我们可能会直接向您收集个人信息，也可能会间接获取您的个人信息，例如从公开来源（如一般网站或公众可访问的数据库）、第三方数据提供商、第三方社交平台（如微信）、医疗健康提供方、医疗保险公司，以及我们的第三方合作伙伴和供应商。我们也可能会合并线上线下多种来源的个人信息。

我们可能会收集的有关您的个人信息的类别包括：

● 个人直接识别标识和联系信息，例如您的姓名、性别、身份证号、通讯地址、电话号码、电子邮件地址、工作单位、部门、职位、第三方平台用户识别标识和昵称、教育经历和工作经历；

● 与健康有关的信息，例如有关您的健康状况的信息（包括出生日期、年龄或年龄组、您（或您配偶）是否怀孕、种族、身高、体重、病史、可疑药品或药品组合、不良反应以及其他必要的健康信息）、与我们任何产品有关的安全和健康信息，或保险和统计信息；

● 与企业福利及招聘相关的信息，例如当您参加我们为员工提供的亲友福利项目时所收集的员工的家庭成员和/或朋友的姓名、性别、身份证号、电话号码、健康状况、紧急联系人等相关信息，您向我们推荐的候选人的姓名、性别、通讯地址、电话号码、教育背景、工作经历等相关信息；

● 与财务有关的信息，例如您的银行卡账号及开户行信息、信用卡卡号及开户行、付款记录等（主要是便于向您支付服务费用、支付赔偿、补偿或保险理赔金等费用）；

● 关系数据，包括您感兴趣的产品、治疗和健康状况的信息，以及与此相关的行动轨迹、访问记录、使用习惯、反馈信息；

● 注册信息，例如您在我们的平台上注册账户而生成的用户名和密码；

● 收入和人口统计信息，例如当您为购买我们的某种产品请求财务支持时所收集的信息。

通常情形下，我们收集到的您的个人信息仅会用于我们以下所载或者我们在向您收集个人信息时所告知的目的。但是，在法律允许的情形下，我们也会将您的个人信息用于其他新的目的，且这些目的与我们先前向您告知的目的不存在冲突。

企业经营与业务

我们可能会将您的个人信息用于我们日常的企业经营与业务目的，例如付款处理和财务账户管理、合同管理、网站管理、履行、公司治理和报告义务。

业务及产品的开发、管理与优化

为了发现新的事实来帮助我们更好地了解客户需求并帮助开发、改进和评估产品服务、质量、材料、计划和方案，我们通过分析个人信息来改善和优化我们的业务和产品。

与您的沟通及处理您的请求

我们还可能使用您的个人信息为您提供您请求的服务，或管理我们的产品及服务。这意味着我们可能会使用您的个人信息来回答您的咨询、为您提供您要求的服务、为您提供最佳的客户体验、履行我们对您的合同义务或根据您的同意采取行动。

企业福利及招聘活动

我们会为员工及亲友制定各类福利项目及活动，因此，我们可能会将您的个人信息用于员工及亲友相关的福利项目，例如安排旅游、邀请参与家庭日等企业活动、参与家属保险项目。我们还可能会在您与我们拟建立雇佣关系阶段的必要情形下使用您的个人信息，例如验证您的基本身份信息、遵守法律法规及公司规则制度的情况调查、资质征信、培训学习、调查评估，推送您感兴趣的或者与您相匹配的职位信息，以及与我们的关联公司共享。

合法与合规

我们可能会根据法律法规（例如与药物警戒相关的法律法规、与医药代表备案相关的法律法规、与个人所得税法相关的法律法规、与医疗行业反腐败调查的法律法规、法院或仲裁机构等国家机关的行政或司法要求等）处理您的个人信息。我们还可能使用个人信息来监控我们的政策和程序的遵守情况、预防欺诈，以及调查和起诉违反我们规则或从事非法或损害他人人身财产的行为的个人。

我们通常会出于下述业务和商业目的委托第三方处理及与第三方共享个人信息。我们不会将个人信息出售给第三方。若我们需要与第三方共享您的个人信息，我们会向您提前告知接收方的名称或者姓名、联系方式、处理目的、处理方式和个人信息的种类，并事先取得您的单独同意。

关联公司与第三方供应商

我们（包括我们的关联公司）与各种第三方供应商建立了关系。这些供应商帮助我们运营业务，并且在向我们提供服务的过程中，他们可能需要访问您的个人信息。我们要求他们根据适当的合同个人信息保护和安全条款处理通过我们收集的您的个人信息。

商业与研究伙伴

我们可能会与其他公司以及公共和私人组织合作，以联合的方式为您提供产品、内容或服务。您应该注意，在这种情况下，除了本个人信息保护政策之外，相关合作伙伴的个人信息保护政策或隐私声明也可能适用，并且在有限的情况下，可能会有共享的个人信息保护政策或隐私声明。

对于联合提供的形式和网站，您将看到同时显示我们的标志和联合合作伙伴的标志。您还应该阅读我们联合合作伙伴的个人信息保护政策，因为他们可能在某些方面与我们有所不同。

此外，我们可能会在业务运营中或履行适用法律法规的义务时，向我们的外部审计师、律师、会计师和类似专业人士披露您的个人信息。

为履行法律义务及为产品安全目的向有关部门的披露

如果您就您使用我们产品的体验联系我们，我们可能会使用您提供给我们的信息向我们所在国家或地区的药品监督管理部门、世界各地其他类似的卫生和药品政府机构，以及根据法律的其他要求，提交我们的报告。我们也可能使用这些信息联系您的处方医生，以跟进涉及使用我们产品的安全性事件。

在某些有限的情况下，我们可能需要披露您的个人信息以遵守法律义务、流程或要求，以及出于公共利益的原因，例如为了遵守向监管机构报告有关我们产品安全的义务，或为了响应公共卫生或其他突发事件、回应传票，或为了满足国家安全或执法要求。

向继任的所有者或经营者披露

我们可能会在发生兼并、合并或其他公司重组时，将您的个人信息转移给继任实体、我们全部或部分资产的购买者，或者根据融资安排或联合促销协议转移您的个人信息。我们可能会根据我们在筹备和完成交易方面的合法利益，将有关您的个人信息转移给交易各方。我们将通知您继任实体的名称和联系信息。任何继任实体都应受与本个人信息保护政策合理相似的条款和条件的约束，否则继任实体需重新获得您的同意

当您访问我们的网站或使用其他网络资源时，我们可能自动从您的设备处收集特定信息。具体而言，这些我们自动收集的个人信息主要包括您的IP地址、设备型号、唯一的设备识别号、浏览器型号、大致的位置信息（例如国家或者城市信息）、以及其他的技术信息。我们也会收集一些您的设备如何与我们的网站或者其他网络资源互动的信息，例如，访问过的页面或者点击过的链接。

收集该等信息使我们可以更好地了解我们网站或其他网络资源的访问者，比如访问者来自哪里以及我们网站或其他网络资源有哪些吸引访问者的内容。我们将该等信息用于内部分析以及提升我们网站或其他网络资源的质量等相关目的。我们同时也需要留存相应的日志来记录我们网站或其他网络资源的运行状态以符合中国法律法规的规定。

这些信息一般通过我们使用的cookies或者类似的追踪科技来进行收集。为使您获得更轻松的访问体验，当您访问我们的网站或者使用其他网络资源时，我们会在您的计算机或移动设备上发送名为Cookies的小数据文件以识别您的身份。我们向您发送Cookies是为了简化您重复输入信息以登录账户的步骤、存储您的偏好设置、帮助判断您的登录状态以及账户或数据安全，目的是向您提供最友好、最安全的服务。我们不会将Cookies用于本个人信息保护政策所述目的之外的任何用途，我们发送给您的Cookies是唯一的，您可根据自己的偏好管理或删除Cookies。您可以清除计算机或移动设备保存的所有Cookies，大部分网络浏览器都设有阻止Cookies的功能，您通常可根据自己的需求来修改浏览器的设置以拒绝Cookies，但如果您这么做，您可能需要在每一次访问网站或者其他网络资源时亲自更改用户设置，可能会影响您安全访问我们的网站或者其他网络资源提供的服务。

如本节所述，如果您是医疗卫生专业人士，我们可能会收集关于您的特定类别的个人信息。我们还会为了本节所述的其他目的使用和披露有关医疗卫生专业人士的个人信息。本节中描述的被收集的个人信息的类别以及使用和披露的目的是对本个人信息保护政策中单独描述的任何其他收集、使用和披露个人信息的做法的补充。

我们可能收集的关于医疗卫生专业人士的个人信息

如果您是医疗卫生专业人士，我们可能会直接从您那里，或从第三方来源收集您的个人信息，例如您工作的机构、公开来源、与我们的互动（包括在线可用来源）以及参与我们赞助或支持的计划（例如我们赞助的临床研发活动、第三方数据库和药物警戒事件的报告者）。

我们可能会收集关于医疗卫生专业人士的如下类别的个人信息：

● 详细的职业信息，例如直接提供给我们的简历或其他文件或表格、执业地点、职位、职业联系方式、医学专业、职业执照号码、职业资格和科学活动（例如过去的临床试验经验、在社交媒体平台或其他网站上从事的活动，以及参与我们和其他公司过去或尚未开始的研究调查）、组织或机构隶属关系、学术或科学研究和文章的出版，以及协会和董事会的成员资格

● 为参与我们赞助或支持的计划而提供的个人信息，例如我们赞助的临床研发活动、有关产品信息的在线或现场研讨会、教育活动和临床信息更新

● 与我们互动的详细信息，例如我们举行的会议、讨论的主题、您对我们的业务和产品的了解和问题、我们向您展示的材料类型、您提供的任何反馈，以及您对相关药物使用的意见和惯例、关于您的患者的惯例、诊断，以及与我们在线互动中的自动跟踪信息

对医疗卫生专业人士个人信息的其他使用和披露

为了以下其他目的，我们可能会使用和披露医疗卫生专业人士的个人信息

● 用于履行我们与您的合同
● 管理和改善我们与您的关系，包括计划、组织和审查与您的任何合作，以及与您联系
● 帮助确保我们根据您的专业知识、对于学术科研领域的关注为您提供相关信息
● 招聘和评估医疗专业人员参与临床试验和市场研究及其他研究的适宜性
● 在公共和私人领域进行市场和研究调查
● 与您就我们的产品和计划进行沟通（取决于任何额外的营销同意要求），与您就科学或教育计划进行交流，管理我们的患者支持计划，并在需要的情况下，为您提供访问权限，回复产品订单，以及提供产品样品
● 用于开发和评估我们产品、服务、材料和治疗的研究和分析目的
● 用于与我们的内部政策和规则相关的内部会计和分析，例如我们的商业行为准则
● 用于安全监控、报告和审计以及回应与我们产品有关的询问或问题
● 遵守适用的法律和法规，包括行业行为准则对于医疗卫生专业人士的支付和其他价值转移数据的收集以及公开披露的要求，并遵守当地适用的同意要求，以便通过表明医疗卫生专业人士个体身份的方式，或为了应对公共卫生或其他紧急情况，来公开此类数据

请您注意，我们通常不会自行主动收集、处理未满14周岁未成年人的个人信息。因具体业务需要，我们可能会在取得父母或监护人授权之后收集未成年人的个人信息（例如未成年人用药的不良反应报告）。如果您作为未成年人的父母或监护人向我们提供未成年人的个人信息，请您在向我们提供个人信息前仔细阅读并理解本个人信息保护政策的内容或其他我们在向您收集个人信息前向您告知的信息。

如果您是未满14周岁未成年人的父母或者监护人，当您对我们处理未满14周岁未成年人的个人信息有相关疑问，可通过“如何联系我们”的信息与我们取得联系。

我们可能会根据本节的描述来进行个人信息的跨境传输。若我们将您的个人信息提供给任何中国境外接收方，我们将会向您告知境外接收方的名称或者姓名、联系方式、处理目的、处理方式、个人信息的种类以及您向境外接收方行使相关法律法规项下的权利的方式和程序等事项，并在适当的情况下获得您的单独同意。

集团公司之间的传输

您的个人信息可能由我们提供给我们的日本母公司及双色球中奖集团在其他国家/地区的附属或关联公司，以及在它们之间传输和处理。有关双色球中奖集团的附属及关联公司的完整列表，请参阅https://www.sumitomo-pharma.com/profile/office/。我们的集团公司间传输是根据适用的数据保护法律进行的（包括在适用法律要求的时候根据您的同意和数据跨境传输合同）。我们实施了多项公司间跨境数据传输协议，涵盖双色球中奖药集团的所有附属及关联公司之间的个人信息传输，以确保与您相关的个人信息获得与您所在国家相同级别的保护。

向第三方供应商和合作伙伴的传输

我们向其他国家或地区的供应商、商业和业务合作伙伴也可能传输和处理您的个人信息。任何向第三方（包括在收集有关您的个人信息的国家以外的国家/地区）的跨境个人信息传输将遵守数据保护法下适用的国际数据传输限制和要求进行（包括在适当的情况下获得您的单独同意以及使用数据传输合同进行个人信息跨境传输），以确保与您有关的个人信息获得与您所在国家/地区相同级别的保护。

我们会采取合适的技术手段以及管理手段来保护我们收集和处理的您的个人信息。这些手段将根据您的个人信息的风险的高低来适用。请您知悉并理解，互联网并非绝对安全的环境。如您发现自己的个人信息发生泄漏的，请您立即通过本个人信息保护政策“如何联系我们”部分的联系方式联系我们，以便我们采取相应措施。

如出现意外事件、不可抗力等情形导致您的个人信息出现泄漏时，我们将极力控制局面，及时告知您事件起因、我们采取的安全措施、您可以主动采取的安全措施等相关信息。如发生个人信息有关的安全事件，我们将根据相关法律法规的要求向有关主管机关报备，及时进行问题排查，并采取应急措施。

我们的网站、微信公众号或其他网络资源可能含有到其他第三方网站的链接，我们不对该等第三方网站对您个人信息的收集和处理承担责任。

存储位置：一般情况下，我们会将收集的您的个人信息存储在中国境内。为了向您提供我们的产品或服务或者与您建立业务合作，更好地与您进行互动以及商务和学术上的交流，处理您的咨询和投诉，以及为了满足我们对这些互动的业务管理和合规记录的要求，我们将允许境外相关主体存储您的个人信息，具体处理规则请参见本政策的“个人信息的跨境提供”章节。

存储期限：除法律法规另有规定外，我们将按如下期间存储您的信息：

我们会储存我们收集到的您的个人信息以满足我们的正当业务需求（例如向您提供服务或者来满足相应的法律、税务以及财务的要求）。

当我们没有这些需要使用到您的个人信息的正当业务需求时或者是中国法律法规规定的留存时间届满时，我们会删除您的个人信息或者对其进行匿名化处理。

针对您的个人信息，除法律法规另有规定外，您享有如下权利：

● 您对您的个人信息的处理享有知情权、决定权，您有权限制或者拒绝我们对您的个人信息进行处理；

● 您有权查阅、复制您的个人信息；

● 若您发现您的个人信息不准确或者不完整的，您有权请求我们进行更正、补充；

● 基于您同意而进行的个人信息处理活动，您有权撤回同意。您撤回同意的，不影响撤回前基于您同意已进行的个人信息处理活动的效力；

● 您有权请求将个人信息转移至您指定的其他个人信息处理者;

● 您有权要求我们对相关个人信息处理规则进行解释说明；

● 您有权在下述特定情况下要求我们删除您的个人信息：

（1）如果我们处理个人信息的行为违反法律法规；

（2）如果我们收集、使用您的个人信息，却未征得您的同意；

（3）如果我们处理个人信息的行为违反了与您的约定；

（4）如果您不再使用我们的产品或服务，或您注销了账号；

（5）如果我们终止服务及运营。

当您从我们的服务中删除信息后，我们可能不会立即备份系统中删除相应的信息，但会在备份更新时删除这些信息。

如果您对我们所进行的个人信息处理活动及本通知有任何异议，您有权通过其他途径解决。

我们将会按照适用的数据保护法律的要求以及时间回应您的行权请求。在法律法规允许的范围内，我们在如下的情况下可能无法回应您的行权请求：

● 如果您的请求与我们履行法律法规规定的义务所相悖；

● 如果您的请求与我们履行法律法规规定的义务所相悖；

● 如果请求的信息与公共安全、公共卫生、重大公共利益直接相关；

● 如果请求的信息与刑事侦查、起诉、审判和执行判决等直接相关；

● 如果我们有充分证据表明您存在主观恶意或滥用权利的；

● 出于维护您或其他个人的生命、财产等重大合法权益但又很难得到您本人授权同意；

● 如果回应您的行权请求将会导致您或者其他个人、组织的合法利益受到严重损害；

● 如果请求的信息涉及商业秘密。

我们将不时地对本个人信息保护政策进行更新以满足法律、技术以及商业上的变化。当我们对本个人信息保护政策进行更新时，我们会依据这些变化的重要程度采取合适的方式通知您。我们会按照适用数据保护法律的要求在对本个人信息保护政策做出任何重大变更时取得您的同意。

您可以通过本个人信息保护政策首部的“最后更新于”了解到本个人信息保护政策的更新时间。若您继续使用我们网站的相关功能或者通过网站上展示的信息联系我们，表示您同意接受更新后的个人信息保护政策。

如您对我们如何处理您的个人信息或本个人信息保护政策有任何的问题或者疑虑，特别是认为我们的个人信息处理行为损害了您的合法权益，您可通过发送电子邮件至privacy.support@sumitomo-pharma.com.cn联系我们。我们将尽快审核所涉问题，并按照法律法规的要求和期限及时予以回复。

Sumitomo Pharma China Privacy Policy

Sumitomo Pharmaceuticals (Suzhou) Co., Ltd. (“We”) respect your privacy rights and value the protection of your personal information (“Personal Information”). This Sumitomo Pharma China Privacy Policy (“Privacy Policy”) aims to introduce to you how we collect and process your Personal Information and how you can exercise your data subject’s rights when you visit our website at  (“Website”), use our other web resources (e.g., when you use our WeChat public account, contact us via our hotline etc.), participate in our activities and interact with us through other means, use our products or services or provide products or services to us or otherwise cooperate with us.

Under certain specific circumstances, we may provide you with other separate personal information protection policies regarding these specific circumstances, to inform you of how we collect and process your Personal Information under such circumstances. Related provisions in this Privacy Policy shall also apply to such circumstances, unless other separate personal information protection policies explicitly exclude the application of this Privacy Policy. If there is any conflict or inconsistency between other separate personal information protection policies mentioned above and this Privacy Policy, such separate personal information protection policies shall prevail in principle (unless otherwise mentioned or agreed upon).

This Privacy Policy is formulated according to the applicable Chinese data protection laws and regulations. “Personal Information” in this policy refers to all kinds of information recorded electronically or otherwise that are related to an identified or identifiable natural person, excluding information after anonymization. Personal Information includes Sensitive Personal Information specified in Chinese data protection laws and regulations, namely the Personal Information that once leaked or used illegally, may easily infringe on the personal dignity of natural persons or endanger personal or property safety, including biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts tracking and other data, as well as the Personal Information of minors under the age of 14.

If you have any questions or concerns about how we use your Personal Information, please contact us using the contact details provided at the bottom of this Privacy Policy.

This Privacy Policy will explain the following information to you:

1.      The Categories of Personal Information We May Collect

2.      How We May Use Your Personal Information

3.      How We May Process and Share Your Personal Information

4.      Notice on Cookies and Related Technologies

5.      Personal Information of HCPs

6.      Personal Information of Minors

7.      Cross-border Provision of Personal Information

8.      How We Protect Your Personal Information

9.      How We Store Your Personal Information

10.   Your Data Subject’s Rights and Choices

11.   Update of This Privacy Policy

12.   How to Contact Us

1.      The Categories of Personal Information We May Collect

We may collect Personal Information directly from you or indirectly, such as from publicly available sources (e.g., general websites or publicly accessible databases), third-party data providers, third-party social networking platforms (e.g., WeChat), healthcare service providers, health insurance companies, and our third-party partners and vendors. We may also combine Personal Information from multiple online and offline sources.

The types of Personal Information we may collect about you include:

● Direct personal identifiers and contact information, such as your name, gender, ID number, mailing address, telephone number, email address, workplace, department, position, third-party platform user identifiers and nicknames, educational background and work experiences;

● Health-related information, such as information about your health status (including date of birth, age or age group, whether you (or your spouse) are pregnant, race, height, weight, medical history, suspected drugs or drug combinations, adverse effects, and other necessary health information), safety and health information related to any of our products, or insurance and statistical information;

● Information related to corporate benefits and recruitment, such as the name, gender, ID number, telephone number, health status, emergency contact and other relevant information about an employee’s family members and/or friends collected when you participate in our employee benefits program for employees, the name, gender, mailing address, telephone number, educational background, work experiences and other relevant information about the candidates you refer to us.

● Financial-related information, such as your bank account and issuing bank, credit card number and issuing bank, payment records, etc. (mainly to facilitate payment to you for service fees, payment of compensation, indemnity, or insurance claims, etc.);.

● Relationship data, including information about products, treatments and health conditions of interest to you, as well as action tracks, access logs, usage habits, and feedback related thereto;

● Registration information, such as your username and password generated by registering an account on our platform(s);

● Income and demographic information, such as information collected when you request financial support for the purchase of our products.

2.      How We May Use Your Personal Information

In general, we will only use the Personal Information we collect for the purposes set out below or as we have informed you at the time we collect the Personal Information from you. However, where permitted by law, we may also use your Personal Information for other new purposes that do not conflict with the purposes we have previously communicated to you.

Corporate Operations and Business

We may use your Personal Information for our day-to-day corporate operations and business purposes, such as payment processing and financial account management, contract management, website management, fulfillment of corporate governance and reporting obligations.

Business and Product Development, Management and Optimization

In order to discover new facts to help us better understand our customers’ needs and to help develop, improve and evaluate product services, quality, materials, plans and programs, we analyze Personal Information to improve and optimize our business and products.

Communication with You and Handling Your Requests

We may also use your Personal Information to provide you with the services you request or to manage our products and services. This means that we may use your Personal Information to respond to your inquiries, provide you with the services you request, provide you with the best customer experience, fulfill our contractual obligations to you, or act on your consent.

Benefits and Recruitment Activities of the Company

We may have various benefit programs and activities for our employees’ families and friends, so we may use your Personal Information for benefit programs related to our employees’ families and friends, such as arranging trips, inviting your family and/or friends to corporate events such as union family days, and inviting your family and/or friends to participate in insurance programs. We may also use your Personal Information as necessary in the course of your proposed employment relationship with us, such as to verify your basic identification information, to investigate your compliance with laws, regulations and company rules and regulations, for qualification and credit reporting, for training and learning, for investigation and evaluation, to push information about jobs that are of interest or match you, and to share such Personal Information with our affiliated companies.

Legality and Compliance

We may process your Personal Information in accordance with laws and regulations (e.g., laws and regulations related to pharmacovigilance, laws and regulations related to the filing of pharmaceutical medical representatives, laws and regulations related to personal income tax laws, laws and regulations related to anti-corruption investigations in the healthcare industry, administrative or judicial requirements of state authorities such as courts or arbitration institutions, etc.). We may also use Personal Information to monitor compliance with our policies and procedures, to prevent fraud, and to investigate and prosecute individuals who violate our rules or engage in conduct that is unlawful or harmful to other persons or property of others.

3.      How We May Process and Share Your Personal Information

We usually entrust third parties to process Personal Information and share Personal Information with them for the business and commercial purposes described below. We do not sell Personal Information to any third parties. If we need to share your Personal Information with a third party, we will inform you in advance of the name of the recipient, contact information, purpose of processing, processing means and type of Personal Information, and obtain your separate consent in advance.

Affiliates and Third-Party Vendors

We (including our affiliates) have established relationships with various third-party vendors. These vendors help us operate our business and, in the course of providing services to us, they may need to access your Personal Information. We require them to process your Personal Information collected through us in accordance with appropriate contractual privacy and security provisions.

Business and Research Partners

We may partner with other companies and public and private organizations to provide products, content, or services to you on a joint basis. You should be aware that in such cases, the privacy statements of the relevant partners may apply in addition to this Privacy Policy and, in limited circumstances, there may be shared privacy statements.

For jointly offered forms and websites, you will find the display of both our logo and the logo of the joint partner. You should also read our joint partners’ personal information protection policies, as they may differ from ours in some respects.

In addition, we may disclose your Personal Information to our external auditors, attorneys, accountants and similar professionals in the course of our business operations or to comply with our obligations under applicable laws and regulations.

Disclosures to Relevant Authorities to Fulfill Legal Obligations and for Product Safety Purposes

If you contact us about your experience with our products, we may use the information you provide to us to file our reports with the drug regulatory authorities in the country or region where we are located, other similar health and drug government agencies around the world, and as otherwise required by law. We may also use this information to contact your prescribing physician to follow up on safety-related events involving the use of our products.

In certain limited circumstances, we may need to disclose your Personal Information to comply with legal obligations, processes or requirements, and for reasons of public interest, such as to comply with obligations to report to regulatory agencies about the safety of our products, or to respond to public health or other emergencies, to respond to subpoenas, or to meet national security or law enforcement requirements.

Disclosures to Subsequent Owners or Operators

We may transfer your Personal Information to a successor entity, a purchaser of all or a portion of our assets, when a merger, consolidation or other corporate reorganization occurs, or transfer your Personal Information under a financing arrangement or joint promotional agreement. We may transfer Personal Information about you to all parties to the transaction based on our legitimate interest in preparing and completing the transaction. We will notify you of the name and contact information of the successor entity. Any successor entity shall be subject to terms and conditions reasonably similar to this Privacy Policy, or the successor entity will need to obtain your consent again.

4.     Notice on Cookies and Related Technologies

When you visit our Website or use other web resources, we may automatically collect certain information from your device. Specifically, the Personal Information we collect automatically mainly includes your IP address, device model, unique device identification number, browser model, general location information (such as country or city information), and other technical information. We may also collect information about how your device interacts with our Website or other web resources, such as pages visited or links clicked.

Collecting these information allows us to better understand the visitors to our Website or other web resources, such as where the visitors come from and what content attracts visitors to our Website or other web resources. We use these information for internal analysis and for purposes related to improving the quality of our Website or other web resources. We also need to keep appropriate logs to record the operating status of our Website or other web resources to comply with Chinese laws and regulations.

These information are generally collected through our use of Cookies or similar tracking technologies. For your convenient visiting experience, we may send small data files called Cookies on your computer or mobile device to identify you when you visit our Website or use other web resources. We send Cookies to you to simplify the process of repeatedly entering information to log in to your account, to store your preferences, to help determine your login status, and for account or data security purposes, with the goal of providing you with the most user-friendly and secure service. We do not use Cookies for any purpose other than those described in this Privacy Policy, and the Cookies we send you are unique and can be managed or deleted according to your preferences. You can clear all cookies stored on your computer or mobile device, and most web browsers have a feature that blocks Cookies, and you can usually modify your browser settings to reject Cookies according to your needs, but if you do so, you may need to personally change your user settings each time you visit the Website or other web resources, which may affect your safe access to our Website or services offered by other web resources.

5.     Personal Information of HCPs

As described in this section, if you are a health care professional (“HCP”), we may collect certain categories of Personal Information about you. We may also use and disclose Personal Information about HCPs for other purposes described in this section. The categories of collected Personal Information described in this section and the purposes for which they are used and disclosed are in addition to any other collection, use and disclosure practices of Personal Information described separately in this Privacy Policy.

Personal Information We May Collect About HCPs

If you are an HCP, we may collect your Personal Information directly from you, or from third-party sources such as from the organization where you work, publicly available sources, through interactions with us (including online available sources), and participation in programs we sponsor or support (such as our sponsored clinical research and development activities, third-party databases, and pharmacovigilance event reporters).

We may collect the following categories of Personal Information about HCPs:

● Detailed professional information, such as resumes or other documents or forms provided directly to us, practice locations, positions, professional contact information, medical specialties, professional license numbers, professional qualifications and scientific activities (such as past clinical trial experience, activities on social media platforms or other websites, and participation in past or pending research investigations held by us and others), organizational or institutional affiliations, academic or scientific research and publication of articles, and membership in associations and boards of directors

● Personal Information provided for participation in programs we sponsor or support, such as clinical development activities we sponsor, online or on-site seminars for product information, educational events and clinical information updates

● Details of interactions with us, such as meetings we hold, topics discussed, your knowledge and questions about our business and products, the types of materials we present to you, any feedback you provide, and your opinions and practices regarding the use of relevant medications, practices regarding your patients, diagnoses, and automated tracking information from online interactions with us

● Details of payments and other transfers of value received from your interactions with us, which may include your ID number, bank account number (where required or permitted by law)

Other Uses and Disclosures of HCPs’ Personal Information

We may use and disclose Personal Information about HCPs for the following other purposes:

● To perform our contract with you.

● To manage and improve our relationship with you, including planning, organizing and reviewing any collaboration with you and contacting you.

● To help ensure that we provide you with relevant information based on your expertise and interest in the field of academic research.

● To recruit and assess the suitability of medical professionals to participate in clinical trials and market research and other studies.

● To conduct market and research studies in public and private sectors.

● To communicate with you about our products and programs (subject to any additional marketing consent requirements), to communicate with you about scientific or educational programs, to manage our patient support programs, and to provide you with access, to respond to product orders, and to provide product samples, if necessary.

● For research and analytical purposes in the development and evaluation of our products, services, materials and treatments.

● For internal accounting and analysis related to our internal policies and rules, such as our codes of business conduct.

● For security monitoring, reporting and auditing and for responding to inquiries or questions regarding our products.

● To comply with applicable laws and regulations, including the requirements of industrial codes of conduct for the collection and public disclosure of payment and other value transfer data to HCPs, and to comply with applicable local consent requirements for the disclosure of such data in a manner that identifies HCPs individually or in response to public health or other emergencies.

6.     Personal Information of Minors

Please note that we do not intentionally collect and process Personal Information of minors under the age of 14. For specific business purposes, we may collect Personal Information of minors with the authorization of their parents or guardians (e.g., adverse drug reactions reported in minors). If you, as a parent or guardian of a minor, provide us with Personal Information about the minor, before providing us with such data, please read and understand this Privacy Policy or any other information that we inform you of before collecting Personal Information from you.

If you are a parent or guardian of a minor under the age of 14 and have questions on how we process minors’ Personal Information, please contact us using the contact details provided in “How to Contact Us”.

7.     Cross-border Provision of Personal Information

We may transfer Personal Information overseas as described in this section. If we provide your Personal Information to any recipient outside of China, we will inform you of the name of the overseas recipient, the contact information, the purpose of processing, the processing means, the type of Personal Information, and the manner and procedure for you to exercise your rights under relevant laws and regulations to the overseas recipient, and, where appropriate, obtain your separate consent.

Transfers among Group Companies

Your Personal Information may be provided by us to, transferred to, and processed by our parent company in Japan and the Sumitomo Pharma Group’s subsidiaries or affiliates in other countries/regions. Please refer to https://www.sumitomo-pharma.com/profile/office/ for a complete list of the Sumitomo Pharma Group’s subsidiaries and affiliated companies. Our transfers within group companies are made in accordance with applicable data protection laws (including, where required by applicable law, in accordance with your consent and cross-border data transfer agreements). We have implemented a number of intragroup cross-border data transfer agreements covering the transfer of Personal Information among all subsidiaries and affiliated companies of the Sumitomo Pharma Group to ensure that the Personal Information relating to you maintains the same level of protection as in your country/region of residence.

Transfers to Third-Party Vendors and Partners

We may also transfer and process your Personal Information to vendors, commercial and business partners in other countries or regions. Any cross-border transfers of Personal Information to third parties (including in countries/regions other than the country in which the Personal Information about you was collected) will be made in compliance with the applicable cross-border data transfer restrictions and requirements under data protection laws (including, where appropriate, obtaining your separate consent and using data transfer contracts for cross-border transfer of Personal Information) to ensure that the Personal Information relating to you maintain the same level of protection as in your country/region of residence.

8.     How We Protect Your Personal Information

We use appropriate technical and organizational measures to protect the Personal Information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your Personal Information. However, please be aware and understand that we cannot ensure an absolutely secure network. If you find that your Personal Information is breached, please contact us using the contact details provided in “How to Contact Us” immediately so that we can take corresponding measures.

In the event of any accident, force majeure event, or other circumstances leading to the breach of your Personal Information, we will make every effort to control the situation and promptly inform you of the cause, the security measures we have taken and you can take and other relevant information. In the event of a security incident related to Personal Information, we will report to the competent authorities in accordance with the requirements of relevant laws and regulations, promptly investigate the problem, and take emergency measures.

Our Website, WeChat, or other web resources may contain links to other third-party websites, and we are not responsible for the collection and processing of your Personal Information by such third-party websites.

9.     How We Store Your Personal Information

Retention Location:Generally, we will store your Personal Information in China. In order to provide you with our products or services or to establish a business relationship with you, to better interact with you and communicate with you commercially and academically, to handle your inquiries and complaints, and to meet our business management and compliance record requirements for these interactions, we will allow the storage of your Personal Information by the relevant overseas entities, as described in the “Cross-Border Provision of Personal Information” section of this Privacy Policy.

Retention Period: Except as provided otherwise by laws or regulations, we will retain your Personal Information for the following periods:

● We will store your Personal Information only to the extent as necessary to our proper business needs (e.g., for the purposes of providing services to you, or complying with legal, tax and financial requirements).

● When there is no such business need to use your Personal Information or the retention period stipulated by Chinese laws or regulations expires, we will delete or anonymize your Personal Information.

10.   Your Data Subject’s Rights and Choices

Unless otherwise provided by laws and regulations, you have the following data subject’s rights:

● You have the right to know and decide on the processing of your Personal Information, and you have the right to restrict or refuse our processing of your Personal Information;

● You have the right to access and copy your Personal Information;

● If you find that your Personal Information is inaccurate or incomplete, you have the right to request us to correct and supplement them;

● You have the right to withdraw your consent for personal information processing activities based on your consent. If you withdraw your consent, it does not affect the validity of the personal information processing activities already carried out based on your consent before the withdrawal;

● You have the right to request the transfer of Personal Information to another personal information processor designated by you;

● You have the right to ask us to explain the relevant personal information processing rules;

● You have the right to request us to delete your Personal Information in the following specific circumstances;

(1) If our processing of Personal Information violates laws and regulations;

(2) If we collect and use your Personal Information without your consent;

(3) If we process Personal Information in violation of our agreement with you;

(4) If you no longer use our products or services, or if you de-register your account; or

(5) If we terminate our services and operations.

When you delete your data from our services, we may not immediately delete the corresponding data in our backup system, but we will delete such information when the backup is updated.

● If you have any objections to the personal information processing activities conducted by us and this Privacy Policy, you have the right to resolve them through other means.

We will respond to requests from you to exercise your rights in accordance with the requirements of applicable data protection laws within the required time limit. To the extent as permitted by laws and regulations, we may not be able to respond to your request to exercise your rights in the following circumstances:

● If your request is contrary to our obligations under laws and regulations;

● If the requested data is directly related to national security, national defense security;

● If the requested data is directly related to public safety, public health, or significant public interest;

● If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;

● If we have sufficient evidence of your subjective malice or abuse of rights;

● If it is in the interest of safeguarding your or other individuals’ significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent;

● If responding to your request to exercise your rights would result in serious harm to your or other individuals’ or organizations’ legitimate interests;

● If the requested data involves trade secrets.

11.   Update of This Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, depending on the significance of the changes we make. We will obtain your consent to any material changes to this Privacy Policy if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was effective by checking the “Effective Date” displayed at the top of this Privacy Policy. If you continue to use the functions on our Website or contact us through the contact information shown on the Website, you are deemed to have accepted the updated Privacy Policy.

12.   How to Contact Us

If you have any questions or concerns about how we process your Personal Information and this Privacy Policy, especially if you consider that our processing of your Personal Information impairs your legitimate interests, please contact us by sending email to privacy.support@sumitomo-pharma.com.cn. We will review your problem without delay and make a timely reply according to the applicable laws and regulations.