IQVIA Solutions Malaysia Sdn Bhd (the “Company”) shall collect, store, and process information (the "Personal Information") of each patient (the “Patient”) and where applicable the Patient’s Parents or legitimate guardian who registers to the OneCare program (the "Program") that is sponsored by GlaxoSmithKline Pharmaceuticals Sdn Bhd (the “GSK”). In this Privacy Policy (the "Privacy Policy") the Company discusses how Personal Information is collected, protected, stored, processed, and shared. Terms capitalized which are not defined herein in this Privacy Policy shall have the meaning as set out in the Patient Terms and Conditions.

By agreeing to the Privacy Policy, you, the Patient fully understands, acknowledge, accepts and will comply in its entirety without exception.

1.1. From the Patient

1.1.1. First name

1.1.2. Last name

1.1.3. Birthday

1.1.4. WhatsApp number

1.1.5. Email address

1.1.6. Preferred language

1.1.7. Prescribed medicine

1.1.8. Picture of prescription

1.1.9. Home address (for face-to-face visit)

1.2. From the legal guardian

1.2.1. First name

1.2.2. Last name

1.2.3. WhatsApp number

1.2.4. Email address

1.2.5. Preferred language

1.3. For Alternative Funding Navigation Patients

1.3.1. Other documents and information necessary for the accomplishment of the applications for alternative funding.

2.1. The Patients provide consent to continue the use of his/her Personal Information for the purpose of, but is not limited to:

2.1.1. Registering for the Program.

2.1.2. Fulfilling the Program’s Services.

2.1.3. Providing customer support.

2.1.4. Fulfilling all reporting responsibilities.

2.1.5. Analysis of Program performance and other metrics.

2.1.6. Fulfilling activities required by GSK regarding Adverse Events (AE) reporting and product complaints reporting.

2.1.7. Any other purpose that is relevant to the performance of this Program

2.2. The Company shall seek the patient’s consent in case there are other processes that will be done with his/her Personal Information other than the identified purposes above.

3.1. It may be necessary for the Company to share Personal Information with third parties for the purpose of fulfilling, such as, but is not limited to, service provider vendors, outsourced personnels, affiliates, and subsidiaries.

3.2. THE COMPANY REQUIRES THESE THIRD PARTIES TO PROTECT THESE PERSONAL INFORMATION SHARE TO THEM IN COMPLIANCE TO THE AGREED TERMS AND CONDITIONS PRIOR TO CONTRACTUAL. IN THE EVENT OF ANY BREACH COMMITTED BY THESE THIRD PARTIES, THE COMPANY SHALL NOT BE LIABLE FOR ANY DAMAGES, INCONVENIENCE, AND/OR LOST THAT MAY OCCUR.

4.1. The Company transfers and holds all personal data of the patients in servers in Singapore. The Company shall ensure security measures are put in place and in practice to protect all Personal Information from collection, storage, processing, and sharing;

4.2. Reasonable and measures deemed appropriate by the Company are to be in constant practice such as, but is not limited to, procedural safeguards, and physical and digital storage security;

4.3. No patient identifiable and confidential data are to be shared to GSK except for adverse events and product complaints related matters where it may be necessary for GSK to be aware of such information.

4.4. Only permitted individuals identified by the Company shall have access and shall be allowed to process Personal Information respective for the purposes identified in section 2, User of Collected Data; strict compliance to this Privacy Policy will be required from these individuals;

4.5. All Personal Information and data recorded through and for the Program shall be retained for 10 years from termination of the Program. Such data may still be used to generate physical and/or digital statistical or analytical report, and other research-purpose output to be done by the Company, third party service provider vendors, outsourced personnels, affiliates, and subsidiaries; and

4.6. THE COMPANY SHALL NOT USE NOR PERMIT THE USE OF PERSONAL INFORMATION COLLECTED, STORED, PROCESSED, AND SHARED FOR THE PURPOSE OF DATA TRAFFICKING.

5.1. The Patient has the right to access, correct and limit the Company’s processing of their own Personal Information. To exercise such right, the Patient may reach out to the Program’s Customer Support (contact details are listed at section 6 Acceptance). By exercising such a right, the Patient fully acknowledges, understands, and accepts that based on the limitations set, they may not partially or fully receive the complete benefits of the Program.

5.2. The Patient has the right to inquire about the Company’s process in collecting, protecting, storing, processing, sharing, and eventually erasing their Personal Information. To exercise such right, the Patient may reach out to the Program’s Customer Support (contact details are listed at section 6 Acceptance).

6.1. Failure to completely accept this Privacy Policy shall disqualify any individual from participating in the Program.

6.2. By accepting this Privacy Policy, the Patient confirms that he/she fully understood all the terms stipulated and agrees to comply upon acceptance.

6.3. The Company reserves the right to change, modify or amend any of this Privacy Policy without giving prior notice to the Patient.

6.4. These terms and conditions shall be governed by and construed in accordance with the laws of Malaysia.

6.5. For any questions or concerns relating this Privacy Policy and/or about Patient Personal Information in the Program, Patient may contact the following:

Program Customer Support

Email Address: my_onecare@psplink.com

Contact Number: 012-620 2316