General Privacy Statement

At Hoffmann-La Roche Limited ("Roche") we are committed to protecting your personal information. This Privacy Notice outlines the types of personal information Roche may collect; the means by which Roche may collect, use, or share your personal information; steps Roche takes to protect your personal information; and choices you are provided with respect to the use of your personal information.

For purposes of this Privacy Notice, "Personal Data" is any information by which you can be individually identified both directly and indirectly, including, but not limited to, your name, address, e-mail address, and telephone number.

How and Why We Process Your Personal Data

We may request Personal Data about you. Examples of Personal Data that we may collect that directly identifies you includes your name, contact information, email address, and other information in combination with these identifiers. On our websites, we also may collect certain Personal Data information that does not directly identify you by name, but could be used to identify that a specific computer or device has accessed our website.

We process your Personal Data for many reasons, including:

• To respond to your requests or inquiries;
• To complete a transaction;
• To track and monitor adverse events and other activities related to pharmacovigilance);
• To meet legal, regulatory and security processing requirements;
• To personalize your experience on our website(s);
• To perform website analytics and measure website performance; and
• To maintain our website(s), including for security purposes.

More Information on our Processing Activities

Responding to Requests or Inquiries: Personal data may be submitted to us for various purposes, including through direct interactions, via our website(s) and other online resources. For example, you may submit a Medical Information request, inquire about a product, or subscribe to one of our mailing lists. In these instances, we may use the information that you provide to us to take the steps necessary to respond to your request. Depending on your request, we may collect your contact information (such as your name, mailing address, telephone number, job title), your interests and preferences (such as products or areas of interest), and any other information you provide to us. If reporting is required, we may process your data to comply with our legal obligations.

Completing Transactions: Your Personal Data may be collected to fulfill services that you have requested and to understand your interests and preferences. In these instances, we may collect your contact information as well as a history of your previous transactions with us (such as order history, customer account information). If you are purchasing or ordering a product or service from us, we use this information to perform our agreement with you.

Personalizing Your Experience: We may collect certain information about you, your preferences, and how you have interacted with us in the past in order to understand your interest in our products and services so that we can best serve you. This may include information about your contact and product preferences, languages, marketing preferences, and demographic data. In cases where we collect this information automatically, we collect and process this information for our legitimate business interests. In other cases, we will collect and process this information pursuant to your consent.

Website Analytics and Tracking: Where permitted by law, we may combine Personal Data you provide with other information you've provided to Roche through our websites. Where permitted by law, we may also combine Personal Data collected through our websites and online resources with Roche's offline records and information provided to us by third parties. More information about this can be found in the section below "Cookies and Other Web Trackers".

Pharmacovigilance and Medical Inquiries: Any personal data provided to Roche related to adverse events or other activities related to pharmacovigilance will be used solely for these purposes. This information is very important for public health and will be used for the detection, assessment, understanding and prevention of adverse effects or any other medicine-related problem. We collect and process your data for these purposes in accordance with specific GVP (Pharmacovigilance) legislation and in order to comply with our legal obligations. Any personal data provided to Roche related to a medical inquiry may be used to answer the inquiry, follow up on such requests and maintain the information in a Medical Information database for reference. Where required by law (such as for pharmacovigilance), we may also be required to report the data to regulatory authorities. Your data will not be used for any other purpose.

No Third-Party Direct Marketing Use

We will not sell or otherwise transfer the personally identifiable information you provide to us to any third parties for their own direct marketing use unless we provide clear notice to you and obtain your explicit consent for your data to be shared in this manner.

Recipients of your Personal Data

We may share your Personal Data with Roche's affiliates around the world. Our Roche affiliates will use your Personal Data for the same purposes as we do. A list of Roche's affiliates is available in the current annual report, which can be found in the Investors section of www.roche.com.

We may also share your Personal Data with outside third parties, including our data processors, for the following purposes:

• To help fulfill Roche business transactions;
• To conduct technical maintenance of our websites and other web platforms;
• To facilitate a merger, consolidation, transfer of control or other corporate reorganization in which Roche participates, or pursuant to a financial arrangement undertaken by Roche;
• To respond to appropriate requests of legitimate government authorities, or where required by applicable laws, court orders, or government regulations; and
• Where needed for corporate audits or to investigate or respond to a complaint or security threat

International Transfers of Your Personal Data

Any Personal Data you provide to us may be transferred to or stored in a geographic region which imposes different privacy obligations than your country of origin. This may mean that your Personal Data may be sent to a country with less restrictive data protection laws than your own. Any such transfer will be conducted in compliance with applicable law and Personal Data may be subject to the local laws of the jurisdictions within which it is collected, used, disclosed and/or stored, and may be accessed by governmental and law enforcement authorities in those jurisdictions.

Retention / Storage Period of Your Personal Data

The length of time in which we will store your Personal Data will differ depending on the purpose for which we have collected and are processing your data. In most cases, we will keep the data for three (3) years following our last interaction with you. We may, however, maintain your data for a longer period of time if we are required by law to maintain your data. For example, reports related to pharmacovigilance are kept for a minimum of 10 years after the withdrawal of the product in the last country where the product is marketed.

Our Websites

We use information to secure our websites, network systems, and other assets. This may include information concerning your IP Address, geographic location, resources you have accessed, and similar information. We collect this information automatically, for our legitimate business interests. Several places on our website require Personal Data if you choose to use them, including surveys, registration, and content sharing features (i.e., "E-mail to a Friend" links). Roche and its business partners collect this information about you only if you voluntarily provide it to us. Please be aware that certain features of this site may not be available to you if you elect not to provide certain Personal Data. Any Personal Data you provide to us will be used in accordance with this Privacy Notice.

Cookies and Other Web Trackers

Our websites use technology such as cookies, web beacons and other tracking technologies that enable us to deliver content that is tailored to your interests and preferences based on your past activity on the site. Please see our Cookie Policy for more information.

Websites We Do Not Own or Control

Our websites also may contain links to third-party websites. We do not endorse and are not responsible for the content of third-party websites or resources, and our privacy notice does not apply to any sites that are not affiliated with Roche, even if you access them via a link on our site. You should review the privacy policies of any third-party site before providing any information.

Minors

We do not knowingly collect any Personal Data from anyone under the age of 16 without the prior, verifiable consent of a legal representative. Such legal representative may have the right, upon request, to view the information provided by the child and require that it be deleted. Moreover, all minors should seek their parent's or guardian's (legal representative) permission prior to using or disclosing any Personal Data on our website or online resource. This website is not designed or intended for use by children under the age of 16.

Data Security

Roche uses technology and security precautions, rules and other procedures to protect your personal information from unauthorized access, improper use, disclosure, loss or destruction. To ensure the confidentiality of your information, Roche uses also industry standard firewalls and password protection. It is, however, your personal responsibility to ensure that the computer you are using is adequately secured and protected against malicious software, such as trojans, computer viruses and worm programs. You are aware of the fact that without adequate security measures (e.g. secure web browser configuration, up-to-date antivirus software, personal firewall software, no usage of software from dubious sources) there is a risk that the data and passwords you use to protect access to your data, could be disclosed to unauthorized third parties.

Access

You have a right to request access to your Personal Data and to request a correction to it if you believe it is inaccurate. In the event that you believe that your Personal Data is not accurate or you wish access to your Personal Data, you may make a request using the contact information provided below.

We endeavor to provide timely access to your Personal Data. However, we may require you to verify your identity to our satisfaction prior to doing so. Further, there may be circumstances where access cannot be granted. For example, we will not grant access where doing so would lead to the disclosure of Personal Data of another individual and that individual refuses to provide consent to the disclosure, or where the information is subject to privilege or other legal restrictions. In such cases you will be notified of the reason why it is not possible to grant access to your Personal Data.

Updates to This Privacy Notice

From time to time, we may revise this Privacy Notice. Any such changes to this Privacy Notice will be reflected on this page. Roche recommends that you review this Privacy Notice regularly for any changes. The date on which this notice was last revised is located at the top of this notice.

How to Contact Roche

For questions or if you wish Roche to amend or delete your profile, please contact us in writing (by post), as follows: