Version Date: [04/07/2025]

Scope of this Privacy Notice

Aptar Digital Health, LLC (hereinafter “ADH,” “our” “we” or “us”) owns or controls Esme, an MS Patient App to provide support to individuals living with Multiple Sclerosis (MS). This Privacy Notice describes what “personal data” (meaning any information relating to an identified or identifiable natural person) we need to collect from you in the app, how we use it and why, and your choices in relation to this collection and use.

You cannot use Esme without consenting to the use of your personal information described in this Policy. Please read the following information carefully.

Should you have any questions, you may directly contact ADH by sending an email to informationgovernance@aptardigitalhealth.com.

Information we collect and how we use it

ADH is the data controller of your personal data to the extent that it determines the purposes and means of the processing related to Esme's services.

ADH is the data processor of your personal data to the extent it ensures the implementation of processing related to Esme’s services.

The different features of the app collect different types of personal data depending on your use of these features.

App registration. If you choose to use the app, you will need to create an account and user profile within the app. We will collect the following necessary personal data from you to do this: your name; e-mail address; password; country in which you live; the date you registered to use the app; and topics of interest to you regarding MS. We will then assign you with a unique app user registration number. We may also collect the following personal data from you: gender; date of birth, month and year of MS diagnosis; and type and description of your MS; and information about your treatment or therapies. We require this information to: (a) create, validate and manage your account; (b) tailor your user experience and provide you with information that matches your personal profile and preferences; and (c) provide you with local technical and administrative support, where necessary.

MS journal. If you use the journal feature of the app, this allows you to have a full picture of your MS and will involve your recording health information concerning your MS (such as mood, symptoms, fitness and physical activity) and medical history (including whether/when you were diagnosed with MS, type of diagnosis, treatment and medication). The journal also allows you to manage your medical appointments and remind you to take your medication in a compliant way. It can also send you push notifications to remind you of events connected with your MS, if you chose to activate this functionality. It is up to you whether you set up and use the journal and you decide what information you enter.

Reports. The app allows you to generate reports based on your journal that can be shared, e.g. with your doctor. This feature allows you to select the information that is provided in your report as well as the date range for that information. Your report will be generated in PDF format and can be shared outside of the app, by whichever means you decide, using the methods made available to you by your device, e.g. e-mail, text message or WhatsApp message.

Apple Health or Google Health app interactions. If you choose to activate this feature, we may collect the following categories of personal data from the relevant app to which you subscribe: activities; mindfulness; nutrition; body measurements; health records; and sleep. This feature is linked to the content that you have provided in your Apple Health or Google Health app and you will be asked which categories of information you would like to be shared with our app. If you have not recorded any information in your Apple Health of Google Health app, you will be unable to use this feature. This information is shared via an app interface technology that uses a piece of code enabling it to: (a) verify that you have activated this feature; and (b) send a request for information to your Apple Health or Google Health app. We will not share your personal data in the app with your Apple Health or Google Health app.

Information materials on MS. The app gives you access to articles and videos on MS. Your personal data mentioned in the “App registration” paragraph above will be used to personalize some of this content.

Programs. The app gives you access to videos designed to improve your health and fitness. If you choose to use this feature, we will collect usage data, including what videos you have seen; your rating of any videos you have seen; what programs you have completed; and when you have completed them. We require this information to: (a) provide you with videos or programs that match your profile and preferences; (b) manage the content of the videos or programs that we provide; (c) request your feedback on a video or program; (d) send you a congratulatory message when you have completed a program; and (d) send you a reminder to complete a program that you have not yet finished.

Marketing materials. If you provide your consent by ticking the relevant tick box in the app, ADH, and companies working with ADH, may use your personal data to send you direct marketing communications via email (including treatment information, insights about MS, patient education materials and invitations to participate in market research surveys) or otherwise provide you with information about ADH products, services, and programs or other topics of interest. I understand and agree that any information that I provide may be used by ADH to help develop new products, services, and programs. You may unsubscribe from receiving such email communications at any time by clicking the unsubscribe link at the bottom of the email or sending a request to us via email at informationgovernance@aptardigitalhealth.com. You may also manage your communication preferences in the app.

Use of analytics technologies

Data Collection Technologies and online advertising. If you choose to use the various features of the app mentioned above, we may automatically collect the following electronic network activity information (Traffic data) from you to assess how you are using the app, where this is permitted by your device settings:

(a) technical information, including your IP address, your login information, browser type and version, device identifier, location and time zone setting, browser plug-in types and versions, operating system and platform; and

(b) information about your visit, including what features of the app you use and how frequently you use them.

This data collection technology allows us to personalize your experience, to enhance this app and your experience when you use it, and to send you push notifications if you have selected to receive them. Cookies and similar technologies may be used to collect this information, such as your interactions with the app.

How we share your information

Service providers. ADH engages service providers to assist it in the administration of its data processing activities in relation to the app. These include the companies which host the app and your personal data in the cloud and provide ADH with data storage facilities.

Other ADH companies. ADH may also share your personal data with other companies in the ADH group for the purposes described in this Privacy Notice. If a third party acquires all or a material part of ADH's business or assets, then your personal data may be disclosed or transferred in connection with that sale.

Pharmacovigilance and regulatory requirements. ADH is obliged by law to comply with regulatory requirements applicable to it as a pharmaceutical company, including the reporting of adverse reactions to its products to monitor the safety of all medicines that we market (also known as our pharmacovigilance or adverse event reporting obligations). ADH may collect, use and disclose your personal data to other members of the ADH group and other third parties where it considers this necessary for compliance with applicable laws, to protect the vital interests of any person, or where necessary to exercise, establish or defend ADH's legal rights.

Ensuring protection of your data. Your data is hosted on secure servers located in Europe, which comply with the security standards required by the United States, ensuring the protection of your information. The transfers mentioned above may include transfers outside of your country to countries with different data protection laws than your country. ADH takes appropriate steps to ensure your data is adequately protected if transferred to such countries.

How we store your personal data

We retain your personal data as long as your account remains active and you may deactivate your account at any time. Your account may be deactivated automatically if you have not used the app for more than 60 months. Before your information is deleted, ADH will contact you to ask you if you wish your account to remain active.

As a general rule, your personal data will only be retained for five (5) years following your last use of the services, or as necessary to fulfill legal or regulatory obligations.

Your Rights

If you have any questions or wish to exercise your rights, you may directly contact ADH by sending an email to informationgovernance@aptardigitalhealth.com

✓ You can request the access to your personal data in order to obtain clear, transparent and understandable information on how ADH processes your personal data and on your rights (as provided in this policy), as well as a copy of your personal data (you can access certain information relating to your account (name, contact information and preferences) by signing into your account and going to the “PROFILE” section of our mobile or web application).

✓ You can request the rectification of your personal data in order to obtain the modification of your personal data if they are obsolete, inaccurate or incomplete.

✓ You can request the closure of your online account. If you close your account, we will no longer use your online Personal Information or share it with third parties. ADH may, however, retain a copy of the information for legal purposes and to avoid identity theft or fraud.

✓ You have a right to ask to get an Accounting of Disclosures of when and why your health information was shared.

✓ You may decide if you want to give your authorization before your health information may be used or shared for certain purposes, such as for marketing.

✓ You have the right to receive your information in a confidential manner.

✓ You have a right to restrict who receives your information.

Under certain circumstances, ADH may ask you for specific information in order to confirm your identity and ensure the exercise of your rights. This is another appropriate security measure to ensure that personal data is not disclosed to an individual who does not have the right to receive it.

If needed (fraud, scams, rip-off, bogus product, etc.), you may also report a complaint to your national data protection agency, the Federal Trade Commission ‘FTC’.

To do so, you may:

- directly use the FTC complaint form available on their website: ftc.gov/complaint

- or call 1-877-FTC-HELP

Your California Privacy Rights

If you are a California resident, California law may provide you with additional rights regarding our use of your personal information. To learn more about your California privacy rights, we advise you to consult the official website of the California Privacy Right Act (CPRA).

Children’s Privacy

The app is a general audience app and not designed for use by anyone under the age of 13 years old. We do not knowingly make the app available to, or collect personal data from, children under this age. In case we discover that a child under 13 has downloaded the app and provided us with personal data, we immediately delete this from our servers and block access to the app. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us so that we can take the necessary action.

Contact ADH

If you have any questions, concerns, complaints or suggestions regarding our Privacy Policy or otherwise need to contact us, please email our Data Protection Officer at informationgovernance@aptardigitalhealth.com or use the dedicated message service available through the App.

In the event of any fraud or scams, you may report a complaint to your national data protection agency (the FTC) as described in section 7.