Medical Inquiry, Pharmacovigilance and Product Quality Complaints Privacy Policy

This Xian Janssen Pharmaceutical Co., Ltd. Medical Inquiry, Pharmacovigilance and Product Quality Complaints Privacy Policy ("this Privacy Policy") applies:

Individuals who make medical inquiries with us (such as healthcare professionals);
Individuals who report adverse events, provide information about the safety of our products and submit product quality complaints;
Individuals who are parties to adverse events and product quality complaints, or individuals related to adverse events.

Xian Janssen Pharmaceutical Co., Ltd. (hereinafter "Xian Janssen" or "We") respects the privacy of our inquirers, reporters, patients, patient partners, and clinical trial subjects (hereinafter "You") and wants you to be familiar with how we collect, use and disclose information. This Privacy Policy describes our practices in connection with collecting information. We encourage you to read the full Privacy Policy before providing any personal information. If you are not the patient, patient partner, or the clinical trial subject, you should ensure that you have informed the patient, patient partner, or the clinical trial subject of the contents of this Privacy Policy and obtained the patient's, patient partner's, or the clinical trial subject's necessary and appropriate consent before providing us with the patient's, patient partner's, or the clinical trial subject's personal information.

Please note that adverse events occurring to clinical trial subjects in clinical trials conducted by Xian Janssen, Johnson & Johnson (China) Investment Ltd., and Actelion Pharmaceuticals Trading (Shanghai) Co., Ltd., as clinical trial application agents, Xian Janssen will process the personal information involved in these adverse events as the data controller, and reports such adverse events to regulatory authorities.

Please read carefully this Privacy Policy before providing personal information to us.

USE BY MINORS

This website is not directed to individuals under the age of eighteen(18), and we request that these individuals not provide personal information through this website. If your child has submitted personal information and you would like to request that such personal information be removed, please contact us as explained below under "Contacting Us".

We may collect personal information from minors under the age of fourteen (14) with parental or guardian authorization for the purpose of reporting adverse events to medications administered to minors. If you are a parent or a guardian of a minor under the age of 14 and you provide us with personal information about the minor, before you provide personal information for us, please carefully read and understand the contents of this Privacy Policy or other information of which we inform you.

How we collect and use your personal information

In order to provide timely and accurate assistance in obtaining high-quality medical information and answers regarding the use of pharmaceutical products, we will record and use the relevant information of individuals who make medical inquiries ("inquirers"). This includes the inquirer's name, email address, hospital, department, and medical inquiry.

In order to deal with adverse event reports and product quality complaints, to monitor the safety of medicines, including the detection, assessment, follow-up and prevention of adverse events, to respond to your product quality complaints such as any quality defects and/or shortcomings in efficacy, stability, reliability, safety, performance or use of the medicines, to carry out the assessment, categorization and evaluation of product quality complaints, as well as to report adverse events to the regulatory authorities, we will process the personal information you provide.

When dealing with adverse event reports and/or product quality complaints, we will record and use the personal information you provide, including:

the personal information of the patients: patient code, gender, age, date of birth, name initials, ethnicity, race, severity of adverse event, records related to treatment following adverse event, medical records, height, age at the time of the adverse event, weight at the time of the adverse event, reproductive information, gestational age, birth weight, medication records, name, email address, phone number, region, address, postcode, bank information, and ID number;
the personal information of the clinical trial subjects: gender, subject identification code, severity of adverse event, records related to treatment following adverse event, medical records, height, age at the time of the adverse event, weight at the time of the adverse event, reproductive information, gestational age, birth weight, medication records, and age;
the personal information of individuals who report adverse events, or submit product quality complaints ("reporters"): type, name initials, title, name, e-mail address, phone number, region, address, postal code, occupation, and fax.

For specific adverse events, we will additionally collect the name, age, date of birth, race, medical records, and medication records of patient partners during the follow-up process.

SENSITIVE INFORMATION

The health and physiological information that is bolded and underlined above is sensitive personal information. We need to collect sensitive personal information in order to deal with adverse event reports and product quality complaints and to meet the regulatory requirements of the relevant medicine regulation. We will take appropriate measures to protect your sensitive personal information and anticipate that the processing of your sensitive personal information will not have a material adverse effect on your personal rights and interests.

How we outsource, sharing, public or transfer your personal information

Outsource
For the purpose of providing services, we may engage third-party service providers for website hosting and moderation, mobile application hosting, data analytics, payment processing, order fulfillment, infrastructure provision, IT services, customer service, email and direct mail services, auditing, etc. During this process, we may allow the third-party service providers to process personal information necessary to perform their functions, but they may only process such personal information on our behalf for the purpose of providing the services to you.
Sharing
- We also disclose information to our affiliates for the purposes described in this Privacy Policy. A list of our affiliates is available at www.investor.jnj.com/financials/sec-filings/, click on the link for Form 10K, Exhibit 21, under " SEC Filings"
- Other pharmaceutical companies (if adverse events, product quality complaints are related to one of the company's products);
- Regulatory authorities, including the National Medical Products Administration of China, the European Medicines Agency (EMA), which controls the EU EudraVigilance database (https://www.ema.europa.eu), and the U.S. Food and Drug Administration (FDA);
- In addition, we may use and disclose your information as we believe to be necessary or appropriate: (a) to comply with legal process or applicable law; (b) as permitted by applicable law to respond to requests from public and government authorities; (c) to enforce our terms and conditions; and (d) to protect our rights, privacy, safety, or property, and/or the rights, privacy, safety, or property of our Affiliates', your or others' rights. We may also use and disclose your information in other ways, after obtaining your consent to do so.
Prior to specific sharing, we will notify you of the third party's name, contact information, the purposes and manners of processing, the categories of personal information processed and obtain your separate consent (if applicable) where required by applicable data protection laws.
Transfer
As permitted by applicable law, your personal information may be disclosed to a third party in the event of a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).
Public
We will not publish information that has not been published by yourself, except in compliance with applicable laws and regulations or with your consent.

How you can access, change, restrict or delete your personal information

If you would like to access, correct, update, restrict, or delete your personal information (subject to other relevant laws and regulations), or if you would like to request an electronic copy of your personal information for purposes of transmitting it to another company, please contact us by sending an email to cccdesk@its.jnj.com. We will respond to your request within fifteen (15) working days after confirming your request. If circumstances cause any delay in our response, you will be promptly notified and provided a date for our response.

CROSS-BORDER TRANSFER

Name and Contact Information of The Overseas Recipient	Johnson & Johnson Services, Inc. Address: 1 Johnson and Johnson Plaza, New Brunswick, NJ 08933, United States.
Purposes of Processing Personal Information by the Overseas Recipient	Currently, Xian Janssen utilizes the established and mature information systems and technologies of Johnson & Johnson’s Asia Pacific region to conduct its related business. This approach effectively reduces Xian Janssen's operating costs while ensuring coordination with Johnson & Johnson's Asia Pacific region in the use of these information systems. In order to fulfill the legal obligations related to pharmacovigilance, the Overseas Recipient is required to continuously monitor and collect pharmacovigilance information within China and globally, as well as other relevant information that may be related to patient safety, and after processing and analyzing the information, report to the relevant competent authorities in China and other countries on the adverse events and other relevant information found.
Methods of Processing Personal Information by the Overseas Recipient	The Overseas Recipient hopes that all affiliated parties worldwide will use the same information system as much as possible. This model can effectively ensure that any Johnson & Johnson Asia Pacific entity (including Xian Janssen) can receive unified support and maintenance when encountering information system issues. Through real-time aggregation and analysis of data, the information generated from clinical trials and post-marketing adverse events worldwide is aggregated and analyzed to form an assessment of the adverse events and confirm the level of the adverse events; at the same time, the information involved in the adverse events and the results of the analyses are submitted to local departments of Johnson & Johnson and its affiliates responsible for submitting pharmacovigilance related reports, in order to report the adverse events to the drug regulatory authorities in accordance with the local requirements.
Categories of Personal Information Provided to the Overseas Recipient	If you are the patients, we may provide the following personal information about you to the Overseas Recipient: Basic personal profiles: patient code, gender, age, name initials, race; Personal health and physiological information: severity of adverse event, records related to treatment following adverse event, medical records, height, age at the time of the adverse event, weight at the time of the adverse event, reproductive information, gestational age, birth weight, medication records.
	If you are the clinical trial subjects, we may provide the following personal information about you to the Overseas Recipient: Basic personal profiles: gender, subject identification code; Personal health and physiological information: severity of adverse event, records related to treatment following adverse event, medical records, height, age at the time of the adverse event, weight at the time of the adverse event, reproductive information, gestational age, birth weight, medication records.
	If you are the patient partners, we may provide the following personal information about you to the Overseas Recipient: Basic personal profiles: name, age, race Personal health and physiological information: medical records, medication records.
	If you are the reporters, we may provide the following personal information about you to the Overseas Recipient: Basic personal profiles: type, name initials, title
Methods of the Exercise of Rights by Individuals against the Overseas Recipient	You may exercise your rights related to your personal information by contacting Chinaprivacy@its.jnj.com, and the Overseas Recipient will respond to your request within the time required by law or regulation.
Retention Place and Period	Your data will be stored in a secure manner primarily in our suppliers' data centers in the United States and we will store your personal information for the shortest period necessary to achieve the purpose of the processing.

SECURITY

We strictly comply with relevant laws and regulations and adopt comprehensive personal information protection measures. We have established a dedicated data security management department and, in accordance with data classification and grading standards, developed and implemented corresponding management systems and technical measures throughout the entire data lifecycle. Specific measures include:

• Our network services employ encryption technologies such as Transport Layer Security (TLS) protocols, providing browsing services via HTTPS to ensure the security of users’ personal information during transmission;

• Based on data classification and grading, we adopt corresponding encryption measures for data storage and use isolation technologies for security isolation;

• We regularly conduct security assessments and audits on network devices at security boundaries, promptly patch vulnerabilities, and eliminate weak passwords;

• We regularly perform system and code-level vulnerability scans, promptly patching discovered security vulnerabilities and non-compliant configurations;

• We have established strict data usage and access systems, employing rigorous data access permission controls to protect personal information and prevent unauthorized use of your personal information;

• We have implemented data and technical security audits, establishing log audit and behavioral audit mechanisms to ensure secure and controllable processes;

• We also regularly organize security and privacy protection training programs to continuously strengthen employees’ awareness of the importance of protecting personal information;

• In addition, we have established a dedicated department responsible for security emergency response and personal information security assurance, ensuring rapid and effective response and handling in the event of emergencies.

If you discover that your personal information may have been or has been leaked or is in an insecure state, please immediately contact us through the contact information provided in the “Contacting Us” section below, so that we can take appropriate measures to avoid or mitigate related losses. We will continue to improve our security system and effectively safeguard the security of your personal information. Currently, our important information systems have all passed the assessment requirements for cybersecurity classified protection.

RETENTION PERIOD

We will retain your personal information for the shortest period as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide the service to you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

After the necessary storage time unless otherwise permitted by laws, administrative regulations or agreed by you, we will delete your personal information.

CONTACTING US

Xian Janssen Pharmaceutical Co., Ltd. located at No.19, Cao Tang 4th Road, Cao Tang Science and Technology Industry Base, Hi-Tech Zone, Xian, Shaanxi, is the Data Controller under this Privacy Policy.

We provide support for any questions, comments, concerns or complaints related to personal information protection, and also support you in exercising any rights related to personal information protection. The Data Protection Officer can be contacted at Chinaprivacy@its.jnj.com.

We will always make our best efforts to handle and resolve any requests or complaints brought to our attention. In addition, you may also submit requests or complaints to the regulatory authorities.

UPDATED TO THIS PRIVACY POLICY

We may change this Privacy Policy. Any changes to this Privacy Policy will become effective when we post the revised Privacy Policy on the website. Your provision of personal information following these changes means that you accept the revised Privacy Policy, but we will re-obtain your consent if required by the applicable law. We recommend that you regularly review the Privacy Policy when you provide personal information.
[This policy was last updated in July 2026]