Pharmacist Hub

Page 2

1. Who is the responsible entity for your personal information?

Depending on the ways in which you interact with Smith+Nephew, the responsible entity for your personal information will be the Smith+Nephew entity which: (a) manages the Smith+Nephew website you visit; (b) is responsible for the sale of Smith+Nephew products in your country; or (c) has a business or other relationship or interaction with you. For more information on the locations in which Smith+Nephew’s entities operate please see here.

2. Contact information and your privacy point of contact

If you: (a) want to exercise your rights in connection with your personal information (please also see Section 8 ‘What are your rights regarding your personal information?’); (b) have any questions about this privacy notice; (c) need more information; or (d) would like to raise a concern, please contact us at privacy@smith-nephew.com or via our speak up line here.

3. What personal information or categories of information do we collect about you?

Depending on your particular relationship or interaction with Smith+Nephew, the personal information we collect and process may include but is not limited to the following:

• (a) Personal Information, such as your name, surname (including prefix or title), alias, gender, age, or date of birth, marital status, signature, as well as your preferred language;

• (b) Account details, such as your account credentials and account history;

• (c) Contact Information, such as information that enables us to contact you (including, where applicable, the details of your emergency contacts), such as your personal or business email, mailing address, telephone number, fax number, country/state/region/province, and/or, your profile on a social media platform;

• (d) Professional information, such as information related to your professional role, job title, organisation, work location, professional specialties, areas of interests, CV and any publicly available information relating to your work;

• (e) Technical and Network Activity Information: Information such as your device and your usage of our websites, apps and systems, including your IP address, device ID, hardware model and version, mobile network information, operating system and other online identifiers, type of browser, browsing history, search history, access time, pages viewed, enrolment, progress and completion of activities when relevant, URLs clicked on, forms submitted, physical location, marketing preferences and user interaction;

• (f) Financial Information, such as your bank details, including account name, account number, sort code, VAT number, credit card information;

Page 3

• (g) Health Insurance Information, such as your insurance policy information, identification number, application and claims history;

• (h) National identifiers, such as your National ID/passport, driver’s license, social security number or other taxpayer/government identification numbers;

• (i) Due Diligence Information: Information that allows us to perform our due diligence before we do business with you or your company (such as to identify any conflict of interests or in relation to mergers and acquisitions), which may involve citizenship status, nationality, address history, criminal checks, information about investigations and enforcement actions, business ownership, references etc.;

• (j) Investigations Information, such as e-discovery data, and other information collected as part of reported concerns we receive and investigations we conduct to monitor compliance with laws, regulations, and Smith+Nephew policies;

• (k) Travel & Events Information, such as any information related to your travel and participation in Smith+Nephew events, including any dietary restrictions;

• (l) Training information, such as any information relating to trainings you receive from us as part of our relationship with you (e.g., trainings on Smith+Nephew products);

• (m) Transactional and Product Use Information, such as:

  • Data related to your use of our products and services;

  • Your purchase and payment history and preferences;

  • Your interactions with us;

  • Your preferred method of communication with us;

  • Services and sources of information you may use.

• (n) Feedback information, such as responses you provide to our surveys (e.g., customer satisfaction or supplier surveys);

• (o) Audio-Visual information, such as photos, videos, and voice recordings of you, to the extent applicable in your specific situation;

• (p) Publicly available information, such as public social media posts you make to the extent these are relevant for Smith+Nephew’s business purposes (e.g., managing external relations, conducting due diligence and investigations);

• (q) Special categories of personal data or Sensitive Personal Information such as information about your health situation, patient ID, medical record and treatment, disability, gender or ethnicity, that you provide to us directly (e.g. when you submit a product complaint to us) or a Smith+Nephew customer or Healthcare Professional provides to us (e.g. in order to report any adverse events relating to our products, enable the order and use of Smith+Nephew products used in your treatment or to process cost reimbursement requests),

Page 4

• when Smith+Nephew processes this information for its own business purposes;

• (r) Any other information we may collect as part of our relationship with you, when you contact us, submit requests or complaints, report concerns or adverse events or otherwise interact with us.

You can choose not to give us personal information when we ask you for it. If you decide not to give us your personal information, it may restrict our relationship with you. For example, we may not be able to provide you with the services that you have requested. If you do not wish to give us personal information but we are required by applicable law or regulation to obtain your information, we will confirm this requirement to you.

4. How do we collect your personal information?

(a) Directly from you, such as when you:

• Create an account on any Smith+Nephew website, app or system;

• Purchase Smith+Nephew products and services;

• Supply Smith+Nephew with products and services;

• Use Smith+Nephew apps and systems;

• Use your company’s sign on or other third-party authentication service to gain access to our systems or apps;

• Share or use your social media profile to contact Smith+Nephew or engage with Smith+ Nephew content on social media platforms;

• Sign up with us to receive marketing material, newsletters and other regular communications;

• Visit our websites or engage with online content or events on our website or licensed third party platforms;

• Engage with one of our sales and customer support representatives, or call centres;

• Respond to surveys, provide feedback or provide testimonials;

• Submit any online or offline forms (e.g. to order product samples);

• Share adverse events with us or submit product or medical information requests;

• Attend online and offline meetings;

• Attend or complete online and offline trainings;

• Are subject to due diligence or investigations by Smith+Nephew relating to you or your organisation;

• Otherwise engage and communicate with us.

(b) From other sources, such as:

Page 5

• Your organisation as part of our business relationship with them;

• Any third party reporting a concern to us;

• Your Healthcare Professional when they order Smith+Nephew products relating to your treatment, to the extent your information is shared with us for the purpose of the order or cost reimbursement purposes;

• Your Healthcare Professional when they share adverse events with us relating to your treatment;

• Publicly available repositories or sources of information;

• Providers of marketing services;

• Agencies specialising in event management;

• Entities facilitating travel arrangements;

• Professional networking platforms, such as LinkedIn or other social media platforms;

• Instances where our products are referenced in online discussion, such as when mentioning a Smith+Nephew product in a social media post;

• Consultants or law firms representing you or your organisation;

• Government agencies or similar organisations who hold your information on file; and/or

• As is needed to (a) assist in meeting our legal obligations, (b) handle litigation and investigations and (c) facilitate the safety of our employees and customers.

If you connect your social media account to our websites, or apps, you will share certain personal information from your social media account with us. This may include your name, email address, photo, list of social media contacts, and any other information you make accessible to us when you connect your social media account to our websites, or apps.

We may combine information about you from various sources, including the information you provide to us and personal information, which is collected during your relationship with us.

5. How do we use your personal information?

We may use your personal information for the purposes described below:

(a) To manage our relationship with you.

For example, we may use your personal information to:

• Conduct due diligence before we do business with you or as part of mergers and acquisitions;

Page 6

• Provide our products and services and interact with you and your organisation;

• Procure product and services and interact with you and your organisation;

• Provide and manage access to online services, such as webcasts, job opportunities, educational programmes, news, testimonials, and financial updates;

• Manage your account on our websites and apps;

• Identify you and authenticate your access rights to our websites, systems and apps;

• Help with any questions or requests you have about our products, services, online services or other matters;

• Provide you with information when you request it or when we believe our products and services may be of interest to you. If we intend to share electronic marketing with you, we will ask for your consent where required and you can opt out at any time;

• Invite you to provide feedback, participate in research, surveys or attend events;

• Depending on the nature of our relationship with you, we may use the data you share with us to make decisions about your interests and preferences so we can make the marketing materials we send you more relevant. We may also combine the information we hold about you with data about your interests or demographics that third parties have collected from you online and offline, to make your experience more personalised and further tailor our marketing materials. You have certain rights in relation to this – please see Section 8 'What are your rights regarding your personal information?' below for further information;

• Provide personalised content and recommendations for you in the context of Medical Education;

• Perform analytics, market research and segmentation to understand your preferences, improve our products and services and our communications to you;

• Report any issues with our products e.g. potential adverse events from our products to ensure they are safe;

• Engage with you on initiatives/activities such as for publication purposes;

• Manage events you participate in and make travel arrangements;

• Offer you relevant training.

(b) To manage and improve our processes and our business operations.

For example, we may use your personal information to:

Page 7

• Manage our network and information systems security;

• Process orders and payments;

• Administer the supply and distribution of our products;

• Respond to reports you make of a possible adverse event associated with one of our products and to monitor the safety of our products;

• Respond to customer or government agency requests or requirements;

• Keep records related to our relationship with you;

• Perform data analysis, auditing and research to help us deliver and improve our digital platforms, content and services;

• Monitor and analyse trends, usage and activities in connection with our products and services and use this data to make improvements;

• Prepare and perform management reporting and analysis, including analytics and metrics.

(c) To achieve other purposes.

For example, we may use your personal information:

• To follow or comply with applicable laws and regulations;

• To tell you about changes to our terms, conditions and policies;

• In connection with potential, threatened or actual disputes or litigation;

• To investigate and take action against illegal or harmful behaviour and/or violations of laws, regulations, or Smith+Nephew policies;

• To protect Smith+Nephew, your vital interests, or those of another person;

• When we sell, assign or transfer all or part of our business.

6. Why are we allowed to collect and use your personal information?

(a) To take steps before entering into a contract or perform a contract; (b) To follow the law, for example:

• Providing information to customers and government agencies or similar organisations in order to comply or demonstrate compliance with legal or regulatory obligations;

Page 8

• To comply with our record-keeping, regulatory monitoring and reporting obligations, including those related to adverse events, product complaints and product safety;

• Complying with anti-corruption, transparency and fiduciary obligations and other applicable laws or regulations;

• To comply with our legal obligations when you exercise your privacy rights outlined under Section 8 ‘What are your rights regarding your personal information?’.

(c) You have specifically given us your consent. For example, we may need your consent in the following circumstances:

• Placing cookies on your device to find out how you use our websites so we can personalise what you see by tailoring content and notifications to the things you are interested in;

• Certain situations where you share sensitive information about yourself, such as your health;

• Before we send you certain electronic marketing communications;

• In any other situation where processing your personal information relies upon your consent.

(d) We need to use your personal information for legitimate business purposes, for example, to enable us to run our business successfully. These include but are not limited to:

• Conducting audits and internal investigations and complying with internal policies on anti-bribery and conflict of interest;

• Managing and ensuring the security of our IT and communications systems and networks;

• Planning and improving our business activities including without limitation in relation to research and development, educational, clinical, supply chain and other commercial activities;

• Processing transactions and payments;

• Providing related customer service;

• Responding to and handling queries or requests;

• Sending administrative information, such as changes to our terms, conditions and policies;

• Reaching out to you to provide information about our products or request input on surveys;

Page 9

• Conducting training and gathering feedback;

• Protecting our rights, privacy, safety or property, and/or that of our affiliates, you or others;

• Communicating and managing our relationship with you;

• Verifying your eligibility to access certain products, services and data that may be provided only to licensed healthcare professionals or otherwise conducting verification, due diligence and/or background checks to ensure we are not precluded from working with you;

• Analysing or predicting your preferences to identify aggregated trends to develop, improve or modify our products, services and business activities;

• For the establishment, exercise or defence of legal claims or proceedings or any dispute or potential litigation.

(e) To protect your vital interests or those of others; (f) Because it is necessary for reasons of substantial public interest, on the basis of applicable laws and regulations.

7. How do we protect your personal information?

• We make sure your personal information is treated with the utmost care and in accordance with our policies and procedures and we take appropriate steps to protect it.

• We use a variety of security measures and technologies to help protect your personal information and regularly monitor these for possible vulnerabilities and attacks.

• We carefully choose service providers to work with, and check they have security measures and technologies in place to protect your personal information.

• We do not sell your personal information.

8. What are your rights regarding your personal information?

Local privacy laws may give you rights with respect to your personal information, as described in more detail below. You may exercise your rights by contacting us (see Section 2 ‘Contact information and your privacy point of contact’). We will handle any request to exercise your rights in accordance with applicable law, but please note that these rights only arise in certain circumstances and may not be absolute. Depending on our reason for processing your personal information and to the extent the local law in your jurisdiction grants the applicable rights to you, you may be entitled to:

Page 10

• Withdraw your consent to us processing your personal information;

• Ask us about the processing of your personal information including to be provided with copies of your personal information;

• Ask us to correct information you think is inaccurate or incomplete;

• Ask us to delete your personal information;

• Ask us to restrict the processing of your personal information;

• Object to our processing of your personal information;

• Ask that we transfer personal information you have given us from one organisation to another, or to give it to you;

• Appeal the response received related to your rights request where you deem it inadequate or insufficient; and

• Complain to your local data protection authority.

For your protection, and to protect the privacy of others, we may need to verify your identity before completing what you have asked us to do.

Where we have relied upon your consent to use your personal information, and you later withdraw that consent, we may not be able to complete some of the activities described in Section 5 ‘https://viivexchange.com/privacy-notice/#section-5How do we use your personal information?’. Please also note that under certain local laws and applicable regulations, there are situations within which the right to withdraw your consent will not apply.

9. How long do we keep your personal information?

• In some jurisdictions, we are legally required to keep your personal information for a certain period. How long depends on the specific legal requirements of the relevant jurisdiction. Otherwise, we will only keep it for as long as is necessary for the purpose for which it was collected.

• At the end of the retention period, your personal information will either be deleted completely or deidentified, for example by aggregation with other data so that it can be used in a nonidentifiable way for statistical analysis and business planning.

10. With whom do we share your personal information?

The personal information Smith+Nephew collects about you may be shared with teams in the Smith+Nephew group of companies who need the personal information in order to perform their business activities.

Page 11

We may also share your personal information with companies or agents working on Smith+Nephew’s behalf to assist in fulfilling business needs or other third parties. By way of example such third parties include but are not limited to:

• Event and travel agencies;

• Marketing agencies;

• Technology suppliers who provide, manage and/or support our websites, digital forums, IT systems and apps;

• Media services providers who work with us;

• Healthcare service providers who work with us;

• Suppliers managing adverse event reports;

• Regulators, courts, governments and law enforcement authorities;

• Professional advisors, such as auditors, accountants, consultants and lawyers;

• Potential counterparties in the context of corporate merger, acquisition or disposal transactions, counterparties in litigation, or otherwise in the context of satisfying legal obligations provided that any such recipients are subject to confidentiality obligations; and

• Parties entitled by relevant legal authorities to obtain such categories of information.

Smith+Nephew will only provide third parties with the data necessary to fulfil the purposes outlined in this privacy notice. Furthermore, third parties with whom Smith+Nephew has a direct contractual relationship will generally be required to maintain the confidentiality of your personal information and to comply with appropriate privacy and security standards and prohibited from using that information for any other purpose.

11. In what instances do we transfer your personal information outside of your home country?

• Because of the international nature of our business, we may transfer your personal information within the Smith+Nephew group or to third parties located outside of your jurisdiction. Such countries may have different laws and data protection compliance requirements to those that apply in the country in which you are located. For more information on the locations in which Smith+Nephew’s entities operate please see here.

• To the extent permitted by local law, by providing your personal information to Smith+Nephew you consent to the transfer, use and storage of your personal information in other countries.

Additional information if you are in the European Economic Area (EEA), UK or Switzerland

Page 12

• Competent authorities in the EEA, UK and Switzerland recognise that data protection laws in certain countries outside those jurisdictions provide a similar level of data protection standards. Where we transfer your personal information to countries not recognised by those authorities, we have procedures in place to ensure your personal information receives the same protection as if it were being processed in the EEA, UK or Switzerland. For example, our contracts with third parties who would have access to your personal information stipulate the standards they must follow in respect of your personal information.

• Any transfer of your personal information will follow applicable laws and we will treat the information under the guiding principles of this Privacy Notice.

12. Cookies, Website and Application Data; Use for Analytics and Marketing

• Our websites may use cookies and similar technologies. You can choose to accept or decline cookies. If you choose to decline cookies, not all elements of our websites, apps and services may function as intended, so your experience may be affected.

• To the extent that your local laws consider the information collected by cookies and other technologies as personal information, we will treat that information to the standards set out in this privacy notice.

• For more information on our use of cookies, please refer to our Cookie Policy. This policy explains what cookies and similar technologies are, and how we use them.

• We collect information about your computer browser type and operating system, websites you visited before and after visiting our websites, standard server log information, Internet Protocol (IP) addresses, location data, mobile phone service provider, and mobile phone operating system. We use this information to understand how our visitors use our websites and mobile applications so that we can improve them, the services we offer, and our advertising. We may also share this information with other companies within the Smith+Nephew group of companies and with other third parties.

• Some of our websites use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to analyse use patterns and may collect information about your use of the website, including your IP address. More information on Google Analytics can be found here. If you would like to opt-out of having your data used by Google Analytics, you can opt out here.