Avexima Open Joint Stock Company

(Avexima, OJSC)

31A/1, Leningradsky av. 125284 Moscow city, Russia

tel.: 8 (495) 258-45-28

INN (Taxpayer identification number): 7714856826, KPP (Registration reason code): 771401001, OGRN (Principal State Registration Number): 1117746923909, OKPO (Russian National Classification of Businesses and Organizations): 37238334, OKVED (Number under Russian Standard Industrial Classification of Economic Activities): 85.11

PRIVACY POLICY

regarding personal data processing

1. General provisions

1.1 The purpose of this policy of Avexima OJSC (hereinafter referred to as Company) regarding personal data processing (hereinafter referred to as PD) is establishment of basic principles and conditions of PD processing, the rights and responsibilities of PD subjects and the Company when processing PD, as well as the requirements and actions for PD protection implemented in the Company, protection of legal rights and interests of PD subjects.

This Policy applies as well in respect of the User PD that www.avexima.ru website can obtain when the User views or uses the website. In particular, but not as a limitation thereof, when the User sends his/her feedback and questions, takes part in advertising and marketing campaigns or actions and/or reports adverse drug reactions or other interactions as a result of drug product use.

When filling in the feedback form on the website and pressing "I agree" button, I give Avexima OJSC my consent for processing my personal data under the conditions set out in this Policy. When filling in the document forms on www.avexima.ru website, the personal data subject gives Avexima OJSC ( 125284 Moscow, 31A/1, Leningradsky avenue) his/her consent for processing his/her PD including those specified in "Adverse event report" form.

By giving such consent PD subject confirms that he/she acts of his/her own free will, volition and in his/her interests. PD received via www.avexima.ru website are processed to perform pharmacovigilance functions entrusted to Avexima OJSC pursuant to p. 4 of art. 64 of the Federal Law of April 12, 2010 N 61-FZ "On Circulation of Medicines" and Company statutory activities. The above-mentioned PD are also processed for other purposes provided by this Policy as well as for possible further contact with PD subjects and provision of necessary information. The PD are valid during the period of personal data storage in Avexima OJSC established by this Policy and can be withdrawn by PD subject.

Applicant's personal data are processed in strict accordance with the current Policy of Avexima OJSC. User's consent for provision, processing and transmission of his/her personal data by Avexima OJSC in accordance with this Policy is full and unconditional.

Website visitors should refrain from completion of the form and/or use of other services of the website if they disagree (in full or partially) with the Policy and if they refuse to provide personal data.

1.2. The consent given by the user includes the consent for collection, systematization, accumulation, storage, refinement (update, modification), use, blocking, depersonalization and destruction of personal data. The user also gives his/her consent for transmission of personal data within the Company (or to the service provider obliged to abide by personal data protection agreement) for distribution of information materials or for promotional purposes, cross-border transfer (if any).

1.3. The consent given by the user covers the following personal data: surname, first name, patronymic, e-mail address, postal address for order delivery, contact phone number, bank details.

1.4 General definitions used in this policy:

1.4.1 personal data means any information related directly or indirectly to a certain private person (subject of personal data). The information constituting personal data for the purposes of this Policy is also any personal information provided by the User via www.avexima.ru and/or collected using this website that allows identifying the subject of personal data or may be used for this purpose.

This Policy is applied to all avexima.ru website users which operator is the Company (hereinafter referred to as the Company). Users also include all the persons who connect and use this website entering their personal data.

1.4.2 personal data processing means any action (operation) or a number of actions (operations) performed with or without automation tools, including collection, recording, systematization, accumulation, storage, refinement (update, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data.

1.4.3 operator is a legal entity arranging and (or) processing personal data without assistance or together with other entities, as well determining the purposes of personal data processing, content of personal data subject to processing, actions (operations) performed with personal data;

1.4.4 automatic personal data processing means personal data processing using computer equipment;

1.4.5 personal data provision means actions aimed at disclosure of personal data to a particular person or particular number of persons;

1.4.6 distribution of personal data means actions aimed at disclosure of personal data to general public;

1.4.7 personal data blocking means interruption of personal data processing (except where processing is required for rectification of personal data);

1.4.8 depersonalization of personal data means actions resulting in impossibility to determine ownership of personal data to a specific personal data subject without additional information;

1.4.9 cross-border transfer of personal data means transfer of personal data to the territory of foreign country to the authority of foreign country, to foreign private entity or foreign legal entity.

1.4.10 destruction of personal data means actions resulting in impossibility to restore the content of personal data in the personal data information system and (or) resulting in destruction of all material media bearing the personal data;

1.4.11 personal data information system means pooled personal data contained in the databases and providing its processing by information technologies and technical means;

1.4.12 "Website Administrators" means the employees authorized by the Company to manage the website who also organize and (or) process personal data, as well as determine the purposes of personal data processing, the composition of personal data subject to processing, actions (operations) performed with personal data. In the context of this Policy these provisions are applied also to the definition of "website administrators" when mentioned in the text about Company rights and responsibilities;

1.4.13 "Website User" (hereinafter referred to as the User)" is a person who has access to the Website via the Internet and uses the Website;

1.4.14 "Cookies" is a small piece of data sent by a web server and stored on a user's computer that the web client or web browser sends to the web server in an HTTP request each time a page of the corresponding website is opened;

1.4.15. "IP address" is a unique network address of a node in a computer network built using the Internet Protocol.

1.5 This Policy covers all the operations performed in the Company with PD using the automation aids including via information and telecommunication network of the Internet, or without it.

1.6 This Policy is drawn up in accordance with the requirements of the Federal Law of the Russian Federation of July 27, 2006 No. 152-FZ "On Personal Data" (hereinafter - FZ-152).

1.7 The Company is a PD Operator. A key term to implement the mission of the Company is to ensure protection of rights and freedoms of RD subject during processing of his/her RD.

Operator does not check authenticity of personal data provided by users and has no opportunity to evaluate its relevance. However, Operator believes that the users provide reliable and sufficient personal data and keep this information updated.

Operator takes necessary legal, organizational and technical actions to provide safety and confidentiality of personal data in accordance with the requirements of international contracts, the legislation of the Russian Federation and substatutory regulatory legal acts in the field of personal data processing and protection.

Providing personal data to the Company including via www.avexima.ru website, personal data subject agrees with processing of his/her personal data and accepts the conditions of its processing. Processing means any operation with personal data irrespective of the means and procedures used, in particular, but not limited to recording, collection, systematization, accumulation, storage, refinement (update, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data. In case of disagreement with the terms and conditions of this Policy, website User should stop using the Website.

The Operator does not control and is not responsible for any third-party websites where the website User may be redirected using the links available on the Website.

The Website Administrators do not verify the authenticity of the personal data provided by the User to the Website.

1.8 Basic rights of PD subject:

1.8.1 to agree or not to agree with his/her PD processing;

1.8.2 to withdraw consent for his/her PD processing;

1.8.3 to demand refinement, blocking or destruction of his/her PD from the Company;

1.8.4 to obtain the information concerning his/her PD processing;

1.8.5 to complain against acts or omissions of the Company;

1.9. Basic responsibilities of PD subject:

1.9.1 to provide information about the Personal Data required to use the Website,

1.9.2 to update and supplement the provided Personal Data in case of any data modifications.

1.10 Basic rights of the Company:

1.10.1 to obtain PD from PD subjects and from the third parties (persons other than PD subjects);

1.10.2 to check completeness and accuracy of PD provided;

1.10.3 to process PD in cases provided by art. 6 of FZ-152;

1.10.4 to continue PD processing without PD subject consent in case of any grounds specified in FZ-152.

1.11 Basic responsibilities of the Company:

1.11.1 to maintain PD confidentiality;

1.11.2 to take actions necessary and sufficient to ensure compliance with the responsibilities provided by FZ-152;

1.11.3 to stop PD processing upon PD subject request in cases provided by FZ-152;

1.11.4 to provide information about subject PD processing upon his/her request;

1.11.5 in case of automatic PD processing to use the databases located in the territory of the Russian Federation.

1.12 The Company processes PD of the following PD subject categories:

1.12.1 Potential employees.

- decision about hiring or refusal to hire;

- creation of external candidates pool.

1.12.2 The employees who are or were in an employment relationship with the Company and their relatives.

- execution and fulfilment of obligations under employment and civil law contracts;

- keeping HR records and personnel records;

- creation of internal candidates pool;

- meeting the requirements of tax legislation in connection with calculation and payment of the personal income tax, as well as unified social tax;

- execution of pension legislation when generating and providing personalized data about every recipient of income taking into account during accrual of insurance contributions for compulsory pension insurance and benefits;

- filling in primary statistical documents;

1.12.3 Representatives of suppliers, partners, potential and existing customers of the Company:

- business negotiations to enter into contracts and agreements;

- entering into contracts and agreements;

- acquisition of intellectual property rights;

- joint implementation of projects in the field of production and circulation of drug products.

1.12.4 Subjects of circulation of drug products:

- entering into contracts and agreements;

- development and market registrations of drug product;

- research activities in the field of pharmaceutical industry;

- interaction with drug product manufacturers;

- activities in the field of pharmacovigilance.

1.12.5 Visitors of www.avexima.ru website,

- user opinion polls,

- improvement of website content, website adaptation to user preferences,

- consideration of candidate's appeal for workplaces,

- consideration of side effect reports during administration of drug products, adverse event reports.

Terms of personal data processing are determined in accordance with the purposes for which it was collected.

2. Purposes of collection and processing of personal data:

2.1.1 Collection purposes:

- assistance in employment, training and promotion, use of privileges;

- assistance in provision of services of additional medical insurance to the employees, work mobile communication, preparation of travel tickets, granting a power of attorney;

- maintenance of accounting records;

- establishment of business contacts with the representatives of suppliers, partners, potential and existing customers of the Company;

- entering into the contracts with contractual partners and performance of contractual obligations;

- interaction with suppliers, partners, potential and existing customers of the Company;

- marketing support of Company product promotion;

- identification of the User registered on the Website for ordering and (or) entering into Purchase Contract or remote rendering of services, obtainment of adverse event reports during administration of drug products or for other purposes;

- providing the User with access to personalized resources of the Website;

- coupling back, including sending notifications and inquiries to the User regarding the use of the Website, service rendering, processing the User's requests and applications;

- determining the User's location for security and fraud prevention;

- confirmation of authenticity and completeness of the Personal Data provided by the User;

- creating a user account for making purchases or ordering services provided that the User has agreed to it;

- Website user notification;

- providing the Customer with effective client and technical support, in case of problems related to the use of the Website;

- providing the User (upon his/her consent) with product or service updates, special offers, information on prices, newsletters and other information on behalf of the Website and/or the Website partners.

- implementation of advertising activities upon the User's consent;

- granting access to the User to websites or services of the partners of the Website in order to obtain products, updates and services.

2.1.2. Processing purposes:

- monitoring of effectiveness and safety of drug products;

- provision of access control in the physical location of the Company;

- preparation of responses to the messages received by the Company;

- protection of human and civil rights and freedoms during processing of his/her personal data including protection of rights to personal and family privacy;

- promotion of goods, works, services of the Operator on the pharmaceutical market by direct contacts with potential consumer, drug product circulation subjects and other individuals using communication means;

- obtainment of reliable data about potential employees.

3. Legal grounds for personal data processing

3.1 Art. 86-90 of the Labor Code of the Russian Federation;

3.2 The Tax Code of the Russian Federation;

3.3 The Civil Code of the Russian Federation;

3.4 The Federal Law of July 24, 2009 No. 212-FZ "On insurance fees in the Pension fund of the Russian Federation, Social Insurance Fund of the Russian Federation, Federal fund of compulsory medical insurance";

3.5. The Federal Law of October 22, 2004 No. 125-FZ "On archiving in the Russian Federation";

3.6 The Decree of the Ministry of Labour and Social Protection of the Russian Federation No.73 "On approval of forms of documents required for investigation and accounting of industrial accidents and provisions about particularities of investigation of industrial accidents in individual industries and organizations";

3.7. Art. 29 of the Federal Law of December 06, 2011 No. 402-FZ "On Accounting";

3.8 Federal Law No. 61-FZ of 12.04.2010 "On drug circulation";

3.9. Decree of the Government of the Russian Federation of 15.09.2008 No. 687 "On approval of the Regulations on features of the personal data processing performed without use of the automation equipment";

3.10. Decree of the Government of the Russian Federation of 01.11.2012, No. 1119 “On approval of requirements for the protection of personal data when they are processed in personal data information systems"

3.11. Order of the Federal Service for Surveillance in Healthcare No. 1071 of 15.02.2017;

3.12 Decision of the Council of the Eurasian Economic Commission of 03.11.2016 No. 87 "On approval of Rules of Good Pharmacovigilance Practice of the Eurasian Economic Union";

3.13 Company Statute;

3.14 Contracts that are entered into between the Company and suppliers, partners, customers;

3.15 Provisions about Company access control;

3.16 PD subject consent;

3.17 PD subject applications;

4. Volume and categories of the personal data being processed, categories of personal data subjects

4.1 Potential employees:

4.1.1 Full name,

4.1.2 date of birth,

4.1.3 residence address,

4.1.4 data about education,

4.1.5 data about work experience,

4.1.6 data about previous places of work,

4.2 The employees who are or were in an employment relationship with the Company and their relatives:

4.2.1 Full name,

4.2.2 date of birth,

4.2.3 registration address,

4.2.4 residence address,

4.2.5 data about education;

4.2.6 data about work experience,

4.2.7 data about previous places of work,

4.2.8 position, division,

4.2.9 data about family members and caring responsibilities,

4.2.10 data about military service obligation,

4.2.11 data about hiring, transfer, discharge, appointments, other events associated with work activities,

4.2.12 INN,

4.2.13 SNILS (personal insurance policy number),

4.2.14 Full names of relatives,

4.2.14 e-mail;

4.2.15 data about salary.

4.3 Representatives of suppliers, partners, potential and existing customers of the Company:

4.3.1 Full name,

4.3.2 position, division,

4.3.3 location address,

4.3.4 phone number,

4.3.5 e-mail.

4.4 Subjects of circulation of drug products:

4.4.1 Full name;

4.4.2 e-mail;

4.4.3 phone number;

4.4.4 position;

4.4.5 place of work.

4.5 Persons visiting the premises the Company:

4.5.1 Full name,

4.5.2 Identity document details,

4.6 Persons appealing to the Company including via www.avexima.ru website:

4.6.1 surname, first name, patronymic of User (User representative);

4.6.2 contact phone number of User (User representative);

4.6.3 e-mail address;

4.6.4 Position and place of employment;

4.6.5 Data about pregnancy, gestational age (if required, after obtainment of written consent of PD subject);

4.6.6 Age (if required);

4.6.7 Sex (if required);

4.6.8 Weight (if required, after obtainment of written consent of PD subject);

4.6.9 Data about presence of allergic reaction (if required, after obtainment of written consent of PD subject);

4.6.10. Delivery address of the Goods or place of Service rendering (if required);

4.6.11. User place of residence (if required).

4.6.12 The Website protects the Data automatically transmitted at the time of viewing ad units and visiting pages where the statistical script of the system ("pixel") is installed:

IP-address;

information from cookies;

information about browser (or other program providing access to advertisement view);

Disabling cookies may result in impossibility to access parts of the Website requiring authorization.

The Website collects statistical data about IP addresses of its visitors. This information is used to reveal and solve technical problems.

4.7 Total volume of PD being processed on all PD subject categories: less than 200,000 persons

4.8 Processing of special categories is not carried out.

4.9 Processing of biometrical PD is not carried out.

5. Procedure and conditions of personal data processing:

5.1 Actions performed with PD by the Company: collection, recording, systematization, accumulation, storage, refinement (update, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data.

5.2 Processing procedures of PD by the Company: by means of combined (automatic, non-automatic) processing (in paper form, in electronic format and in ISPD) with transfer via internal network of the legal entity, with transfer on the Internet public network.

5.3 PD processing terms are determined taking into account:

5.3.1 set PD processing purposes;

5.3.2 validity terms of contracts with PD subjects and consents of PD subjects for their PD processing;

5.3.3 terms determined by:

- The Federal Law of October 22, 2004 No. 125-FZ "On archiving in the Russian Federation";

- The Order of the Ministry of Culture of the Russian Federation of 25.08.2010 No. 558 "On the Approval of the List of Standard Administrative Archive Documents Generated in the Course of Activities of Government Agencies, Local Government Bodies and Organizations, and their Storage Periods";

- The Order of the Ministry of Culture of the Russian Federation of 31.07.2007 No. 1182 "On the Approval of the List of Standard Administrative Archive Documents Generated in Scientific and Engineering and Production Activities of the Organizations and their Storage Periods";

5.4 The Company does not disclose to the third parties and does not disseminate PD without PD subject consent (unless otherwise stipulated by the legislation of the Russian Federation). Regarding user personal data, it is kept confidential except for the cases of personal data processing, general public access to which is provided by the user or upon his/her request. The Company has the right to give user personal information to the third parties in the following cases:

- user provided his/her consent to such actions.

- transfer is required to reach the goals, to perform and execute functions, authorities and obligations assigned by the legislation of the Russian Federation to the Company.

5.5 The Company does not assign PD processing to the other entity unless otherwise stipulated by PD subject consent or agreement the party, the beneficiary or the pledger thereof is PD subject.

5.6 The company does not perform cross-border transfer.

5.7 The Company transfers PD being processed to government agencies based on and pursuant to current law.

5.8 The Company performs PD processing on legal and equitable basis.

5.9 No decisions resulting in legal consequences regarding PD subject or otherwise involving his/her rights and legal interests are made on the basis of only automatic PD processing in the Company.

5.10 The Company takes actions to protect personal data to ensure performance of obligations provided by FZ-152 and regulatory legal acts accepted in accordance with it, including:

5.10.1 a person responsible for PD processing arrangement is appointed;

5.10.2 current policy and local acts concerning processing and safety of PD were issued, as well as local acts establishing the procedures aimed at prevention and detection of violations of the legislation of the Russian Federation, damage control of such violations;

5.10.3 legal, organizational and technical actions are taken to ensure PD safety;

5.10.4 internal control of PD processing compliance with the requirements of FZ-152 and regulatory legal acts accepted in accordance with it, this Policy, local Company acts;

5.10.5 the damage which can be caused to PD subjects in case of violation of requirements of the federal legislation on PD is evaluated, the ratio of the specified damage and the actions taken by the Company is analyzed;

5.10.6 Company employees directly engaged in PD processing have read and understood the provisions of the legislation of the Russian Federation on PD, local Company acts regarding PD processing issues.

5.11. The requirements to PD protection are implemented in the Company, including:

5.11.1 information protection means which passed the procedure of compliance evaluation in accordance with the established procedure are applied;

5.11.2 PD carrier use and functioning control is kept;

5.11.3 detection of facts of unauthorized access to PD is performed;

5.11.4 possibility of restoration of modified and destructed PD is provided;

5.11.5 access control arrangements are in places where PD is processed;

5.11.6 control is kept over the actions taken to provide PD safety;

5.11.7 the requirements established by the Decree of the Government of the Russian Federation of 15.09.2008 No. 687 "On approval of the Regulations on features of the personal data processing performed without use of the automation equipment" are implemented.

5.11.8 PD are protected within the control (management) system of data security, including: firewalls, electronic signature - during transfer of personal data using the Internet).

5.12 The Company stops PD processing in the following cases:

5.12.1 in the event of termination of PD processing conditions or after termination of the established terms;

5.12.2 when reaching purposes of its processing or in case when it is not necessary to reach these goals;

5.12.3 upon request of PD subject, if PD being processed in the Company is incomplete, out-dated, incorrect, illegally obtained or is required for the specified processing purpose;

5.12.4 in case of detection of unauthorized PD processing, if it is impossible to provide PD processing legitimacy;

5.12.5 in case of withdrawal of consent by PD subject for his/her PD processing or upon termination of the validity term of such consent (if PD is processed by the Company based on PD subject consent only);

5.12.6 in case of Company liquidation.

5.13. Personal data storage terms:

The Company stores personal data within 5 (five) years after PD processing termination date.

5.14. In case of automatic PD processing including by means of the Internet, operator provides recording, systematization, accumulation, storage, refinement (update, modification), extraction of personal data of the Russian Federation citizens using the databases located in the territory of the Russian Federation, except for the cases specified in the Federal Law.

5.15 During PD processing, its accuracy, sufficiency, and, where appropriate, relevance regarding PD processing purposes are provided.

6. Rights of PD Subject and his/her legal representative:

6.1.1 to obtain the information concerning subject PD processing;

6.1.2 to submit a request for PD refinement in case of its inaccuracy;

6.1.3 to submit a request to withdraw consent for PD processing;

6.1.4 to submit a request about PD processing illegality.

7. Contact information for requests/applications of PD subjects:

7.1 To obtain the information concerning subject PD processing, to refine PD and recall PD subject consent, send a written request at the address: 31A/1, Leningradsky av. Moscow, Russia 125284, in accordance with the procedure established by the art. 14 of FZ-152.

7.2 The request can be sent as an electronic document and be signed by the qualified electronic signature by e-mail: info@avexima.pro.

8. Regulation of response to requests/applications of personal data subjects and their representatives, authorized agencies regarding inaccuracy of personal data, illegality of its processing, withdrawal of consent and access of personal data subject to his/her data:

8.1 Request forms: free form.

8.2 The Company prepares a response to request within thirty days from the date of receipt.

8.3 The Company provides the information to the authorized agencies for protection of rights of PD subjects upon its request required for the activities of the specified agency within thirty days from the date of receipt of such request.

8.4 Prior to taking legal action following the disputes between the Website User and the Company (operator), it is obligatory to lodge a claim (a written proposal for dispute settlement in good faith).

9. The Company has the right to introduce changes in this Policy without User consent by publication of new revision of the Policy on www.avexima.ru website which is publicly available.