Scope of this Website Privacy Statement

Information We Collect and How We Use It

Through this website and depending on your interactions with Lilly, we may collect the following information about you:

• Name/Alias/Signature;
• Full Date of Birth;
• Identifiable Photograph/Video/Physical Characteristics or Descriptions;
• Gender;
• Business/Professional Contact Information (e.g., title, company name, business address, business email address, business phone/fax number);
• Personal Contact Information (e.g., personal address, personal email address, personal phone/fax, personal web/internet address, family member names);
• Online identifiers that correspond to your device(s) (e.g., personal IP [Internet Protocol] address, cookies, RFID, etc.);
• Employment/Professional Job or Qualifications Information;
• Health Information and any other data that could easily result in an inferred health status;
• Biographic Information;
• Protected Characteristics;
• Online/Electronic Resources Activity;
• Location Data;
• Financial and Government Identifying Numbers (e.g., Social Security number);
• Criminal/Conviction Records (e.g., on Federal Exclusion list);
• Biometric Identifiers;
• Website Utilization and Social Media Use;
• Education Information;
• Commercial Information (e.g., purchasing, consuming history or tendencies);
• Inferences Reflecting Preferences

We collect PI from a number of sources, including:

• Employees, potential employees and their family members;
• Patients and clinical/medical trial participants;
• Clinical/medical investigators and staff conducting clinical/medical research;
• Health care professionals;
• Adverse event reporters and subjects;
• Consumers;
• Customers;
• Investors and shareholders;
• Vendors, suppliers, and contractors
• Business partners;
• Government officials

We process/use PI for the following business or commercial purposes:

• Activity for public health and interest;
• Activities as an employer to support and fulfill our obligations to our employees;
• Research and development of our products;
• Compliance with legal or regulatory obligations (e.g., adverse event reporting, exercising or defending legal claims, financial disclosure reporting);
• Business and market research;
• Market research for our products and services;
• Study recruitment;
• Marketing and sales of our products;
• Communicating information about our products, responding to requests and registration for services;
• Providing patient assistance;
• Finance and tax activities;
• Statistical analytics;
• Event management;
• Contracting and business planning activities; and
• Administration of other legal and business processes that are in Lilly’s legitimate interest, inclusive of company record retention, safeguarding our physical and electronic workplace, and website management.

Lilly may share your PI with:

• Lilly employees and affiliates;
• Health care professionals;
• Vendors, suppliers and contractors;
• Business partners; and
• Government officials (e.g., law enforcement authorities, the courts, regulatory authorities).

Summary: This website may collect Personal Information that either directly identifies you or could be used in combination with other information to identify you. Examples of Personal Information that directly identify you include your name, contact information, email address, and other information in combination with identifiers. Our websites may also collect Personal Information that does not directly identify you by name or contact information but which may be used to identify that a specific computer or device has accessed our website.

• Contact information: This might include information such as your name, address, telephone number, e-mail address, and other similar information ("Personal Information"). We collect this information so that we can communicate with you. You may always refuse to provide Personal Information to us, but then we may not be able to provide you with certain information, products, or services.
• Additional Information: Certain areas of our websites allow you to share additional Personal Information with us. For example, you may subscribe to one of our mailing lists or newsletters. We may use the information you provide to send your requested information, respond to your inquiry, improve our websites, verify your relationship with us, and take other actions that may be necessary to respond to your request. We may also collect online identifiers that correspond to your device(s) that do not directly identify you in order to improve, manage and secure our websites, network systems and other assets; understand your interests and preferences.
• Interests and preferences: This information lets us better understand how to best serve you based on your interest in our products and services. This information may include your preferences about how to contact you, further develop a business or professional relationship, understand product preferences, languages, marketing preferences and some demographic data. Some of this information we collect with your consent and some of this information we collect automatically for our legitimate business purposes.
• Website Usage: We use this information to manage and secure our websites, network systems and other assets. This may include information about your IP ("Internet Protocol") address, the date and time of your website session, geographic location, and how you have navigated the website, and other information collected through our weblogs, web beacons, cookies, third-party and digital advertising, Google Analytics^®, social media plug-ins, or in other ways. This may also include information that does not directly identify you but which corresponds to your device. It is possible that your IP Address, or a cookie that we use, may contain information that may be considered Personal Information. How we use Cookies and other technologies is described in more detail below. This information is collected automatically, for our legitimate business purposes.

We may also use the information to meet legal or regulatory obligations, such as adverse event reporting or to enforce our rights; and for company record retention, website management, research and product development that are in the legitimate interest of Lilly.

Where permitted by law, we may also enhance or merge information about you, including Personal Information, with information about you obtained from third parties for the same purposes shared above. Your information may also be used for profiling for the same purposes shared above. You may object to profiling via automated decision-making by contacting us using the information in the "How to Contact Us" section below.

If you are a caregiver or a Healthcare Professional, Lilly recommends that you inform patients when you report an adverse event/Product Complaint relating to them.

We do not sell PI.

Cookies and Similar Technologies

Web beacons

This site may use a technology known as web beacons that allows the collection of web log information. A web beacon is a tiny graphic on a web page or in an e-mail message designed to track pages viewed or messages opened. Web log information is gathered when you visit one of our websites by the computer that hosts our website (called a "webserver").

On certain web pages or in e-mails we send to you, we may utilize a technology called a "web beacon" (also known as an "action tag" or "clear GIF technology"). We may use web beacons to help determine which e-mail messages sent by us were opened and whether a message was acted upon. Web beacons also help analyze the effectiveness of websites by measuring the number of visitors to a site or how many visitors clicked on key elements of a site.

Cookies

This website may use a technology called a "cookie". A cookie is a small data file that a website can place on your computer's hard drive, where your internet browser files are kept. A cookie saves you the trouble of reentering certain information in some registration areas because cookies can be used to enable a site to "remember" information a visitor has previously inputted. A cookie also helps deliver specific information to you and tracks how sections of the website are used. Cookies can be placed on your computer both by us and by third parties with whom we have a relationship, such as web analytic services and advertising network services. With most Internet browsers or other software, you can change your browser settings to erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored. Please check your browser instructions to learn more about these functions. If you reject cookies, functionality of the site may be limited, and you may not be able to take advantage of many of the site's features.

Do Not Track

There are different ways you can prevent tracking of your online activity. One of them is setting a preference in your browser that alerts websites you visit that you do not want them to collect certain information about you. This is referred to as a Do-Not-Track (DNT) signal. Please note that currently our websites and web-based resources do not respond to these signals from web browsers. At this time, there is no universally accepted standard for what a company should do when a DNT signal is detected.

Choices about Cookies

If you would like to opt-out of, or manage, cookies used for targeted advertising, you may do so by following the options provided by the Network Advertising Initiative and the Digital Advertising Alliance. Ads displayed to you using this technology will usually have an AdChoices logo in the corner, which you can also click on to begin the same opt-out process. Additionally, if you receive ads on a social media site, you can check that site’s privacy statement and terms of use to determine how to stop seeing such ads.

The European Interactive Digital Advertising Alliance (EIDAA) keeps a website where people can opt out of receiving interest-based advertising from some or all of the network advertising companies participating in the program. You can find information about the EIDAA here: www.youronlinechoices.eu.

Reasons Your Information is Shared

We may share your Personal Information with our agents, contractors, partners or third parties in connection with work that they do for, or with, Lilly, such as sending email messages, managing data, hosting our databases, providing data processing services, providing customer service, or so we may enhance or add data about you from these other entities. These agents, contractors, partners or third parties are restricted from using this data in any way other than to provide services for us, or services for the collaboration in which they are engaged with us (for example, some of our products are developed and marketed through joint agreements with other companies). These third parties must agree to protect the PI and to use it only as directed by Lilly.

We will share Personal Information to respond to subpoenas or other lawful information requests of governmental authorities, including to meet national security or law enforcement requirements, to provide Internet security, or where required by law. In exceptionally rare circumstances where national, state or company security is at issue, we reserve the right to share our entire database of visitors and customers with appropriate governmental authorities.

We may also provide your Personal Information to a third party in connection with the sale, assignment, or other transfer of the business of a website to which the information relates, in which case we will require any such buyer to agree to treat Personal Information in accordance with this Privacy Statement.

Google Analytics

Google Analytics may be used to help make our website work better and to help us understand what parts of the website are being utilized. Google Analytics uses technical tools such as first-party cookies and JavaScript code to collect information about visitors. Google Analytics service tracks visitors to the site who have JavaScript enabled. Google Analytics anonymously tracks how visitors interact with a website, including where they came from and what they did on a site. Google Analytics collects the information set forth above from users.

This information is used to administer and update the website, and we will also assess whether the visitors to the site match the expected site demographics and determine how key audiences are navigating the content.

First-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick cookie) will be used to report how your ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to visits to this site.

A. Opt-Out Provision:

Google analytics offers an opt-out provision for website visitors who do not want their data to be collected. You can receive more information about this option here: http://tools.google.com/dlpage/gaoptout.

B. Google's Use of Data:

Google and its wholly owned subsidiaries may retain and use, subject to the terms of its Privacy Policy (located at http://www.google.com/privacy.html, or such other URL as Google may provide from time to time), information collected in your use of the Google Analytics Information Disclosures and Sharing.

Social Media Plugins

Our websites may use Social Media Plugins to enable you to easily share information with others. When you visit our websites, the operator of the social media plugin that is on our website can place a cookie on your computer that lets that operator recognize individuals on their website who have previously visited our sites. If you have previously logged in to the social media website while browsing on our website, social media plugins may allow that social media website to receive directly identifiable information about you that shows you have visited our website. The social media plugin may collect this information for visitors who have logged in to social networks, whether or not they specifically interact with the plugin on our website. Social media plugins also allow the social media website to share information about your activities on our website with other users of their social media website. Lilly does not control any of the content from social media plugins. For more information about social media plugins from social media websites, refer to those sites’ privacy and data sharing statements.

How Long We Keep Your Information

Your Information will be saved for a period of time needed to fulfill legitimate and lawful business purposes in accordance with our records retention policies and applicable laws and regulations.

Children's Information

This site is not intended for or designed for individuals under the age of 18. We do not knowingly collect Personal Information from any person under the age of 18, unless a parent or guardian provides consent.

California Privacy Rights
California Civil Code Section 1798.83 entitles California residents who have an established business relationship with Lilly the right to request information regarding Lilly’s disclosure of certain PI to Third Parties for their direct marketing purposes. To make a request for such information, you may contact us using the information in the “How to Contact Us” section below.

California Consumer Privacy Act (CCPA) entitles California residents to certain rights with regard to their PI. Those rights have been incorporated into this Privacy Statement.

How We Secure Your Information

We provide reasonable physical, electronic, and procedural safeguards to protect Personal Information collected via this website. For example, we limit access to this information to authorized employees, service providers, and contractors who need access to perform the activities described in this notice. Although we strive to provide reasonable security for information we process and maintain, no security system can prevent all potential security breaches.

Your Rights and Choices

Upon verification of your identity, and as applicable by law, you have the right to request:

• information from us on how your PI is being processed, and with whom it is being shared
• information about our process to verify your identity can be found here
• to see and get a copy of the PI that we have about you
• that we correct, restrict the processing of, and/or erase/delete your PI
• to have your information transmitted to another entity or person in a machine-readable format, in limited circumstances
• in France, set expectations for the handling of your PI after your death

There may be limitations on our ability to comply with your request.

To exercise your rights, you or your authorized representative may submit a request to datarights@lilly.com or 1-800-Lilly-Rx (1-800-545-5979).

You can find information regarding our responses to U.S. requests regarding personal information here. Instructions on appointing authorized representative to submit U.S. requests for personal information on your behalf can be found here.

You will not be discriminated against for exercising any of your rights.

How to Contact Us

You may make any of the above requests by contacting us at:

Eli Lilly and Company
P.O. Box 6245
Indianapolis, IN 46206-6245
1-800-Lilly-Rx (1-800-545-5979)
privacy@lilly.com

You may also contact us at the above if you have questions about this Privacy Statement.

For more information about Lilly’s privacy practice, please view the Privacy Statement at https://www.lilly.com/privacy.

How to Submit a Complaint

If you wish to raise a complaint on how we have handled your personal information, you can contact our Global Privacy Office and Data Protection Officer at privacy@lilly.com who will investigate the matter.

If you are not satisfied with our response or believe we are processing your personal information not in accordance with the law, you can register a complaint with a relevant authority (e.g. a Data Protection Authority [DPA] or Attorney General)

Where We Transfer and Work With PI

This website is owned and operated by Lilly in the United States. However, any information collected on this website may be transferred to other Lilly affiliates and third parties worldwide. These affiliates and third parties may in turn transmit PI to other Lilly affiliates and third parties. Some of Lilly’s affiliates and third parties may be located in countries that do not ensure an adequate level of data protection as the country you reside in. When transferring PI across country borders, Lilly and its affiliates utilize appropriate transfer mechanisms as applicable (which may include consent, Standard Contractual Clauses, existing adequacy decisions, etc.). Nevertheless, all of Lilly’s affiliates are required to treat PI in a manner consistent with this notice, and Lilly’s internal global privacy policies. By using this website, you consent to the collection, storage, and processing of your PI in the United States and in any country to which we may transfer your information in the course of our business operations. To obtain additional information regarding the basis for transfers and safeguards that Lilly has in place for cross-border transfers of Personal Information, please contact us at privacy@lilly.com or visit https://www.lilly.com/privacy.

Links to Third Party Websites

As a convenience to our visitors, this website may contain links to other sites owned and operated by third parties that we believe may offer useful information. The policies and procedures we describe here do not apply to those sites. We are not responsible for the collection or use of Personal Information at any third party sites. Therefore, we disclaim any liability for any third party's use of Personal Information obtained through using the third party website. We suggest contacting those sites directly for information on their privacy, security, data collection, and distribution policies.

Changes to Our Privacy Practices

We may update this Privacy Statement from time to time. When we do update it, for your convenience, we will make the updated statement available on this page. We will always handle your Personal Information in accordance with the Privacy Statement in effect at the time it was collected. We will not make any materially different use or new disclosure of your Personal Information to another entity using your Personal Information for its own purposes unless we notify you and/or obtain your consent and give you an opportunity to object.

Last Updated: September 2020