ViiV HEALTHCARE US PRIVACY NOTICE

Last Updated:

November 4, 2024

This Privacy Notice sets out how ViiV Healthcare (“ViiV”) collects, uses, transfers, processes, and discloses your data and sets out our security practices. We respect your privacy and are committed to protecting your personal information.

When we say “ViiV”, “we”, “us” or “our”, this is who we are referring to ViiV Healthcare.

Please note, our privacy practices are subject to the applicable laws of the places in which we operate.

We may change this Privacy Notice from time to time. We encourage you to review this Privacy Notice periodically.

Specific State Resident’s Supplemental Notice: Please review our State Specific Resident’s Supplemental Notice (“Supplemental Notice”). This notice applies to residents of California, Colorado, Connecticut, Montana, Oregon, Texas, Utah and Virginia. This Supplemental Notice provides additional details about our privacy practices related to your personal information as required by the applicable U.S. Privacy Laws in your state of residence. Some portions of this Supplemental Notice apply only to residents of particular states. In those instances, we have indicated that such language applies only to those residents.

Specific State Consumer Health Data Rights: Please see our Consumer Health Data Privacy Notice for information about rights you may have as a Washington or Nevada resident relating to your Consumer Health Data.

Employees and Job Applicants: If you are a ViiV employee or job applicant, please also refer to the ViiV Candidate Privacy Notice (available as part of the ViiV applicant process) or the Employee Privacy Notice (available from Human Resources) for additional information about our data processing practices.

In this privacy notice, we explain:

What personal information do we collect about you?

The personal information, including sensitive personal information, that we collect, and process/or disclose may include, both currently and in the preceding 12 months:

Categories of PI Collected	Applicable Categories of Individuals
Name, Contact information and Unique Identifiers: Identifiers, such as a real name, alias, postal address, telephone number, unique personal identifier, online identifier, device ID, internet protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, National Provider Identifier Standards, or other similar identifiers as well as demographic information such as date of birth, place of birth, country of residence, income, family size, marital status, etc. An individual’s written or digital signature.	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators, Site Staff and Participants Patients Customers Website Visitors Caregiver Authorized Representative
Financial Information: Bank account number, credit or debit card number, credit reports, background checks or other financial information.	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators
Medical Information: Any information in possession of or derived from yourself, a healthcare provider, healthcare insurer, healthcare service plan, pharmaceutical company, or contractor regarding an individual’s medical history, mental or physical condition, or treatment. This includes an individual’s insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in the individual’s application and claims history (including prescription information).	Employees Candidates for employment Contractors Clinical Trial Participants Patients Customers Caregiver Authorized Representative
Protected Characteristics: Characteristics of legally protected classifications such as race, gender, age, nationality, physical or mental disability, and religion.	Employees Candidates for employment Clinical Trial Participants Patients
Purchase History and Tendencies: Information regarding products or services purchased, obtained, or considered.	Health Care Providers Patients Customers Website Visitors Caregiver Authorized Representative
Biometric Information: Physiological, biological, or behavioral characteristics that can establish an individual’s identity, including DNA, face, iris or retina imagery, fingerprint, voice recordings and sleep, health, or exercise data that contain identifying information.	Employees Candidates for employment Contractors Clinical Trial Participants Patients Customers Website Visitors Caregiver Authorized Representative
Network Activity: Internet or other electronic network activity information, such as browsing history, search history, and information regarding an individual’s interaction with an internet website, application, or advertisement. Includes analytics evaluation and cookies.	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators and Site Staff Patients Customers Website Visitors Caregiver Authorized Representative
Geolocation Data: Precise geographic location information about a particular individual or device, including geolocation information derived from your GPS, WiFi and Bluetooth signals, IP address, and other device information.	Employees Candidates for employment Contractors Health Care Providers Patients Customers Website Visitors Caregiver Authorized Representative
Electronic and Sensory Data: Audio, electronic, visual, or similar information (e.g., a recording of a customer service call, answers to a quiz/questionnaire or profile photograph).	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators, Site Staff and Participants Patients Customers Website Visitors Caregiver Authorized Representative
Education and Professional Information: An individual’s academic information and records, resume, professional credentials (such as field of expertise and specialization, institutional affiliations, and scientific activities, such as previous clinical trial experience, activity on social media platforms, and participation in past or current research studies with us or other companies), information related to your practice (such as license information and disciplinary history), publication of academic or scientific research and articles, membership in association and boards, information provided to participate in our sponsored initiatives (such as clinical research and development activities or promotional activities), and information about your professional experience and interactions with ViiV, such as the kinds of meetings we have held and the topics covered.	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators and Site Staff Website Visitors
Inferences: Inferences drawn from any of the information listed above to create a profile about an individual reflecting the individual’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. We may combine the information we collect about you from different sources, including to draw these inferences.	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators, Site Staff and Participants Patients Customers Website Visitors Caregiver Authorized Representative Households
Correspondence or communications you send to us.	Employees Candidates for employment Contractors Health Care Providers Clinical Trial Investigators, Site Staff and Participants Patients Customers Website Visitors Caregiver Members of the Media Members of the Public Authorized Representative

How do we collect your personal information?

We and our service providers collect personal information in a variety of ways, including from:

directly from you or an authorised representative;
government entities;
public records;
research partners;
data resellers;
marketing vendors
joint marketing partners
publications
business service providers.

How do we use your personal information?

We use your personal information for the purposes we have described below in this Privacy Notice, or for purposes which are reasonably compatible with the ones described.

To manage our relationship with you.

We will use your personal information:

To respond to your requests;
To improve our level of service;
To provide our products and services to you;
To promote our products and services;
To manage your account, if necessary;
To provide you with information when you request it
To provide information when we believe it may be of interest to you;
To invite you to provide your views on our products and services, participate in research or attend events;
To report any product adverse events that you notify us about;
To consider your application for employment;
To perform analytics and understand your preferences;
To create aggregated and anonymized or de-identified data;
To provide access where required to our sites and facilities;
To assist with sales compensation;
To perform identity verification
To detect and prevent fraud
Exercise and defend legal claims
To gain insights and feedback on our products and services in order to correct or improve them, by analysing information from external sources such as Google, Facebook and Twitter (and others);
For our own internal administrative and quality assurance purposes; and
For other purposes that may be detailed on a website or mobile application which will be described at the time the information is collected.
To manage and improve our processes and our business operations.

We will use your personal information to:

Manage and protect our network and information systems security
Project our equipment and facilties
Conduct risk and security assurance measures
Manage our workforce effectively;
Prepare and perform management reporting and analysis, including analytics and metrics

To achieve other purposes.

We will use your personal information:

To follow applicable laws and regulations;
To respond to lawful requests from competent public authorities;
To tell you about changes to our terms, conditions and policies;
To exercise or defend ViiV against potential, threatened or actual litigation;
To detect fraud and risk
To protect ViiV’s or your vital interests, or those of another person;
To disclose any transfers of value made to you in relation to expert services that you provide to us;
For the purpose of authorship of a scientific publication;
To respond to and handle your queries or requests;
To assist with product safety and recalls; and
When we sell, assign or transfer all or part of our business.

Website and mobile application usage information

We also collect information about your computer browser type and operating system, websites you visited before and after visiting our websites, standard server log information, Internet Protocol (IP) addresses, location data, mobile phone service provider, and mobile phone operating system.

We use this information to understand how our visitors use our websites and mobile applications so that we can improve them, the services we offer, and our advertising. We may also share this information with other companies within the ViiV group and with other third parties, including through the use of cookies and similar technologies, as discussed below.

Use of IP addresses

An IP address is a set of numbers that is automatically assigned to your computer whenever you log on to your Internet service provider or through your organization’s local area network (LAN) or wide area network (WAN). Web servers automatically identify your computer by the IP address assigned to it during your session online.

ViiV, or third-party companies acting on our behalf, may collect IP addresses for the purposes of systems administration and to audit the use of our websites. We also may use IP addresses to identify users of our websites when we feel it is necessary to enforce compliance with the websites’ terms of use or to protect our service, websites or other users.

How do we use cookies and similar technologies?

Our websites and mobile applications may use technology called “cookies” and similar technologies, such as web beacons (collectively “cookies”). A cookie is a small text file that is placed on your hard disk by a server. Cookies and similar technologies allow our websites and mobile applications to respond to you and provide a more personalized experience.

The website or mobile application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. For example, our server may set a cookie that keeps you from having to enter a password more than once during a visit to a website.

Our advertising partners also may use these technologies to display advertising tailored to your interests on other websites and services, although you have a number of choices as described further below. We are not responsible for the privacy practices of these advertising partners.

Cookies and Targeted Advertising Choices

In this section, we describe choices you have with respect to cookies, including those used for targeted advertising. Many of the choices you have are browser-based choices, which means they will apply only to the specific browser you use when you opt out or exercise the applicable choice. You will need to opt-out separately on all your browsers. In addition, if you delete cookies, change browsers, or use a different device, you may need to opt out or exercise your choice again.

Browser and Device Settings. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies or receive a warning before a cookie is stored if you prefer. Please refer to your Internet browser’s instructions or help screen to learn more about these functions and to specify your cookie preferences, and note that your browser controls might not control other types of technologies. You may also wish to refer to https://www.allaboutcookies.org/manage-cookies/index.html. If you choose to decline all cookies, you may not be able to fully experience the interactive features of our websites or any other websites that you visit. Please check your device settings and mobile app permissions for additional information on how to opt out.

Do-Not-Track Signals, Global Privacy Control, and Similar Mechanisms. Some web browsers transmit "do-not-track" signals to websites. Because the “do-not track” browser-based standard signal has yet to gain widespread acceptance, we don’t currently respond to those signals. However, we support the Global Privacy Control in certain jurisdictions [such as California], as described below in the “Your Opt-Out Rights” section.

Your Opt-Out Rights. In accordance with applicable laws for your state (Please review the Supplemental Notice), you can opt out or withdraw consent of processing of your personal information for targeted advertising by:

clicking the “Your Privacy Choices” link at the bottom of relevant web pages or within relevant apps and then toggling off targeting cookies; or
broadcasting the Global Privacy Control, which ViiV supports in certain jurisdictions to facilitate state opt-out rights. The Global Privacy Control is a browser-based setting that communicates your preferences to opt out of processing for targeted advertising to online services that you visit. Please visit the Global Privacy Control website to learn more about the setting and how to enable it for each participating browser system that you use.

In addition, in accordance with applicable laws for your state, you may request to opt out of any non-cookie based (i.e., offline) sharing of their personal information for targeted advertising by submitting a request via the Individual Privacy Rights Request Self-Service Form and providing the requested information.

Please note that ViiV and its service providers may still use technologies for ViiV’s advertising and other purposes in accordance with applicable laws.

Unsubscribe. You may always choose to use ViiV’s unsubscribe process to remove yourself from categories of our marketing communications. Please use the Individual Privacy Rights Request Self-Service Form.

Other Industry Choices. Some advertising partners may participate in an industry organization that offers users an opportunity to opt out of ad targeting. To learn more, including about how to opt out from interest-based advertising, please visit About Our Ads. You may download the AppChoices application at www.aboutads.info/appchoices to opt out in mobile apps. Due to the differences between using apps and websites on mobile devices, you also should check the settings for your apps and device to opt out. For more information about targeted advertising, please see the Network Advertising Initiative’s (NAI) opt out page.

Some of our websites may use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to analyze use patterns and may collect information about your use of the website, including your IP address. More information on Google Analytics can be found here: https://policies.google.com/technologies/partner-sites. If you would like to opt-out of having your data used by Google Analytics, please use the Google Analytics opt-out available here: https://tools.google.com/dlpage/gaoptout/.

How long do we keep your personal information?

We keep your personal information for as long as needed or permitted for the purpose(s) described in this privacy policy and consistent with applicable law. In addition, we might keep the information for longer based on criteria such as applicable rules on statute of limitations, any legal requirements to retain your personal information in light of compliance obligations, any relevant litigation or regulatory investigations, and the duration of your use of our website and receipt of our services.

With whom do we share your personal information?

We share your personal information on a need-to-know basis, to the extent necessary to follow laws and regulations, and to manage the activities related to our relationship with you.

We share your personal information with teams in our ViiV companies and affiliates who need to see it to do their jobs. Please refer to the list of our affiliates and their locations.

In some cases, our relationship with you is supported by specialized service providers working on our behalf. These service providers are contractually-required to protect your personal information and not to use it for their own purposes.

These specialized service providers include:

advertising partners that provide us services;
internet service providers;
data analytics providers;
operating systems and platforms;
social networks;
joint marketing partners; and
research partners.

We will share your personal information with local or foreign regulators, or government and law enforcement authorities as necessary or appropriate, in particular when we have a legal obligation to do so. These may be in or outside your country of residence. We may also disclose your personal information for other legal reasons, such as to enforce our terms and conditions; and protect our rights, privacy, safety or property, and/or that of our affiliates, you or others.

We may share your personal information in connection with a sale or business transaction, such as a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We may also share information with advertising partners as described in the section entitled “How do we use cookies and similar technologies?” and for any other purposes disclosed to you at the time we collect the information or pursuant to your consent.

In what instances do we transfer your personal information outside of your home country?

This website and Privacy Notice are intended only for individuals within the United States. However, ViiV works all over the world. Therefore, we may need to transfer and use your personal information outside of the United States. We implement appropriate measures to protect your personal information when we transfer your personal information outside of your home country, such as data transfer agreements that incorporate standard data protection clauses. The data privacy laws in the countries we transfer it to may not be the same as the laws in the United States. Law enforcement agencies, regulatory agencies, security authorities or courts in the countries we transfer your personal information to may have the right to see your personal information.

Additional information if you travel to the European Economic Area (EEA)

The European Commission recognizes that some countries outside the EEA have similar data protection standards. See the the full list of these countries.

If we transfer your personal information to a country not on this list, we do so based on our Binding Corporate Rules (BCRs) and standard contract clauses adopted by the European Commission. These enable us to make international transfers of personal information within our group of companies and meet the data protection laws of the European Union and the General Data Protection Regulation (GDPR).

How do we protect your personal information?

ViiV will take appropriate legal, organizational, and technical measures to protect your personal information consistent with applicable privacy and data security laws.

Unfortunately, the transmission of information via the Internet or a mobile phone network connection is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of the personal information you transmit to our websites or mobile applications: any transmission is at your own risk. While we cannot guarantee that loss, misuse or alteration to data will not occur, once we have received your information, we will employ appropriate technical security measures to help prevent such unfortunate occurrences.

What are your rights and choices regarding your personal information?

Data Subject Rights:

You may be entitled under applicable laws to request:

That we provide you transparency about our privacy practices, including copies of your personal information that we process, subject to some exceptions;
Provide portability of your information, subject to some exceptions;
Correct information that is inaccurate or incomplete, subject to some exceptions; and
Delete your personal information, subject to some exceptions.
Where allowed in your jurisdiction, the ability to opt out of the sale or sharing of your information.

To make a request or to express a privacy concern, you or your authorized agent should use our online webform available at: Individual Privacy Rights Request Self Service Form. To appeal a request you feel was denied in error, please respond to the contact information provided in the response denying your request.

For additional contact information, please refer to the “Contact Information and Privacy Point of Contact” section.

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. For your protection, and to protect the privacy of others, we may need to verify your identity before completing what you have asked us to do. We may need to request additional personal information from you, such as your home address, email address and government issued ID, in order to protect against fraudulent or spoofed requests. If you want to make a request as an authorized agent on behalf of an another individual under applicable law , you may use the submission methods noted in the “Contact Information and Privacy Point of Contact” section. As part of our verification process, we may request that you provide us with proof that you have been authorized by the individual on whose behalf you are making the request, which may include signed permission. If you object to us using your personal information or withdraw permission for us to use your personal information, after initially giving it to us, we will respect your choice in line with applicable law. While we will do our best to limit the ability such withdrawal has on our ability to provide you services and information you requested, some of the functionality and features available on our services may change or no longer be available to you.

We will not discriminate against you for exercising your rights and choices, although some of the functionality and features available on our websites and online services may change or no longer be available to you. Any difference in services are related to the value provided.

Separate from data subject rights afforded to you under applicable law, you may have commercial relationships with specific ViiV teams whom you may contact for information about matters relating to your relationship with those business teams, including:

Reportable Payments: CMS Helpdesk 1-855-326-8366 openpayments@cms.hhs.gov

For information about our data handling and your rights in connection with a ViiV Patient Assistance Program, please contact us at the following: https://contactus.viivhealthcare.com/consumer-contact-form/

Our responsibility regarding websites that we do not own or control

From time to time, we may provide links to websites or mobile applications that are not allowed or controlled by us or embed third party websites or content or work with third parties to display advertising on third party websites or services. Our Privacy Notice does not cover them. Please read the privacy notices on those websites and mobile applications if you would like to find out how they collect, use and share your personal information.

Information about children

Our services are not directed to those under 16 and we do not knowingly collect, sell, or share for targeted advertising any personal information from minors under 16 years of age.

How we update this Privacy Notice?

From time to time, we will update this Privacy Notice. Any changes become effective when we post the revised Privacy Notice, although we may elect to otherwise notify you in some cases where changes are significant or where required by law. This Privacy Notice was last updated as of the “Last Updated” date shown above.

Contact Information and Privacy Point of Contact

If you have any questions about this Privacy Notice, need more information or would like to raise a privacy concern, please contact US.CPA@gsk.com. If you want to correct the personal information we may have about you, or if you and want to exercise applicable rights granted by your jurisdiction regarding your personal information, please contact us at:

Online:
Use our online webform available at: Individual Privacy Rights Request Self-Service Form

Telephone:
ViiV Healthcare Pharmaceutical products: 1.877.844.8872

Specific State Resident’s Supplemental Notice (“Supplemental Notice”)

This Supplemental Notice provides additional details about our privacy practices related to your Personal Information as required by the applicable U.S. Privacy Laws in your state of residence.] Some portions of this Supplemental Notice apply only to residents of particular states. In those instances, we have indicated that such language applies only to those residents

The following definitions apply in this Supplemental Notice

“Consumers” means residents of California, Colorado, Connecticut, Montana, Oregon, Texas, Utah and Virginia
“Personal Information” means information of residents of that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household. Personal Information also includes “Sensitive Personal Information” that we specifically described in this Supplemental Notice.
“Sell,” “Sale,” or “Sold” means renting, releasing, or transferring an individual’s Personal Information to a Third Party for money or other valuable consideration.
“Share,” “Shared,” or “Sharing” means transferring an individual’s Personal Information to a Third Party for cross-context behavioral advertising or targeted advertising purposes, whether or not for money or other valuable consideration.
“Third Party” means a person or organization which is not a Consumer, Vendor, or an entity owned or controlled by us.
“Vendor” means a service provider, contractor, or processor which collects, stores, or otherwise handles data for us and is bound by certain contractual obligations consistent with applicable laws to use your Personal Information only as directed by us.

Sources From Which We Collect Personal Information

In the past 12 months, we may have shared and disclosed for our appropriate business purposes the categories of personal information described above in the “What Personal Information Do We Collect About You?” section, although the information we collect and process about you varies depending on the nature of our relationship with you.

Additionally, we may collect and process the following categories of information that may be considered sensitive data: Personal Information that reveals your racial or ethnic origin, religious or philosophical beliefs; health-related data; or your sexual orientation, social security, driver’s license, state identification card or passport number and precise geolocation that is used or intended to be used to locate you within a small geographic area (less than a radius of 1850), We may process sensitive data for the following business purposes:

Performing the services or providing the goods reasonably expected by an average consumer who requests those goods or services;
Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information;
Resisting malicious, deceptive, fraudulent, or illegal actions directed at us and prosecuting those responsible for those actions;
Ensuring the physical safety of natural persons;
Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us, provided that we will not disclose your Personal Information to a Third Party and will not build a profile about you or otherwise alter your experience outside of your current interaction with us;
Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
Verifying or maintaining the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and improving, upgrading, or enhancing the service or device that is owned, manufactured by, manufactured for, or controlled by us;
Collecting or processing sensitive data where such collection is not for the purpose of inferring characteristics about a Consumer; and
Targeted advertising

Sources from which we collect Information: In addition to the list found at the section titled, “How Do We Collect your Personal information,” we collect information about Consumers from Vendors and Third Parties.

Rights to Opt Out of Sale or Sharing of Your Personal Information

Over the past 12 months, our advertising partners have collected information about users’ use of our websites and apps through cookies, web beacons, and similar technologies (collectively, “cookies”) to display advertisements that are tailored to your interests on other websites and services, as described in the Section entitled “How do we use cookies and similar technologies?” Consumers have rights under their state privacy law to opt out of this sharing of their personal information for targeted advertising, which is referred to as cross-context behavioral advertising. To opt out of cookie-based sharing for targeted advertising, Consumers should visit the “Your Privacy Choices” link and exercise their choices to toggle off targeting cookies or broadcast the global privacy control signal. Note that many of the choices you have are browser-based choices, which means they will apply only to the specific browser you use when you opt out or exercise the applicable choice. You will need to opt-out separately on all your browsers. In addition, if you delete cookies, change browsers, or use a different device, you may need to opt out or exercise your choice again.

In addition, Consumers may opt out of any non-cookie based (i.e., offline) sharing of their personal information for targeted advertising by submitting the: Individual Privacy Rights Request Self-Service Form and providing the requested information.

Data Subject Rights

Please see the section entitled, “Data Subject Rights” for information about additional rights available to you as a Consumer and how to exercise them.

Additional Disclosures

Financial Incentives for California Residents. We do not provide financial incentives to California Residents who allow us to collect, retain, Sell or Share their Personal Information. We will describe such programs to you if we do.

California Data Subject Request Metrics,

For California residents, in the 2023 calendar year, the number of eligible consumer access requests we received was 3. Of those requests, 3 were complied with in whole or in part, 0 were denied, and 0 are open. The number of eligible consumer deletion requests we received was 6. Of those requests, 6 were complied with in whole or in part, and 0 were denied. The median number of days within which we substantively responded to all requests was 15 days.