JW PHARMACEUTICAL CORPORATIONS ("JW", "we", "our" or "us"), 2477, Nambusunhwan-ro, Seocho-gu, Seoul, Republic of Korea, respects your privacy. This Privacy Policy applies to the personal data we process in connection with the use of our website [www.jw-pharma.co.kr] and in the course of conducting our clinical trials, scientific research, medical testing, pharmacovigilance activities and any other activities relating thereto (collectively, the "Services").

In this Privacy Policy, we describe the types of personal data we process through our Services, how we may use the information, for how long we may keep the information, with whom we may share it and the choices available to you regarding use of the information and exercising your rights, including a right to object to some of the processing we carry out (if provided by applicable law). More information about your rights, and how to exercise them, is set out in the "Your Rights" section. For more detailed information on how we process your information, please continue to read below.

Effective Date: 14 07, 2021

When we refer to "personal data" in this Privacy Policy, we mean information that relates to an identifiable individual. The following personal data is collected in connection with the Services:

Some Services enable you to give us information directly. For example:

• When you communicate in any manner with our Customer Service staff or others regarding a customer inquiry, your communications and other information required to respond to and satisfy your requests will be processed through our systems.


• When you participate in a clinical trial, scientific research and/or medical testing conducted by us, we will collect from you your name initials, date of birth, age or age group, sex, height, weight and other patient identifiers, country and trial site. We will also collect health information (e.g., your health status, medical background, history, medication details, adverse events), health care information (e.g., identity and contact information of your healthcare professionals) and racial/ethnic origin.


• When you report to us any information in connection to our pharmacovigilance activities, such as post-marketing surveillance, we will collect from you your name initials, date of birth, age or age group, sex, height, weight and other patient identifiers, country and trial site. We will also collect health information (e.g., your health status, medical background, history, medication details, adverse events), health care information (e.g., identity and contact information of your healthcare professionals) and racial/ethnic origin.

We may also collect information about you from third parties, such as your healthcare professionals, hospitals/clinics, contact research organisations and clinical trial investigators, our licencees and business partners, government agencies or public records, third party service providers, industry and patient groups and associations.

In addition to the information you provide, we will collect information during your use of our website through software on your devices (e.g., web browser) and by other means, namely your location (country) and IP address.

Our Services may enable you to connect to other websites, devices, apps and other features, which may operate independently from us and have their own privacy notices or policies, which we strongly suggest you review. To the extent any linked website, device, app or other feature is not owned or controlled by us, we are not responsible for its content, use or privacy practices.

We may also collect other information about you, your devices, or your use/participation of the Services with your consent or where required by law.

The information we collect will be used for the following purposes. In each case, we will rely on a legal basis of processing under the General Data Protection Regulation of the European Union ("GDPR").

We process your personal data when this is necessary to enable you to use our website or respond to your requests, questions and instructions, based on our legitimate interests.

We process your personal data when this is necessary to conduct clinical trials, research and/or medical testing in which you are participating in, as well as any related activities supporting the same including, without limitation, pharmacovigilance activities. This may include activities relating to the detection, assessment, understanding and prevention of adverse effects, tracking and responding to safety and product quality concerns, conducting related scientific and medical research, supporting public health initiatives, attributing to academic and promotional materials and any other product-related issues.

Such use of your personal data may be based on performing a contract we executed with you or our legitimate interests. We make sure to consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law.

We will only process your sensitive personal data (such as health related information) when allowed by law.

On other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

We may process your personal data in order to comply with and enforce applicable law requirements and to respond to requests from government or law enforcement. This includes complying with regulatory monitoring and reporting obligations, such as those related to adverse events, product complaints and patient safety.

We may disclose personal data about you as described below:

• JW affiliates, subsidiaries, and personnel. We share personal data with our personnel, including contractors and agents, and other companies in our group, to the extent this is necessary to provide our Services and to fulfil the purposes set out in section 2 above.


• Business partners. We may share your personal data with our business partners, including but not limited to licensees of our products, to the extent this is necessary to conduct and perform pharmacovigilance activities, such as adverse event or quality reporting, as further detailed in section 2 above.


• Third Party service providers. We may disclose your information to carefully selected companies that provide services on our behalf, for example, companies that help us develop and operate systems for the Services; providers of IT services, security, hosting, customer care activities, mailing, billing, marketing services; clinical research organisations and clinical trial investigators. These entities are only authorised to access and use your personal data to the extent this is necessary for them to provide us with their services, and they are not allowed to use this information for other purposes. Our service providers may be located in countries outside of Europe.


• Other Parties When Required by Law or as Necessary to Protect Our Services. There may be instances when we disclose your information to other parties:
  • to comply with the law or respond to compulsory legal process (such as a search warrant or other court order);
  • to verify or enforce compliance with the policies and regulations governing our Services (such as complying with monitoring and reporting obligations to government authorities); and
  • to protect and defend the rights, property, and the security or safety of us, or, in compliance with data protection laws, any of our respective affiliates, business partners, our customers, or members of the public.


• Other Parties with Your Consent or on Your Request. In addition to the disclosures described in this Privacy Policy, we may share information about you with third parties when you separately consent to or request such sharing.

We take appropriate steps to ensure that we process and retain information about you in accordance with the following principles:

• at least the duration for which the information is used to provide you with our Services and to fulfill the purposes set out in section 2 above;


• as required under law, a contract, or with regard to our statutory obligations (e.g., tax laws); or


• only for as long as is necessary for the purpose for which it was collected, is processed, or longer if required under any contract, by applicable law, or, in anonymised form, for statistical purposes, subject to appropriate safeguards.


• Where we process your information for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.

Your personal data belongs to you. To the extent provided by applicable law, you can ask us for a copy of the personal data we hold about you, and you can ask us to delete it or correct any inaccuracies. You can also ask us to restrict or limit the processing of your personal data, as well as to provide to you your personal data that you provided to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this data to another controller.

In addition, to the extent provided by applicable law, you can object to the processing of your personal data in some circumstances (in particular, where we do not have to process the data to meet a contractual or other legal requirement). You have the right to object at any time to the use of your personal data for direct marketing purposes, including profiling relating to direct marketing.

These rights may be limited, however, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in national laws. We will inform you of relevant exemptions we rely upon when responding to any request you make. To make a request concerning your rights or to make an inquiry, see the Contact Us section below.

We take protection of your information seriously and have put in place appropriate physical, technical, and organisational measures to safeguard the information we collect in connection with theServices. However, please note that although we take reasonable steps to protect your information, no website, Internet transmission, computer system, or wireless connection is completely secure.

Your use of our Services will involve the transfer, storage, and processing of your personal data within and outside of your country of residence, consistent with this Privacy Policy. In particular, your personal data will be transferred to the Republic of Korea. In order for us to comply with monitoring and reporting obligations regarding our products in various jurisdictions, your information may also be transferred to other countries outside the Republic of Korea. Please note that the data protection laws and other laws of countries to which your information may be transferred might not be as comprehensive as those in your country.

If you are in the EEA, UK or Switzerland, we will transfer your personal data to the Republic of Korea and other countries outside the EEA or Switzerland. When transferring information outside the EEA, we will take appropriate measures, in compliance with applicable laws, to ensure that your personal data remains protected. Such measures include for instance the use of the European Commission-approved Standard Contractual Clauses to safeguard the transfer of information outside of the EEA, or reliance on your explicit consent. To request more information or obtain a copy of the contractual agreements or other safeguards in place, please contact us using the contact details set out in the Contact Us section below.

This Privacy Policy may be updated to reflect changes in our personal data practices with respect to the Services, or changes in the applicable law. We will bring to your attention any material changes to our Privacy Policy in an appropriate manner (for example, by posting a notice on our website) and indicate at the top of the Privacy Policy when it was most recently updated.

To exercise your rights, or for further information about how we use your personal data, please contact our Data Protection Officer, Byon-Joon Kwon, at privacy@jw-group.co.kr or via post to 2477, Nambusunhwan-ro, Seocho-gu, Seoul, Republic of Korea.

"To comply with the General Data Protection Regulation (2016/679) we have appointed a European representative. If you wish to contact them, their details are as follows:
Bird & Bird GDPR Representative Services SRL
Avenue Louise 235
1050 Bruxelles
Belgium
EUrepresentative.JWP@twobirds.com
Key Contact: Vincent Rezzouk-Hammachi
Our EEA Representative can only be contacted for queries in relation to data protection."