1. Guiding Principles

In the normal course of business, NS Pharma collects personal information that it uses to Help People Lead Healthier, Happier Lives. Below are principles that, at a high level, guide how NS Pharma conducts business ethically and in Compliance with the applicable laws, regulations and industry standards. Later sections of this document provide guidance for specific activities and direct parties to the appropriate resources for additional information.

1.1 Patient focused

It is the responsibility of Company Representatives to protect patient personal information. It is the responsibility of Company Representatives to appropriately use information he or she collects to advance patient outcomes.

1.2 Act ethically and socially responsible

It is the responsibility of Company Representatives to ensure that personal information is collected in an ethical manner. It is the responsibility of Company Representatives to avoid doing business with individuals or organizations where it is known that the individual or organization misuses or otherwise abuses personal information.

1.3 Respond timely and safely to challenges

It is the responsibility of Company Representatives to be proactive in identifying misappropriation of personal information. It is the responsibility of Company Representatives to safely dispose of any patient information that comes into his or her possession.

1.4 Fair and transparent dealing with HCP/HCOs, government officials, and other stakeholders.

It is the responsibility of Company Representatives to, when collecting data, clearly identify himself or herself as a representative of NS Pharma. It is the responsibility of Company Representatives to comply with all requests to delete Personal Information when feasible and executed in a legal manner.

2. Information Collection

2.1 Overview

A. In the normal course of business, NS Pharma collects or receives information from a range of sources. This information may be actively collected by NS Pharma or may be obtained inadvertently or in conjunction with other information.

2.2 How information is collected

A. NS Pharma collects certain information automatically when individuals visit the NS Pharma website or other online service. This information includes:

i. Internet Protocol (IP) address, which is a number automatically assigned to a computer by an Internet Service Provider. Most websites on the internet collect IP addresses as a standard practice. Collection of IP addresses allows a website to determine website usage levels. NS Pharma websites may collect this information by using cookies. Many internet security services and software packages prevent cookies from attaching to a computer’s hard drive, thus preventing data collection.

ii. Location Information may be collected from users who visit an NS Pharma website or use an NS Pharma technology application. This includes information from the IP address or that may be provided by the type of device an individual is using to access NS Pharma digital property.

B. NS Pharma collects information that individuals provide to the company directly or through a third party, such as a market research organization. This information includes, but may not be limited to:

i. Name, email address, street address, professional credentials, date of birth, and other personal information that an individual provides by uploading information to an NS Pharma website. This information may be uploaded in conjunction with an employment application, joining a Company sponsored competition, requesting additional information about products or services, or as part of an adverse event report.

ii. Information provided as part of a patient assistance program.

iii. Information collected during HCP, payer, patient, or other advisory board or consulting type activities.

iv. Details provided in correspondence with the Company about a product, concern or other topic.

3. Use of Information

3.1 Overview

A. Information collected by NS Pharma that is deidentified may be used for any purpose not prohibited under applicable law or Company policy. NS Pharma respects the contribution that such information can make to improving the Company’s operational efficiency and clinical outcomes and recognizes the sensitivity around using personal information, even after it is deidentified.

3.2 How Information is Used

A. In addition to using personal information for the specific purposes for which it was initially provided or collected, NS Pharma may use personal information for the following:

i. Deliver targeted sales and marketing information related to the services an individual requested or about which he or she inquired.

ii. Advise individuals as to other products or services offered by NS Pharma. Marketing activities can be via telephone, email, or other channel as permitted by law. Individuals have the right to opt out of their personal information being used for marketing activities.

iii. Develop and administer speaker programs. This includes activities related to verifying speaker credentials, training, scheduling, advertising speaker events, processing honoraria, and reimbursing expenses.

iv. Conduct research and development activities by aggregating an individual’s deidentified information and analyzing to improve distribution and product channels.

v. As otherwise required under applicable law and NS Pharma policy.

3.3 Data Retention

A. NS Pharma retains Personal Information described in this Policy for as long as necessary to satisfy the purpose for which it was originally collected or for which there is legitimate business, operational or clinical purpose. Data is retained pursuant to applicable law. Individuals may opt out of their Personal Information being collected by NS Pharma as described in Section 4.6 of this Policy.

B. It is the responsibility of the NS Pharma Representative receiving the information to retain it in an appropriate way that satisfies all applicable laws and NS Pharma policies. Additional guidance should be sought from Legal/Compliance as needed.

4. Children's Information

4.1 Policy

A. NS Pharma does not knowingly solicit or collect information from children under the age of 18 years of age without the consent of a parent or legal guardian.

B. NS Pharma Representatives receiving information from a patient advocacy organization or other external entity must ensure that any release authorizing NS Pharma to use information for a child under 18 years of age is signed by a parent or legal guardian.

5. Sharing of Information

5.1 Overview

A. To better serve patients, caregivers and the larger Healthcare Community, NS Pharma may share personal information. Information sharing is limited to third parties with whom NS Pharma has established relationships or as mandated by law.

5.2 How Information is Shared or Disclosed

A. Personal information may be shared with third parties that NS Pharma uses to administer and provide services on our behalf. These services include patient preauthorization, assisting in research and development activities, process management, etc.

B. NS Pharma may share personal information with professional service individuals or firms retained by the Company for routine or specific business purposes. These parties include, but are not limited to, legal counsel, auditing organizations and accountants.

C. Information posted by individuals to an NS Pharma social media account or other interactive media account managed by NS Pharma or an authorized third party, may be shared with NS Pharma, friends or connections of the posting entity, other parties active on the media site, or other parties exposed to the content. Information shared on many websites and social media accounts is subjected to the hosting company’s own privacy policies.

D. Personal information that NS Pharma obtains may be shared as part of business negotiations or transactions. Example of such sharing include information exchanged during asset valuation and due diligence associated with a proposed sale or divestiture.

E. NS Pharma will share information as required by law or court order. This includes adverse event reporting and complying with subpoenas or lawful requests for information from appropriate government health organizations.

6. Opt Out Option and Information Destruction

6.1 Overview

A. NS Pharma respects the choice of patients, stakeholders, or other parties to opt out of certain uses of their personal information.

6.2 Policy

A. At any time, an individual may limit or opt out of allowing NS Pharma to collect or use his or her data or Personal information by contacting the Company.

B. NS Pharma Representatives should include an opt out option on communication using or requesting personal information to the extent technically available. This opt out option may take the form of an “unsubscribe” button at the bottom of an email or a checkable box on a form as examples.

C. Individuals who opt out of NS Pharma collecting or using Personal Information may continue to receive notification regarding products or services they purchased, such as invoices or delivery status updates.

7. Other Matters

7.1 Annual Policy Review and Responsibility

A. NS Pharma Representatives from Legal, Compliance, and Information Technology will review and approve this Policy annually. If an Information Technology function has not been established, the individual that manages data security on behalf of NS Pharma should be included.

B. The Compliance department has primary and day-to-day responsibility for implementing this Policy and for monitoring its use and effectiveness and dealing with any queries on its interpretation. If a Compliance department has not been established, Legal has primary and day-to-day responsibility for implementing this Policy. Management at all levels are responsible for ensuring that those reporting to them are made aware of and understand this Policy and are given adequate and regular training on it.

7.2 Other Information

A. Unless otherwise noted, NS Pharma presumes that individuals providing information on behalf of other individuals are permitted to do so.

B. For further guidance on NS Pharma’s data and privacy practices and policies, please contact Legal and Compliance.