PRIVACY NOTICE

This Privacy Notice describes how we use, share, and protect the personal information of customers, and visitors who visit the Chiesi Canada Sites. It also describes your rights and choices regarding the use, access, and correction of personal information we may hold about you.

Our Sites may contain links to other third-party websites. The information practices and content of such third-party websites are governed by their own privacy notices. We encourage you to review the privacy notices of such third-party websites to understand their information practices.

1. PERSONAL DATA

We collect information from you when you visit our website, sign up as a business partner, provide services as a third party, request information as an external stakeholder, file complaints through Pharmacovigilance, or apply for employment with us (when applicable).

Information we may have about you may either be directly provided by you, by our business partners (i.e., the legal entity for whom you work), by third parties (e.g., external vendors or medical agencies), or be obtained through trusted publicly available sources.

ourironwill.ca is an informational Site with limited interaction with visitors, therefore we may only process your usage information – as defined below – and data connected to cookies and similar technologies eventually used on the Site.

2. USAGE INFORMATION

When you visit our Site, we automatically collect the following types of information during your use and navigation of our Site (“Usage Information”):

• your browser type (to ensure compatibility between our Site and your browser),
• the domain name of the website that allowed you to navigate to our Site,
• your incomplete internet protocol (IP) address,
• time spent on our Site,
• web pages viewed,
• frequency of visits, and
• other relevant statistics about your use of our Site.

Unless you also actively submit personal information to us, any Usage Information typically does not allow us to identify you personally. Usage Information is generally collected through the use of cookies.

3. TRACKING TECHNOLOGIES AND COOKIES

We use cookies to collect aggregate information. A “cookie” is a small piece of information sent by a Web server to a Web browser that enables the server to collect information from the browser. Cookies are stored on your hard drive and not on our Site, so you can examine your data files and see what information is being recorded. Most cookies are “session cookies” that are automatically deleted when the user closes his or her browser at the end of a session. You may decline cookies if your browser permits. If you do so, however, you may be required to re-enter your previously submitted information each time you visit our Site.

Data collected by cookies is used to monitor a website and improve its usability. We may use cookies on certain pages, for example, to eliminate the need for you to re-enter your password during a session. We can also use cookies to identify your IP address when you visit a Site to keep track of your browsing patterns and to build a demographic profile.

4. SOCIAL NETWORK PLUGINS

We use social plugins (“Plugins”) of the following online social networks (collectively, the “Social Networks”) on certain web pages of our Site to provide certain online content and features:

• facebook.com, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA;
• twitter.com, operated by Twitter Inc., 795 Folsom Street, Suite 600, San Francisco, CA 94107, USA;
• plus.google.com, operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA; and
• youtube.com, operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. These Plugins are labeled with an icon of the corresponding Social Network.

When you visit a webpage on our Site containing a particular Plugin, your browser establishes a direct connection with the server of the corresponding Social Network. As a result, the Social Network will receive a notification that your browser has accessed that webpage of our Site on which the Plugin appears. In addition, if you interact with that Plugin, such as by clicking Facebook’s “Like” button, the corresponding Social Network will receive information about your interaction with that Plugin. If you have logged into your account associated with that Social Network, the Social Network will be able to associate the above information with your account.

Please refer to the privacy statements of the above-listed Social Networks to learn more about the ways in which and purposes for which they collect, use, disclose and process your personal information, as well as your choices and rights with respect to their processing of your personal information.

This website contains links to other sites and resources provided by third parties, these links are provided for your information only. Such links should not be interpreted as approval or endorsement by us of those linked websites or information that you may obtain from them. Unless indicated otherwise, we have no control over the contents of those sites or resources.

We always process your personal information for a specific purpose and only process personal information necessary to achieve that purpose. We may use your personal information for the following purposes, as permitted by applicable law:

• To operate our business.
• To deliver services, products, and information.
• To maintain and improve our Site.
• To communicate with you and complete and fulfill your requests.
• To perform activities necessary to ensure compliance with applicable federal, provincial and other applicable laws, to respond to requests from government authorities, and to protect the legal interests of yours, ours or third parties, such as to protect against fraud.
• In the event that we, or some or all assets related to our Site are acquired by or merged with a third-party entity or in connection with a proposed or actual merger, acquisition, sale, or other change of control, we may use or transfer some or all of the personal information that we have collected about you to determine whether to proceed with the transaction and execute the transaction if we decide to do so. We will use your personal information as permitted by applicable law and take any steps required by law in connection with these activities.

1. PHARMACOVIGILANCE INTAKE

Pharmacovigilance Intake personal information concerns individuals reporting adverse events or submitting product quality complaints.

We process your personal information for the purposes of monitoring the safety of medicinal products and medical devices, which includes detecting, assessing, and preventing adverse events; reporting to health authorities, and for any other purposes imposed by law and authorities.

The processing of your personal information is based on our legal obligations regarding the safety of medicinal products and medical devices.

We will retain your personal information only for as long as necessary for the purpose(s) for which it was obtained. We will retain and use your personal information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

We may share your personal information in the following situations, as permitted by applicable law:

• Within Our Family of Companies. Chiesi and its subsidiary, affiliate, and parent companies may share your personal information amongst and between each other for the purposes set forth in this Privacy Notice.
• Legal Compliance. We will share information for legal reasons as we believe appropriate to:
  • • satisfy any applicable law, regulation, judicial process, court order, legal process, or proper government request;
    • detect, prevent, or otherwise address fraud, security or technical issues;
    • protect against harm (whether tangible or intangible) to the rights, property or safety of ours, our users or the public; and
    • establish or exercise our rights, defend against a legal claim, and investigate, prevent or take action regarding possible illegal activities or a violation of our policies.
• Mergers and Acquisitions. We may provide personal information to a potential or actual buyer in connection with a proposed or actual merger, acquisition, sale, or other change of control, as described above.
• Aggregate and Deidentified Data. Chiesi may also disclose aggregate or de-identified information that is not personally identifiable to third parties for any purpose.
• Other Disclosures with Your Consent. We may ask you to share your information with other recipients not described elsewhere in this Privacy Notice.

We have implemented a variety of security measures and technologies intended to help protect personal information from unauthorized access, use, disclosure, alteration, or destruction. Unfortunately, no data transmission over the Internet or data storage system is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If you have reason to believe that your interaction with us is no longer secure (for example, if you suspect your account has been compromised), please immediately notify us by contacting us at ca.privacy@chiesi.com.

We do not knowingly collect personal information from children under the age of thirteen without authorization by a holder of parental responsibility. If we discover that we have collected or received personal information from a child under the age of thirteen without parental authorization, we will immediately delete that information. If you believe that we may have collected personal information from or about a child under the age of thirteen, please submit your request at the Chiesi Canada Privacy Web Form or send an email to ca.privacy@chiesi.com with the subject line “Personal Information of a Minor,” and we will make efforts to confirm and delete that information.

We share your information with affiliated and unaffiliated service providers as necessary for them to provide services to us, subject to appropriate confidentiality and data protection agreements. These third-party vendors collect, store, use, process, and transfer information about your activity on our service in accordance with their Privacy Policies.

Service providers assist us with data analysis, customer service, web hosting, website development, and other activities related to the management of our business and provision of our products and services.

You may have rights under applicable privacy laws, including the right to:

• request that we provide you with more specific details about how we process your personal information;
• access the personal information that we hold about you;
• correct, update and amend the personal information that we hold about you;
• restrict our processing of your personal information (for example, in the case of direct marketing); and
• withdraw your consent, so that we no longer process personal information in ways that you previously consented to.

Please contact our Privacy Office at ca.privacy@chiesi.com. or submit your request at the Chiesi Canada Privacy Web Form if you would like to exercise your rights under applicable privacy laws. Please note that we may need to retain certain personal information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or withdrawing your consent.

If you are not satisfied with our response to your privacy concern, you may wish to contact the Office of the Privacy Commissioner by email at info@priv.gc.ca or by telephone at 1‑800‑282‑1376.

You can always choose not to share your personal information with us when prompted to share. If you object to the processing of your personal information, or if you have provided your consent to the processing and later choose to withdraw it, we will respect your choice in accordance with our legal obligations. This could mean that we may be unable to perform the actions necessary to achieve the purposes set forth above, or you may be unable to make use of the services offered by our Site.

The Site is controlled and operated by us from Canada, and any information you provide to Chiesi through use of the Site may be stored and processed, transferred between and accessed from Canada, the United States, and other countries outside of Canada and the United States which may not guarantee the same level of protection of personal information. We may also provide your personal information to subsidiaries, affiliates, parent companies, and affiliated and unaffiliated service providers located outside of Canada, in accordance with this Privacy Notice. While your information is in another jurisdiction, it may be accessed by the courts, law enforcement, and national security authorities of that jurisdiction.

We may update this Privacy Notice from time to time to reflect changes to our information processing practices. When we change this Privacy Notice in a material way, we will update the effective date at the beginning of the document. We will also provide you with notice of changes and obtain your consent to any such changes where and as required by applicable law. We encourage you to review this Privacy Notice periodically for the latest information on our information processing practices.

If you have questions about the processing of your personal information or Chiesi data privacy policies, please contact us at: ca.privacy@chiesi.com or write to us at the following address:

Chiesi Canada Corp.

Suite 100E, 3800 Steeles Avenue West Woodbridge, ON L4L 4G9

Attn: Legal Department

You have the right to file a complaint with the Office of the Privacy Commissioner of Canada regarding the handling of your personal information. Such complaints should be directed to:

Office of the Privacy Commissioner of Canada

30 Victoria St.

GATINEAU QC K1A 1H3