Privacy Policy

This Privacy Policy describes the circumstances in which we may share your Personal Data. We may share your Personal Data with other Novartis Gene Therapies and Novartis subsidiaries and affiliates worldwide to exchange information and maintain databases in different countries. We also may transfer Personal Data to third parties who act on our behalf, for further processing in accordance with the purpose(s) for which the data were originally collected or may otherwise be lawfully processed, such as services delivery, evaluating the usefulness of our Services, marketing, advertising, data management, or technical support.

We will not sell, share, or otherwise transfer your personal information to third parties other than those indicated in this Privacy Policy.

In the course of our activities and for the same purposes as those listed in this Privacy Policy, your Personal Data can be accessed by, or transferred to the following categories of recipients on a need to know basis to achieve such purposes:

• our personnel (including personnel, departments or other companies of Novartis Gene Therapies and the Novartis group);
• our independent agents or brokers (if any);
• our other suppliers and services providers that provide services and products to us;
• our IT systems providers, cloud service providers, database providers and consultants;
• any third party to whom we assign or novate any of our rights or obligations; and
• our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.

These third parties have contracted with us to only use Personal Data for the agreed upon purpose, and not to sell Personal Data to third parties, and not to disclose it to third parties except as may be permitted by us, as required by law, or as stated in this Privacy Policy.

We may disclose your Personal Data to a third party in the event that the business or a part of it and the customer data connected with it is sold, assigned or transferred, in which case we would require the buyer, assignee or transferee to treat Personal Data in accordance with this Privacy Policy.

Also, we may disclose your Personal Data to a third party if we are required to do so because of an applicable law, requests from public and government authorities (including court order, subpoena, or governmental regulation), even outside your country of residence; if we need to enforce our terms and conditions; when we believe in good faith that the disclosure is necessary to protect legal rights, the security or integrity of this website; to protect your safety or the safety of others; as part of any criminal or other legal investigation or proceeding in your country or in other countries; or to third parties, advisors, and other entities to the extent reasonably necessary for development of or to proceed with the negotiation or completion of a corporate or commercial transaction.

Your Personal Data may also be processed, accessed, or stored in countries outside the European Union. Such countries may offer a different level of protection of Personal Data. If we transfer your Personal Information to external companies in other jurisdictions, we will make sure to protect your Personal Data by applying the level of protection required under applicable data privacy laws by implementing adequate technical and organisational measures. In the event that your Personal Data is transferred to a service provider based in a third country (countries outside the European Union that do not have a level of data protection comparable to the data protection law of the European Union, as determined by a competent data protection authority) and processed there, Novartis Gene Therapies ensures the protection of your Personal Data by means of Standard Contractual Clauses or EU Model Clauses or another method in accordance with applicable law. Should these Standard Contractual Clauses in the future be declared null and void and/or be revised by the European Commission, we will adopt other applicable and/or approved instruments to provide for appropriate safeguards required for the third country transfers and enter into such agreed instruments in a written and legally binding form.

For transfers of Personal Data among Novartis subsidiaries and affiliates, Novartis has adopted Binding Corporate Rules, a system of principles, rules, and tools, authorized by European law, to regulate the transfer of Personal Information outside the EEA and Switzerland. Read more about the Novartis Binding Corporate Rules by clicking here.