EU-HCP Engagement Privacy Notice

We hereby notify you on the processing of your personal data in accordance with articles 12-14 of Regulation (EU) 2016/679 (General Data Protection Regulation).

This privacy notice concerns the collection and use of personal data when engaging with healthcare professionals and healthcare organisations (HCPs/HCOs) regarding services, such as, but not limited to, consultancy, speaker activities, advisory boards and when providing donations, grants and/or sponsorships.

1. We are the data controllers - how do you contact us?
The LEO entity with whom you are making a contract, LEO Pharma A/S and the LEO entity of your home country of register (all of which may be the same) are the joint data controllers for the processing of the personal data that we have received about you / you have provided to us. You will find our contact information below.

2. Contact information on the Data Protection Officer

If you have any questions about the processing of your personal data, you are always welcome to contact our Data Protection Officer in the following ways:

• By e-mail: Dataprivacy@leo-pharma.com

• On the phone: +45 4494 5888

• By letter: LEO Pharma A/S, Industriparken 55, 2750 Ballerup, Denmark, c/o Data Protection Officer

3. Purpose and legal basis for processing your personal data
We process your personal data for the following purposes:

4. Recipients or categories of recipients
We disclose or entrust your personal data to the following recipients for the mentioned purposes:

• Compliance with local law and industry standards

  Recipients: LEO Pharma internal personnel who documents, assess and monitor the legitimate business need and justification of selection of HCPs/HCOs, and fair market value, including monitoring compliance in relation to the prohibition of inducements to supply or prescribe particular products.

• Audit and/or inspection purposes

Recipients: LEO Pharma internal personnel, local law enforcers or local industry associations.

• Transparency purposes

If you reside in a country with legislation on transparency:

National authority website, information are made accessible to the general public .

If you reside in a country with local industry obligations on transparency:

Local industry association/company website of the LEO Entity of your registered country, information are made accessible to the general public if consent has been provided where required.

• Data processors

IT applications and server storage

We utilise a series of data processors (providers of IT applications and server storage) for the purposes mentioned above. Such providers are obligated by contract to ensure the confidentiality and security of your personal data as required by law.

Performance of activity/services

LEO Pharma internal personnel and LEO Pharma contracted third parties who are administering logistics in relation to activities performed by you. Such third parties are obligated by contract to ensure the confidentiality and security of your personal data as required by law.

5. Transfer to recipients in third countries
Personal data is not transferred to countries outside the European Economic Area (EEA), i.e. third countries, on a regular or systematic level.

6. Where your personal data originates
Where you have not yourself provided your personal data, such as registration number, we may retrieve such data from publicly available sources, such as registration databases made available by the national authorities, or from an HCO. You can always request access to your personal data in accordance with paragraph 8 below.

7. Retention of your personal data
Personal data is retained for a minimum of 5 years after a transfer of value has been made to you, in accordance with general industry requirements, unless a shorter period is required under applicable national data privacy or other laws or regulations.

8. Your rights

You have several rights in relation to our processing of your personal data pursuant to the General Data Protection Regulation. If you want to use your rights, please contact us.

Right to see personal data (Access)

You are entitled to gain access to the information that we are processing about you.

Right to rectification (correction)

You have the right to have incorrect information about yourself corrected.

Right to deletion

In certain instances, you have the right of deletion of information about you before the time of our ordinary general deletion.

Right to limit processing

In certain instances, you have the right to limit the processing of your personal information. If you are entitled to limited processing, in future, we may only process the information - except for storage - with your consent or for the purpose of determining, enforcing or defending legal claims, or for protecting a person or important social interests.

Right to object

You may, in certain cases, have the right to object to our or legitimate processing of your personal information. You can also object to processing your information for direct marketing.

9. Complain to Supervisory Authority

You are entitled to file a complaint with the supervisory authority, in particular in country of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data infringes the General Data Protection Regulation.

UK/IE-092018/1.0

Last Updated: September 2018