Privacy Statement

PRIVACY STATEMENT FOR HEALTH CARE PROVIDERS

Chiesi Pharmaceuticals B.V. (hereinafter referred to as "Chiesi" or the "Controller" or "we, us, our"), issues this privacy notice (hereinafter referred to as the "Privacy Notice") pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "General Data Protection Regulation" or "GDPR") to illustrate how Chiesi, in its capacity as Controller, collects, uses and processes your personal data, as defined below.

1 CATEGORIES OF PERSONAL DATA

The Controller collects the personal data listed below directly from you or from third-party database service providers who collect and process your personal data in accordance with applicable laws and regulations. The Controller collects, uses and processes the following personal data about you:

• Your name, first name, gender, personal contact information (i.e. address, phone number, email address);
• your academic degree, additional professional qualifications (i.e., postgraduate degree, master's-after-master's degree, doctorate), professional job title, field of study, professional registry entry and registration date, lectures and publications;
• Your professional contact information (i.e. address, phone number, e-mail address), visiting hours, estimate of number of patients;
• Your preferences regarding our informational materials;

(hereinafter collectively referred to as "Personal Data").

The Controller does not collect, use or process special categories of personal data about you. The Controller may collect your signature via a tablet or similar device. In this case, we inform you that no special categories of personal data are collected as the device does not collect biometric data.

2 PROCESSING PURPOSES

Your Personal Data will be collected, used and processed for the following purposes:

(a) compliance with applicable laws and regulations or decisions of competent authorities, specifically in the area of pharmacovigilance and drug safety (i.e., to inform you of medical product recalls, pharmacovigilance and drug safety communications, adverse event communications, etc.);

(b) for product and promotional communications, specifically to provide you with information on medicines and non-drugs (i.e. dietary supplements), professional training meetings, scientific events, conferences and training, to conduct market research and/or surveys, as well as to provide you with scientific product-related materials via email, text/chat, phone, mail;

(c) For scientific communications and materials related to conditions and treatment options via email, text/chat, phone, mail;

(d) for institutional communication purposes, specifically to provide you with information about our initiatives and programs, even at the group level (i.e. corporate social responsibility, scientific research, patient support programs, etc.) via email, text/chat, phone, mail;

(e) to assess your areas of professional interest, specifically to analyze or predict aspects of your professional preferences and interests (i.e., treatment preferences), through our representatives and targeted market surveys in order to enhance the information and promotional activities mentioned in points (b) and (c) (i.e., improving the scheduling of our scientific information visits, personalizing our product and promotional communications to better reflect your preferences and avoid the provision of unnecessary informational materials, etc.);

(f) to communicate them purely for internal administration and management purposes to the parent company, a subsidiary or related party within the group of which the Controller is a member (hereinafter referred to as the "Chiesi Group").

The Controller invokes the following legal basis for the collection, use and processing of your Personal Data :

• referred to in point (a), the processing is necessary to comply with a legal obligation incumbent on the Controller in accordance with Article 6.1 point (c) of the AVG, more specifically in the area of pharmacovigilance and drug safety; for these purposes, the Personal Data must be provided and if you fail to do so, the Controller may fail to comply with the obligations as stipulated in applicable laws and regulations;
• referred to in points (b), (c), (d) and (e), the processing is based on your consent, which is free and optional, in accordance with Article 6.1 point (a) of the GDPR; provision of the Personal Data for these purposes is optional and failure to do so will prevent the Controller from sending scientific information, product, promotional and institutional communications, conducting market surveys and assessing professional areas of interest in order to strengthen its scientific information and promotional activities;
• referred to in point (f), processing is based on our legitimate interests in the transmission of Personal Data within the Chiesi Group for purely internal administration and management in accordance with Article 6.1 point (f) and Ground 48 of the GDPR; provision of the Personal Data for these purposes is optional and failure to do so hinders the Controller in optimizing internal administration and management of its activities.

3 CATEGORIES OF RECIPIENTS

The processing of your Personal Data will be performed only by authorized persons, such as the Controller's employees and our representatives, acting under the Controller's authority, who will have access to your Personal Data only to the extent they need that information. To pursue the above purposes, the Controller may also transfer your Personal Data to the following third parties:

• the parent company, a subsidiary or related party within the Chiesi Group for purely internal administration and management;
• competent public and governmental authorities, including courts, if required by applicable law or regulation;
• the Processor's service providers (hereinafter referred to as the "Data Processors"), such as cloud providers, direct marketing providers, or market research companies, who process your Personal Data subject to contractual measures and instructions provided by the Processor and whose purpose is the guaranteed protection of your Personal Data.

Some of the above recipients may be located in countries outside the European Economic Area ("EEA"). If the recipient is located in a country that does not provide adequate protection of Personal Data, we take all necessary measures to ensure that the transfer from the EEA is adequately protected as required by applicable law (i.e., by implementing European standard contractual clauses). You may request a copy of such appropriate safeguards and a list of our Data Processors by contacting the Controller in the manner set forth below.

4 PROCESSING PRINCIPLES AND RETENTION PERIOD

Personal data is processed in electronic, digital and physical ways in accordance with the lawfulness, propriety, transparency and other fundamental principles of the GDPR, including the principles of minimal data processing and limited storage periods.

Personal data shall be stored by the Controller for the period necessary to fulfill the purposes for which they were collected.

If the Controller no longer needs to process your Personal Data, we will erase or anonymize it so that you can no longer be identified. Additional retention periods may be required to comply with legal and regulatory obligations to which the Controller is subject.

Except as otherwise provided in applicable laws or regulations, Personal Data will be stored for processing purposes pursuant to your consent until revocation of your consent.

5 YOUR RIGHTS

In accordance with Article 15 et seq. of the GDPR, you have the right to:

• from the Controller as to whether or not personal data concerning you are being processed and, if so, to access that personal data and other information, such as the purposes of processing and the right to obtain a copy;
• when personal data are transferred to a third country or an international organization, be informed of the appropriate safeguards in accordance with Article 46 of the GDPR on the transfer;
• obtain from the Controller without delay the right to rectify inaccurate personal data concerning you;
• obtain from the Controller without delay the right to have personal data concerning you erased;
• obtain from the Controller the restriction of processing;
• obtain the personal data concerning you, which you have provided to the Controller, in a structured, common and machine-readable form, and you have the right to transfer that data to another Controller, without being impeded by the Controller;
• object to the processing of personal data concerning you;
• withdraw your consent at any time, including the processing referred to in paragraph 2 point (b), (c), (d) and (e), without prejudice to the lawfulness of the processing based on the consent before its withdrawal as well as to choose the communication methods referred to in paragraph 2 point (b), (c) and (d).

Please note that conditions and limitations, as provided in the GDPR and applicable laws and regulations, may apply to the exercise of the above rights.

In any case, you always have the right to complain to the competent supervisory authority.

6 CONTACT INFORMATION

For questions or explanations regarding the Privacy Statement or the exercise of your rights, please contact the Controller at Evert van de Beekstraat 1-120, 1118 CL Schiphol, The Base Tower C3, the Netherlands or the appointed Data Protection Officer (DPO) at dpo.benelux@chiesi.com

* * *