Privacy Statement │ Gilead Medical Information

Article 1. (Items and Purposes for Processing Personal Information)

The Company processes personal information for purposes set forth below. Any personal information being processed will not be used for purposes other than the following purposes, and any change in any purpose of processing personal information requires prior consent thereto.

	Items	Purposes
Required Field	Items Required Field: Full Name Email address, Password, Date of registration (If you are a healthcare professional (HCP) – doctor, nurse or pharmacist) occupation, License number of a doctor, nurse or pharmacist Date of birth Information collected through passive information collection tool (access log, IP address, last login date), service use history (browsing history, searching history, etc.) Information collected or confirmed in the course of your use of Gilead Korea Medical Information Website (“Website”) services or communication with the Company (including your opinion/response/assessment of the Company’s products or services, complains/queries and the Company’s responses, responses to surveys, etc.)	Purposes Required Field: Subscription to and management of membership for Website; Provision of services through the Website: Provision of medical information regarding the Company’s products, Taking actions to and providing relevant medical information to inquiries on the Company’s products, including questions and answers; Verification of identity and eligibility (HCP) for membership; Prevention of duplicate subscription, unauthorized/illegal use; General communications with the Company such as handling of complaints/requests and responding to disputes; analyzing members, analyzing data, statistics, and improving products and services such as analyzing feedback on information provided by the Company and retaining records of processing complaints related to the Company products/services, preparing/maintaining relevant evidentiary materials, and other tasks of the Company associated with the above purposes; and Performance of legal and administrative obligations imposed on the Company.

Article 2. (Period of Processing and Retention of Personal Information)

In principle, the Company will use and retain the personal information until the termination of the membership. Thereafter the personal information will be immediately destroyed, unless the applicable laws and regulations require the Company to preserve personal information. Company retains personal information pursuant to the following applicable laws and regulations:

Website activity records: 3 months (Protection of Communications Secrets Act of Korea)

Article 3. (Provision of Personal Information to a Third Party)

In principle, the Company processes personal information only for the purposes described in Article 1. The Company shall not provide personal information for purposes not prescribed herein nor share the same with any third party without prior consent of the Principal. However, the foregoing shall not apply to the following cases:

1. In the event that the Principal provides consent on the provision and disclosure of personal information to a third party; or

2. In the event that the provision is required or allowed by the applicable laws, etc.

The Company provides personal information to third parties as follows:

Recipient Name (Contact Information)	Country Where Recipient is Located	Recipient’s Purpose of Using the Personal Information	Items of Personal Information to be Transferred	Period of Retention and Use by Recipient
Recipient Name (Contact Information) Gilead Sciences Inc. and its affiliates (“Gilead Group Companies”)¹	Country Where Recipient is Located Gilead Sciences Inc.: USA Affiliates: About 40 countries including Ireland and Korea	Recipient’s Purpose of Using the Personal Information All purposes specified in Article 1 above	Items of Personal Information to be Transferred All collected personal information specified in Article 1 above	Period of Retention and Use by Recipient Until the termination of the membership, unless otherwise required to be retained pursuant to applicable laws and regulations

Recipient Name (Contact Information)

Country Where Recipient is Located

Recipient’s Purpose
of Using the Personal Information

Items of Personal Information to be Transferred

Period of Retention and Use by Recipient

Recipient Name (Contact Information)

Gilead Sciences Inc. and its affiliates (“Gilead Group Companies”)¹

Country Where Recipient is Located

Gilead Sciences Inc.: USA

Affiliates: About 40 countries including Ireland and Korea

Recipient’s Purpose of Using the Personal Information

All purposes specified in Article 1 above

Items of Personal Information to be Transferred

All collected personal information specified in Article 1 above

Period of Retention and Use by Recipient

Until the termination of the membership, unless otherwise required to be retained pursuant to applicable laws and regulations

¹You can find the current status of Gilead affiliates at http://www.gilead.com/about/worldwide-operations. By selecting a region in the Global Operations section, you may find the addresses and contact details of the affiliates that operate in that region.

Article 4. (Delegation of Personal Information Processing Services)

The Company delegates personal information processing services as follows and will notify any changes in the delegatees and the details of delegated services through this Privacy Statement.

Delegatee	Services to be Delegated
Gilead Sciences Inc.	Support for IT, Technology and administrative function
ZP Lab Co., Ltd.	Maintenance of the Website

Article 5. (Overseas Transfer of Personal Information)

Personal information collected by the Company pursuant to Article 1 above is transferred through telecommunication network to servers located in Korea from time to time as needed and maintained therein. The Company transfers personal information as follows:

(1) Provision to Overseas Third Parties

Recipient Name (Contact Information of person in charge of information management)	Country Where Recipient is Located	Items of Personal Information Being Transferred	Time/Method of Transfer	Recipient’s Purpose of Using the Personal Information	Period of Retention and Use by Recipient
Recipient Name (Contact Information of person in charge of information management) Gilead Group Companies	Country Where Recipient is Located Gilead Sciences Inc.: USA Affiliates: About 40 countries including Ireland and Korea	Items of Personal Information Being Transferred All collected personal information specified in Article 1 above	Time/Method of Transfer Transferred through telecommunication network from time to time as needed	Recipient’s Purpose of Using the Personal Information All purposes specified in Article 1 above	Period of Retention and Use by Recipient Until termination of membership, unless otherwise required to be retained pursuant to applicable laws and regulations

Recipient Name (Contact Information of person in charge of information management)

Country Where Recipient is Located

Items of Personal Information Being Transferred

Time/Method of Transfer

Recipient’s Purpose of Using the Personal Information

Period of Retention and Use by Recipient

Recipient Name (Contact Information of person in charge of information management)

Gilead Group Companies

Country Where Recipient is Located

Gilead Sciences Inc.: USA

Affiliates: About 40 countries including Ireland and Korea

Items of Personal Information Being Transferred

All collected personal information specified in Article 1 above

Time/Method of Transfer

Transferred through telecommunication network from time to time as needed

Recipient’s Purpose of Using the Personal Information

All purposes specified in Article 1 above

Period of Retention and Use by Recipient

Until termination of membership, unless otherwise required to be retained pursuant to applicable laws and regulations

(2) Overseas Delegation

Recipient Name (Contact Information)	Country Where Recipient is Located	Items of Personal Information Being Transferred	Time/Method of Transfer	Recipient’s Purpose of Using the Personal Information	Period of Retention and Use by Recipient
Recipient Name (Contact Information) Gilead Sciences Inc. (353-214825372)	Country Where Recipient is Located USA	Items of Personal Information Being Transferred All collected personal information specified in Article 1 above	Time/Method of Transfer Transferred through telecommunication network from time to time as needed	Recipient’s Purpose of Using the Personal Information Support for the Company’s IT, technological administrative and other work	Period of Retention and Use by Recipient As specified in Article 2, unless the applicable laws and regulations require the Company to preserve personal information

Article 6. (Rights and Obligations of Principal and Method of Exercise Thereof)

The Principal may exercise the rights relating to protection of personal information, including a request for inspection, correction or deletion of personal information or suspension of processing of personal information towards the Company pursuant to the applicable laws, including the PIPA.
The exercise of the rights pursuant to Paragraph (1) can be done by the legal representative or delegatee of the Principal. In such case, a legitimate power of attorney of the Principal should be submitted to the Company pursuant to the Enforcement Regulations of the PIPA.
The Company will take measures without delay as stipulated by the applicable laws, including the PIPA with respect to the exercise of the rights by the Principal.

Article 7. (Destruction of Personal Information)

In principle, the Company will immediately destroy personal information when the purposes of processing such personal information are attained and such personal information becomes unnecessary.
When the Company destroys personal information, it will implement measures to ensure that the information is not restored or regenerated.
If the Company has to retain personal information instead of destroying it under relevant laws and regulations, the Company will store and manage such personal information or personal information file separately from other personal information.
If the personal information that needs to be destroyed is in the form of electronic file, the Company will permanently delete such information in an irrevocable manner. Any other document, printout, letter and other recorded media will be destroyed by incineration or shredding.

Article 8. (Measures to Ensure Safety of Personal Information)

The Company takes the following technical, managerial and physical measures necessary for ensuring safety of personal information.

Managerial measures: Establishment and enforcement of a personal information internal management plan, provision of periodic education on protection of personal information for employees, etc.
Technical measures: Management of the right to access the personal information processing system, etc., installation of the access control system, encryption of unique identification information, etc., installation of security programs
Physical measures: Restrictions on the access to physical storage facilities storing personal information, including computer rooms and data rooms

Article 9. (Installation and Operation / Refusal of Devices that Automatically Collect Personal Information)

The Company operates cookies, etc. that store and retrieve the Principal’s information from time to time. Cookies are small text files sent to the Principal’s browser from the server that operates the Website and are stored in the Principal’s computer hard disk. Once the Principal accesses the Website, the Company may use cookies for purpose of statistics at work by analyzing frequency of access, visit time, etc., tracing the Principal, and obtaining information on event participation and frequency of visit, etc. The Principal has the right to choose whether or not to accept cookies. The Principal may accept all cookies, choose to store just specific types of cookies, or reject all cookies by changing his/her web browser’s option. [An example of the installation method (for Internet Explorer): The tool button on the upper part of the web browser > Internet Option > Personal Information]. However, if the Applicant rejects all cookies, the use of some of the services within the Website may be restricted.

Article 10. (Amendment to Privacy Statement)

The Company may make any amendment to this Privacy Statement pursuant to the applicable laws, rules and the Company’s internal operation policies, in which case the changes made to this Privacy Statement will be disclosed in accordance with the methods stipulated by the applicable laws.

Article 11. (Methods of Seeking Remedy for Infringement of Rights)

The Principal may request remedies, counseling, etc. regarding infringement of personal information towards the following agencies:

Personal Information Infringement Reporting Center (operated by the Korea Internet & Security Agency, “KISA”)

Handling affairs: Report on infringement upon personal information, application for counseling
Website: http://privacy.kisa.or.kr
Tel. No.: 118 (without area code)
Address: (58342) Korea Internet
Security Agency, Personal Information Infringement Reporting Center, 9, Jinheung-gil, Naju-si, Jeollanam-do, Korea
Personal Information Dispute Resolution Committee

Handling affairs: Application for dispute resolution of personal information, resolution of group dispute
Website: www.kopico.go.kr
Tel. No.: 1833-6972
Address: (03171) 12th floor, 209, Sejong-daero, Jongno-gu, Seoul, Korea
Cybercrime Investigation Department, the Prosecution Service:
02-3480-3573 (www.spo.kr)
National Police Agency Cyber Terror Response Center: Cyber Terror Response Center, the National Policy Agency:
1566-0112 (www.netan.go.kr)

Article 12. (Collection of Opinions and Handling of Complaints)

The Principal may make a request regarding inquiries on protection of personal information, handling of complaints, remedies for damages, etc. towards the following department in charge. The Company will provide a prompt and sufficient response with regard to the complaints of the Principal.

[Department in charge of protection of personal information]

Department: Medical Information Department

Telephone Number: 0079 814 800 9172

Email: koreamedinfo@gilead.com

Gilead Sciences Korea Ltd.
15F West Center 1 Building, 26, Eulji-ro 5-gil, Jung-gu, Seoul, 04539 South Korea

Addendum

1. This Privacy Statement is put into force from [*] of [Month], 2023.

Collected Items	Full Name, (If you are a healthcare professional (HCP)) occupation, degree, institution/affiliation Contact: Email address, address, phone number (If an inquiry includes any complaint about the Company’s product) Name, address or contact information of the clinic/hospital/drugstore All information you provided in the course of medical information inquiry and any and all other general personal information collected, identified and generated in the course of communicating and contacting with the Company as well as Gilead Sciences Inc. and its affiliates (“Gilead Group Companies”)¹
Purpose of Collection and Use	Processing and providing responses to medical information inquiries: Send requested materials, provide response to inquiries and/or handle requests, collect and analyze feedback on the information Company provided, handle requests and claims, deliver notices, keep records of claims and complaints (If an inquiry includes any adverse event after taking the Company’s product) Processing, investigation and retention of the records of post-marketing safety management under applicable laws and regulations, collection and analysis of information on adverse events, product improvement, research and development, response to related disputes and evidence, compliance with applicable laws and internal regulations (If an inquiry includes any complaint about the Company’s product) Quality control of products and handling of complaints, exchange of products and sending of reports, product improvement, research and development, response to related disputes and evidence, compliance with applicable laws and internal regulations Any other tasks necessary or related to fulfill the foregoing purposes
Period of Retention and Use	Unless the Company is otherwise obliged to preserve your personal information by applicable laws and regulations, the Company retains and uses your personal information for 5 years from the completion of processing of medical information inquiries. If an inquiry includes any adverse event after taking the Company’s product, the Company retains and uses your information for 25 years from the expiration or withdrawal date of the relevant product’s last license or approval on a global basis. If an inquiry includes complaints about the Company’s product, the Company retains and uses your information for 3 years from the expiration date/period of use of the relevant product’s batch.

Collected Items	(If an inquiry includes any adverse event after taking the Company’s product) If your inquiry includes health information, for example, if you report your health condition after taking the Company’s product to the Company, the relevant health information Any and all other sensitive information collected, identified and generated in the course of communicating and contacting with the Company and Gilead Group companies with respect to the foregoing
Purpose of Collection and Use	Processing, investigation and retention of the records of post-marketing safety management under applicable laws and regulations, collection and analysis of information on adverse events, product improvement, research and development, response to related disputes and evidence, compliance with applicable laws and internal regulations Any other tasks necessary or related to fulfill the foregoing purposes
Period of Retention and Use	Unless the Company is otherwise obliged to preserve your personal information by applicable laws and regulations, the Company may retain and use your sensitive information for 25 years from the expiration or withdrawal date of the relevant product’s last license or approval on a global basis.

Privacy Statement

Article 1. (Items and Purposes for Processing Personal Information)

Article 2. (Period of Processing and Retention of Personal Information)

Article 3. (Provision of Personal Information to a Third Party)

Article 4. (Delegation of Personal Information Processing Services)

Article 5. (Overseas Transfer of Personal Information)

Article 6. (Rights and Obligations of Principal and Method of Exercise Thereof)

Article 7. (Destruction of Personal Information)

Article 8. (Measures to Ensure Safety of Personal Information)

Article 9. (Installation and Operation / Refusal of Devices that Automatically Collect Personal Information)

Article 10. (Amendment to Privacy Statement)

Article 11. (Methods of Seeking Remedy for Infringement of Rights)

Article 12. (Collection of Opinions and Handling of Complaints)

Addendum

You are now leaving the AskGileadMedical.com website

Click “Continue” to proceed or “Back” to return to AskGileadMedical.com

You are leaving this website

Consent Form for Processing Personal Information (Medical information inquiries on MI website)

Consent to Collection and Use of Personal Information

Collection and Use of General Personal Information

Collection and Use of Sensitive Information

Third-party Transfer of Personal Information

Overseas Transfer of Personal Information

Consent Form for Processing Personal Information
(Medical information inquiries on MI website)