United Therapeutics Corporation Privacy Statement

For Washington residents and residents of other states with specific laws protecting consumer health data, please review our Consumer Health Data Privacy Notice if you have or plan to provide us with health-related information.

This privacy notice describes how United Therapeutics Corporation and its subsidiaries (together, “UTC”, “we”, “us”, or “our”) may collect, use, share, or otherwise process your personal information when you visit or interact with us through our websites, through email, social media accounts, or through any other mobile application (together, “Sites”), and through other online and offline interactions where this privacy notice is referenced (together, “Services”).

As used in this privacy notice, “Personal Information” means any information that identifies, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual.

Your Rights Under Specific State Laws: If you are a resident of Alabama, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, or Virginia, please review our Supplemental State Privacy Disclosures for additional information related to our processing of your Personal Information and your rights under laws of those states.

1. Types of Personal Information We Collect

2. Sources of Personal Information We Collect

3. How We Use Your Personal Information

4. How We Disclose Your Personal Information

5. Cookies

6. Your Choices

7. Data Security and Retention

8. Children’s Privacy

9. External Links and Embedded Video Players

10. Contact Us

11. Supplemental State Privacy Disclosures

12. Supplemental Canada Notice

13. Supplemental EEA/UK Notice

14. Changes to this Privacy Notice

1. Types of Personal Information We Collect

We collect Personal Information about you when you interact with us, including through our Sites and Services. Depending on your specific interactions with us we may collect the following types of Personal Information:

A. Identifiers, such as your name, alias, email address, physical address, telephone number, business contact information, social media username, unique personal identifier, and device identifiers (e.g., cookie IDs and IP address).

B. Records about you, such as signatures; financial information; physical characteristics or a description of you; the content, timing and method of communications you have with us, such as online chats, calls, and emails; information you share with or upload to our Sites, such as reviews and comments; and information you upload or send to us to gain access to our Services, such as enrollment forms.

C. Demographic information, such as age (including birthdates), marital status, gender, and information about your lifestyle and social circumstances.

D. Commercial information, such as information related to your transactions; products or services purchased, obtained, or considered (including survey responses providing your opinion about our products and services); or other purchasing or consuming histories or tendencies.

E. Internet or other electronic network activity information, such as your browsing history, search history, preference information (including marketing and purchasing preferences), account settings (including any default preferences), and other information regarding your interactions with and use of our Sites and Services (including inferences about your health derived from the activities, usage information, and location information that we collect). See our Cookie Notice for more information about our automatic collection activities.

F. Non-precise geolocation data, such as your location derived from your IP address.

G. Audio, visual, or other sensory information, such as photographs and audio/video recordings.

H. Professional or employment-related information, such as job title; organization; professional licenses, professional memberships, credentials, or affiliations; and other professional information.

I. Education information, such as your degrees earned and institution information.

J. Inferences drawn from any of the information we collect about your preferences or behavior, including to assess the level of interest in our products and services based on frequency of visits and contact and determine your preferred frequency for receiving offers.

K. Sensitive Personal Information, including information about your health (such as medical condition(s), diagnoses, or information that could result in an inferred health status). See our Consumer Health Data Privacy Notice for more information on how we handle your health and medical information.

If you submit any Personal Information relating to other people to us, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

2. Sources of Personal Information We Collect

The sources from which we collect each category of Personal Information are summarized below.

A. Directly from you. We may collect Personal Information you provide to us directly, such as when you contact us or submit requests through our Sites, interact with us in person, fill out our surveys, register for an event, sign up for offers or newsletters, communicate with us, or sign up for an account or other Services.

B. Data collected automatically through Cookies and similar technologies. We may automatically collect information or inferences about you, such as through cookies, pixels, tags, scripts, and other tracking technologies (collectively, “Cookies”), when you interact with our Sites. This may include information about how you use and interact with our Sites, information about your device, and internet usage information.

C. From third parties. We may collect Personal Information from third parties, such as customers, service providers, our affiliated companies and subsidiaries, business partners, investors and shareholders, healthcare professionals, patients and clinical trial participants, clinical investigators and staff conducting clinical trials, clinical trial participants, government officials, adverse event reporters and subjects, data brokers, social media companies or other parties who interact with us.

D. From publicly available sources. We may collect Personal Information about you from publicly available sources, such as public profiles, social media, and websites.

We will only collect your information in accordance with applicable law.

We may combine information that we receive from the various sources described in this privacy notice, including third party sources, and use or disclose the combined information for the purposes identified in Section 3 (How We Use Your Personal Information).

3. How We Use Your Personal Information

We use the Personal Information we collect for the purposes described below. Where we reference health-related information in this section, please also refer to our Consumer Health Data Privacy Notice for a more complete description of how we use that information.

A. To provide you or your company products and services, such as making our Sites and Services and our commercial products and services available to you; registering, verifying, and maintaining your account with us; providing customer service; processing or fulfilling orders and transactions (including processing payments); verifying your information and eligibility for certain programs or benefits; communicating with you (including soliciting feedback or responding to requests, complaints, and inquiries); hosting events and informational webinars; and providing similar services or otherwise facilitating your relationship with us.

B. For our internal business purposes, including maintaining internal business records such as accounting, document management and similar activities; implementing our policies and rules; training; management reporting; auditing; IT security and administration; and other day-to-day business operations.

C. For marketing and targeted advertising, such as marketing our products or services or those of our affiliates, business partners, or other third parties. For example, we may use Personal Information to personalize advertising to you (including by developing product, brand, or services audiences and identifying you across devices/sites); to analyze your interactions with us or our Sites; or to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars. We may use AI to improve the quality, speed, and value of our marketing analysis.

D. For our internal research and product improvement purposes, such as verifying or maintaining the quality or safety of our products or services; improving our products or services, including AI, machine learning, and similar tools; designing new products and services; evaluating the effectiveness of our advertising or marketing efforts; and debugging and repairing errors with our systems, networks, and equipment.

E. For legal, safety or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against us, our personnel, and our customers; for establishing, exercising or defending legal claims; protecting our, your, our customers’, and other third parties’ safety, property or rights; to detect, prevent, and respond to security incidents and health and safety issues (including managing spread of communicable diseases); and to protect against malicious, deceptive, fraudulent, or illegal activity.

F. To support public health and public interest initiatives.

G. In connection with a corporate transaction, such as if we acquire assets of another business, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.

De-Identified and Anonymized Information

We may de-identify or anonymize Personal Information so that it can no longer reasonably be used to identify you, either directly or indirectly. We may use de-identified or anonymized information for any purpose permitted by law.

Large Language Models and AI

We do not use your personal information to train a large language model, nor do we use artificial intelligence or automated decision-making technologies for profiling in furtherance of any decision that would produce a legal effect or other significant effect.

4. How We Disclose Your Personal Information

We may disclose your Personal Information to third parties, including the categories of recipients described below:

A. Our affiliates, including parent entities, subsidiaries, business units, and other companies that share common ownership with us.

B. Our contracted service providers that perform functions on our behalf, such as website hosting and analytics, data analytics, customer service and call center operations, email and digital marketing, medical information fulfillment, patient support and hub services administration, co-pay assistance program administration, print and mail services, payment processing, event administration, and IT and cybersecurity services.

C. Healthcare providers and pharmacies, at your direction and with your consent.

D. Professional consultants, such as accountants, lawyers, consultants, financial advisors, and audit firms.

E. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.

F. Legal process and protection of rights, including to law enforcement, government and regulatory agencies, and other recipients, when we believe it is necessary to comply with applicable law, regulation, legal process, or a lawful governmental request; to enforce our contracts, terms of use, and company policies; to protect the rights, safety, or property of our company, our employees, our customers, or others; and to detect, prevent, or respond to fraud, security incidents, or other illegal activity.

G. Other entities in connection with a corporate transaction, such as if we acquire assets of another entity, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.

H. Business partners that may use Personal Information for their own purposes, such as:

• Advertisers, ad platforms and networks, and social media platforms;

• Co-promotion and co-marketing partners;

• Third parties whose Cookies we use as described in our Cookie Notice, including data analytics providers.

If required by law, we will obtain your consent prior to disclosing your Personal Information to our business partners. Where recipients use your Personal Information for their own purposes independently from us, we are not responsible for their privacy practices or Personal Information processing policies. You should consult the privacy notices of those third-party services for details on their practices.

I. The public, such as when you have an opportunity to make comments regarding us or our products that we may share with the public, including comments on our blog and social media posts. Any Personal Information in comments, reviews, or other content that you share in public areas of our Sites may be read, collected, or used by other users or the public.

J. Entities to which you have consented to the disclosure.

5. Cookies

Our Sites and authorized third parties use Cookies and similar technologies to collect information about you, your device, and how you interact with our Sites. To learn more about our use of Cookies and similar technologies, see our Cookie Notice.

6. Your Choices

Email Communications

If you receive marketing or promotional emails from us, you may opt out at any time by clicking the “unsubscribe” link in any such email or by contacting us at privacyoffice@unither.com. Please note that even if you opt out of marketing communications, we may still send you transactional or service-related messages, such as order confirmations, account notices, or responses to your inquiries.

Text and SMS messages

You may have the opportunity to receive occasional text messages from us. These messages may include information on our products and services, or about products and services that may be of interest to you. Frequency will vary. By providing your phone number and opting in to receive text messages, you expressly consent to receive these communications. This includes automated text messages to the phone number that you provide. Consent to receiving text messages is not required to receive products or services from us. Message and data rates may apply, and your carrier’s rates will apply. You can opt out of receiving future text messages or receive help by following the directions in the text message you receive. As we are in the United States, international rates may apply depending on your location. We may disclose your mobile phone number to service providers with whom we contract to send you automated text messages. However, we will not disclose your mobile phone number to third parties for their own marketing purposes without your express consent. Opting out of calls, texts and SMS messages does not mean that we will not contact you for service-related or informational messages.

Cookies and Tracking Technologies

You can control the use of Cookies in several ways:

• Cookie Preference Center. You can manage your Cookie preferences at any time through our Cookie Preference Center, accessible via the link or icon in the footer of our website.

• Browser settings. Most browsers allow you to refuse or delete Cookies through their settings. Note that disabling certain cookies may affect the functionality of our website.

• Opt-out tools. You may opt out of interest-based advertising through the Digital Advertising Alliance (DAA) at optout.aboutads.info, the Network Advertising Initiative (NAI) at optout.networkadvertising.org, or, for EU/UK users, the European Interactive Digital Advertising Alliance (EDAA) at youronlinechoices.eu.

Global Privacy Control

We recognize and respond to the Global Privacy Control (GPC) signal when legally required, and in some cases, voluntarily. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out of the sale or sharing of your Personal Information for cross-context behavioral advertising, consistent with applicable law, including the California Consumer Privacy Act (CCPA/CPRA). You can enable GPC through supported browsers or browser extensions. More information is available at globalprivacycontrol.org.

GPC signals are processed at the browser or device level and apply to the specific browser or device from which the signal is sent. If you use multiple browsers or devices, you will need to enable these signals on each one separately.

Do Not Track

Our Sites do not currently respond to “Do Not Track” browser settings or similar mechanisms.

Targeted Advertising

We may share certain data with advertising partners to deliver interest-based advertisements on other platforms. You can opt out of this by:

• Adjusting your settings through our Cookie Preference Center

• Using the DAA or NAI opt-out tools listed above

• Adjusting ad personalization settings in your Google, Meta, or other platform accounts directly

7. Data Security and Retention

Security

Although we maintain reasonable security safeguards, no security measures or communications over the internet can be 100% secure, and we cannot guarantee the security of your Personal Information.

Retention

Your Personal Information will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. For example, we will retain your Personal Information for as long as you have an active account with us and as necessary to comply with our tax, accounting, and recordkeeping obligations, to provide you with any services you have requested, as well as an additional period of time as necessary to protect, defend, or establish our rights, defend against potential claims, and comply with our legal obligations. We may also retain your Personal Information to maintain our business relationship with you; improve our business over time; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes.

8. Children’s Privacy

Our Sites and Services are intended for individuals 18 years of age and older, and are not directed at, marketed to, nor intended for, children under 18 years of age. Except when required by law, such as when receiving adverse event information, or when required to assert or protect our legal rights, we do not intentionally collect any Personal Information from children under 18 years of age unless a parent or guardian provides consent. If you believe that we have inadvertently collected Personal Information from a child under the age of 18, please contact us at the address in Section 10 (Contact Us) below, and we will take prompt steps to delete the information.

9. External Links and Embedded Video Players

The Sites and Services may contain links to websites and other digital properties that are not owned or controlled by UTC (“Third-Party Sites”) and may contain embedded video players owned and operated by third parties (“Third-Party Video Players”) used to play content controlled and directed by UTC, or by third parties.

This privacy notice does not apply to, and we are not responsible for, the privacy and data collection and handling practices and policies of the operators of Third-Party Sites or Third-Party Video Players. We recommend that you read the privacy notices and terms of use of the entities operating such Third-Party Sites or Third-Party Video Players for information on their privacy practices, and do not engage with such content unless you are comfortable with the applicable terms.

10. Contact Us

If you have questions, concerns, or requests about this privacy notice or our privacy practices, or wish to contact the privacy officer or data protection officer for your country or region please email us at privacyoffice@unither.com.

Alternatively you may contact us by postal mail or by telephone as follows:

Attn: Privacy Office
United Therapeutics Corporation
P.O. Box 14186
Research Triangle Park, NC 27709
USA

1-877-864-8437

11. Supplemental State Privacy Disclosures

Data Subject Rights

Depending on our relationship with you and in which state you reside within the United States (such as California, Colorado, Nevada, Oregon, or Delaware), you may have certain rights regarding Personal Information that you can exercise by calling us at 1-877-864-8437, or by emailing us at privacyoffice@unither.com:

Right to Know: You may have the right to request information about the categories and specific piece of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting, selling, or sharing the Personal Information, and to whom we have disclosed your Personal Information and why. Residents of certain states such as Connecticut, Oregon, and Minnesota may also request a specific list of third parties to whom we disclose your Personal Information.

Right to Delete: You may have the right to request that we delete Personal Information that we have collected about you. We may deny a deletion request where we are legally authorized to do so.

Right to Correct: You may have the right to request that we correct inaccurate Personal Information that we maintain about you.

Right to Opt Out of Profiling: You may have the right to opt out of certain automated processing activities that are used to evaluate characteristics about you. Residents of certain states such as Minnesota and Connecticut may also request to review the Personal Information used in profiling, question the result of the profiling, and request additional information on how the profiling was conducted.

Right to Limit Use and Disclosure of Sensitive Personal Information: You may have the right to limit the use and disclosure of Sensitive Personal Information.

Right to Opt Out of Sale, Sharing, and Targeted Advertising: You may have the right to opt out of selling, sharing, and/or targeted advertising, as such terms are defined under applicable laws. We do not knowingly sell data about minors under 18. You can exercise the right to opt out of sale and sharing of your personal information with respect to targeted advertising by accessing the Cookie Preference Center available from the link or icon in the footer of our Sites and changing the “Do Not Sell or Share my Personal Information” selector to the “on” position. You can exercise your right to opt out of Targeted Advertising by accessing the Cookie Preference Center from the link or icon in the footer of our Sites and changing the “Targeted Advertising” selector to the “off” position.

Selling and Sharing of Personal Information

We do not sell personal information for monetary consideration. However, our use of certain website tracking-technologies may meet the definition of “selling” or “sharing” as that term is defined by applicable law. We may have sold or shared the following categories of personal information with our targeted advertising service providers and partners: Identifiers, Non-precise geolocation data, and Internet activity information. We do not knowingly sell the personal information of minors under 18.

We will not discriminate against you for exercising your privacy rights.

Verification of Your Identity

To process rights requests, we may need to obtain information to locate you in our records or verify your identity depending on the nature of the request.

For Requests to Opt-Out of Sale, Sharing, and Targeted Advertising and Requests to Limit Use and Disclosure of Sensitive Personal Information: We may collect your name and email to locate you in our records.

For Requests to Know, Delete, and Correct: We collect information necessary to locate you in our records and verify your identity and that you are a resident of a state that provides for these rights, which may include name, mailing address, email address, phone number, relationship to us.

Authorized Agents

Authorized agents may exercise rights on your behalf by submitting a request to privacyoffice@unither.com.

If you designate an authorized agent to submit a Request to Know, Delete, or Correct: We may seek additional information from the authorized agent or reach out to you directly to verify your identity or to confirm that you provided the authorized agent permission to submit the request.

If you designate an authorized agent to submit a Request to Opt Out of Sale, Sharing, and Targeted Advertising or Request to Limit Use and Disclosure of Sensitive Personal Information: We may seek additional information directly from the authorized agent to process the request.

Appeal

If we deny your rights request, you may have the right to appeal. To submit an appeal, contact us at 1-877-864-8437 or privacyoffice@unither.com. We will inform you of our response.

Additional Disclosures Regarding Processing of Personal Information

This section provides additional information about how we process Personal Information.

Disclosure of Personal Information

The following details categories of Personal Information we collect and third parties we disclose to, share with, or sell to for a business purpose in the last 12 months.

Identifiers (see Section 1.A)

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; healthcare providers and pharmacies; professional consultants; data analytics providers; partners and collaborators; regulatory and government agencies, law enforcement and other recipients for legal, security, or safety purposes; in connection with a corporate transaction; entities to which you have consented to the disclosure; others as may be required by law.

Categories of third parties to whom we may “sell” or “share” Personal Information for targeted advertising: Advertisers, ad platforms and networks, and social media platforms; third parties whose Cookies we use as described in our Cookie Notice, including data analytics providers.

Records about you (see Section 1.B)

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; professional consultants; vendors necessary to complete transactions you request; law enforcement, government agencies, and other recipients for legal, security, or safety purposes; in connection with a corporate transaction; entities to which you have consented to the disclosure.

Demographic information (see Section 1.C)

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; healthcare providers and pharmacies; vendors necessary to complete transactions you request; law enforcement, government agencies, and other recipients for legal, security, or safety purposes; in connection with a corporate transaction; entities to which you have consented to the disclosure.

Categories of third parties to whom we may “sell” or “share” Personal Information for targeted advertising: Advertisers, ad platforms and networks, and social media platforms.

Commercial information (see Section 1.D)

Internet or other electronic network activity information (see Section 1.E)

For more information about Cookies, please see our Cookie Notice.

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; vendors necessary to complete transactions you request; law enforcement, government agencies, and other recipients for legal, security, or safety purposes; in connection with a corporate transaction; entities to which you have consented to the disclosure.

Non-precise geolocation data (see Section 1.F)

Audio, electronic, visual, or other sensory information (see Section 1.G)

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; professional consultants; internet service providers; data analytics providers; in connection with corporate transactions; regulatory authorities, government agencies and law enforcement, and other recipients for legal, security, or safety purposes; entities to which you have consented to the disclosure; others as may be required by law.

Categories of third parties to whom we may “sell” or “share” Personal Information for targeted advertising: Not sold or shared.

Professional or employment-related information (see Section 1.H)

Education information (see Section 1.I)

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; professional consultants; law enforcement, government agencies, and other recipients for legal, security, or safety purposes; in connection with a corporate transaction; entities to which you have consented to the disclosure.

Inferences drawn from any of the information we collect about your preferences or behavior (see Section 1.J)

Sensitive Personal Information (see Section 1.K)

Categories of third parties to whom we may disclose Personal Information for a business purpose: Affiliates and subsidiaries; service providers; healthcare providers and pharmacies; law enforcement, government agencies, and other recipients for legal, security, or safety purposes; in connection with a corporate transaction; entities to which you have consented to the disclosure; others as may be required by law.

Categories of third parties to whom we may “sell” or “share” Personal Information for targeted advertising: Not sold or shared.

Use and Disclosure of Sensitive Personal Information

We may use and disclose sensitive personal information, including inferences about your health, for the purposes described in Section 3 (How We Use Your Personal Information) above; however, we do not sell or share your Sensitive Personal Information.

California Shine the Light

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please call 1-877-864-8437 or email us at privacyoffice@unither.com.

12. Supplemental Canada Notice

How We Safeguard Your Information

We use safeguards designed to protect your Personal Information from loss and unauthorized access, use and disclosure, including:

• A privacy governance program comprised of policies and procedures regarding the protection of Personal Information through its lifecycle and which defines the roles and responsibilities of our personnel regarding the handling of Personal Information.

• Employee privacy and data security training.

• Procedures for receiving, investigating and responding to complaints or inquiries regarding UTC’s information handling practices.

• Contractual provisions and other measures to require our service providers with whom we share Personal Information to maintain adequate privacy protections and standards.

International Transfers of Personal Information

As part of the data processing activities described in this privacy notice, we may transfer your Personal Information outside of Canada, including to the United States. As such, your Personal Information may be subject to foreign laws and may be accessible by foreign governments, courts, law enforcement and regulatory agencies.

13. Supplemental EEA/UK Notice

This Section applies primarily to residents of the EEA or the UK. The processing activities described below are those specific to our operations in the EEA and UK.

We rely on the following legal bases when processing Personal Information for the purposes described below:

To provide our Sites and Services, process and fulfill your requests, communicate with you (including responding to your inquiries, complaints, and feedback) and for other customer service and business administration purposes

Legal basis: Legitimate interests in operating and growing our business and providing requested services.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records about You; Commercial Information.

To manage and support internal business operations, including recordkeeping, compliance, auditing, reporting, IT administration and information security

Legal basis: Legal obligation; legitimate interests in ensuring operational efficiency, security and business continuity.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records About You; Professional or Employment-related Information; Commercial Information; Internet or Other Electronic Network Activity Information.

To conduct research, analytics and data analysis to improve or optimize our Site and Services and user experience

Legal basis: Legitimate interests in maintaining and improving our Sites and Services and supporting business operations.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records About You; Commercial Information; Internet or Other Electronic Network Activity Information; Professional or Employment-related Information; Education Information.

To identify, recruit, evaluate and engage you for participation in our projects, research, educational activities or other professional engagements

Legal basis: Performance of a contract or to take steps at your request prior to entering into a contract.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records About You; Professional or Employment-related Information; Education Information; Commercial Information.

To comply with transparency and disclosure obligations, including reporting and publicly disclosing Transfers of Value and other reportable payments or benefits provided to you

If your engagement with us is subject to transparency reporting requirements, you will receive a separate privacy notice at the time of the engagement.

Legal basis: Legitimate interests in complying with transparency requirements and industry standards.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records About You; Professional or Employment-related Information; Commercial Information.

To comply with legal and regulatory obligations, manage compliance activities, and establish, exercise or defend legal claims

Legal basis: Legal obligation.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records About You; Professional or Employment-related Information; Commercial Information.

To protect our business, Sites, Services and information systems, and detect, prevent and investigate fraud, cybersecurity incidents, unauthorized access and other unlawful activities

Legal basis: Legitimate interests in maintaining the security, integrity and resilience of our business, Sites, Services and information systems.

Categories of Personal Information processed (as described in Section 1): Identifiers; Records About You; Internet or Other Electronic Network Activity Information; Non-precise Geolocation Data; Inferences.

If you participate in a clinical trial or research activity sponsored by us, your Personal Information is processed in accordance with the applicable study documentation

Legal basis: Explicit consent.

Categories of Personal Information processed: We only receive de-identified study data and do not hold information that enables us to identify you.

If you have any questions regarding your participation in a clinical trial or a research activity, please contact your study investigator or study site.

Consequences of not providing us with your Personal Information

You may choose not to provide Personal Information to us. However, where Personal Information is necessary for us to manage our relationship with you, operate our business, or comply with legal obligations, your failure to provide such information may limit our ability to do so. As a result, we may be unable to provide certain products, services, programs, or support, or otherwise fulfil our obligations to you.

Your Data Subject Rights

Subject to applicable law and certain conditions, you have the following rights regarding your Personal Information:

• Right of Access. You may request confirmation of whether we process your Personal Information and, if so, a copy of that data along with information about how it is used.

• Right to Rectification. You may request that we correct inaccurate or incomplete Personal Information we hold about you.

• Right to Erasure. You may request that we delete your Personal Information where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where there is no other lawful basis for retention.

• Right to Restrict Processing. You may request that we limit how we use your Personal Information in certain circumstances, such as while a dispute about its accuracy is resolved.

• Right to Data Portability. Where processing is based on consent or contract and carried out by automated means, you may request that we provide your Personal Information in a structured, commonly used, and machine-readable format, or that we transmit it directly to another controller where technically feasible.

• Right to Object. You may object to processing based on our legitimate interests. If we process your Personal Information for direct marketing purposes, you have the right to object to such processing at any time.

• Right to Withdraw Consent. Where we are processing your Personal Information on the legal basis of consent, you are entitled to withdraw your consent at any time. This does not affect the legality of the processing which took place when we had your consent.

• Right to Complain. If you are not satisfied with our use of your Personal Information or our response to any request by you to exercise any of your rights in this Section, you have the right to lodge a complaint with your local supervisory authority. In the EU, this is the data protection authority in your country of residence or establishment. In the UK, this is the Information Commissioner's Office (ICO), reachable at ico.org.uk.

• Rights Related to Automated Decision-Making. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless an exception applies.

How to Exercise Your Rights

To submit a rights request, please contact us at privacyoffice@unither.com. We will respond within 30 days of receipt. In complex or multiple requests, we may extend this period by a further two months and will notify you accordingly. We do not charge a fee for reasonable requests, though we may charge a reasonable fee or decline to act on requests that are manifestly unfounded or excessive.

We may need to verify your identity before processing your request. We will ask only for information reasonably necessary to confirm your identity.

International Data Transfers

Your Personal Information may be transferred to and processed in countries outside the EEA or UK, including the United States, which may not provide the same level of data protection as your home country. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission / UK International Data Transfer Agreements (IDTAs), as applicable.

Contact Us About Your Personal Information

We have appointed Forvis Mazars Ireland as our EU Representative under Article 27 of the GDPR, located at Unit 3 - Harcourt Centre, Harcourt Road, D02 A339 Dublin 2 and can be contacted at the following email address: UTdataprotectionrep@mazars.ie

Individuals in the UK may also use the above contact details for any privacy-related enquiries.

14. Changes to this Privacy Notice

We may change this privacy notice from time to time to account for changes in law and changes to our business practices. Please check this privacy notice periodically. If required by law, we will obtain your consent or contact you directly if there are material changes to this privacy notice.

Last Updated August 2026