Boehringer Ingelheim Cares Foundation US Privacy Statement

Boehringer Ingelheim Cares Foundation (“Boehringer Cares”), together with its US subsidiaries and affiliates,(“Boehringer,” “We,” “Us” or “Our”) respects your privacy, and we want to inform you of how we collect, use, share and otherwise process Personal Data we collect about US consumers who use our websites or mobile applications, or otherwise interact with us online or offline (collectively, our “Websites and Services”).

Read our Consumer Health Data Privacy Statement Supplement for additional information on our processing of Consumer Health Data as defined under US state laws.

Read Boehringer Ingelheim Pharmaceuticals, Inc. and Boehringer Ingelheim Animal Health USA Inc. (“Boehringer”) Privacy Statement for information on how Boehringer Cares processes Personal Data.

A. What is Personal Data?

Personal Data means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular living person or household. The type of Personal Data we collect depends on the nature of your interactions with us and our Websites and Services.

Boehringer may collect, use and otherwise process the following categories of Personal Data:

• Name, Contact Information, and Unique Identifiers –Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol (IP) address, phone number, email address, account name and login credentials, driver’s license number, or other government-issued identifiers.
• Financial Information – Financial information, including bank account number, credit or debit card number, or other financial information.
• Medical Information–Medical Information such as any information in possession of or derived from yourself, a healthcare provider, healthcare insurer, healthcare service plan, pharmaceutical company, or contractor regarding your medical history, mental or physical condition, or treatment. This may include your insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify you, or any information in your application and claims history (including prescription information).
• Protected Characteristics – Characteristics of protected classifications under state or federal law, such as race, gender, physical or mental disability, and religion.
• Commercial Information– Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies (including survey responses providing your opinion about our products and services).
• Biometric Information – Biometric information, including physiological, biological, or behavioral characteristics to the extent it can be used to establish individual identity. Biometric information consists of, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template (such as a faceprint, a minutiae template, or a voiceprint) can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
• Network Activity Data – Internet or other electronic network activity information, such as browsing history, search history, and information regarding your interaction with an internet website, application, or advertisement.
• Geolocation Data – Approximate or precise geolocation data.
• Electronic and Sensory Data – Audio, electronic, visual, thermal, olfactory, or similar information (e.g., a customer service call recording, event or commercial video recording or photography, or profile photograph). This also includes the contents of your messages, chats, or other communications that you send to us through a website, app, chatbot, or company social media channel.
• Professional and Educational Information – Professional or employment-related information, including academic information and records, licenses, professional or employment-related information, and professional interactions with Boehringer.
• Inferences–Inferences drawn from any Personal Data to create a profile about you or reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
• Sensitive Personal Data – Types of Personal Data that may be considered “sensitive” such as biometric information, content of communications, financial information, login credentials, government-issued identifiers, health insurance and medical information, and protected characteristics. Further, we may also collect and process Personal Data that under certain laws may be defined as "Consumer Health Data.” Please refer to our Consumer Health Data Privacy Statement Supplement for additional information about our processing of Consumer Health Data as defined under US state laws.

We will only process Sensitive Personal Data and Consumer Health Data when we have either your express consent or as permitted under applicable law. We will also process your Consumer Health Data if required for example, when necessary to comply with applicable law, respond to requests from government authorities, including authorities that may be outside of your country of residence, to protect or defend our legal interests, and if necessary, to protect the safety of our employees and other stakeholders. You may request to opt-out or limit the processing of your Sensitive Personal Data by clicking the Link “Limit the Use of My Sensitive Data” found on our Websites, or via the details found in the “ Contact Us” section of this Statement.

We, together with our contracted vendors and/or service providers, may combine the Personal Data we collect about you online with the Personal Data we collect about you from our offline interactions with you (for example, our interactions by telephone or in person). We, together with our contracted vendors and/or service providers, may also combine any of the information we collect about you with information we lawfully obtain from other sources, such as public records or websites, or other third parties (e.g., health care professionals, health insurers, patient groups, government agencies, or other companies).

B. Purposes for Processing Personal Data

We, together with our contracted vendors and/or service providers, collect, use, and disclose Personal Data for the following purposes:

• Recruit for employment purposes, including identifying and evaluating candidates for employment purposes.
• Respond to recruitment questions regarding our clinical trials or refer you to specific organizations that may provide information on how to participate in clinical trials or to facilitate clinical trials.
• Provide and manage clinical research opportunities, patient support programs, and other Websites and Services we offer.
• Address questions related to products in development or in market.
• Deliver requested information on resources available related to the therapeutic areas or other medical or scientific areas that Boehringer provides.
• Develop new products and services.
• Operate, evaluate, secure, and improve our Websites and Services.
• Analyze the use of our Websites and Services, operate and maintain our business, and for analytics and marketing purposes, including to conduct targeted advertising. You may opt-out of targeted advertising via the details found in the “ Contact Us” section of this Statement.
• Contact you, including providing you with information, opportunities, updates, and special offers from Boehringer and our business partners.
• Staff, facilitate, and manage market research, studies, and related activities.
• Conduct surveys or polls and/or obtain testimonials.
• Create aggregated analytics for research purposes.
• Process grants and sponsorship applications.
• Fulfill our obligations to you under an applicable contract or conduct business with you.
• Provide support-related activities, such as customer service.
• Monitor the safety and efficacy of our products or services.
• Monitor, investigate potential breaches of, and enforce compliance with Boehringer policies and procedures and legal and regulatory requirements.
• Respond to and comply with legal process, such as civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons.
• Exercise or defend the legal rights of Boehringer and its employees, affiliates, customers, contractors, agents, and others.
• Comply with legal obligations, regulatory requirements, and our own policies and procedures.
• Conduct other legitimate business activities, as allowed by applicable law.
• Use aggregated or de-identified information to train, test, and improve our AI models and automated systems. We take steps to minimize the use of Personal Data and apply safeguards consistent with applicable privacy laws.

We may use automated processes or technologies subject to appropriate human oversight for a variety of purposes, including:

• Responding to customer inquiries through automated or assisted chat features
• Analyzing usage patterns to improve our website and services
• Personalizing content, recommendations, or user experiences
• Detecting fraud, security incidents, or violations of our terms

C. Sharing and Disclosure of Personal Data

In certain circumstances we may share the Personal Data described above without further notice to you, unless required by applicable law, with the following categories of third parties:

• Third party, marketing and advertising partners for marketing purposes, including online targeted advertising. You may opt-out of targeted advertising, the Sale, or Sharing of your Personal Data via the details found in the “ Contact Us” section of this Statement.

We may also disclose Personal Data listed in the “What is Personal Data” section above, in the following contexts:

• Boehringer subsidiaries and corporate affiliates.
• Service providers, who work on Boehringer’s behalf to provide certain services.
• Business partners with whom we collaborate regarding our investigational products and programs, such as scientific advisors, joint venture partners, and strategic collaboration partners.
• To legal, regulatory, or other enforcement authorities and other third parties if required to comply with law, regulation, or judicial process, or to protect the security, rights, and property of Boehringer or of users of our Websites and Services.
• To third parties in the event Boehringer is involved in an actual or contemplated merger, acquisition, or sale of a portion of its assets, or in the event of bankruptcy. If this occurs, we will seek assurances that the Personal Data will be processed in accordance with this Privacy Statement.
• With your consent or as permitted under applicable law, to third parties that offer AI-based tools to support our operations where these providers process information on our behalf and are contractually required to use Personal Data only as instructed by Boehringer and in accordance with applicable privacy and security requirements.
• To third parties to protect rights and interests, such as when needed for corporate audits, to investigate or respond to a complaint or threat, or to exercise our legal rights.
• To other third parties, with your consent or as permitted under applicable law, for any of the purposes listed in “Purposes for Processing Personal Data” section above.

Boehringer may sell or share Personal Data under certain US privacy laws, such as for targeted advertising, analytics or other marketing or sales activities.

Because the information we sell, share, and process may allow for inferences to be made concerning health interests and conditions, we provide the following notice for compliance with U.S. privacy laws:

NOTICE: We may sell your Sensitive Personal Data, including, where applicable, your Biometric Data.

You may opt-out of the sale or sharing of your data via the details found in the “ Contact Us” section of this Statement. Additionally, browsers and devices offer settings that enable you to send a signal to websites that communicates your decision to opt-out of the sale or sharing of Personal Data. We currently recognize requests to opt-out of the sale or sharing that have been submitted through the Global Privacy Control (GPC). If we receive a signal from the GPC, we will opt-out that browser or device and any associated profiles from the sale or sharing of their Personal Data.

D. Personal Data Retention and Minimization

Boehringer uses the minimum amount of Personal Data reasonably necessary to accomplish the purpose for which it was collected. Further, we retain your Personal Data for as long as necessary to fulfill the purposes for which they are collected or to satisfy a legal obligation imposed on Boehringer. Personal Data that are no longer needed for the above purposes may be deleted or deidentified. Whenever we de-identify Personal Data, we take reasonable measures to ensure that the information cannot be associated with a consumer or household, and we maintain and use the information in deidentified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements.

E. Sources of Personal Data

We may collect Personal Data directly from you, such as when you disclose Personal Data to us to receive information, opportunities, updates, or special offers from Boehringer and its business partners. You can also ask us about our products or services, or someone can ask for them for you. You may want to join one of our programs or be part of a patient community that we support. Also, some of our Websites and Services offer interactive content, like patient education and support. Users of our Websites and Services may provide Personal Data to Boehringer to experience these features. We also collect Personal Data from our vendors and from third parties when they disclose Personal Data to us, as well as from joint marketing partners, publicly available sources, and social media.

Further, we collect Personal Data via cookies and similar technologies on our Websites and Services. We use these technologies for different reasons, such as to provide, improve, measure, personalize, or share online services with you and to improve website functionality, performance, and other cookies to remember your preferences or to show relevant content. You can review, modify, or revoke your consent to cookies by customizing your preferences in our Cookie Preference Center which can be accessed through any of our Websites.

F. Protecting Personal Data

Boehringer implements technical, physical, and administrative protections to keep Personal Data secure. However, despite these protections, no organization, including Boehringer, can completely guarantee that your Personal Data are not accessed by unauthorized people/bad actors. If Boehringer becomes aware that Personal Data has been compromised, Boehringer will promptly take steps to resolve the incident in accordance with applicable laws and regulations.

G. Personal Data of Minors

Boehringer is committed to protecting the privacy of children. Our Websites and Services are not geared toward children under the age of 18. Further, we do not collect Personal Data from children under 16 years old without the express consent of the child’s parent or guardian. If you are the parent or guardian of a child under 16 years old and you believe that we have collected Personal Data about your child without your consent, please contact us immediately at us.privacy@boehringer-ingelheim.com and we will promptly take steps to delete such Personal Data from our systems.

H. Exercising Data Subject Rights

You, or an authorized agent, may have the right to request access to, modification, export or deletion of your Personal Data, or object to the use of it with regards to AI or automated decision-making, under law. These rights are not absolute and may only apply in certain circumstances. This means that we may be unable (e.g., due to legal requirements) or not obligated to satisfy your request.

In some cases, we may need to collect additional Personal Data from you in order to verify your identity before providing you access to or deleting your Personal Data, such as a government-issued identification. Boehringer will not discriminate against you for exercising your rights, but we may not be able to provide you with Services that you have requested if we are not able to use your Personal Data.

If you have provided permission (consent) to Boehringer to process your Personal Data, you have the right to withdraw your consent for such processing at any time by contacting us as outlined in our “ Contact Us” section below.

You can opt-out of sharing your Personal Data with any cookie provider that may use your Personal Data for their own purposes via our Cookie Preference Center by opting-out of Performance & Analytics and Targeting & Advertising cookies. Click the “Customize Cookies” icon found in the lower left-hand corner of our Websites to open the Cookie Preference Center at any time. Please note that you can always unsubscribe from receiving promotional emails from us by using the “Unsubscribe” link provided in the emails you receive from us.

I. International Transfers of Personal Data

Your Personal Data may be stored and processed in any country where we have facilities or in which we engage service providers. We will only transfer your Personal Data across international borders where (to the extent required by law) we have established a legal basis for such processing and put in place adequate measures to protect your Personal Data as may be required by local law. You should not use our Websites and Services if you do not want your Personal Data potentially transferred, or otherwise processed, in countries outside of your country of residence, which may have data protection laws that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your Personal Data.

If you are located in the European Economic Area (“EEA”), your Personal Data may be transferred to Boehringer and our affiliates, each a data controller, or to service providers in non-EEA countries that are not recognized by the European Commission as providing an adequate level of data protection according to EEA standards. For transfers from the EEA to countries not considered by the European Commission to have adequate protections, we implement measures to protect your Personal Data, such as standard contractual clauses adopted by the European Commission.

J. Changes to this Notice

Our business, Websites and Services may change from time to time. As a result, we may change this Privacy Statement at any time. If we do make such changes, we will post an updated version on this page, unless another type of notice is required by the applicable law. Additionally, when required under applicable law, we will request additional consent to collect and process your Personal Data. We encourage you to visit this page periodically and to review our most current Privacy Statement and applicable effective date.

K. Contact Us

If you have any questions about our Privacy Statement or data practices, want to receive this Privacy Statement in a different format, or want to exercise or appeal a decision regarding the data subject rights you have in connection with your Personal Data, you may contact us via email at us.privacy@boehringer-ingelheim.com, via webform by clicking here, or via mail or phone at the below contact information.

Boehringer Ingelheim Cares Foundation:

900 Ridgebury Road

Ridgefield, CT 06877

Phone: 1-800-243-0127