This information is meant to explain to you what kind of personal data we collect from what sources and are used for which purposes.

Identity and contact details of the data controller

Affiliates in the following countries Australia, Bangladesh, Hong Kong, India, Indonesia, Malaysia, Myanmar, New Zealand, Philippines, Taiwan, Thailand, Vietnam ("Roche") are the data controllers.

In the event that your personal data is covered by the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"): EU representative of F. Hoffmann-La Roche Ltd is Roche Privacy GmbH, Emil-Barell-Str. 1, D-79639 Grenzach-Wyhlen, [email protected].

In the event that your data is covered by the UK GDPR: the UK representative is Roche Products Limited, 6 Falcon Way, Shire Park, Welwyn Garden City, Hertfordshire AL7 1TW, United Kingdom.

In the event that your personal data is covered by the China Personal Information Protection Law (PIPL): Shanghai Roche Pharmaceuticals Co., Ltd., No. 1100 Longdong Avenue, Pudong District, Shanghai, email: [email protected]

Data subject categories:

This privacy notice applies to the processing of personal data in the context and for the purposes described below and in particular to the following data subject categories:

• Qualified Healthcare Professionals ("HCP") for FAREAL case bank platform

Purposes and legal basis for processing

We collect your personal data in order to provide services, to personalize your experience and to evaluate the effectiveness of education related to FAREAL case bank.

If and to the extent the data processing is subject to GDPR, we collect and process your data on the basis of consent.

Categories of personal data processed

We collect the following categories of personal data:
name, contact details, affiliations, IP address (for consent agreement and disclaimer agreement)

Recipients of personal data and international data transfers

Recipients of your data may be Roche's affiliates around the world including in countries with privacy standards different from those in your country. Our Roche affiliates will use the data for the same purposes as we do. A list of Roche's affiliates is available in the current financial report which can be found in the Investors section of www.roche.com.

The personal data that we collect and process may be transferred to and stored in geographic regions in which data protection regulations differ from those in your own country. All such data transfers will be made in compliance with applicable law.

For the transfer of personal data, we rely on the adequacy decision or we ensure the personal data is protected through appropriate contracts, in particular the so-called standard contractual clauses of June 4, 2021 (EU 2021/914) of the European Commission, the United Kingdom supervisory authority and the Swiss supervisory authority.

Storage period

The FAREAL project is expected to be conducted from 2025 to 2030. We store your personal data for 1 year after the project ends.

Information about your rights

In accordance with GDPR and UK GDPR, please note that you have the right to request from Roche access to and rectification of your personal data as well as the right to data portability, if applicable, or erasure or restriction of processing of your personal data. Erasure or restriction of processing is only possible if and to the extent the processing of personal data is based on consent or legitimate interest. If data processing is based on consent, kindly note that you have the right to withdraw your consent at any time, however, without affecting the lawfulness of processing based on consent before its withdrawal.

In accordance with the Swiss Federal Act on Data Protection, please note that you have the right to request from Roche access to your personal data, a copy of your personal data, to rectify your personal data or to have Roche register a note dispute. Additionally, you have the right to erasure or anonymisation of your personal data if it is no longer needed for the purpose for which you provided it, and the right to restrict the processing of your personal data to specific purposes if erasure is not possible. If the processing of your personal data is based on your consent kindly note that you have the right to withdraw consent at any time. However, the withdrawal is only valid for the future and we reserve the right to continue to process personal data in the event of a withdrawal, based on a different basis.

In accordance with the Chinese PIPL you have the right to know what personal data Roche collects about you, the right to request from Roche access to and rectification of your personal data as well as the right to data portability, if applicable, or erasure or restriction of processing of your personal data. In case of consent, you also have the right to withdraw your consent at any time, however, without affecting the lawfulness of processing based on consent before its withdrawal.

For sending us a note to exercise your privacy rights, including withdrawal of consent, please see contact details in the section "Identity and contact details of the data controller" above.

In the event you have the impression that our data processing is non-compliant with applicable privacy laws: You are entitled to lodge a complaint with the responsible supervisory authority.