Privacy Policy_KUNTUO

IQVIA (also referred to as the "Company", "we" or "our") respects our relationships with clients and all individuals whose privacy is involved with respect to personal information that IQVIA may handle in the course of providing services and conducting business operations. This Privacy Policy (hereinafter referred to as the "Policy") explains how IQVIA collects, holds, uses and discloses personal information, including that of our personnel, consumers, healthcare professionals, patients, medical research subjects, clinical investigators, clients, suppliers, vendors, business partners and investors. IQVIA expects that this Company Privacy Policy, along with the standard practices and procedures we implement, will assist us in timely compliance with all international privacy laws and regulations worldwide.

This Policy is supplementary to our EU-U.S. Data Privacy Framework (DPF) Policy (available here). Where appropriate, we rely on the DPF and the UK extension to the DPF for transferring data from the European Union and the United Kingdom to the United States. With respect to data transfers from Switzerland to the United States under the Swiss-U.S. Data Privacy Framework, we are awaiting an adequacy decision. Therefore, we currently rely on other data transfer mechanisms for these data transfers. In this Policy, we collectively refer to these other data transfer mechanisms and the DPF as "appropriate data transfer mechanisms".

For more information about IQVIA's privacy practices regarding information processed through online products, please refer to our "Online Privacy Policy". If you are a resident of California, you may review our California Privacy Appendix to learn about additional rights that may apply to you. Additionally, if we process your "consumer health data" pursuant to Washington State's My Health My Data Act or similar health privacy laws in other jurisdictions, please refer to our Consumer Health Data Policy.

* * *

Scope: This Policy applies to all personal information of individuals received by IQVIA in electronic or paper format, including company personnel, job applicants, consumers, healthcare professionals, patients, medical research subjects, clinical investigators, clients, suppliers, vendors, business contacts, as well as partners, government officials and investors. IQVIA endeavors to collect, use and disclose personal information in a manner consistent with the laws of the countries where it conducts business and adheres to the highest ethical standards in business practices.

Definitions: For the purposes of this Policy, the following definitions shall apply:

"Agent" means any third party that uses personal information provided by IQVIA to perform tasks on behalf of and/or pursuant to the instructions of IQVIA, or to whom IQVIA discloses personal information for its use.

In this Policy, the "European Economic Area" (EEA) refers to the following thirty countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Ireland, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden (i.e., countries within the European Union) as well as Iceland, Liechtenstein and Norway.

"Individual" means any natural person.

"Personal information" means any information or set of information about an identified or identifiable individual, including but not limited to: (a) first name or initials and last name; (b) home address or other physical address; (c) telephone number; (d) email address or online identifier associated with the individual; (e) social security number or other similar identification number; (f) employment or financial information; or (g) any other information about the individual in combination with any of the above. The term "personal information" does not include anonymized information or aggregated reported information (provided that such aggregated information does not identify a natural person).

"Company personnel" includes but is not limited to any employees (permanent or temporary), directors, executives, contractors, workers, temporary staff, job applicants, IQVIA retirees and any and all their respective dependents.

"IQVIA" means any entity directly or indirectly controlled by one or more intermediaries, or controlled by IQVIA Holdings Inc. or under common control with IQVIA Holdings Inc. For the purposes of this definition, "control" means the power to direct or cause the direction of the management and policies of the entity, whether through ownership of voting securities, by contract or otherwise.

"Sensitive personal information" means personal information that can identify a unique individual when disclosed or processed:

All government-issued identification numbers (including U.S. Social Security numbers, EU Social Security numbers, Canadian Social Insurance numbers, driver's license numbers and passport numbers);

All financial account numbers (bank account numbers, credit card numbers and other information that can access financial accounts);

Personal background investigation reports;

Information revealing race, ethnicity, nationality, political opinions, religious or philosophical beliefs, trade union membership, citizenship or civil status, information relating to sexual life or orientation, or information relating to criminal offenses;

Precise geolocation data related to the workplace of healthcare professionals;

Personal information of individuals under thirteen (13) years of age; or

Any other category of information regulated as sensitive data or sensitive personal information under applicable data protection laws.

If any information received from an employee or third party is considered and/or identified as sensitive information by that employee or third party, IQVIA will also treat such information as sensitive personal information.

Capitalized terms not defined above shall have the meanings set forth in the corresponding paragraphs of this Policy.

Notice of Data Collection and Use

If IQVIA collects personal information directly from an individual, it will state the purposes for which it collects and uses the personal information, the types of third parties to whom IQVIA discloses such information, and the choices and means by which IQVIA provides individuals to restrict the use and disclosure of personal information, if any. The notice will be in clear and prominent language. This explanation will be provided as soon as practicable and should be provided before IQVIA discloses the personal information or uses such information for purposes materially different from those for which the personal information was initially collected or processed. IQVIA will also provide any other information required by law regarding specific contexts, products or services. In general, except for exceptions and other legal bases that may be relevant to any specific product or service notice, IQVIA processes personal data for its legitimate interests in accordance with applicable laws. When one IQVIA entity receives personal information from another IQVIA entity or other entity, including when processing personal information as a clinical research organization (CRO) under client instructions, it will use such information in accordance with the notices provided by that entity and the choices made by the individual to whom the personal information relates. In cases where IQVIA obtains personal data as a service provider to its clients or affiliates, IQVIA's clients or affiliates are responsible for providing appropriate notices to individuals and, where applicable, obtaining any necessary consents (unless this function has been delegated to IQVIA).

IQVIA may collect various types of personal information for the following purposes (as detailed below):

Research-related information. For individuals participating in investigational studies managed by IQVIA as a CRO or in other investigational studies in which IQVIA is involved, including patients, their spouses/partners, caregivers and relatives, clinical investigators or other researchers, as well as other consultants, contractors, managers and agents (all natural persons) of study sponsors and their affiliates, business partners and third-party service providers, personal information may be used for the conduct of applicable studies and other research-related services and/or pharmacovigilance. This may include transferring such personal information to applicable study sponsors, their affiliates, business partners and third-party service providers performing study-related services (e.g., study data management, clinical research monitoring services, safety monitoring, etc.).

Human resources-related information. For individuals who are company personnel, we will process their personal information to conduct and support our human resources functions and activities, including but not limited to: (i) qualification assessment; (ii) provision of employment benefits; (iii) employee administration and management, compensation, stock options, grants and purchase plans, bonuses, retirement, training and career planning; (iv) utilization of employee skills and ongoing allocation of employee resources; (v) communication with employees or their emergency contacts; (vi) management of the company's business, including budgeting, workforce planning and organizational design; (vii) verification of individual identity when accessing computer system applications; (viii) changes to personal information data; (ix) changes in employment status; (x) travel, expense planning and reimbursement; (xi) employee performance evaluation and time management; and (xii) personnel performance management, implementation, investigation and reporting of compliance, disciplinary procedures and matters. IQVIA may provide personal information to agents to support IQVIA in carrying out such human resources-related activities. For more information on how IQVIA collects, uses, shares and protects personal information of company personnel, please refer to the "IQVIA Company Personnel" section in IQVIA's internal privacy policy. In addition, for job applicants, personal information will be used to assess the applicant's suitability for a position. Where required by law or with the candidate's consent, IQVIA may, at its discretion, conduct such background checks as it deems appropriate to assess suitability.

Business contacts. For individuals who are IQVIA's business contacts, IQVIA may collect personal information about the contact details of such business contacts. This information may be used for purposes consistent with the provision of information by such contacts, which may include marketing activities focused on selling new products and services, requesting participation in market research to improve the quality of IQVIA's products, and other business activities.

Healthcare professionals. IQVIA collects information about healthcare professionals directly from healthcare professionals, official sources and business partners. We use this information for various healthcare activities, including clinical trials, real-world studies of patient treatment, healthcare outcomes analysis, market research activities, and other situations where healthcare professionals can provide important information.

Client and program participant information. For individuals who share personal information with IQVIA to inquire about or otherwise use our services or to purchase, receive or seek information, including any healthcare products and services available through IQVIA and opportunities to participate in clinical research, healthcare education and patient support programs, we will use such personal information to provide the requested information, products and/or services. Such uses may include but are not limited to processing requested transactions, improving the quality of our services, communicating about products and services obtained through IQVIA, and enabling our business partners and agents to perform certain activities on our behalf.

Data analytics functions. In some cases, IQVIA obtains and processes personal information for various data analytics purposes. In most cases, this data has been anonymized or de-identified and is no longer personal information when obtained or transmitted by IQVIA. In some cases, IQVIA receives personal information from clients or other data providers for the purpose of anonymization or de-identification. In other cases, the data obtained and processed by IQVIA is anonymous. Such anonymous information may be used for research purposes, primarily with academic partners and the academic community, and may be transmitted by IQVIA to the United States as part of such research-related activities. In all such cases, IQVIA's activities are consistent with the notices and choices provided by such clients or data providers to individuals, and IQVIA's use of such information is consistent with IQVIA's obligations to provide services to these entities. In such cases and when such information is transmitted to the United States, IQVIA uses such information only in a manner consistent with appropriate data transfer mechanisms and the manner in which the data was obtained.

Our business purposes. We may choose to rent, publish, disclose, disseminate, provide or sell your personal information or sensitive personal information to our business partners for monetary or other valuable consideration. We may use your personal information for targeted advertising. In addition, your use of our websites and online services may allow third parties to collect your personal information or sensitive personal information over time across different Internet websites. We will not use your personal information for profiling that could result in legal or similarly significant effects.

IQVIA may also use the personal information collected as described above for the purposes of complying with our legal, regulatory obligations, policies, procedures and internal management. We may also collect, use and disclose personal information we collect online for any of the purposes outlined in our online privacy policy.

Disclosure of Other Personal Information

In certain circumstances, IQVIA may disclose personal information: (i) if disclosure is required by law, court order or legal process, (ii) in response to a legitimate request from a public authority, including to meet national security or law enforcement requirements, (iii) in the course of litigation, (iv) to enforce IQVIA's policies or contracts, (v) to collect amounts owed to IQVIA, (vi) when we believe disclosure is necessary or appropriate to prevent personal injury or financial loss or in connection with investigating, prosecuting suspected or actual illegal activities, or (vii) when disclosure is believed to be necessary or desirable in good faith. IQVIA may also transfer personal information when a significant event involving its business operations, assets or shares is proposed or occurs (e.g., purchase, disposal, merger, joint venture or acquisition). In such cases, IQVIA will endeavor to direct the transferee to use personal information in a manner consistent with this Policy. IQVIA will provide individuals with reasonable mechanisms to exercise their choices to the extent required by applicable law.

Responsibility for Forward Transfers

In accordance with applicable data privacy laws, personal information we collect or receive may be stored or transmitted to our service providers or agents worldwide, including those hosting our databases or providing data processing services, during the performance of services and business operations. The provisions of this Policy regarding notice and choice apply to transfers to third parties.

IQVIA may also share an individual's personal information with agents (including affiliates) for the purposes of services performed by or with IQVIA or for business purposes. For example, IQVIA may provide an individual's personal information to agents to host our databases, provide data processing services or send the individual requested information.

IQVIA may transfer personal information to agents for specific, limited purposes and will endeavor to ensure that the privacy protections provided by such agents are at least equivalent to those required by appropriate data transfer mechanisms and this Policy, and that the agent shall notify IQVIA if it determines that it can no longer fulfill this obligation.

If IQVIA becomes aware that any third party to whom it has provided personal information is using or disclosing personal information in a manner inconsistent with this Policy, IQVIA will take reasonable steps to prevent or stop such use or disclosure. For such forward transfers to agents, IQVIA shall remain liable, to the extent of its responsibility for the event, if its agents process personal information in a manner inconsistent with appropriate data transfer mechanisms and this Policy.

In cases where IQVIA obtains personal information as a service provider to its clients or affiliates, IQVIA's clients or affiliates are responsible for protecting individuals' rights in forward transfers.

Security

Given the risks involved in processing and the nature of the information handled by IQVIA, whether such personal information is in electronic or physical hard copy form, IQVIA will endeavor to implement reasonable and appropriate technical, administrative and physical safeguards to protect the personal information it possesses from loss, misuse and unauthorized access, disclosure, alteration and destruction. We have a privacy incident response plan designed to promptly respond to and report all privacy-related issues, complaints and concerns, including any potential privacy or security incidents.

Data Storage

We may periodically archive or store the information we collect in accordance with backup procedures, and will only store it for as long as needed for the purposes of collection, as well as to provide our products and services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, fulfill our agreements and comply with applicable laws.

Data Integrity and Purpose Limitation

IQVIA uses personal information only in a manner consistent with the original purpose of collection or subsequent authorization from the individual. For as long as IQVIA holds such information, IQVIA will take reasonable steps to ensure that it uses only personal information that is accurate, complete, up-to-date and otherwise reliable in relation to the original purpose for which the information was obtained and the intended use. IQVIA's personnel are responsible for assisting IQVIA in maintaining accurate, complete and up-to-date personal information. When IQVIA acts as a CRO or on behalf of other entities, IQVIA endeavors to process only personal information relevant to the services it provides and only for purposes consistent with those for which the personal information was collected; where possible, such personal information is de-identified. When IQVIA processes personal information as a CRO or under client instructions, IQVIA works with such clients to enable them to provide individuals with a way to correct or update their personal information to the extent required by law.

Your Privacy Choices

Depending on your jurisdiction, you may also have certain legal rights related to the processing of your personal information. These rights may include:

1. The right to access your personal information (including data portability requests);

2. The right to correct or modify any personal information we have on file about you;

3. The right to delete your personal information;

4. The right to restrict the use of your "sensitive" personal information;

5. The right to opt out of the sale or "sharing" of your personal information;

6. The right to opt out of the use of your personal information for targeted advertising;

7. The right to restrict or object to the processing of your personal information (e.g., for direct marketing purposes);

8. The right to restrict the use of your personal information for certain automated decisions (including profiling); and

9. The right to withdraw your consent (where applicable).

To exercise any of the above rights, please complete the form on this webpage or contact us by email (privacyofficer@iqvia.com), providing your name, physical address, email address, the email address associated with your contact with IQVIA (if different), telephone number and details of your contact with IQVIA (whether you are a patient or healthcare professional). You may also designate an authorized agent to submit a request on your behalf. To designate an agent, please also send us a written document signed by you and the agent authorizing the agent to act on your behalf. You may also use a power of attorney. Please note that we will still require you to provide sufficient information to allow us to reasonably verify that you are the person making the request we receive. We will respond to any request you submit within the timeframes required by applicable law and will allow you to appeal any decision we make regarding such requests in accordance with applicable law. Appeals may be submitted to privacyofficer@iqvia.com. Although IQVIA sincerely provides individuals with access to their personal information, there may be circumstances where IQVIA cannot provide access, including but not limited to: the information is subject to legal privilege, would prejudice the privacy or other legal rights of others; the burden or expense of providing access would be disproportionate to the risks to the individual's privacy, or the information is proprietary business information. If IQVIA decides that access should be restricted in any particular case, we will provide you with an explanation for that decision and contact information for further inquiries.

Depending on your jurisdiction, you may also have the right to lodge a complaint with your supervisory authority or challenge our decisions regarding any of your data protection rights. For example, for a list of EU supervisory authorities, please refer to the following directory for contact details: https://edpb.europa.eu/about-edpb