AMERICAN REGENT, INC. PRIVACY NOTICE

Effective Date/Last Modified: August 24, 2026

INTRODUCTION AND SCOPE

American Regent, Inc. (“ARI,” “we,” “us,” or “our”) recognizes and respects the privacy rights of individuals with regard to their information, including Personal Information, and is committed to protecting your privacy in accordance with this Privacy Notice. “Personal Information,” also commonly referred to as “Personal Data,” is Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your household.

This Privacy Notice explains how ARI collects, uses, discloses, stores, and otherwise processes information, including Personal Information, with its websites, applications, and other digital services (collectively, “Services”), as well as why such information may be disclosed to third parties. It also sets forth the rights and choices individuals have regarding the collection and processing of their Personal Information. ARI will not use or share Personal Information with anyone except as described in this Privacy Notice. This Privacy Notice does not apply to individuals that ARI interacts with in an employment or contingent employment relationship.

Please review this Privacy Notice carefully before using ARI Services. If you do not agree with any part of this Privacy Notice or our https://americanregent.com/terms-of-use/, which are incorporated herein by reference, please do not use any of the Services. By using the Services, or when you submit information to or through the Services, you consent to the terms of this Privacy Notice, the Terms and Conditions, and our collection, use, disclosure, retention and processing of your information as described in this Privacy Notice.

If you have any comments or questions in connection with this Privacy Notice, or for further information on ARI’s processing activities and your rights in relation to your information, please contact us as described in the “How to Contact Us” section below.

INFORMATION WE MAY COLLECT AND PROCESS

We may collect, obtain, use, store, transfer and process various kinds of information that you provide to us as well as information we obtain from your use of the Services. Some of the types of information that we may collect include:

• Identity Data including first name, maiden name, last name, username or similar identifier, marital status, title, and date of birth; 
  
  
• Contact Data including billing address, delivery address, email address and telephone numbers; 
  
  
• Transaction Data including details about payments to and from you and other details of products and services you have purchased from us;
  
  
• Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites or intranet;
  
  
• Usage Data including information about how you use our website, intranet, products and Services;
  
  
• Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences;

Please note that, depending on your interactions with ARI, we may have collected and processed one or more of the above categories of your Personal Information within the preceding twelve (12) months.

HOW WE MAY COLLECT INFORMATION

Whether we collect certain types of information and how we process it depends on how you access and use the Services. Some information may be collected directly from you and some information may be collected automatically through the use of various data collection tools. More specifically, we may collect information in the following ways:

Direct Interactions. You may give us various types of information and thus we may collect this information directly from you including, for example, when you:

• apply for employment with us or when you become an employee/contractor;
  
  
• apply for or purchase/complete a transaction for our products or services;
  
  
• subscribe to our services or publications;
  
  
• request marketing information to be sent to you;
  
  
• agree to take part in a clinical research program;
  
  
• enter a promotion, contest, or sweepstakes;
  
  
• complete a customer satisfaction or market research survey;
  
  
• give us feedback; or
  
  
• provide unsolicited information to us.

Automatically Collected Information: ARI may automatically collect certain types of information whenever you use the Services. Techniques ARI may use for this purpose include, for example, maintenance of web server logs and placement of cookies and web beacons. ARI may use the information collected through these techniques for the following purposes:

•  After you have entered information into a form or data field, cookies enables the information to be ‘saved’ or ‘remembered,’ should you so choose;
  
  
• Cookies and other passive information collection technologies enable ARI to deliver content that is tailored to your interests and preferences based on your past use of the Services; and/or
  
  
• Cookies and other passive information collection technologies enable ARI to compile aggregate statistics concerning use of the Services, analyze trends, and otherwise administer and improve the Services.

Third parties or Public Sources. We may receive Personal Information about you from various third parties and publicly available sources as set out below:

• Caregivers or other authorized individuals (e.g. legal guardians) who complete forms or submit requests on your behalf;
  
  
• Our Vendors, Business Partners, Service Providers, Contractors, Consultants, and Processors that assist us with our business operations and, in the process, may collect, store, transfer or otherwise process information, including Personal Information for ARI and who are bound by certain contractual obligations as well as applicable laws to use your Personal Information only as directed by ARI;
  
  
• Healthcare Providers and Insurance Companies in connection with treatment, adverse event reporting, or patient assistance programs;
  
  
• Professional organizations with whom we interact;
  
  
• Publications and public databases;
  
  
• Social media platforms;
  
  
• Technical Data from analytics providers such as Google, advertising networks and search information providers;
  
  
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services;
  
  
• Identity and Contact Data from data brokers, aggregators, recruitment agencies, and publicly availably sources; and
  
  
• Other Categories of Data including, for example, licensing data to verify qualifications of healthcare professionals or to perform background checks of employment applicants.

We may combine the information we collect from you with information from other sources and use the combined information as described in this Privacy Notice.

Web Server Logs and IP Addresses.  A web server log is a text document that contains a record of all activity related to a specific web server over a defined period of time. The web server gathers data or information automatically and constantly to provide administrators with insight into how and when a server is used, as well as the users that correspond with that activity.  While server data is available immediately within the server log itself, in most cases the log file is also stored in a database and can be used to produce customized reports on demand. This information can be used by administrators to better understand and accommodate web traffic patterns, better allocate IT resources, and adapt sales and marketing activity.

An IP (Internet Protocol) address is a unique numerical label that is automatically assigned to every device (e.g., computer) connected to a network, allowing the device to identify itself and communicate with other devices over the Internet or local networks. Depending on the nature of your connection, the IP address may change each time you connect the device or may always be the same number for that device. ARI reserves the right to log IP addresses for system administration, security, statistical analysis, demographic analysis of website use, and other functions.

Cookies.  We, along with the service providers that help us provide the Services, may use small text files called “cookies.” Cookies are created by a web server while a user is browsing a website and are placed on the user’s computer or other device by the web browser. Cookies can collect various types of information including: device information (e.g., IP address, browser type, operating system); user preferences (e.g., login details, items in a shopping cart); session data (i.e., activity during a single browsing session); and tracking information (e.g. behavior across websites, time spent on each page, interactions with content). Cookies are not themselves personally identifiable information but may be linked to Personal Information that you provide to us through your interaction with the Services.  Most web browsers are set up to accept cookies, although some browsers (including some mobile web browsers) provide settings that allow a user to reject cookies or to alert a user when a cookie is placed on a user's computer or other device by the web browser. Also, most mobile devices offer settings to reject mobile device identifiers. ARI websites offer you the ability to accept or reject cookies; however, rejecting or blocking cookies may prevent access to some features available through the Services.  Additionally, cookies can help improve the Services by, for example, tracking users' navigation habits and storing users' passwords to customize a user’s Service experiences.  Furthermore, cookies can enable us to analyze technical and navigational information about the Services and help to detect and prevent fraud.  Thus, cookies allow ARI to conduct website analysis and performance reviews as well as to help make your web experiences better. You can find out more about cookies, including how to manage and delete cookies, by visiting www.allaboutcookies.org.

Social Media and Plugins.  The Services may offer you the ability to use social media services including, for example, Facebook, Instagram, etc. (collectively, “social media”) in conjunction with certain Services. When you access the Services through a social media account, the Services may, depending on your privacy settings, have access to information that you have provided to the social media platform. We may use this information for the purposes described in this Privacy Notice or at the time the information was collected. When you associate your social media account and authorize us to have access to this information, you agree that we may collect, use, store, transfer and process the information provided by social media services as described in this Privacy Notice.

Social plugins are software modules that connect websites to social media platforms, enabling users to share, comment, or interact with content directly from the site. Certain ARI sites may use social plugins (e.g., the Facebook "Like" button) to enable you to easily share information with others. When you visit our site, the operator of the social plugin may be able to place a cookie on your computer, enabling that operator to recognize individuals who have previously visited ARI’s site. If you are logged into the social media website (e.g., Facebook) while browsing on ARI’s website, the social plugins allow that social media website to receive information that you have visited our website. The social plugins also allow the social media website to share information about your activities on our website with other users of their social media website. For example, Facebook® Social Plugins may allow Facebook to show your “Likes” and comments on ARI’s pages to your Facebook friends. Facebook Social Plugins also may allow you to see your friends' Facebook activity on our website. ARI does not control any of the content from the social media plugins. For more information about Facebook Social Plugins and other social media tools, and for more information about other social plugins from other social media websites, you should refer to those sites' privacy and data sharing statements.

Web Beacons.  A web beacon (also known as an "action tag" or "clear GIF technology") is a tracking technology used on web pages or emails to monitor user activity. It is typically an invisible element embedded in content, such as a single-pixel image or a piece of HTML code, that sends information back to a server when accessed. On certain website pages or emails, ARI may utilize a web beacon to help analyze the effectiveness of our websites by measuring, for example, the number of visitors to a site or how many visitors clicked on key elements of a site.

Cookies, web beacons and other tracking technologies do not automatically obtain Personal Information. Only if you voluntarily submit Personal Information, such as by registering for contest or promotion or sending emails, can information about your use of our websites be linked to identifying information.

Disclaimer – Not Child-Directed. The Services are not intended for use by children and we do not otherwise knowingly solicit information from, or market to, children. If you are under the age of majority in your place of residence, you may use the Services only with the consent of or under the supervision of your parent or legal guardian.  Consistent with the requirements of the Children's Online Privacy Protection Act (COPPA), if we learn that we have received any information directly from a child under 13 years old without first receiving his or her parent's verified consent, we will use that information only to respond directly to that child, his or her parent or legal guardian to inform the child that he or she cannot use the Services and subsequently we will delete that information.  If a parent or guardian becomes aware that his or her child has provided us with information, he or she should contact us as described in the “How to Contact Us” section below.  We will take reasonable steps to delete such information from our database within a reasonable time.

HOW WE MAY USE YOUR INFORMATION

ARI may use the information we collect, including Personal Information, for legitimate business purposes and collects only the information necessary to achieve these business purposes, including, but not limited to:

• Business Operations. Marketing and sales, research and development, clinical trials, patient support, donations and sponsorships, communications, customer relationship management, contractual obligations management, quality assurance audit management and oversight, management of events, travel, and associated expenses, providing training and support.
  
  
• Business Administration. Finance and accounting, human resources, processing of employment applications, compliance and investigatory activities, payroll processing, and benefits management.
  
  
• Business Management. Internal audit, asset management, system and business controls, IT security and integrity including fraud or other illegal activity detection.
  
  
• Legal Compliance. Contracts, disputes including lawsuits, subpoenas, discovery requests, court orders, supporting clinical trials, preparing for regulatory submissions, assessing and reporting on adverse events, and otherwise complying with applicable laws and regulations. 

HOW WE MAY SHARE AND DISCLOSE INFORMATION

ARI takes steps to process your information, including Personal Information, according to the provisions of this Notice and the requirements of applicable laws. ARI does not and will not sell your Personal Information. However, we may share and disclose information including Personal Information and, in fact, may have done so over the past twelve (12) months, as set out below for the purposes set out above in the Section titled “How We May Use Your Information.”  See “Privacy Rights and Choices” below if you wish to opt-out of the sharing or disclosure of your Personal Information.

• Internally. ARI, including ARI’s wholly-owned subsidiary, may use and share information, including Personal Information, as necessary to perform their job functions.
  
  
• When You Consent.We may share information, including Personal Information, with third parties if you have given us your consent to do so. 
  
  
• To Perform Services.We may disclose information, including Personal Information, to third parties in order to perform services requested or functions initiated by users. In addition, we may disclose Personal Information in order to identify a user in connection with communications sent through the Services. We also may offer users the opportunity to share information with others through the Services.
  
  
• Third Party Service Providers and Vendors. We may share information, including Personal Information, with our service providers or vendors to perform the functions for which we engage them (e.g., IT system administration and data analytics services; social media networks, clinical trial services; promotional, advertising and marketing support). We do not allow our service providers to use Personal Information for their own purposes and only permit them to process Personal Information for specified purposes and in accordance with our instructions.  ARI may, however, disclose anonymized information that is not personally identifiable to third parties for any purpose. 
  
  
• Professional Advisers. Advisors (e.g., lawyers, bankers, accountants, auditors, insurers) retained by ARI to provide consultancy, banking, legal, accounting, payroll, insurance and other professional services may receive any category of information necessary for them to provide agreed-upon services.
  
  
• Legal Purposes.We may share information, including Personal Information, that we collect from users to protect and enforce our rights, protect our property, and, if necessary, to protect the safety of our employees and others.  We also may share information as necessary to support external auditing, compliance and corporate governance functions. Further, we will disclose Personal Information as we deem necessary to respond to subpoenas, court and other orders including those of governmental agencies (e.g., Customs, IRS, FDA). We may also share Personal Information, as necessary, to pursue available remedies or limit damages we may sustain
  
  
• Corporate Changes. We may share information, including your Personal Information, in connection with a merger, sale, acquisition or other change of ownership or control by or of us or any affiliated company (in each case whether in whole or in part). When one of these events occurs, a new owner(s) may use the information provided to them in the same way as set out in this Privacy Notice and we will use reasonable efforts to notify users before their information is transferred or becomes subject to a different privacy notice or policy.
  
  
• Aggregated Form.Information collected through the Services may, subject to user privacy controls (if available), be used or shared in an individualized manner or an aggregated form—that is, in a statistical or summary form that does not include any personal identifiers—with third parties in order to discover and reveal trends about how users like you interact with our services.
  
  
• Cross-Border Transfers. When you provide Personal Information to us through the Services, you consent to the processing of your Personal Information in the United States and its territories.  ARI may transfer Personal Information to parties located in countries outside the United States and its territories. For example, we may transfer Personal Information internationally to our group companies, service providers, business partners and governmental or public authorities.  By providing Personal Information and other information to ARI, including through the ARI Services, and/or by sending a communication to an ARI e-mail address, you understand and consent to the collection, use, processing disclosure and transfer of such information from the United States or its territories to other countries or territories, which may not offer the same level of data protection as the United States and its territories, in accordance with the terms of this Privacy Notice.

HOW WE SECURE INFORMATION

We employ industry-standard security measures designed to protect the security of all information submitted through the Services. ARI also limits access to your information, including Personal Information, to those employees, agents, contractors and other third parties who have a legitimate business need to know the information. They will be instructed to only process your information on our instructions, and they will be subject to a duty of confidentiality.  Additionally, we have implemented a variety of security technologies and organizational procedures to protect your information from unauthorized access, use, and disclosure. For example, we store your information on computer systems that have various types of technical and physical access controls, such as encryption.

However, while ARI has implemented data security controls consistent with industry standards, ARI cannot guarantee the security of your information, and we are not responsible for any interception or interruption of any communications through the internet.  As a result, we have put in place procedures to deal with any suspected privacy breach and will notify you and any applicable regulator of a privacy breach when we are legally required to do so.  It is also important for you to protect against unauthorized access to your computer, mobile devices, password(s), user ID(s) or other forms of authentication involved in obtaining access to protected or secure areas of any of our Services. In order to protect you and your information, we may suspend your use of any of the Services, without notice, pending an investigation, if any breach of security is suspected. Access to and use of protected and/or secure areas of any of the Services are restricted to authorized users only. Unauthorized access to such areas is prohibited and may lead to criminal prosecution. If you have reason to believe that your interaction with us is no longer secure (e.g., if you feel that the security of any account you might have with us has been compromised), please notify us immediately as described in the “How to Contact Us” section below.

HOW WE RESPOND TO GLOBAL PRIVACY CONTROL (GPC), DO NOT TRACK (DNT) AND SIMILAR SIGNALS

As stated above, ARI may use cookies, web beacons, and similar technologies to provide more relevant and personalized advertisements based on our users’ interests and browsing habits.  Certain web browsers and other programs may be used to automatically signal your preferences to ARI about how or whether ARI or third parties may collect Personal Information about your online activities.  

Global Privacy Control (GPC) is a browser-based setting that communicates a user’s preference to opt out of the sale or sharing of personal information.  ARI websites are configured to recognize GPC signals. If you have enabled GPC in your browser, our systems will automatically respond by limiting sharing of your Personal Information as required by law. You do not need to take any additional action on our website to exercise this right. ARI does not, and will not, sell your Personal Information regardless of whether GPC is enabled.   

Do Not Track (DNT) signals are HTTP header fields that allow users to opt-out of tracking by websites.  When enabled, these signals are sent with web requests, indicating a user’s preference not to be tracked. However, websites are not legally obligated to honor these signals, and compliance is voluntary.  Thus, a DNT signal is treated like a request, and websites may choose to ignore it.

You may also use your browser settings to limit cookies or select your preferences directly on ARI websites. 

LINKS TO OTHER WEBSITES

ARI’s websites may provide links or references to other websites not affiliated with ARI. This Privacy Notice does not apply to such third-party websites or services. You should refer to the privacy policies and notices posted on such third-party sites before using them.

HOW LONG WE RETAIN INFORMATION

We may retain information, including Personal Information, as long as it is necessary and relevant for our operations. We also retain information in response to legal holds, to comply with applicable laws, prevent fraud, resolve disputes, troubleshoot problems, assist with any investigation, enforce our the terms of this Privacy Notice and Terms and Conditions, collect any fees owed and other actions permitted by law. After it is no longer necessary for us to retain information, we dispose of it according to our data retention and deletion policies. To determine the appropriate retention period for information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process information and whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

PRIVACY RIGHTS AND CHOICES
It is important to us that you are able to review the Personal Information we have about you and make corrections to it or delete it, as necessary and subject to limitations and exclusions in existing laws. Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights. We may, however, ask for details to verify your identity and request, such as your name, email address, postal address, phone number, your interaction with ARI, and the privacy right you wish to exercise. We will do our best to respond to your request and, if we cannot verify your identity, we will explain why and provide steps to help verify your identity and/or request. To exercise these rights, please contact us as described in the “How to Contact Us” section below.

• Right to Know - You have the right to confirm whether we are processing Personal Information about you and, under certain laws, to obtain certain personalized details about the Personal Information we have collected about you, including: 
  • The categories of Personal Information collected;
  • The categories of sources of the Personal Information;
  • The purposes for which the Personal Information were collected;
  • The categories of Personal Information disclosed to third parties (if any), and the categories of recipients to whom this Personal Information were disclosed;
  • The categories of Personal Information shared for targeted advertising purposes (if any), and the categories of recipients to whom the Personal Information were disclosed for these purposes;
  • The categories of Personal Information sold (if any) and the categories of third parties to whom the Personal Information were sold; and
  • The specific third parties to whom we have Personal Information.
    
    
• Right to Delete - You have the right to request that ARI delete Personal Information about you which ARI has collected from you. If you request deletion of your Personal Information, we will assess if we need to retain it for business purposes, legal obligations, or other permitted reasons. If we cannot fulfill your deletion request, we will explain why.
  
  
• Right to Access & Portability – You have the right to obtain access to the Personal Information we have collected about you and, where required by law, the right to obtain a copy of the Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance.
  
  
• Right to Revise or Correct Personal Information - You have the right to correct inaccurate Personal Information that ARI maintains about you. However, please note that there may be some situations in which users will not be allowed to revise their information, such as when the correction requires a level of effort disproportionate to the necessity of the change or when it is maintained for legal compliance or for a legitimate business purpose.
  
  
• Right to Opt-Out of Information Sharing (Targeted Advertising) - You have the right to opt-out from the “sharing” of your Personal Information with third parties for advertising purposes. You can do so by clicking on the “Cookies Settings” link on the ARI website cookie banner or using browser settings to disable cookies.  ARI does not, and will not, sell your Personal Information.
  
  
• Right to Withdraw Consent/Opt-Out of Sensitive Personal Information Processing – You have the right not to provide consent, to withdraw consent or opt-out to processing your Sensitive Personal Information, subject to certain exceptions. Sensitive Personal Information, which is a subset of Personal Information, is data that if disclosed or misused could cause significant harm, identity theft, discrimination or financial loss to an individual.
  
  
• Right Not to Receive Discriminatory Treatment - We do not discriminate against users of our Services because of how they choose to exercise their privacy rights such as their right to access, delete or opt-out from sharing their Personal Information. This means that we will not, because you have exercised your consumer privacy rights granted by relevant law:
  • Deny goods or services to you;
  • Charge you different prices or rates for goods or services;
  • Provide you a different level or quality of goods or services;
  • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
    
    
• Right to Appeal - Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. Please refer to the “How to Contact Us” section below to submit an appeal request.

Please note that exercising certain privacy rights may impact or completely prevent or delay our ability to provide Services, share information, or complete contractual obligations with you. 

THIRD PARTY SERVICES

Please note that this Privacy Notice does not apply to information, including Personal Information, collected through third party (non-ARI) websites or services (“Third Party Services”) that you may access through the Services or that you may submit to us through e-mail, text messages, other electronic messages or offline.

Also, as a convenience to those who use our Services, ARI may provide links to Third Party Services with which we have no affiliation but that we believe may offer useful information. The inclusion of a link on the ARI website does not imply our endorsement of the Third Party Services or the quality or accuracy of information presented on third party sites. When you click on one of these links, you will be transferred from the website. This Privacy Notice is no longer applicable when you leave an ARI site by way of a link. Each of these linked sites should maintain its own independent privacy policies and procedures.  We encourage you to carefully review the legal and privacy notices of all Third Party Services that you visit and to do so before providing any information, including Personal Information.

USER RIGHTS UNDER SPECIFIC U.S. STATE STATUTES

Privacy rights in the United States and its territories are rapidly changing and thus ARI encourages you to understand the privacy rights afforded to you by the particular state in which you reside.  In particular, residents of Alabama, California, Colorado, Connecticut, Delaware, District of Columbia, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia may have certain additional rights, subject to the limitations and exclusions in those laws or conflicting laws.

PRIVACY NOTICE UPDATES

The effective date of this Privacy Notice is set forth at the top of this Notice. As ARI may revise or update this Privacy Notice from time to time, please review this Privacy Notice periodically for the latest information on our privacy practices. If we make any changes, the updated Privacy Notice will be posted with a new effective date. We will not make retroactive changes that reduce your privacy rights unless we are legally required to do so.

HOW TO CONTACT US

ARI welcomes any questions or comments you may have regarding this Privacy Notice including its implementation.  If you have questions about this Privacy Notice or want to exercise your individual rights, please contact us as follows: