Last Revised: 1 June, 2026

General Privacy Statement

At F. Hoffmann-La Roche Ltd and all Roche’s subsidiaries (“Roche”), we are committed to protecting your personal information in accordance with the applicable data protection laws. This Privacy Notice outlines the types of personal data Roche may collect, the means by which Roche may collect, use, or share your personal data; steps Roche takes to protect your personal data; and choices you are provided with respect to the use of your personal data. This Privacy Notice applies to Personal Data collected and processed in the context of Roche events (i.e. events organized by Roche).

For the purposes of this Privacy Notice, “Personal Data” is any information by which you can be individually identified both directly and indirectly, including, but not limited to, your name, e-mail address and pictures, taken during Roche events.

Minors

Our processing activities described in this Privacy Notice are not designed or intended to collect Personal Data from children under the age of 18 unless explicitly advertised in the event information. We do not knowingly collect any Personal Data from anyone under the age of 18 without the prior, verifiable consent of a parent or guardian. Such parent or guardian may have the right, upon request, to view the information provided by the child and require that it be deleted.

Identity and Contact Details of the Data Controller

The Data Controller is Roche Latvija SIA. Address: 25 Miera iela Riga, LV-1001 Latvia. E-mail address: [email protected].

Categories of personal data processed

In the context of Roche events, we may collect the following personal data:

1. Contact details: includes your name, email address, telephone number.

2. Professional information: includes your affiliations/profession, employing health care organization, job title, therapeutic area, qualifications or experience, education and scientific/medical activity.

3. Interaction information: includes professional interactions between Roche and you, records of your collaborations, registration and participation in Roche’s events or related activities, feedback that you provide.

4. Audio-visual information: photographs, videos, sound recordings if your image and/or voice appears in them.

How and Why We Process Your Personal Data

In the context of Roche events, we process your personal data in order to ensure adequate organization and management of Roche events, adequate communication about Roche events and preservation of Roche event materials for audit purposes and historical value.

Roche and its business partners collect and process your personal data only if you voluntarily participate in Roche events. You always have the right to freely decide whether you wish to participate in Roche events or not.

We bring your attention to the fact that photographs and/or video recordings are usually being taken during Roche events and that such material may be shared with other event participants, used for communication about the events, as well as preserved by Roche for audit purposes and historical value. If you do not wish to be photographed please reach out to Roche personnel during the event. If you wish a particular photograph containing you to be deleted, please reach out to Roche personnel during the event or after event using contact details provided at the beginning of this Privacy Notice, in the section “Identity and Contact Details of the Data Controller”.

More Information on our Processing Activities

Please see the table below for details on specific purposes, categories of personal data, and legal basis for personal data processing in the context of Roche events.

Sources

Roche uses different methods and channels to collect personal data from you and about you including:

1. Directly from you (e.g. information you provide when filling in the registration form or participate in a post-event survey);

2. Interactions with you, including photographs taken during Roche events.

3. Publicly available sources, including public websites and social media networks (e.g. if we would like to invite you to a Roche event we may contact you using publicly published contact details).

Information Sharing / Recipients of Personal Data

Recipients of your Personal Data

Roche may share the Personal Data with Roche’s subsidiaries around the world. Our Roche subsidiaries will use the Personal Data for the same purposes as the data Controller does, for example if event is organized in collaboration with other Roche group companies, if other Roche group companies wish to contact you for a potential collaboration or event etc. A list of Roche’s subsidiaries is available in the most current yearly “Roche finance report” in report’s section “List of subsidiaries and associates”. Most current yearly “Roche Finance Report" can be found in the “Reporting” section of Roche webpage www.roche.com/investors/reports.

Furthermore, we may also share the Personal Data with third parties, for the following purposes:

• Service providers, including event organization service providers, photography and video recording service providers, data hosting service providers, providers of information systems development and technical maintenance services, marketing and public relations service providers.

• To respond to appropriate requests of legitimate government authorities, or where required by applicable laws, court orders, or government regulations; and

• Where needed for corporate audits or to investigate or respond to a complaint or security threat.                                       

International Transfers of the Personal Data

Roche may transfer the Personal Data in a geographic region that imposes different privacy obligations than your country of origin (e.g. United States or India). This means that your Personal Data may be sent to a country with less restrictive data protection laws than your own. Any such transfer will be conducted in compliance with applicable laws.

For transfers of personal data within the Roche Group and Roche’s processors or business partners, contracts containing the EU Standard Contractual Clauses according to the EU Commission decision of 04 June 2021 (C(2021) 3972), constitutes appropriate and suitable safeguards to ensure compliance, including supplementary measures where required.

Retention / Storage Period of Your Personal Data

The length of time in which we will store your Personal Data will differ depending on the purpose for which we have collected and are processing your data:

1. For the purpose of ensuring adequate organization and management of Roche events – up to 1 year;

2. For the purpose of ensuring communication about Roche events – up to 10 years. Please note that information, published in external outlets will follow retention policies of those particular external outlets;

3. For the purpose of preserving event materials for audit purposes and historical value – up to 10 years.

We may deviate from retention periods indicated above in case of an ongoing dispute or investigation. Also, if applicable law (e.g. tax law, accounting regulations etc.) requires to maintain specific data for a given time, we will follow such legal requirements.

Information About Your Rights Regarding Your Personal Data

You have the following rights with respect to your Personal Data:

• The right to request access to the Personal Data that Roche has about you;

• The right to rectify or correct any Personal Data that is inaccurate or incomplete;

• The right to request a copy of your Personal Data in electronic format so that you can transmit the data to third parties, or to request that Roche directly transfer your Personal Data to one or more third parties;

• The right to object to the processing of your personal data for where processing is based on legitimate interest;

• If certain data processing operations is based on your consent, you have the right to withdraw your consent at any time.

• The right to erasure of your Personal Data when it is no longer needed for the purposes for which you provided it, as well as the right to restriction of processing of your Personal Data to certain limited purposes where erasure in not possible.

To exercise any of these rights, please contact Roche Latvija SIA. Address: 25 Miera iela Riga, LV-1001 Latvia. E-mail address: [email protected].

You are also entitled to lodge a complaint with the responsible supervisory authority: Latvian State Data Inspectorate (Datu valsts inspekcija, "DVI" – https://www.dvi.gov.lv/.

Updates to This Privacy Notice

From time to time, we may revise this Privacy Notice. The date on which this notice was last revised is located at the top of this notice.