Introduction

This Personal Data Protection Notice outlines the ways in which the Dr. Reddy’s Laboratories Ltd. group of companies and its affiliates, subsidiaries and organizations, (hereinafter referred to as "Dr. Reddy's", "Company", "We", "Our", "Ours"), collect, store, use, process and destroy information about individuals, including employees, customers, suppliers, Key Opinion Leaders (KOLs), patients and healthcare professionals (HCPs) ("Data Subject", "You", "Your", "Yours"), in accordance with applicable laws on the protection of confidential information, trade secrets and personal data protection, and regulations. Depending on the subject's personal data category of to which you belong, you will find more detailed information regarding data processing performed by Dr. Reddy's with respect to your Personal Data, Personal Information that is strictly confidential, and (or) any data related to clinical trials (collectively or separately referred to as the "Personal Data ") attached in the following documents (pay attention to the section "How Personal Data will be Used"). For the purposes of this Personal Data Protection Notice, the words "Dr. Reddy's","Company", "we" and (or) "our" refer to the company that is considered to be the operator of your Personal Data; to determine which company is the operator of your personal data, see below the section "Identification information and contact details of the operator and employees under the Global Privacy Policy".

Commitment made

Dr. Reddy's undertakes to protect the confidentiality of Personal Data and to handle them responsibly in accordance with the applicable laws on personal data protection in the jurisdiction of direct transfer of the Personal Data, Regulation 2016/679 ("General Data Protection Regulation" or "GDPR", interchangeable), as well as any other relevant privacy laws in the countries of our presence.

We will not knowingly collect, use or disclose the Personal Data of minors under the age of 18 without prior consent of the person with parental responsibility (such as a parent or guardian) by contacting them personally. We will provide such parent / guardian with relevant information regarding the processing of the child's Personal Data.

Dr. Reddy's will in all cases process your Personal Data in accordance with the Global Privacy Policy, including any other document(s) referred to herein or attached hereto. The Global Privacy Policy is on the home page of Dr. Reddy’s Laboratories Ltd.

How will personal data be used?

Please read the following information on how Dr. Reddy's processes your Personal Data, depending on the category of the data subject to which you belong.

If you are an employee, customer, supplier, key opinion leader in medical science (KOL), healthcare professional (HCP) of Dr. Reddy's, please read our Global Privacy Policy, including any document(s) referenced in this document or attached hereto in order to obtain information on how Dr. Reddy's processes your Personal Data, and familiarize yourself with the legal grounds for such processing and storage of the disclosed data, as well as information about the international transfer of your personal data.

If you are a patient participating in the clinical trials of Dr. Reddy's, please read our Global Privacy Policy, including any document(s) referenced in this document or attached hereto in order to obtain information on how Dr. Reddy's processes your Personal Data, and familiarize yourself with the legal grounds for such processing and storage of the disclosed data, as well as information about the cross-border transfer of your personal data.

Dr.Reddy`s also offers the possibility of registration, authorization and creation of an account on the site through your existing profile in a social network (Gmail, Facebook). In this case, your access parameters (name and email address) are imported from your account in the relevant social network. Please note that when using this option, Dr.Reddy`s may receive certain information through the relevant social network, such as your name, age, location, preferences, occupation and other information specified in your public profile of such social network . Dr.Reddy`s may not request all of this information, it is automatically provided by the provider of the relevant social network through the use of the "login via social network" option. Despite this, Dr.Reddy`s will only use the information necessary to create an account, and after receiving any other information, will delete unnecessary data.

To whom will my personal data be disclosed? Will my personal data be transferred outside Ukraine or the EU?

Your personal data may be transferred by the Personal Data Operator in accordance with legal or contractual requirements to the countries as per the link here (Cross-border Data Transmission). In addition, your Personal Data may be provided to third-party service providers (for example, for payroll, accommodation services, ticket booking, employee remuneration, certificate of experience, dismissal, reimbursement, business correspondence, etc.). to the extent determined and permitted by local laws of the jurisdiction within which you transferred your personal data to Dr. Reddy's, and applicable privacy policies.

Your personal data may also be disclosed:

if this is allowed or required in accordance with applicable laws or regulatory requirements (in which case we will endeavor to disclose only directly requested information relating to the purposes of processing your personal data);

to comply with applicable legal procedures, such as a search warrant, subpoena or court order; as part of the commitment of Dr. Reddy's for regular reporting; to protect the legal rights and property of Dr. Reddy's;

in emergencies, as well as in the case of the need to protect health and safety of an individual or a group of individuals.

1. GLOBAL PERSONAL DATA PROTECTION NOTICE

Information on the international transfer of your personal data by Dr. Reddy’s Laboratories Ltd group of companies and its affiliates, subsidiaries and organizations, (hereinafter referred to as "Dr. Reddy's" and/or "Company"), can be found in the relevant document in the above section "How will personal data be used?".

Within Dr. Reddy's, we make every effort to ensure that the original adequate level of protection of your Personal Data is retained during the transfer. In addition, the Company ensures the application of appropriate technical and other measures to protect the security and confidentiality of your Personal Data by third-party organizations.

How long will my personal data be stored at Dr. Reddy's?

Your Personal Data will be stored for the period for which you have given your consent to the processing of your personal data and in accordance with the purposes of processing, within the period allowed by applicable laws of the countries of presence of Dr. Reddy's. Unless otherwise permitted or required by applicable laws or regulations, your Personal Data will be stored by Dr. Reddy's "for the time necessary to accomplish the purposes for which these data were collected (in particular, to fulfill any legal, accounting or other requirements and obligations). Instead of destroying or deleting your Personal Data with your consent, we may make it impersonal, which will not allow anyone to associate it with you or establish your identity.

Your rights

You have the right to request access, correction or deletion of your Personal Data, restrict their processing and transfer, by contacting the Personal Data Operator directly.

If you consent to the processing of your Personal Data, you have the right to withdraw your consent at any time, which will not affect the legality of data processing before its withdrawal.

You have the right to request that your Personal Data be verified, confirmed or modified.

You can file a complaint with the Personal Data Protection Department if you believe that we have not complied with the requirements of the applicable personal data protection laws with respect to your personal data. If you believe that Dr. Reddy's has not properly enforced your rights, you have the right to lodge a complaint with a competent supervisory authority.

Note

Any such request must be made in writing as specified in this Notice to the Operator.

When you exercise your rights, we may request certain information from you to verify your identity. If you need assistance, contact the Operator's Personal Data Processing Officer.

Rights are not absolute. There are cases when applicable laws or applicable regulations allow us or require us to waive your rights. In addition, your Personal Data may be destroyed, erased or depersonalized in accordance with our obligations and applicable laws.

Personal Data Operator

As your Personal Data Operator, the Company operating personal data may also process your data in accordance with applicable laws and personal data protection requirements. To determine who is your Personal Data Operator, please note that:

If you are an employee of Dr. Reddy's, then the Company with which you have entered into an employment contract will be your Personal Data Operator.

If you are a customer, supplier, key opinion leader in medical science (KOL), healthcare professional (HCP), then your Personal Data Operator is the Company with which you have entered into a contract.

If you are a patient participating in the clinical trials of Dr. Reddy's, then the Company with which you have entered into a contract / agreement for the provision of services will be your Personal Data Operator.

Methods of Personal Data Protection

Dr. Reddy's implements the technical and organizational measures necessary to ensure the security of Personal Data. Personal data must be protected from unauthorized disclosure and (or) any unlawful processing. These measures ensure compliance with the requirements, the level of security, the nature of the data protected and the risks arising from the processing of such data.

2. GLOBAL PERSONAL DATA PROTECTION NOTICE

Implementation

Dr. Reddy’s Laboratories Ltd. group of companies and its affiliates, subsidiaries and organizations, (hereinafter referred to as "Dr. Reddy's" and/or the "Company") is responsible for using and enforcing applicable data protection laws. According to the agreement, requests for the processing of personal data by third parties must be made in writing.

Representatives of Dr. Reddy's must ensure that the third party handles the data properly and in accordance with the principles set out in the Global Privacy Policy, as well as any related documents, including this Personal Data Protection Notice. If a third party is unable to ensure adequate security of Personal Data, Dr. Reddy's may, at its sole discretion, terminate its agreement with this third party at any time.

Amendments to this Personal Data Protection Notice

Dr. Reddy's may, at any time, amend its Global Privacy Policy, as well as any related documents, including this Personal Data Protection Notice, to reflect changes in legal or regulatory obligations and the principles of handling your personal data. Any changes and amendments to the Global Privacy Policy, as well as to any related document(s), including this Personal Data Protection Notice, will be reported accordingly in a public resource - on the website of Dr. Reddy’s Laboratories Ltd. Group of Companies

Contact us

If you have any questions about our privacy policies and personal data protection methods, or if you have any doubts, please feel free to contact our Privacy Officer at the following address: [email protected]

Address

Employee in the field of personal data protection,

Dr. Reddy’s Laboratories Ltd.

Direct number: 8-2-337, Route No.: 3, Banjara Hills Hyderabad - 500034

India.