CelltrionHealthcare

UK Privacy Notice

Last updated: 2025. 07. 29.

Introduction

This Privacy Notice is provided by Celltrion Healthcare United Kingdom Limited, on behalf of its group of companies (hereinafter “Celltrion Healthcare”, “Our” or “we”) to explain who we are, how we collect, share, and use personal data about visitors to this website (www.celltrionhealthcare.co.uk) or other individuals contacting us for customer management or product monitoring purposes (hereinafter “you” or “your”), as well as how you can exercise your privacy rights. We collect and use your personal data in compliance with relevant data protection regulation and laws in the United Kingdom (“U.K.”), including without limitation the UK General Data Protection Regulation, Data Protection Act 2018, and The Privacy Electronic Communications (EC Directive) Regulations 2003.

If you have any questions or concerns about our use of your personal data, or would like to exercise any of your rights, including, but not limited to, objecting to the processing of your personal data in the ways that we describe here, then please contact us using the details provided at the end of this Privacy Notice in the “Contact Us” section.

Who We Are

Celltrion Healthcare United Kingdom Limited is a member of the global pharmaceutical group of companiesthe ultimate parent company of which, Celltrion, Inc., is headquartered in Incheon, Republic of Korea (South). For more information about Celltrion, Inc.’s group of companies, please visit https://www.celltrion.com. Celltrion Healthcare United Kingdom Limited is the controller and responsible for this website and when we use Celltrion Healthcare, “we”, “us” or “our” we refer to the relevant company responsible for processing your Personal Data.

Celltrion Healthcare United Kingdom Limited has registered offices in the U.K.: Celltrion Healthcare United Kingdom Limited, The Charter Building, Charter Place, Uxbridge UB8 1JGUK and are registered on the Information Commissioner’s Office (“ICO”) Register.

Information That We Collect

We do not require registration to visit our websites. However, some services may require you to provide us with Personal Data, such as contact details and interests.

“Personal Data” may refer to any data that identifies one as an individual or relates to an identifiable individual. We may collect, use, store and transfer different kinds of Personal Data about you or individuals about whom you are contacting us, such as:

• Contact data (including name, address, telephone numbers and email addresses);
• [Financial data (corresponding to your bank account and banking and payment information);]
• Interestsdata (including specific requests made through the website);
• Health data (including e.g. pathology, treatment, disability data, particular in the context of research).
• Technical data (including internet protocol (“IP”) address browser type and version, time zone setting and locationbrowser plug-in types and versions, operating systems and platform, device IP and other technology on the devices you use to access this website); and
• Usage data (including information about how you interact with and use our website, products and services).

If you are a Healthcare Professional (“HCP”), we may collect, use, store and transfer additional kinds of Personal Data related to our professional interaction with you.

HCP refers to any member of the medical, dental, pharmacy, or nursing professions or any other person who, during his or her professional activities, may prescribe, purchase, supply, or administer a medicinal product.

Additional kinds of Personal Data requested from HCP may include, but are not limited to:

• Professional data such as professional biography/credentials and data related to licenses, specialties, professional affiliations, publications, credentials, and other occupational achievements; and
• Customer data related to your use of our products, your interactions with us, and services for those whom you care for.

Providing us with, or giving us permission to collect, any Personal Data relating to individuals other than yourself requires you to have valid authority to do so pursuant to relevant legislation.

How We Collect Your Personal Data

We use different methods to collect Personal Data from and about you including through:

• Your interactions with us. You may give us your Personal Data by filling in online forms or by corresponding with us by post, phone, email or otherwise, including but not limited to when you give us feedback or contact us.
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical and Usagedata about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy [Celltrion Healthcare] for further details.
• Third parties or publicly available sources. We will receive Personal Data about you from various third partiesand public sources as set out below:
  • Technical data is collected from the following parties:
    • analytics providers, such as Google based outside the UK;
  • Identity and Contact Data is collected from:
    • data brokers or aggregators based in the UK; and
    • publicly available sources such as Companies House and the Electoral Register based inside the UK, or the appropriate accreditation provider or professional organisation overseeing particular activities conducted by an individual including HCPs.
  • Health data is collected in connection with adverse event reporting, including regulatory databases where such reports are made.

How We Use Your Personal Data

We use Personal Data in order to maintain functionalities on our website and to provide other services such as:

• Providing customer service to individuals;
• Responding to individuals’ inquiries and fulfilling any requests from them;.
• Adverse event recording and monitoring;
• Sending administrative information to individuals, such as changes to our terms, conditions, and policies, as well as market information that we believe may be of interest to you.

We also use Personal Data to ensure that our business operations comply with any relevant legal obligations and match our legitimate interests.

Our business activities may include:

• Data analysis;
• Internal data audits;
• Identifying usage trends for our websites;
• Detecting, preventing, and investigating fraud in the use of our websites;
• Cyber security monitoring;
• Developing, enhancing, or modifying our products and services;
• Validating users’ ability to access or utilise our products and services;
• Understanding how our products and services impact you and /or those in your care;
• Expanding our business network and scale of operations.

The Personal Data that you and others provide may be aggregated, and we may use and disclose such aggregated data for any purpose. Aggregated data does not personally identify you or any other individual.

How we Disclose Personal Data

We take your privacy very seriously and will never disclose, share or sell your data without your consent, unless required to do so by law or as otherwise set out below.

We disclose Personal Data to third parties as follows:

• Other members of the Celltrion group of companies, for the purposes described in this Privacy Notice.
• Service providers in order to provide services including, but not limited to website hosting, data analysis, information technology, infrastructural provision, cyber security, customer service, email delivery, and auditing.
• Other companies with whom we collaborate regarding products or services, including our co-promoting partners for products that we develop and market jointly.

We may also disclose your Personal Data as necessary or appropriate:

• To comply with applicable law, as well as our regulatory monitoring and reporting obligations (including laws outside your country of residence);
• to respond to requests from both public and government authorities (including authorities outside your country of residence);
• to cooperate with law enforcement; or
• for other legal purposes.

Legal basis and purpose for Processing Personal Data

The law requires us to have a legal basis for collecting and using your Personal Data. Our legal basis for collecting and using the Personal Data as described above will depend on the Personal Data concerned and the specific context in which we collect it.

In the context of our website, we will generally collect Personal Data from you as described in the following table:

In the context of our customer management activities (e.g. quoting and issuing invoices in our activities with HCPs only), we will generally collect Personal Data from you as described in the following table:

In the context of monitoring the marketing of our products (e.g. managing our legal marketing obligations, clinical studies, adverse effects, etc.), we will generally collect Personal Data from you as described in the following table:

Where you have consented to us providing you with promotional offers and marketing, you are free to withdraw this consent at any time. If you opt out of receiving marketing communications, you may still receive service-related communications that are essential for administrative or customer service purposes.

Your Rights

You have the right to access any Personal Data that we process about you and to request information about:

• What Personal Data we hold about you
• The purposes of the processing
• The categories of Personal Data concerned
• The recipients to whom the Personal Data has/will be disclosed
• How long we intend to store your Personal Data for
• If we did not collect the Personal Data directly from you, information about the source.

You may also be able to:

• Request correction of the Personal Data that we hold about you;
• Request erasure of your Personal Data in certain circumstances;
• Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your Personal Data;
• Object at any time to the processing of your Personal Data for direct marketing purposes;
• Request the transfer of your Personal Data to you or to a third party;
• Withdraw consent at any time where we are relying on consent to process your Personal Data; and
• Request restriction of your Personal Data.

On some of our websites, you have the option to register and update your profile online.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request. This is to ensure that your data is protected and kept secure. We will respond to your request as soon as reasonably practicable.

When asked to provide Personal Data, you may decline. However, choosing not to provide necessary information may limit our ability to supply you with requested services.

Data Security

We take your privacy very seriously and use reasonable organizational, technical, and administrative measures in order to protect your Personal Data. We work hard to protect you and your information from unauthorised access, alteration, disclosure, or destruction and have several layers of security measures in place, this includes encrypting your Personal Data in transit and at rest.

Data Retention Period

We only retain your Personal Data for as long as reasonably necessary to fulfil the purpose(s) for which it was obtained in this Privacy Notice, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We have strict review and retention policies in place to meet these obligations.

When we have no ongoing legitimate business need to process your Personal Data, we will either delete or anonymize it or, if this is not possible (for example, if your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until it can be safely deleted.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Please note that we may need to retain certain types of Personal Data for recordkeeping or legal or regulatory compliance purposes.

Transfers Outside the UK

Your Personal Data may be transferred to, and processed in countries other than the one in which you are resident. These countries may have data protection laws that are different from the laws in your country.

The servers of this website are located in the Republic of Korea (South). We may transfer your Personal Data with legitimate purpose to other members of the Celltrion group of companies, third party service providers, and business partners located around the world.

Whenever we transfer your personal data out of the UK, we ensure that a similar degree of protection is afforded to and that your Personal Data will remain protected in accordance with this Privacy Notice. These include implementing either the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for transfers of personal data or relying on adequacy decision in order to transfer your Personal Data outside the UK.

As of the last updated date of this Privacy Notice, the Information Commissioner's Office (the ICO) has adopted an adequacy decision for Republic of Korea (South Korea) since 23 November 2022, which means that free unrestricted transfers of personal data from the UK to private and public entities in South Korea will be permitted from that date onwards (including remote access from South Korea).

Appropriate safeguards have also been implemented with our third-party service providers and partners as required. Further details, along with our Standard Contractual Clauses, can be provided upon request.

Use by Minors

Our websites and online services are not intended to be used by anyone under the age of 18.

Third-party links

This website includes links to third-party websites. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Contact Us

If you have any questions or concerns about our use of your Personal Data, please contact our data privacy contact for the UK region at dpo.cthc@celltrion.com

Lodging a Complaint

If you wish to raise a complaint regarding the processing of your Personal Data, you may have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel: 0303 123 1113.

Updates

We may update this Privacy Notice from time to time in response to changing legal, technical, or business developments. This Privacy Notice was last updated as of the “Last Updated” date shown above.

Document Control