meet the main purpose of the collection, in case you do not agree with these you will not be able to perform the actions described: (i) For you to participate in, patient and/or clinical research programs; (ii) For you to participate and/or collaborate in various events or forums related to health and/or cultural topics, either in person or digital (remote); (iii) To integrate databases in accordance with the other purposes described herein; (iv) To comply with applicable legislation; (v) To maintain the legal relationship that may be generated; (vi) In some cases, Sandoz may perform the actions it deems necessary, in order to verify, directly or through third parties, the accuracy of the data provided and; (vii) Allow access to any of our facilities and / or perform video surveillance actions within them.
Secondary or complementary purposes, not necessary to fulfill the main purpose of the processing: Additionally, your Personal Data may be used for: (i) marketing, advertising and/or commercial prospecting; (ii) to know you better and contact you to offer you medical and/or health-related information and/or cultural topics and, if applicable, other products and/or services of our own or of any of our affiliates, subsidiaries, controlling companies, associates, commission agents, companies or third parties as well as, in some cases to send you medical samples and materials to collaborate with the care of your patients, and/or to follow up on the delivery of the same; (iii) to invite you to participate in different programs, events, forums and conferences related to health and/or cultural topics, which may be in person or digital (remote); (iv) to perform statistical analysis, generation of information models and/or profiles of current and predictive behavior and participate in surveys; (v) to improve our communications, publications, research processes and/or development of our products; and; (v) to follow up on adverse events that have had to be reported in accordance with the applicable legislation. They may make use of Personal Data for other purposes, provided that such purposes are compatible and may be considered analogous to the above.

DATA FROM THE GENERAL PUBLIC (THOSE PEOPLE WHO DO NOT FIT INTO THE TWO PREVIOUS CATEGORIES):
Primary Purposes, these are those necessary to be able to concretize the relationship with you and that meet the main purpose of the collection, in case you do not agree with these you will not be able to perform the actions described: (i) For you to participate and/or collaborate in various events, forums related to health and/or negotiations and/or with other activities of Sandoz, either in person or digital (remote); (ii) To integrate databases in accordance with the other purposes described herein; (iv) To comply with applicable legislation; (v) To maintain the legal relationship that may be generated; (vi) In some cases, Sandoz may perform the actions it deems necessary, in order to verify, directly or through third parties, the accuracy of the data provided and; (vii) Allow access to any of our facilities and / or perform video surveillance actions.
Secondary or complementary purposes, not necessary to fulfill the main purpose of the collection: Additionally, your Personal Data may be used: (i) to invite you to participate in different programs, events, forums and conferences related to health and/or cultural topics, either in person or remotely; (ii) to offer and/or send you information related to health and/or cultural topics; (iii) to participate in surveys and; (iv) to perform analysis on the use of our web pages.

PERSONAL DATA THAT MAY BE COLLECTED AND PROCESSED:
The categories of Personal Data that we may collect, process and/or store in a database owned by us and that are subject to processing by the Controller and its employees are: (i) Identification Data (including photographs, voice and/or video); (ii) Contact Data (in this case we will request an email to simplify, corroborate and respond to your exercise of rights); (iii) Employment Data; (iv) Academic and/or Professional Data; (vii) Migration Data; (viii) Health Data categorized as sensitive; (ix) Wealth and/or Financial Data; (x) information about your interactions with Sandoz (including without limitation, communications, survey responses, use of our sites and applications, etc. ) and; (xi) Biometric Data categorized as sensitive.

CONSENT OF MINORS OR PERSONS WHO HAVE ANY INCAPACITY ESTABLISHED BY LAW.
When processing personal data under this heading, prior to the processing, the consent of the person exercising parental authority or, if applicable, of the guardian or legal representative shall be requested in accordance with the rules of representation established in the respective legislation.

SECURITY MEASURES:
Sandoz has physical, technical, and administrative measures in place for proper Personal Data Protection.

TRANSFER OF PERSONAL DATA:
If you accept the contents of this document you consent to the transfer of your data: (i) to local or foreign third parties when the transfer is provided for in a Law or Treaty to which the country of residence of the relevant Data Controller is a party; (ii) to local and/or foreign Sandoz holding companies, subsidiaries, parents or affiliates, which operate under the same internal processes and policies (economic interest group); (iii) to third parties, only when it is necessary for the maintenance or fulfillment of a contractual legal relationship between Sandoz and you as the Data Subject and; (iv) to authorities and other third parties when required by local or foreign law for the reporting of adverse events; (v) In the case of Healthcare Professionals, we may additionally share your personal data with third parties to whom we grant a license for the distribution and/or sale of our medicines.
In addition, if you choose to participate in a patient and/or clinical program, Sandoz may, with your consent, transfer your contact information to those third parties that operate such programs funded by Sandoz, in which case such third parties will require your consent.
In certain situations, and subject to your express consent, we may share your data with other third parties not listed in this chapter, in which case we will inform you in advance when requesting your consent. Finally, in some cases corresponding to the delivery of medical samples of medicines that Sandoz distributes, with the acceptance of these, you give your consent for your name, specialty and place of origin to be shared with the pharmaceutical company that owns the medicine, this for the sole purpose of being able to verify and follow up on such delivery.

EXERCISE OF RIGHTS:
Only you, or your legal representative, duly accredited, may exercise the rights of Access, Rectification, Cancellation or Opposition; and those specific to Ecuador; with us through: https://sandoz-privacy.my.onetrust.com/webform/639a8c14-a915-4cdd-af16-67127df13247/79b82c24-0e30-4d20-bfe1-e83ea39f6a2d or, through free writing, submitted to the corresponding address of those described at the beginning of the document.
In Ecuador, you may additionally exercise the following rights:
• Right to Portability: As the Data Subject, you have the right to request Sandoz to transfer your Personal Data to another Controller or to request to receive it directly from Sandoz.
• Right to Suspension of Processing. As the data subject, you have the right to request the suspension of data processing when any of the following conditions are met: 1) When you contest the accuracy of the personal data, while the Data Controller verifies the accuracy of the data; 2) When you object to the deletion of the personal data and request instead the limitation of its use; 3) When the object of processing ends, but you need it for the formulation, exercise or defense of claims and; 4) When you have objected to the processing under Article 31 of the Ecuadorian law; while it is verified whether the legitimate reasons of the Controller prevail over yours.
• Right not to be subject to a decision based solely or partially on automated assessments: You have the right not to have your data subjected to a decision based solely or partially on assessments that are the product of automated processes, including profiling, that produce legal effects on you or that violate your fundamental rights and freedoms, for which you may: 1) Request a reasoned explanation of the decision taken by the Controller; 2) Submit observations; 3) Request the assessment criteria on the automated program; or, 4) Request from the Controller information on the types of data used and the source from which the same have been obtained and; 5) Challenge the decision before the Controller or Data Processor.
For all of the above rights, you must indicate your full name and specify clearly and obviously the exercise of the right(s) you require.
In the case of requests for rectification, you must indicate the modifications to be made and provide additional documentation to support your request.
Please note that, in order to confirm that it is you who is exercising any of the indicated rights, Sandoz may ask you to prove your identity, which we will try to do based on the information we already have about you in order not to collect additional personal data, however, if necessary we may ask you and/or your legal representative, additional information to help prove your identity and/or to find your information within our records.
It is important to mention that the exercise of any of such rights is not a prerequisite nor does it prevent the exercise of any other right. The obligation of access to information will be deemed fulfilled when the personal data is made available to the holder; or by issuing electronic documents or any other means determined by the Responsible.

AUTOMATIC MEANS TO COLLECT PERSONAL DATA:
We inform you that, when accessing our facilities, Sandoz may collect video, photographic and/or voice data through video surveillance cameras. On the other hand, when you access our websites and/or our mobile applications, we may place on your device some means of tracking such as “cookies” or other similar means, which will allow Sandoz to obtain statistical data and improve the operation and your browsing experience when you access them.
Additionally, we inform you that, in compliance with the purposes described in this privacy notice, we may collect from users the navigation data and IP address and, if applicable, data relating to their registration.

• “Cookies”: Defined as a piece of programming information that is stored in your Internet browser or elsewhere on your device. You can manage the acceptance of these directly in your browser preferences, noting that if you choose to block them, you may not be able to access content on our sites. For more information on how to manage cookies on your device, please refer to your browser’s Help function or visit https://www.aboutcookies.org which contains complete information on how to do so on a wide variety of browsers.

• “Web beacons: In some cases, Sandoz may use tracking technologies such as web beacons to collect data about your visits on our websites and other mobile applications; similar to cookies, these are electronic, non-visible images embedded on our sites or in e-mails that also allow us to generate better content to provide you with better information when you use our digital platforms.

MODIFICATIONS TO THE PRIVACY NOTICE:
This Privacy Notice may be modified or updated based on new legal requirements; Sandoz’s own needs or; for other causes. Any modification to this Privacy Notice will be notified to you through any of the following means: a written communication sent to your home address, by e-mail or to your cell phone; through newspapers of wide circulation or; through a message posted on the Sandoz website https://www.cac.sandoz.com/es.
Finally, by consenting to this privacy notice you agree to submit only to the jurisdiction and applicable law in the country where the entity is located as Responsible for collecting your data, regardless of your nationality and / or country where you are a resident.

Consent:
I expressly declare to have read and understood this Privacy Notice and I give my consent to the processing of my personal and/or sensitive personal data in the terms and purposes stated in this document.

Full name and signature: ______________________________________

Date: _________________

(When applicable) The undersigned __________________________________ in my capacity as legal representative of: ______________________________________, declare to have read and understood this Privacy Notice and manifest to have sufficient legal representation of the holder of the personal data and/or sensitive personal data to consent to the purposes of the treatment indicated therein:

Full name and signature: ______________________________________

Date: _________________

DATE OF UPDATE: OCTOBER 2023