Privacy notice

This privacy notice describes the ways in which we collect, hold and use information about individuals who visit this website.

This website does not collect identifiable information (“Personal Data”) about visitors. However, we may be required to process your Personal Data, for example if you contact us.

For the purpose of this Privacy Notice, “Novartis” refers to Novartis Pharmaceuticals UK Limited, which is registered at 2nd Floor, The WestWorks Building, White City Place, 195 Wood Lane, London W12 7FQ. For any Personal Data collected by this website, Novartis acts as “controller”. Novartis is part of the Novartis group and may exercise this responsibility alone or jointly with other companies in the Novartis group (acting as a “co-controller”). In this Privacy Notice, “we” or “us” refers to Novartis.

1. What personal data do we process and for which purposes?
This website does not collect any Personal Data or require you to register, allowing you to visit our site without telling us who you are. However, if you contact us, we may be required to process your Personal Data.

1.1 Cookies
If you accept performance cookies from this website, we may collect and process information about your visit to this website, such as the pages you visit, the website you came from and some of the searches you perform. Such information is used by us to help improve the contents of the site and to compile aggregate statistics using our site for internal, market research purposes. In doing this, we may install “cookies” that collect the domain name of the user, your internet service provider, your operating system, and the date and time of access. A “cookie” is a small piece of information, which is sent to your browser and stored on your device. Cookies do not damage your device. You can set your browser to notify you when you receive a “cookie”, this will enable you to decide if you want to accept it or not, however, if you do not accept, you may not be able to use all functionalities of your browser software. You may prevent or stop the installation and storage of cookies by you browser settings by downloading and installing the free Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout?hl=en. If you do not accept cookies, you may not be able to fully experience all functions of our website.

1.2 Google Analytics
If you accept performance cookies from this website, we use “Google Analytics” to monitor responses to the exit survey on an aggregate, anonymised basis. Novartis does not collect Personal Data from exit survey responses.

Novartis also uses Google Analytics to rationalise our portfolio of websites by (i) optimising traffic to and between corporate websites, and (ii) integrating and optimising web pages where appropriate. “Google Analytics” is a service offered by Google Inc. (“Google”) that generates detailed statistics about a website’s traffic and traffic sources and measures conversions and sales. Google Analytics uses cookies stored on your device to help analyse how users use our website. The information generated by the cookies about your use of our website, including your IP address, will be anonymised by use of the appropriate settings prior to be transmitted to Google servers in the United States. For more information on how IP anonymisation works, please see https://support.google.com/ analytics/answer/2763052.

Occasionally, we may use internet tags (also known as action tags, single-pixel GIFs, clear GIFs, invisible GIFs and 1- by-1 GIFs) and cookies on this site and may deploy these tags/cookies through a third-party advertising partner or a web analytical service partner which may be located and store the respective information (including your IP address) in a foreign country. These tags/cookies may be placed on both online advertisements that bring users to this site and on different pages of this site. We use this technology to measure the visitors’ responses to our sites and the effectiveness of our advertising campaigns (including how many times a page is opened and which information is consulted) as well as to evaluate your use of this website. The third-party partner or the web analytical service partner may be able to collect data about visitors to our and other sites because of these internet tags/cookies, may compose reports regarding the website’s activity for us, and may provide further services which are related to the use of the website and the internet. They may provide such information to other parties if there is a legal requirement that they do so, or if they hire the other parties to process information on their behalf. If you would like more information about web tags and cookies associated with on-line advertising or to opt-out of third-party collection of this information, please visit the Network Advertising Initiative website http:// www.networkadvertising.org.

2. Who has access to personal data and to whom are they transferred?
If we are required to process your Personal Data, for example to respond to your query, we will not sell, share, or otherwise distribute your Personal Data to third parties except as provided in this Privacy Notice or another notice provided to you.

We may share Personal Data with other Novartis affiliates worldwide. Personal Data may also be transferred to third parties who act for or on our behalf, for further processing in accordance with the purpose(s) for which the data were originally collected or may otherwise be lawfully processed, such as services delivery, evaluating the usefulness of this website, data management, or technical support.

These third parties have contracted with us to only use Personal Data for the agreed upon purpose, and not to sell Personal Data to third parties, and not to disclose it to third parties except as may be permitted by us, as required by law, or as stated in this Privacy Notice.

Personal Data may also be transferred to a third party in the event that the business of this site or a part of it and the customer data connected with it is sold, assigned or transferred, in which case we would require the buyer, assignee or transferee to treat Personal Data in accordance with this Privacy Notice or another notice provided to you.

Also, Personal Data may be disclosed to a third party if we are required to do so because of an applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Personal Data may also be processed, accessed, or stored in countries outside the UK. Such countries may offer a different level of protection of personal data. If we transfer Personal Data to external companies in other jurisdictions, we will make sure to protect Personal Data by applying the level of protection required under applicable data privacy laws.

For intra-group transfers of Personal Data, Novartis has adopted Binding Corporate Rules, a system of principles, rules, and tools, provided by European law that ensures effective levels of data protection relating to transfers of Personal Data outside the EEA and Switzerland. Read more about the Novartis Binding Corporate Rules at https:// www.novartis.com/privacy-policy#bcr.

3. How do we protect personal data?
To ensure the security and confidentiality of Personal Data that we collect online, we implement appropriate technical and organisational measures to ensure a level of security appropriate to protect Personal Data from loss, misuse, unauthorised access, disclosure, alteration or destruction and against other unlawful forms of processing.

4. How long do we store personal data?
We will only retain Personal Data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

5. What are your rights and how can you exercise them?
Whenever we process Personal Data, we take reasonable steps to ensure that Personal Data is kept accurate and up-to date for the purposes for which it was collected. We provide the ability to exercise the below rights under the conditions and within the limits set forth in the law.

If you wish to contact us regarding the use of your Personal Data or you want to object in whole or in part to the processing of your Personal Data, please email us at [email protected]. If you have provided consent, you may wish to withdraw consent. You may request to access your Personal Data as processed by us, to ask for correction, erasure or to request portability, where applicable, of your Personal data, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format, subject to your confidentiality obligations.

By contacting us, please note the name of the website related to your request, your relationship and/or interactions with us (as applicable), as well as the specifics of the information you would like us to provide.

We do not currently respond to web browser “do not track” signals or other mechanisms that provide a method to opt out of the collection of information across websites or other online services.

6. Contact us
If you wish to contact us regarding our use of personal data or you wish to exercise your data privacy rights, you may send an email to [email protected]. If you are not satisfied with how we process your personal data, please address your request to our Data Protection Officer at [email protected], who will investigate your concern. In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.

Disclaimer:

This chatbot is not a medical device. This chatbot is intended for informational and educational use only.

This chatbot, and the information generated by it, should not be used as a basis for any diagnosis, monitoring, management or treatment of diseases or any other medical condition. It is intended solely for personal and informational use. It is not intended to and does not provide a means for users to self-diagnose any medical condition. Users of this chatbot who have any health concerns or medical problems should consult with a qualified and licensed doctor or other licensed medical professional. Novartis does not guarantee the security of any information stored in this application or in your device or transmitted from the application. You will need to read and accept the Terms and Conditions presented hereafter in order to access this application. This tool is published by Novartis Pharma AG. It is intended for the United Kingdom.

Please note:

This chatbot is controlled by Novartis Pharma AG and its affiliates (“Novartis”).

This chatbot is hosted on Facebook Messenger. Facebook controls the Messenger platform and processes data in accordance with its Data Policy.

When you use the chatbot, both Novartis and Facebook will process your personal information. Novartis and Facebook will process your personal information for different purposes and will not act as joint controllers.

Novartis will only process your personal information in accordance with this Chatbot Privacy Notice. Any use of your personal information by Facebook is outside of the scope this Chatbot Privacy Notice.

Personal information collected by Novartis

The personal information collected from you by the chatbot may include:

• A unique identifier given to each user of the chatbot
• A record of your interactions with the chatbot, including responses to questions from the chatbot, feedback ratings, manually inputted text (where applicable), and comments you have made in the chat
• Your first and last names according to your Facebook profile
• The email address you provided to the chatbot (where applicable)
• Your recorded information for the UAS7, UCT, DLQI symptom and disease impact trackers
• Your reminder preferences
• The topics in which you have expressed interest during the conversation with the chatbot
• Your Facebook profile image and a unique Facebook identifier code

Purpose and justification for collection by Novartis

Based on your consent, Novartis will use your personal information to provide the chatbot and the most relevant experience to you. For example, Novartis will remember your preferences to send you appropriate reminders, record your symptom tracker scores over time, and prompt you intermittently if you have chosen to be reminded. If you contact Novartis directly, your personal information will also be used to respond to your query.

Novartis may also use your personal information if you provide information that indicates an adverse event or a product complaint. If this happens, Novartis may be required to follow up with you, either through Facebook Messenger or another communication channel, such as email if provided. Novartis may be required to report this information to regulatory agencies. This information will only be accessed for the specific purpose of responding to, or otherwise resolving, an adverse event or product complaint. This use of your personal information is necessary for Novartis' compliance with pharmacovigilance laws and ensuring the quality and safety of medicines.

Novartis may also use your personal information if required to do so because of an applicable law, court order or governmental regulation, or if such use is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Anonymized information will be also used to perform analytics related to the use of the chatbot, continuously update and improve the chatbot functionalities, and provide a better service to users of the chatbot. Anonymized information will not identify you.

Personal information disclosure to third parties by Novartis

Your personal information will be processed by third parties who act for or on Novartis’ behalf, in accordance with the purposes described in this Chatbot Privacy Notice. These third parties may be located in countries or territories that may not offer the same level of data protection as the country in which you reside. Where the processing of your personal information is delegated to such a third party, Novartis will ensure that such third party provides sufficient guarantees with respect to the technical and organizational security measures governing the processing of your personal information.

Novartis has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection for sharing personal information within Novartis, in particular relating to transfers of personal information outside the EEA and Switzerland. For more information, visit https://www.novartis.com/privacy-policy/novartis-binding-corporate-rules-bcr.

Novartis will not share your personal information with anyone who is not directly connected with the purposes described in this Chatbot Privacy Notice.

Retention of personal information by Novartis

Your personal information will be deleted automatically if you are not active within the chatbot for 18 months.

There may be cases when your personal information or part of it may be stored for a longer time period if Novartis is required to do so because of an applicable law, court order or governmental regulation or if such retention is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Protection of your personal information by Novartis

Novartis has implemented appropriate technical and organizational measures to provide an adequate level of security and confidentiality to your personal information, taking into account the nature of the information and the risk of processing such information. The purpose of these measures is to protect your personal information against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.

Your rights and Novartis’ contact details

You may exercise the following rights under the conditions and within the limits set forth in the law:

• The right to access your personal information as processed by Novartis and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating
• The right to request the erasure of your personal information or the restriction thereof to specific categories of processing
• The right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal
• The right to object, in whole or in part, to the processing of your personal information
• The right to object to a channel of communication used for direct marketing purposes
• The right to request portability, i.e. that the personal information you have provided be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from Novartis and subject to your confidentiality obligations

If you have a question, if you are not satisfied with how Novartis processes your personal information, or if you want to exercise the above rights, you may send an email to [email protected]. When contacting Novartis, please add a description of your relationship and/or your interactions with us.

If you have a question about Facebook’s processing of your information, if you are not satisfied with how Facebook processes your personal information, or if you want to exercise the above rights with respect to Facebook, please contact the Facebook Data Protection Officer (details are available in the Facebook Data Policy).

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.