Privacy Notice

California Privacy Notice

Information for California Residents

We collect Personal Information from California residents and comply with the California Consumer Privacy Act and related laws and regulations (“California privacy laws”). This California Privacy Notice applies to California residents (“users,” “you,” or “your”).

For the purposes of this California Privacy Notice, “Personal Information” means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Information:

• Publicly available information;
• Deidentified or aggregated data; or
• Information otherwise excluded from the scope of California privacy laws.

This Privacy Notice provides the following information to California residents:

• Categories of Personal Information we collect;
• Purposes for which we use Personal Information;
• Categories of Personal Information we disclose to third parties;
• Categories of third parties to which we disclose Personal Information; and
• Consumer rights under California privacy laws and how to exercise those rights, specifically including:
  • The rights to access, correct, or delete their Personal Information;
  • The right to limit the use of their Sensitive Personal Information in certain circumstances; and
  • The rights to opt out of targeted advertising, sales of Personal Information, or profiling.

Categories of Non-Sensitive Personal Information

The table below outlines the non-sensitive categories of Personal Information Coherus BioSciences, Inc. collects about California residents and whether and how they are disclosed to third parties.

We collect Non-Sensitive Personal Information from the following sources:

• Directly from our users
• Inferences from your activity using our services
• From our business partners (“business partners” are companies that we have a pre-existing commercial relationship with)
• From data brokers (“data brokers” are companies engaged in the business of buying or collecting Personal Information and selling it to other businesses)

Category of Personal Information: Identifiers

Examples

Identifiers may contain the following: Name, address, contact information, gender, IP Address, practice affiliation, phone number, fax number, email, title and role

Purpose(s) for Collection

To categorize market research responses Enrollment into Coherus Solutions^™ patient support programs, such as benefit verifications, copay enrollment, and patient assistance program enrollment Counting number of unique visitors to a Coherus website Deploying a remarketing banner ad campaign to those who visit certain Coherus websites Commercial Analytics Product Complaints

Targeted Advertising

We may disclose this information with advertising partners for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information may be disclosed to Business Partners and Advertising Partners. We disclose Identifiers To enable our processors to provide services on our behalf.

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Category of Personal Information: Personal Characteristics

Examples

Personal Characteristics may contain the following: Time spent in patient care, years in profession, specialty

Purpose(s) for Collection

For commercial Analytics purposes; This information is collected for enrollment into Coherus Solutions^™ patient support programs, such as benefit verifications, copay enrollment, and patient assistance program enrollment.; To categorize market research responses

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Category of Personal Information: Commercial Information

Examples

Commercial Information may contain the following: insurance (primary/secondary)

Purpose(s) for Collection

This information is collected for enrollment into Coherus Solutions^™ patient support programs, such as benefit verifications, copay enrollment, and patient assistance program enrollment.; To categorize market research responses

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Category of Personal Information: Internet/Electronic Activity

Examples

Internet/Electronic Activity may contain the following: We track actions on our websites, how much time is spent on a website; additionally we track who clicks on our display advertising

Purpose(s) for Collection

Understanding the effectiveness of our websites and advertising

Targeted Advertising

We may disclose this information with advertising partners for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Category of Personal Information: Imprecise Geolocational Information

Examples

Imprecise Geolocational Information may contain the following: Geofencing by location is used to deploy advertisements to those attending certain events. Zip code information about website visitors is also collected.

Purpose(s) for Collection

Deploying targeted advertisement relevant to people attending a local event; Understanding the geographic spread of rare diseases

Targeted Advertising

We may disclose this information with advertising partners for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Category of Personal Information: Professional Information

Examples

Professional Information may contain the following: Employment status and history

Purpose(s) for Collection

Developing cohorts for research studies; Categorize market research responses

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Category of Personal Information: Educational Information

Examples

Educational Information may contain the following: Educational qualifications

Purpose(s) for Collection

Develop cohorts for research studies

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local law with the goal of limiting the retention period of personal information

Categories of Sensitive Personal Information

The table below outlines the categories of Sensitive Personal Information Coherus BioSciences, Inc. collects about California residents and whether they are disclosed to third parties.

We collect Sensitive Personal Information from the following sources:

• Directly from our users

Category of Sensitive Personal Information: Sensitive Category Data

Examples

Sensitive Category Data may contain the following: Gender, age, weight and medical background related to any safety events with our products that mandate reporting to the appropriate government authority

Purpose(s) for Collection

Comply with our drug safety and pharmacovigilance obligations

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties 

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the retention period of personal information

Use of Personal Information

We use Personal Information for the purposes described above. Personal Information may also be used or disclosed as otherwise permitted or required by applicable law.

Disclosing Personal Information

We disclose Personal Information to the following categories of third parties:

• Processors (also referred to as “Service Providers” or “Contractors” in California law): We use processors to securely handle Personal Information on our behalf for our business purposes and only on our instructions. California privacy laws and our contracts with these companies prevent them from using your Personal Information for their own purposes.
• Our Business Partners: We may disclose relevant Personal Information to our business partners to provide you with exclusive offers for products and services that may interest you.

See the tables above for more details about how different categories of Personal Information are disclosed.

We do not sell Personal Information to anyone.

Exercising Your Personal Information Rights

California residents have the following rights under California privacy laws:

• The right to know the Personal Information we have collected about them, including the categories of sources from which we collected the Personal Information, the purpose(s) for collecting, selling, or sharing your Personal Information, and the categories of third parties to whom we have disclosed your Personal Information
• The rights to correct or delete Personal Information;
• The right to limit the use of Sensitive Personal Information in certain circumstances;
• The rights to opt out of targeted advertising, sales of Personal Information, or profiling; and
• The right not to receive discriminatory treatment for exercising their privacy rights.

If you are a California resident, you can submit a request to exercise your personal data rights under California privacy laws by visiting our online privacy request portal at https://www.requesteasy.com/638f-6999 or calling our toll-free number at 1-888-728-0419. Coherus BioSciences, Inc. also processes Opt-Out Preference Signals in compliance with California law. You can send an Opt-Out Preference Signal for our business to process by visiting our website using a device or browser that broadcasts commonly used and recognized Opt-Out Preference Signals. We will apply the Opt-Out Preference Signals we receive to the browser or devise that sent the signal.

To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will verify your identity by reviewing the information provided to us. We may request additional information to ensure we are interacting with the correct individual.We may ask you for additional information as part of this process, including any additional information that may be required by law before we may take action upon such a request. This additional information may vary depending on the nature of your request and/or the nature of the information about which your request relates. In some cases, we may also be required by law to obtain a signed declaration under penalty of perjury from you that you are the subject of the request being made. If we suspect fraudulent or malicious activity, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. If you do not complete the verification process, we may be unable to process your request. Any information you provide to authenticate your identity will only be used to process your rights request and not for any other purpose. Please be aware that we do not accept or process rights requests submitted through other means.

We will respond to your rights request within 45 days (or 15 days for requests to opt-out of the sale of Personal Information, requests to opt-out of targeted advertising, and requests to limit the use of Sensitive Personal information), though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a California resident that are manifestly unfounded, excessive, or repetitive.

Notice of Right to Opt-Out of Sale/Sharing for Targeted Advertising

California law gives California residents the right to direct a business that “sells” or “shares” their Personal Information to stop selling and/or sharing their Personal Information at any time. California law defines “selling” as exchanging Personal Information with a third party for money or anything of value, and it defines “sharing” as disclosing Personal Information to a third party for use in conducting “cross-context behavioral advertising,” also referred to as “targeted advertising.” An example of targeted advertising is displaying advertisements to a person where the advertisement is selected based on Personal Information obtained from their activities over time and across non-affiliated websites or applications to predict their preferences or interests. In certain situations and as detailed above, we share for targeted advertising Personal Information with third parties. You can opt out of the sharing of your Personal Information by visiting our online privacy request portal at https://www.requesteasy.com/638f-6999 or calling our toll-free number at 1-888-728-0419.

Notice of Right to Limit the Use of Sensitive Personal Information

You have the right to limit some uses of Sensitive Personal Information. You may direct companies not to use Sensitive Personal Information except as necessary to provide goods or services you have requested or other exempt purposes.

However, we only use Sensitive Personal Information for purposes that are exempt from this right, such as to provide you with goods or services you have requested, to detect and prevent security incidents, or verifying the quality of our goods and services. The full list of these exempt purposes are specified in California Code of Regulations, Title 11, Section 7027(m).

Children’s Data

We do not knowingly sell or share for targeted advertising the Personal Information of California residents under 16 years of age.

We comply with the Children’s Online Privacy Protection Act (“COPPA”), in addition to California privacy law, with respect to any Personal Information we collect or use from children under the age of 13.

Authorized Agent Requests

California privacy law allows you to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above in the section titled Exercising Your Personal Information Rights. We may require verification of your authorized agent’s authority in addition to the information we require for verification of your identity.

Contact Us

If you have any questions or concerns regarding this California Privacy Notice, contact us at privacy@coherus.com.

CALIFORNIA HR PRIVACY POLICY

Privacy Information for California Employees, Contractors, and Applicants

We collect Personal Information from current and past employees (‘Employees’), Contractors and Applicants and comply with the California Consumer Privacy Act and related laws and regulations (“California privacy laws”). This California HR Privacy Notice applies to California Employees, Contractors, and Applicants (“you” or “your”).

“Personal Information” means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Information:

• Publicly available information;
• Deidentified or aggregated data; or
• Information otherwise excluded from the scope of California privacy laws.

This Privacy Notice provides the following information to California Employees, Contractors, and Applicants:

• Categories of Personal Information we collect;
• Purposes for which we use Personal Information;
• Categories of Personal Information we disclose to third parties;
• Categories of third parties to which we disclose Personal Information; and
• How Employees, Contractors, and Applicants can exercise their rights under California privacy laws:
  • The rights to access, correct, or delete their Personal Information;
  • The right to limit the use of their Sensitive Personal Information in certain circumstances; and
  • The rights to opt out of targeted advertising, sales of Personal Information, or profiling.

Categories of Non-Sensitive Personal Information

The table below outlines the non-sensitive categories of Personal Information Coherus BioSciences, Inc. collects about Employees, Contractors, and Applicants and whether and how they are disclosed to third parties.

We collect Non-Sensitive Personal Information from the following sources:

• Directly from our Employees, Contractors, and Applicants

Category of Personal Information: Identifiers

Examples

Identifiers may contain the following: Names, physical addresses and email addresses.

Purpose(s) for Collection

Government reporting and compliance

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the retention period of personal information.

Category of Personal Information: Personal Characteristics

Examples

Personal Characteristics may contain the following: Age and gender.

Purpose(s) for Collection

Government reporting and compliance.

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the retention period of personal information.

Category of Personal Information: Internet/Electronic Activity

Examples

Internet/Electronic Activity may contain the following: We track actions on our websites, how much time is spent on a website; additionally we track who clicks on our display advertising

Purpose(s) for Collection

Understanding the effectiveness of our websites and advertising

Targeted Advertising

We may disclose this information with advertising partners for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the retention period of personal information.

Category of Personal Information: Professional Information

Examples

Professional Information may contain the following: Employment history.

Purpose(s) for Collection

Government reporting and compliance.

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the retention period of personal information.

Category of Personal Information: Educational Information

Examples

Educational Information may contain the following: Grades.

Purpose(s) for Collection

Government reporting and compliance.

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the retention period of personal information.

Categories of Sensitive Personal Information

The table below outlines the categories of Sensitive Personal Information Coherus BioSciences, Inc. collects about Employees, Contractors, and Applicants and whether they are disclosed to third parties.

We collect Sensitive Personal Information from the following sources:

• Directly from our Employees, Contractors, and Applicants

Category of Sensitive Personal Information: Government ID Information

Examples

Government ID Information may contain the following: HR Subjects’ social security card, driver’s license, state identification card or passport number.

Purpose(s) for Collection

Government reporting, compliance and payroll purposes.

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the period of retention of sensitive information.

Category of Sensitive Personal Information: Sensitive Category Data

Examples

Sensitive Category Information may contain the following: Racial, ethnic, citizenship information and immigration status.

Purpose(s) for Collection

Government reporting, compliance and payroll purposes.

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the period of retention of sensitive information.

Category of Sensitive Personal Information: Financial Information

Examples

Financial Information may contain the following: Bank account information.

Purpose(s) for Collection

Government reporting, compliance and payroll purposes.

Targeted Advertising

We do not engage in targeted advertising or disclose this information for targeted advertising purposes

Sale

This information is not sold to third parties

Other Disclosures

This information is not otherwise disclosed to third parties

Retention Period

We abide by Federal, State, and Local laws with the goal of limiting the period of retention of sensitive information.

Use of Personal Information

We use Personal Information for the purposes described above. Other examples of how we may use your Personal Information within Coherus BioSciences, Inc. include:

• Publishing Employees’ work contact information in an intra-company directory for other Employees to view.
• Disclosing applicants’ submitted Personal Information with our HR department and other employees to process applications.
• Creating profiles of contractors’ performance based on work product.

Personal Information may also be used or disclosed as otherwise permitted or required by applicable law.

Disclosing Personal Information

We disclose Personal Information to the following categories of third parties:

• Processors (also referred to as “Service Providers” or “Contractors” in California law): We use processors to securely handle Personal Information on our behalf for our business purposes and only on our instructions. California privacy laws and our contracts with these companies prevent them from using your Personal Information for their own purposes.
• Other Employees, Contractors, and Applicants: Content you post on our systems may be displayed to other Employees, Contractors, and Applicants as appropriate.

See the tables above for more details about how different categories of Personal Information are disclosed.

We do not sell Personal Information to anyone. We do not share Personal Information for advertising purposes.

Exercising Your Personal Information Rights

California Employees, Contractors, and Applicants have the following rights under California privacy laws:

• The right to know the Personal Information we have collected about them, including the categories of sources from which we collected the Personal Information, the purpose(s) for collecting, selling, or sharing your Personal Information, and the categories of third parties to whom we have disclosed your Personal Information
• The rights to correct, or delete Personal Information;
• The right to limit the use of Sensitive Personal Information in certain circumstances;
• The rights to opt out of targeted advertising, sales of Personal Information, or profiling; and
• The right not to receive discriminatory treatment for exercising their privacy rights.

If you are a California Employee, Contractor, or Applicant, you can submit a request to exercise your Personal Information rights under California privacy laws by visiting our online privacy request portal at https://www.requesteasy.com/638f-6999 or calling our toll-free number at 1-888-728-0419.

To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will verify your identity by reviewing the information provided to us. We may request additional information to ensure we are interacting with the correct individual. We may ask you for additional information as part of this process, including any additional information that may be required by law before we may take action upon such a request. This additional information may vary depending on the nature of your request and/or the nature of the information about which your request relates. In some cases, we may also be required by law to obtain a signed declaration under penalty of perjury from you that you are the subject of the request being made. If we suspect fraudulent or malicious activity, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. If you do not complete the verification process, we may be unable to process your request. Any information you provide to authenticate your identity will only be used to process your rights request and not for any other purpose. Please be aware that we do not accept or process rights requests submitted through other means.

We will respond to your rights request within 45 days (or 15 days for requests to opt-out of the sale of Personal Information, requests to opt-out of targeted advertising, and requests to limit the use of Sensitive Personal information), though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a Employee, Contractor, or Applicant that are manifestly unfounded, excessive, or repetitive.

Notice of Right to Limit the Use of Sensitive Personal Information

You have the right to limit some uses of Sensitive Personal Information. You may direct companies not to use Sensitive Personal Information except as necessary to provide goods or services you have requested or other exempt purposes.

However, we only use Sensitive Personal Information for purposes that are exempt from this right, such as to provide you with goods or services you have requested, to detect and prevent security incidents, or verifying the quality of our goods and services. The full list of these exempt purposes are specified in California Code of Regulations, Title 11, Section 7027(m).

Children’s Data

We do not knowingly sell or share for targeted advertising the Personal Information of California residents under 16 years of age.

We comply with the Children’s Online Privacy Protection Act (“COPPA”), in addition to California privacy law, with respect to any Personal Information we collect or use from children under the age of 13.

Authorized Agent Requests

California privacy law allows you to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above. We may require verification of your authorized agent in addition to the information for verification above for Employees, Contractors, and Applicants and households.

Contact Us

If you have any questions or concerns regarding this California HR Privacy Notice, contact privacy@coherus.com.