Cipla respects your privacy and are committed to protect the privacy and security of your personal data. Cipla urges you to carefully read and review this Privacy Policy Statement before accessing or using the My Cipla mobile application (hereinafter referred to as “My Cipla”). This Policy explains how we obtain, use, and disclose your personal information as we are required in terms of the Protection of Personal Information Act, 2013 (“POPI Act”). If you proceed to access or use My Cipla, you are agreeing to abide by this Privacy Policy statement, without any exceptions. You may not access or use My Cipla if you do not agree to this Privacy Policy statement. Cipla Limited, its subsidiaries, its affiliates, and its group companies (hereinafter referred to as “Cipla”) reserve the right to add, remove or modify this information at any time without any prior notification.

This Privacy Policy (“Privacy Policy”) has been developed to acknowledge the importance of and assist in providing a framework for, the appropriate level of protection for consumer identification, collection, holding, using, disseminating, merging, collating, disclosing and protection of your personal information (“process” or “processing”). The policy represents Cipla’s commitment to compliance with its obligations under the POPI Act.

Collection of Personal Information

My Cipla is not designed to collect and/or receive any personal information of you by itself. Cipla is not able to identify you personally unless you access My Cipla and/or provide any personal information.

Active collection of information: Cipla collects personal information that you enter into data fields on My Cipla. For example, you may submit or share your name, postal address, e-mail address, investor details, profession, photograph, medical records and/ or other personal information in order to receive information about various subjects and services wherever applicable. To protect your privacy, you should not provide Cipla with any information that is not specifically requested. When you register using your other accounts like on Facebook, Twitter, Gmail etc. we shall retrieve information required for your registration from such account to continue to interact with you and to continue providing the services, wherever applicable.

Passive Collection of information: My Cipla may collect information about your visits to My Cipla without you actively submitting such information. This information may be collected using various technologies, such as Internet tags, and web beacons. My Cipla may capture some of this information, such as the URL of the website you just visited, Internet Protocol (IP) addresses, GPS location data, mobile phone service provider, details of operating system, the browser version of your computer/device, etc. Passive information collection technologies can make your use of My Cipla easier by allowing Cipla to provide better service, customize sites based on consumer preferences, compile statistics, analyse trends, and otherwise administer and improve My Cipla. Such information collected by these technologies cannot be used to identify you without additional identifiable information.

Purposes for which we use your Personal Information

Cipla will use the personal information you provide through My Cipla to respond to your questions or enquiries made on My Cipla, have efficient communication and to provide you with efficient service. After you have entered personal information into a form or data field on My Cipla, Cipla may use certain identifying technologies to allow My Cipla to "remember" your personal preferences, such as sections of the My Cipla that you visit frequently and, if you choose, your login credentials.

Cipla shall collect, store, and use your personal information in compliance with provisions of the POPI Act and all other applicable laws. You may always limit the amount and type of personal information that Cipla receives about you by choosing not to enter any personal information into forms or data fields on My Cipla. Some of our online services can only be provided to you if you provide us with appropriate personal information. Other parts of My Cipla may ask whether you wish to opt out or opt into our contact lists for offers, promotions and additional services that may be of interest to you. If opted to do so, we may use this information for marketing and promotional purpose. For example, in accordance with POPI Act and other applicable laws and with your consent, we will use your email address to send you news and newsletters, special offers, and promotions, and to contact you about products or information we think may interest you. We may also reach out to you with response to any queries posted on My Cipla.

We will further use your personal information for the following purposes:

To provide our products or services to you, to carry out the transaction you requested and to maintain our relationship;
To assess and process any relevant queries and complaints;
To confirm and verify your identity, address and banking details, where applicable;
For pharmacovigilance and other product safety related matters;
For any Human Resources and recruitment purposes;
To verify that you are an authorised user for security purposes;
For maintaining the accuracy of your personal information;
For operational purposes, and where applicable;
For the detection and prevention of fraud, crime, money laundering or other malpractice;
To trace you where you are uncontactable;
To conduct market or customer satisfaction research or for statistical analysis;
For audit and record keeping purposes;
Social responsibility; and
In connection with legal proceedings.

Transfer of information between us and a third-party supplier

The personal information you provide may be transferred across foreign borders.

This information transfer is permitted under Chapter 9 of POPI Act which authorises the access seeker (known as the responsible party) permission to transfer the information across foreign borders in the following circumstances:

· the person receiving the information (outside of the Republic), must be governed by laws, binding corporate rules, binding agreements or memorandum of understanding between two public bodies which provide an adequate level of protection; or

· You must consent to the transfer; or

· the transfer must be necessary for:

the performance of a contract between you and the Responsible Party, or for the implementation of pre-contractual measures taken in response to your request;

the conclusion or performance of a contract concluded in your interest between the Responsible Party and a third party; or

the transfer is for your benefit and: –

o it is not reasonably practicable to obtain your consent for that transfer; and

o if it were reasonably practicable to obtain such consent, you would provide it.

We will not share your personal information with any other third parties or use your personal information for any purpose other than described above. The information collected by us that you provide will not be used to make any automated decisions about you.

Spamming

We do not support “spamming". In accordance with your preferences, we may send periodic emails to you if you have asked us to send you information, or if you have provided your details to us while registering for any of our promotional campaigns. You may choose to opt out of receiving marketing-related information through a link we include on emails you receive from us.

Non-Disclosure of Information

Personal information on My Cipla may be accessed by Cipla, by certain companies with which Cipla may conduct joint programs, and by individuals and entities with whom Cipla contracts to carry out business activities for Cipla.

Cipla does not sell or rent your personal Information with anyone else.

Cipla may share the personal information with third-party if it is required for further processing or connection to its business. During this time, the information shared will be in accordance with the confidentiality agreement with the third party, POPI Act and other applicable law for the intended purpose for which the personal information was originally collected and shall ensure all such third parties comply with Cipla’s Data Protection and Privacy Policy and Procedure.

We may release your personal information when we believe release is required to comply with POPI Act or any other applicable law. We may release personal information if, in our judgment after review, the release is compelled by law or regulation.

Protection of personal information

Cipla will maintain adequate technical and organizational security measures to protect personal information. In all circumstances the personal information is held by us on our secure systems or data base. We undertake to take all reasonable and necessary steps to secure the integrity and confidentiality of your personal information and protect your information from misuse, loss, interference, unauthorised access, modification, or unauthorised disclosure.

As a policy, Cipla secures each web page that collects personal information; however, the confidentiality of personal information transmitted over the Internet will not be guaranteed. We urge you to exercise caution when transmitting personal information over the Internet.

Cipla is not obliged to store your personal information for a period which is beyond the intended purpose for which such information was collected or submitted or to stay in compliance to applicable laws and Cipla Policies and Procedures.

Links to other websites

This Privacy Policy applies only to My Cipla. Cipla may provide links to other websites, which we believe, may be of interest to you. Cipla is not responsible for the content on such website, your access to such website links, security of personal information that you provide, or any information collected by that website. The risk of accessing such websites is solely yours.

Use of My Cipla by children

Cipla does not knowingly collect or use any personal information from children (we define "children" as those who are younger than 18 years of age) on My Cipla. We do not knowingly allow children to communicate with us or use any of our online services. If you are a parent or guardian and become aware that your child has provided us with personal information, please contact us and we will work with you to address this issue.

Rights to your personal information on My Cipla

Right to access: You have the right to ask for a copy of your personal data and to verify how we are processing it.

Right to rectification: If you believe we have inaccurate or incomplete information about you, you have the right to ask us to correct or update it.

Right to be forgotten: In certain circumstances, you have the right to ask us to remove or erase your personal information from our records.

Right to object: You have the right to object to processing of your personal information. You also have the right not to be subjected to any automated decision making or profiling.

Right to restriction of processing: You have the right to ask us to restrict processing of your personal information in cases where the data is inaccurate, or the processing of the data is unlawful. This does not restrict Cipla from processing of your personal information for legal and regulatory requirements.

Right to withdraw consent: If we process your personal information based on your consent, you can withdraw your consent at any point of time.

Right to portability: You have the right to ask us to transfer your data to you, or any other third party.

In all communications to Cipla, please include the e–mail address used for registration (if applicable) and explanation of your request. If you would like to delete or amend your personal information and are contacting us by e-mail, please put "Deletion Request" or "Amendment Request", as applicable, in the subject line of the e-mail. We will do our best to respond to all reasonable requests in a timely manner. To exercise any of your right mentioned in this policy please send an email to info.sa@cipla.com.

Complaints and Grievances

You may complain about our failure to comply with POPI Act, there are 2 ways you may complain:

In writing, by sending an email to info.sa@cipla.com.

If you are a resident in South Africa, you can lodge a complaint to the Regulator completing the form as prescribed.

There is no charge for lodging a complaint. We will write to you acknowledging receipt of the complaint. After appropriate investigation, the Privacy Manager will write to you as soon as practicable after a decision has been reached, outlining the decision and the reasons for reaching it.

Change in Policy

Cipla reserves the right to amend this Privacy Policy without prior notice to reflect technological advancements, legal and regulatory changes, and good business practices. If Cipla changes its privacy practices, a new Privacy Policy will reflect those changes and the effective date of the revised Privacy Policy will be set forth in this paragraph.

This Privacy Policy was last updated on 01 July 2021 and is effective as of that date.