Otsuka Patient Assistance Foundation, Inc. Privacy Policy

1.1 Purpose

Otsuka Patient Assistance Foundation, Inc. (collectively, "OPAF," the "Foundation," "we", "our" or "us") are sensitive to privacy issues, and it is important to us to protect the information provided to us. Accordingly, OPAF provides this privacy and information practices policy ("Privacy Policy") to inform you about our online practices, the kinds of information we may collect, how we intend to use and share that information, and how you can correct or change such information. We encourage you to read this Privacy Policy in its entirety before submitting any information.

By continuing to use our websites, or submitting or requesting information, you acknowledge that you understand and agree with the provisions of this Privacy Policy. If you are unable to review or access this Privacy Policy due to a disability, you may contact us to request access to this Privacy Policy in an alternative format. Please call 1-800-438-6124 or email [email protected].

1.2 Scope

This Privacy Policy applies to Personal Information that is collected, used, and retained by OPAF in the course of our business, including on Foundation websites (together with any and all future websites) and through the short code mobile messaging programs operated by or on behalf of OPAF (collectively, the “Sites”). All individuals whose responsibilities include the processing of Personal Information on behalf of OPAF are expected to protect that data by adherence to this Privacy Policy.

1.3 Mobile Messaging Programs

You may decide to subscribe to one of our short code mobile message programs (each, a “Program” and together, the “Programs”) to receive SMS/text messages from OPAF If you choose to opt-in and consent, such as by providing your telephone number to us and clicking submit online, or texting the join code to join to any of our five- or six-digit short code numbers, we will collect information about your interactions with the SMS/text messages that we may send to you from time to time as part of the Program(s) in which you are enrolled.

By subscribing to a Program, you agree to our Terms of Service and the Mobile Messaging Terms of Service applicable to that Program and authorize us to make or initiate SMS/text messages to your telephone number using an automated system. If you wish to receive SMS/text messages through multiple Programs, you must separately opt-in to each Program.

OPAF does not sell information that we obtain from you through our Programs, including Personal Information you submit to us online to consent and opt-in to each Program, and we do not provide that information with non-affiliated third parties for any purpose other than to provide the products, services, and other information requested by you, or to fulfill our legal obligations under applicable law.

2.1 Individuals

OPAF collects Personal Information regarding its clients, visitors and guests including website visitors or healthcare providers, program applicants, contracted workers (collectively "Individuals").

2.2 Information OPAF Collects

The data we collect from or about Individuals include information that may be deemed Personal Information (alone or in combination with other Information), such as name, address, age, birth date, phone number, email address, user name, government identification, diagnoses, medication information, medical history, treatment information, clinical case notes, test results, insurance information and status, social security information and income and household information.

In addition, if you participate in certain programs or services, we may collect information regarding your medications, medical history and other healthcare-related information, including, without limitation, Protected Health Information (collectively, "Health Information"), from you or others. For example, we may indirectly collect information about your health condition, diagnosis, and treatment from your healthcare professional, but only where your healthcare professional has obtained your consent to disclose that information to us, as required by law. Any Health Information that is tied to an Individual's Personal Information will be treated as Personal Information, provided that any Protected Health Information will be protected in accordance with the requirements of HIPAA, if applicable.

2.3 How OPAF Collects Personal Information

Some of the ways that OPAF may collect your Personal Information include:

OPAF may collect Personal Information from you through various channels, including Sites such as but not limited to the OPAF website, the OPAF secure message portal, the OPAF Care Connect Portal, in surveys, during business or events, and when delivering programs and services to you.

When you use the Sites, Otsuka may provide you with opportunities to sign up to receive specific information or services and may ask for your contact information (e.g., name, home address, home phone number or personal email address), so that we can send you specific information about our products or services, educational information and specific health conditions, with your consent.

When you enroll in a program that OPAF offers, we may obtain your contact information, details of your health condition, and prescribing information relating to Otsuka America Pharmaceutical, Inc. products.

OPAF is also obligated to collect certain Personal Information to comply with regulatory requirements, including information relating to adverse effects that you have experienced when using Otsuka America Pharmaceutical, Inc. products.

OPAF may indirectly collect information about your health condition, diagnosis, and treatment from your healthcare professional, but only where your healthcare professional has obtained your consent to disclose that information to us, as required by law.

We may collect information from physicians and other healthcare providers who register on our websites in order to verify their licensure status and identity.

OPAF may collect various information from healthcare professionals as part of marketing activities to healthcare professionals, such as first name, last name, age, gender, home address, home phone number, medical specialization, professional qualifications or license number.

As you navigate the Sites, certain passive information may also be collected, including Internet Protocol addresses, cookies, navigational data, the name of the domain and host from which you access the Internet, the browser software you use and your operating system, the date and time you access our Sites, and the Internet address of the website from which you linked directly to our Sites. This type of information is used for the purpose of gathering data to provide improved administration of our Sites, to improve the quality of your experience when interacting with our Sites, and to show you personalized content.

2.4 Information from External Sources

OPAF may collect information about you from external sources to supplement information provided by you. This supplemental information allows us to verify information that you have provided to OPAF and to enhance our ability to provide you with information about our Foundation, support for Otsuka America Pharmaceutical, Inc. products, assistance services, and educational information. OPAF’s agreements with these external sources typically limit how the Foundation may use this supplemental information.

2.5 Research/Survey Solicitations

From time to time, OPAF may perform research (online and offline) via surveys. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve Individuals by learning more about their needs and -, quality of assistance services, and educational information we provide. The survey responses may be utilized to determine the effectiveness of our Sites, various types of communications. If an Individual participates in a survey, the information given will be used along with that of other individual participants. We de-identify and/or aggregate data for research and analysis purposes.

2.6 How OPAF Uses Your Personal Information

Depending on how you interact with OPAF, we and our external service providers may also use Personal Information in a variety of ways, including:

Providing Information and Services You Requested. OPAF may use the Personal Information about you to provide you information that you may request, e.g., information about product or program we are offering. OPAF may also use your Personal Information to deliver a specific program or service to you, when you enroll to receive the program or service. Such use may include: (a) generally managing your information and accounts; (b) responding to questions, comments and requests; (c) providing access to certain areas and features of the OPAF Sites; and, (d) permitting you to register for events or participate in webinars.

Administrative Purposes. OPAF may use the Personal Information about you for its administrative purposes, including, without limitation, to: (a) measure interest in OPAF's Site, programs or services; (b) perform internal quality control; (c) verify identity; (d) send communications regarding the OPAF Site, programs or services, your account, or any changes to any OPAF policy or terms of service; (e) process payments; (f) prevent potentially prohibited or illegal activities; and, (g) enforce our Terms of Use.

Information Submitted Via Sites. You agree that OPAF is free to use the content of any communications submitted by you via the Sites, including any ideas, inventions, concepts, techniques, or know-how disclosed therein, for any purpose including developing, manufacturing, -. However, OPAF does not release your name or otherwise publicize the fact that you submitted materials or other information to us unless: (a) you grant us permission to do so; (b) we first send notice to you that the materials or other information you submit to a particular part of a site will be published or otherwise used with your name on it; or (c) we are required to do so by law.

Disclosing Content to Friends or Colleagues. OPAF's Sites may offer various tools and functionality. For example, OPAF may provide functionality on its Sites that will allow you to forward or disclose certain content with a caregiver, friend, or colleague. Contact information including name, address, phone number, email addresses that you may provide for a caregiver, friend or colleague will be used to send your caregiver, friend, or colleague the content or link you request, but will not be collected or otherwise used by Otsuka or any other non-affiliated parties for any other purpose. By providing us with the information of another individual, you represent that you have the authority to do so, and permit us to use the information in accordance with this Privacy Policy.

Pseudonymous Data. OPAF may use and share your anonymized or de-identified information within the with external vendors for the enrollment into Foundation programs, program analytics and any other legally permissible purposes.

Other Uses. OPAF may use your Personal Information for other purposes disclosed to you at the time you provide Personal Information or with your consent.

2.7 Social Media

Generally, online social media resources are interactive tools that enable you to collaborate with and disclose information to others. Social media resources include, but are not limited to, social networks, discussion boards, bulletin boards, blogs, wikis, and referral functions to exchange web site content and tools with a friend or colleague.

OPAF may collect Personal Information to enable you to use online social media resources offered either by OPAF or an external vendor. We may also enable you to use these social media resources to post or disclose Personal Information with others. When using social media resources, you should take into careful consideration what Personal Information you disclose to others.

If you use online social media resources offered by an external Social Media Resource ("External SMR") through the OPAF Site, you acknowledge that OPAF may be able to access any information you make public through such External SMR (such as your username, comments, posts and contacts) and other information your privacy settings on such External SMR permit OPAF to access. OPAF will comply with the terms of this Privacy Policy and the privacy policies applicable to any External SMR information OPAF accesses.

2.8 Marketing Communication

OPAF does not solicit or market its services.

2.9 All Internet Users – Cookies, Pixel Tags/Web Beacons, Analytics Information, and Interest-Based Advertising

2.9.1 Cookies

Like many other websites, OPAF or its external vendors or service providers may employ a cookie, or small piece of computer code that enables Web servers to "identify" visitors, each time an Individual initiates a session on the Foundation's Sites. A cookie is set in order to: identify Individuals; tailor our Sites to you; measure and research the effectiveness of our Sites' features, offerings and advertisements; and, authenticate users for registered services. In addition, OPAF or its external vendors or service providers may collect information from your browser or device for interest-based advertising, using cookies or similar technologies.

Cookies can only access Personal Information that you have provided on our Sites and cannot be accessed by other sites. You also have the ability to delete cookie files from your own hard drive at any time by clicking on the Privacy or History tab typically found on the Settings or Options menu in your internet browser. However, please also be advised that cookies may be necessary to provide access to much of the content and many of the features of OPAF's Sites. To learn more about cookies, visit http://www.allaboutcookies.org.

2.9.2 Pixel Tags/Web Beacons

OPAF may use "pixel tags," also known as "web beacons," which are small graphic files that allow us to monitor the use of our Sites. A pixel tag can collect information such as: the Internet Protocol ("IP") address of the computer that downloaded the page on which the tag appears; the URL of the page on which the pixel tag appears; the time the page containing the pixel tag was viewed; the browser type and language; the device type; geographic location; and, the identification number of any cookie on the computer previously placed by that server.

2.9.3 Analytics Information

We may also use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on some of our Sites, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt out of Google's collection and processing of data generated by your use of the Services by going to http://tools.google.com/dlpage/gaoptout.

2.10 De-Identified and Aggregated Information

OPAF may use your Personal Information and other information about you to create de-identified and aggregated information, such as de-identified demographic information, de-identified location information, information about the computer or device from which you access the Otsuka Site or other online services, or other analyses we create. De-identified and aggregated information is used for a variety of functions, including the measurement of visitors' interest in and use of various portions or features of the Sites. De-identified or aggregated information is not Personal Information, and OPAF may use such information in a number of ways, including research, internal analysis, analytics and any other legally permissible purposes. We may share this information within OPAF and with external vendors or service providers for our or their purposes in a de-identified or aggregated form that is designed to prevent anyone from identifying you. We will maintain, process, and use this data in its deidentified form, and will not attempt to reidentify you from it.

5.1 Supplemental Notice for Residents of Certain U.S. States

This Supplemental Notice only applies to our processing of Personal Information of residents of California, Colorado, Virginia, Utah, Connecticut, Montana, Tennessee, and Texas. It provides information required under the privacy laws of those ten states –the California Consumer Privacy Act of 2018 ("CCPA"), the Colorado Privacy Act (“CPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Utah Consumer Privacy Act (“UCPA”), the Connecticut Data Privacy Act (“CDPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Tennessee Information Protection Act (“TIPA”) and the Texas Data Privacy and Security Act (“TDPSA”) (collectively, the “U.S. Privacy Laws”). Some portions of this Supplemental Notice apply only to residents of particular states. In those instances, we have indicated that such language applies only to those residents.

These state laws provide their residents with the right to receive a notice before or at the time we collect Personal Information from them of the Personal Information (including Sensitive Personal Information) to be collected, the purpose for which we use it, whether or not that Personal Information is sold or shared, and the length of time we intend to retain each category of Personal Information. This Supplemental Notice is intended to satisfy this requirement.

These state laws also provide their residents with the right to know the categories of Personal Information we have collected about them, the categories of sources of that information, the external vendors or service providers to whom we have disclosed their Personal Information, and the business or commercial purpose for collecting or disclosing the Personal Information. The information provided below is intended to serve this purpose.

Under these state laws, residents of California, Colorado, Virginia, Utah, Connecticut, Montana, Tennessee, and Texas also have the following rights:

• The right to request a copy of the Personal Information we have collected (including to request a copy in a portable format).
• The right to correct inaccurate Personal Information that we maintain about them.
• The right to delete Personal Information that we have collected from them, subject to certain exceptions.
• The right to opt-out of the sale of their Personal Information.
• The right to opt-out of the use and sharing of their Personal Information for targeted advertising across non-affiliated websites or applications.
• The right to opt-out of the use of their Personal Information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.
• The right to restrict the processing of their Sensitive Personal Information.

“Sale” of Personal Information

OPAF does not "sell" Personal Information, nor do we have actual knowledge of any "sale" of Personal Information of minors under 16 years of age. For purposes of this paragraph, a “sale” is the disclosure of Personal Information to a third party for monetary or other valuable consideration.

Use of Personal Information for “Profiling”

OPAF does not use Personal Information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning an individual.

Your Privacy Choices

OPAF uses the OneTrust consent management platform to recognize and honor certain opt-out preference signals that ask websites to opt out the device or browser from any “sale” or “sharing” of personal information. If you have preset your device or browser to send such signals, our website will automatically treat that signal as your request to opt out of any “sale” or “sharing” of personal information obtained from “targeting cookies” that our advertising partners use to understand your interests and market to you through that device or browser. Recognition of this signal will only take place with respect to the device and/or browser that communicates the signal.

Children’s Personal Information

OPAF processes Personal Information about children less than 13 years of age in accordance with the federal Children’s Online Privacy Protection Act and, where legally required, obtains parental consent before processing Personal Information about a known child. Otsuka does not have actual knowledge that we have Personal Information of California residents under 16 years of age.

Sensitive Personal Information

OPAF uses Sensitive Personal Information for the purposes listed in this Privacy Notice, which include purposes other than those authorized by these state laws or purposes that require consent from you. Where we are required by law to obtain consent from you, we will do so before collecting your Sensitive Personal Information and inform you of any additional purposes we may process that Sensitive Personal Information. Depending on your state of residence, you also may have certain rights to limit the use of your Sensitive Personal Information. To submit a request to limit our processing of your Sensitive Personal Information, please either complete the privacy request form or contact our Privacy Office (at [email protected] or by calling 1-800-438-6124). We will process your request(s) in accordance with applicable law.

Additional Privacy Rights for Virginia, Colorado, and Connecticut Residents

Virginia, Colorado, and Connecticut consumers have the right to appeal our decisions on their data subject requests. To appeal our decision on your data subject requests, you may contact our Privacy Office at [email protected] or by calling 1-800-438-6124. Please enclose a copy of or otherwise specifically reference our decision on your data subject request so that we may adequately address your appeal. We will respond to your appeal in accordance with applicable law.

Non-Discrimination

We will not discriminate against you for exercising your rights conferred by these state laws.

Authorized Agent

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You must provide the authorized agent with written permission to do so, and we may deny a request submitted by a person that does not submit proof that they have been authorized to act on your behalf. In certain circumstances, we may ask you to verify your own identity directly with us and to confirm that you provided the person permission to submit the request. You may also make a verifiable consumer request on behalf of your minor child.

Verification

To protect your privacy, we will take the following steps to verify your identity before fulfilling your request. When you make a request, we will ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized agent, which may include your name, email address, phone number, or birth date. If you are an authorized agent, we will ask you for a copy of the written permission from the requestor authorizing you to submit the request on his or her behalf.

If you are a resident of the U.S. states listed in this section 5.1 and would like to exercise any of your rights described above, please use our privacy request form or call us at 1-800-438-6124. We will process such requests in accordance with applicable laws.

5.2 Supplemental Notice for Nevada Residents

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Information to third parties. You can exercise this right by contacting us at [email protected] with the subject line "Nevada Do Not Sell Request" and providing us with your name and the email address associated with your account, or completing the privacy request form. Please note that we do not currently sell your Personal Information as sales are defined in Nevada Revised Statutes Chapter 603A.

5.3 Washington & Nevada My Health My Data Act Disclosures

This section only applies to website visitors, patients, and clinical trial subjects of the U.S. states of Washington and Nevada to the extent the Washington My Health My Data Act or the Nevada My Health My Data Act apply to OPAF’s processing of health data. We collect the below categories of health data from those state residents, and we process such categories of consumer health data for the purposes and in the manners listed in section 5.1:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of health information;
• Diagnoses or diagnostic testing, treatment, or medication;
• Genetic data;
• Precise location information that could reasonably indicate a resident’s attempt to acquire or receive health services or supplies;
• Data that identifies a resident seeking health care services; and
• Any inferences of the above categories of health data derived or extrapolated from nonhealthy information.

We collect these categories of health data from the sources listed in sections concerning How OPAF Collects Personal Information and Information from External Sources, and we share these categories of consumer health data with the categories of entities listed in Section 4.1.

These state residents may exercise their data subject rights, including obtaining access to and requesting changes to their health data under the Washington My Health My Data Act and the Nevada My Health My Data Act by contacting us via the methods listed in Section 5.1.

We limit third-party collection of health data over time and across different websites or online services when these state residents use our websites or online services. We do this by ensuring strict contractual restrictions with entities whose cookies, pixels, and other online trackers we use on our websites and online services in accordance with applicable U.S. privacy laws including the Washington and Nevada My Health My Data Acts. Nonetheless, please note that non-affiliated parties may still be able to collect health data from you over time and across different websites depending on your browser, browser add-ons, and associated permissions you set on your device, which is unrelated to Otsuka’s collection of health data from you, and we encourage you to view those non-affiliated parties’ privacy notices for more information about their processing of health data and the methods they provide to allow you to opt out of such processing.