PERSONAL DATA RIGHTS NOTICE

1. Legal Basis for Data Processing: We process personal information for the purposes set out in our <Privacy Policy>.

The legal basis to process personal information includes processing that is:

• Necessary for the performance of the contract between you and the entity (ies) listed above.,
• Necessary to provide you with the services you request and to identify and authenticate you so you may use our web sites;
• Necessary to comply with legal requirements (for example, to comply with applicable accounting rules and to make mandatory disclosures to law enforcement);
• Necessary for legitimate business purpose, for example, to manage our relationship with you; ensure security protection, to improve our web sites and our products and services or regulatory requirements such as pharmacovigilance;
• Based on your consent where relevant and as required by local regulations (for example, to communicate with you about our products and services and provide you with marketing information).

Where applicable, your consent can be subsequently withdrawn at any time by using the mechanism embedded in messages received or by contacting the Global Privacy Office. Subsequent withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

In some instances, you may be required to provide us with personal information as described above in order for us to be able to provide you all of our products and services, and for you to use some features of our web site.

2. International Transfers of Personal Information:

Your personal data may be disclosed as needed to MSD entities and third parties located in the United States and other countries around the world, including in countries that may not provide the same level of data protection as your home country. We have implemented appropriate security and compliance mechanisms to ensure your personal information is protected as required and your rights are respected; such as Binding Corporate Rules (BCR), USA/ Swiss Privacy Shield Certification, EU approved data protection contractual clauses or APEC Cross Border Privacy Rules Certification. Additionally, the recipients of your personal information are bound to duties of confidentiality through legally binding framework. More information on these measures and your rights provided by these can be obtained by contacting Global Privacy Office.

3. Profiling and Automated Decision Making:

We will inform you when we implement profiling mechanisms to customize information we provided to you or when we use automated decision-making technologies to support our data processing activities. Where applicable more information on the logic used to make such decision can be obtained by contacting the Global Privacy Office. You may as well exercise your right to object or require MSD expert review of such decision.

4. Your Rights:

In addition to the right to access or correct information, you are entitled to object to or request the restriction of processing of your personal information, and to request erasure and portability of your own personal information. Requests should be submitted by contacting the Global Privacy Office. In case of need and where applicable you have also the right to send a complaint to your local Data Protection Authority.

The link to Global Privacy Office can also be used for initiating inquiries and/or submitting complaints related to personal data processing or exercising specific rights provided by MSD’s BCRs as stated in our <Privacy Policy>.

If you have additional concerns with our use of your personal information or our response to any exercise of your rights, you have the possibility to lodge a complaint to your local data protection Supervisory authority or local court as relevant.