Novartis Privacy Policy for Optimizing the treatment:

Date : Mar 5, 2021

Novartis acknowledges and respects the privacy of individuals. The collection, use, retention and disclosure of your personal information as a result of your registration for the Optimizing the treatment: Optimizing the treatment is managed as set forth below:

Purpose for collecting personal information and related use

Your personal information is collected by our partner Benecke Consultants B.V. on behalf of Novartis Pharma Services AG  and other affiliates of the Novartis Group of Companies (“Novartis”) and will be used to manage and administer webcasts and for related records-‐keeping for compliance with industry codes, regulations and laws. We also use your personal information to understand, develop, test and improve the webcast and educational resource usage and to allow you to access certain parts of this site without re-‐registering. Your personal information including your name, comments or any information about yourself that may contain your image (such as video footage) may be used for non-commercial purposes which may include, among others, internal and external communication channels (e.g. disease awareness events, social media, Facebook, Youtube, marketing e-mails etc.).

Data controller of personal information collected

Novartis will operate as Data Controller and Benecke Consultants B.V. acts on it’s behalf as a Data processor. The personal information collected will be shared with Novartis Group of Companies for processing insofar as necessary for achieving the purposes described above. Novartis has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection, in particular relating to transfers of personal information outside the EEA and Switzerland. Read more about your rights under the Novartis Binding Corporate Rules. This information is also available on the Novartis.com website.

Personal information collected and legal basis for the processing

Personal information, including but not limited to your first and last name, e‐mail address, and country that you enter into the registration form and any information included as part of the questions raised during each webcast will be collected. We will not process your personal data if we do not have a proper justification foreseen in the law for that purpose. Therefore, we will only process your personal data if:

• We have obtained your prior consent;

• The processing is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.

Personal information disclosure to third parties

“Novartis” or it’s partner will not sell, share, or otherwise distribute your personal information to third parties except as provided in this Privacy Policy. Your personal information may be transferred to third parties who act for or on our behalf in accordance with the listed purposes, including to place cookies as described above. These third parties may be located in countries or territories, which may not offer the same level of data protection as the country in which you reside. They have contracted with us to use your personal information solely for the agreed upon purpose, not to sell your personal information to third parties, and not to disclose it to third parties except as may be required by law, as permitted by us or as stated in this Privacy Policy.

Your personal information may also be transferred to a third party in the event that this part of our business and the personal information connected with it is sold, assigned or transferred, in which case we would require the buyer, assignee or transferee to treat your personal information in accordance with this Privacy Policy. Also, your personal information may be disclosed to a third party if we are required to do so because of an applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Retention of personal information

Your personal information will be stored for 12 months from the date of your registration. There may be cases when your personal information or part of it may be stored for a longer time if Novartis is required to do so because of an applicable law, court order or governmental regulation or if such retention is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Protection of your personal information

We have implemented appropriate technical and organizational measures to provide an adequate level of security and confidentiality to your personal information, taking into account the nature of the data and the risk of processing such information.

The purpose thereof is to protect it against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing. Moreover, when handling your personal data, we comply with the following obligations:

·       We only collect and process personal information which is adequate, relevant and not excessive, as required to meet the above purposes;

·       We ensure that your personal information remains up to date and accurate. For the latter, we may request you to confirm the personal data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your personal circumstances so we can ensure your personal data is kept up-to-date.

Exercise of access rights and contact details

You may exercise the following rights under the conditions and within the limits set forth in the law:

·       the right to access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;

·       the right to request the erasure of your personal data or the restriction thereof to specific categories of processing;

·       the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;

·       the right to object, in whole or in part, to the processing of your personal data;

·       the right to object to a channel of communication used for direct marketing purposes; and

If you have a question, if you are not satisfied how we process your personal data or if you want to exercise the above rights, you may send an email to dataprivacy.mena@novartis.com . When contacting us, please add a description of your relationship and/or your interactions with us. If you wish to receive information related to your personal data, please also add a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity.

When sending us such a scan, please make sure to redact your picture and national registry number or equivalent on the scan.

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.