This Privacy Policy (the "Policy") explains the way of treatment of the information which is provided or collected in the websites on which this Policy is posted. In addition the Policy also explains the information which is provided or collected in the course of using the applications of the Company which exist in the websites or platforms of other company.

1. Information to be collected and method of collection

Personal information items to be collected Personal information items to be collected by the Company are as follows:

• Healthcare professional: Name, gender, country, contact information (mobile or landline phone number, email), name of institution (hospital), title/position, address, photograph, account number of financial institutions such as banks and securities companies (including depositor and name of financial institution), and other information submitted or provided by the healthcare professional.

• Patients: Name, age, gender, date of birth, address and telephone number, body-related information, medical history, health information such as medications, health information confirmed through medical examinations and tests conducted in the course of business such as clinical trials or adverse event investigations (height, weight, race, smoking status, fertility, health status, etc.), family information (personal information of limited family members), and other information required in connection with various businesses and programs conducted by the Company.

• Business Partners: Name, contact information (mobile or landline phone number, email, fax number), social security number, details of expenses incurred in providing services, and account numbers of financial institutions such as banks and securities companies (including the name of the depositor and financial institution) of contracting parties such as wholesalers and marketing agencies.

2. Collection and Purpose of Use of Personal Information
The company processes the personal information of data subjects for the following purposes:

• Medical and Pharmaceutical Research Activities: Analysis of data collected through clinical trials, post-market investigations, and other pharmaceutical and medical science research activities.

• Marketing and Dissemination of Medical Information: Dissemination of pharmaceutical-related information in accordance with the Pharmaceutical Affairs Act, Fair Competition Agreement on Pharmaceutical Transactions by the Korea Pharmaceutical and Bio-Pharma Manufacturers Association, marketing activities, advertising information dissemination, and promotional activities for pharmaceutical products.

• Execution of Service Contracts: Verification of the identity of the contracting party, determination of contract conclusion, payment of service fees such as lecture fees and consulting fees, communication within the scope necessary for the performance of the contract, handling of disputes and complaints related to the contract, preparation and retention of evidence for the conclusion and performance of contracts.

• Legal and Administrative Obligations of the Company: Reporting of side effects and adverse drug reactions in accordance with relevant laws such as the Pharmaceutical Affairs Act, submission of required documents, application for review of clinical trial plans (plan changes) under the Pharmaceutical Affairs Act, registration, implementation status, and results reporting for clinical trials, compliance with obligations to report, prepare, retain, and submit expenditure reports related to the provision of economic benefits under the Pharmaceutical Affairs Act, filing and payment of various taxes such as corporate tax and value-added tax, issuance and provision of receipts and tax invoices, and compliance with legal and administrative obligations imposed on the company.

• Responding to Customer Inquiries.

• Execution of Various Programs for Patients and Others.

3. Retention and Use Period of Personal Information
The company promptly destroys personal information when the purpose of collection and use is achieved or when the agreed-upon retention and use period with the data subject expires. However, if there is a need to retain information under relevant laws, the company will retain the information for the period specified by such laws.

4. Destruction Procedure and Method

• Destruction Procedure: Personal information is transferred to a separate database (or filed separately for paper documents) after the purpose is achieved and is stored for a certain period in accordance with the company's internal policy and other relevant laws before being destroyed.

• Destruction Method: Personal information stored electronically is permanently deleted using technically irreversible methods. Personal information on paper is shredded or incinerated to ensure it cannot be reconstructed or reproduced.

5. Provision of Personal Information to Third Parties
Except where permitted by the Personal Information Protection Act, the company does not provide the personal information of data subjects to third parties without the consent of the data subjects or as required by relevant laws. The current status of the company providing personal information to third parties is as follows: