Privacy Notice

PRIVACY NOTICE

Updated July 1, 2020

Coherus BioSciences, Inc. (“Coherus”) recognizes the importance of and is committed to respecting and protecting your privacy. This online Privacy Notice explains how Coherus handles personal information about you provided to us through our three websites, coherus.com, coherusCOMPLETE.com and Udenyca.com, (collectively “Site”), third parties, services and products controlled by Coherus, and any other online or offline interaction with Coherus, that link to this Privacy Notice.

Please read this Privacy Notice carefully to understand how Coherus processes personal information. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY NOTICE, THEN PLEASE DO NOT USE ANY OF THE SERVICES. By accessing and using the “Services,” you agree and consent to the collection, use and disclosure of your Personal Information as outlined in this Privacy Notice. Pursuant to the California Consumer Privacy Act (“CCPA”), Coherus has developed a California Privacy Notice for consumers who reside in California.

Because Coherus is committed to the protection of your personal information, we evaluate our privacy policies and procedures to implement improvements from time to time. If we make material changes to this Privacy Notice, we will notify you by means of a prominent notice on this Site prior to the change becoming effective.

CCPA PRIVACY NOTICE

Information for California Residents

California Consumers' Rights and Choices

If you are a California resident, California law permits you to request Information regarding the:

• Categories of Personal Information (as defined by applicable California law) collected, sold or disclosed by us;
• Purposes for which categories of Personal Information collected by us are used;
• Sources of information from which we collect Personal Information; and
• Specific pieces of Personal Information we have collected about you.

In addition, if you are a California resident you may:

• Opt-out of the sale or disclosure of your Personal Information, in some circumstances;
• Opt-out of receiving marketing communications from us; however, you may still receive administrative communications regarding the Services;
• Opt-in to certain financial incentive programs we may offer related to the collection, sale, or deletion of your Personal Information; and
• Request deletion of your Personal Information by us and our service providers, in some circumstances.

You will not be discriminated against for exercising your rights under the California Consumer Privacy Act. Our privacy policy can be found at: https://www.coherus.com/privacy-policy/.

Collection of Personal Information from California Residents

We have listed below the personal information we may have collected from California residents in the past 12 months.

Here is information on whether we sell or share your personal information.

Requests

You can make requests related to your California privacy rights at the attached links:

• Access My Personal Information: (http://www.requesteasy.com/5ee3-7108);
• Delete My Personal Information: (http://www.requesteasy.com/5ee3-7108);
• Do Not Sell My Personal Information: (http://www.requesteasy.com/5ee3-7108).

You may also make those requests by calling 1-888-728-0419.

Please be aware that we do not accept or process requests through other means (e.g., via fax, social media, email addresses, etc.).

When you make a request, we may ask you to provide verifying information, such as your name, email, or phone number. We will review the information provided and may request additional information via email or other means to ensure we are interacting with the correct individual. Please also be aware that making any such request does not ensure complete or comprehensive removal or deletion of Personal Information or content you may have posted, and there may be circumstances in which the law does not require or allow us to fulfill your request.

Children

Our Services are not directed to children, and we do not knowingly collect Personal Information from children under the age of 16. If you learn that a child has provided us with Personal Information, then you may contact us as indicated above.

Do Not Track

Coherus does not currently take steps to respond to browsers’ “Do Not Track” signals as no uniform standard to respond to such signals has been developed at this time.

Date created: June 25, 2020

GDPR WEBSITE NOTICE

Last updated: June 25, 2020

This Privacy Policy (the “Policy”) applies to the processing of Personal Data, subject to the General Data Protection Regulation, by Coherus BioSciences, Inc., and its subsidiaries and affiliates (“Company”, “we”, “our”, or “us”) through its website, products, and services (the “Services”). It describes how we use and disclose such Personal Data, your rights and choices with respect to your Personal Data, and how you can contact us if you have any questions or concerns.

1. Personal Data We Collect

In this Policy, “Personal Data” means any information relating to an identified or identifiable individual. We may collect Personal Data about you from various sources described below.

Information Provided by You

• Communications. When you contact us via a contact form, email, or other means, you provide us with Personal Data, such as your name and contact details, and the content, date, and time of our communications.
• Support Information. When you request technical support services, we will process your Personal Data such as your name and the contact details you use to contact us, as well as information on the reasons for your support request, and any additional information you may provide in that context.
• Careers. If you apply for a job with us, you may provide us with your resume, name, contact details, and any other relevant information. If you become an employee, we collect additional information, such as your family information, beneficiary selections, banking information, and other relevant information for employment, payroll, and benefit purposes.
• Business opportunities. Information we collect in order to communicate with current and prospective business partners and vendors.

Where applicable, we may indicate whether and why you must provide us with your Personal Data as well as the consequences of failing to do so at the time the data is collected.

Information Collected from Other Sources

• Third Parties. We obtain Personal Data about you from third parties such as Current and prospective vendors and business partners and other entities. This information may include names, email address, phone number, business address and other similar information.

Information we Collect by Automated Means

• Social media. We may collect Personal Data via social media tools, widgets, or plug-ins to connect you to your social media accounts. These features may allow you to sign in through your social media account, share a link, or post directly to your social media account. When you visit a website that contains such tools or plugins, the social media or other service provider may learn of your visit. Your interactions with these tools are governed by the privacy policies of the corresponding social media platforms.
• Cookies. We collect Personal Data via cookies and similar technologies (see section 3 of this Policy for more information).

2. How We Use Personal Data

We use the Personal Data we collect for the following purposes:

• Providing Services, including to operate, maintain, support, and provide our Services.
• Communicating with You, including to contact you for administrative purposes (e.g., to provide services and information that you request or to respond to comments and questions) or to send you marketing communications, including updates on promotions and events, relating to products and services offered by us.
• Analytics and Product Development, including to analyze usage trends and preferences in order to improve our Services, and to develop new products, services, and features.
• Customer and Vendor Relationship Management, including to track emails, phone calls, and other actions you have taken as our customer or vendor.
• Aggregation. We may aggregate or otherwise de-identify Personal Data and use the resulting information for statistical analysis.
• Administrative and Legal, such as to address administrative issues or to defend our legal rights and to comply with our legal obligations and internal policies.

3. Legal Basis for the Processing of Personal Data

We rely on a legal basis to process your Personal Data, including:

• Consent. You have consented to the use of your Personal Data, for example to send you electronic marketing communications or for the use of certain cookies.
• Contract. We need your Personal Data to provide you with our Services and to respond to your inquiries.
• Legal Obligation. We have a legal obligation to use your Personal Data, for example to comply with tax and accounting obligations.
• Legitimate Interest. We or a third party have a legitimate interest in using your Personal Data, for example for product development and analytics purposes. We only rely on this legal basis when our or a third party’s legitimate interests are not overridden by your rights and interests.

4. How We Disclose Personal Data

We may disclose Personal Data about you in the following circumstances:

• Group Entities. We may disclose Personal Data about you to our affiliates and subsidiaries.
• Public Posts. Any information that you voluntarily choose to post to a publicly accessible area of our Services will be available to anyone who has access to that content.
• Service Providers. We work with third-party service providers to provide services such as hosting, maintenance, and support. These third parties may have access to or process your Personal Data as part of providing those services to us.
• Legal. We may disclose your Personal Data if we believe, in good faith, that this is appropriate (a) under applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
• Merger. Information about our users, including Personal Data, may be disclosed and otherwise transferred to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.
• Aggregated Information. We may use and disclose aggregated or otherwise de-identified information for any purpose, unless we are prohibited from doing so under applicable law.

5. Your Rights and Choices

Unless otherwise provided under applicable law, you have the following rights:

• Access and Portability. You may ask us to provide you with a copy of the Personal Data we maintain about you, including a machine-readable copy of the Personal Data that you have directly provided to us, and request information about its processing.
• Rectification and Deletion. You may ask us to update and correct inaccuracies in your Personal Data or to have the information anonymized or deleted, as appropriate.
• Restriction and Objection. You may ask us to restrict the processing of your Personal Data or object to such processing.
• Consent Withdrawal. You may withdraw any consent you previously provided to us regarding the processing of your Personal Data at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.
• Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place.

You may exercise these rights by contacting us using the contact details at the end of this Policy. Note that there are exceptions and limitations to each of these rights, and that we may nevertheless retain Personal Data about you where we reasonably believe that we have a legitimate reason to do so.

6. International Data Transfers

We may transfer your Personal Data outside of Europe and, in particular, to United States and other non-European countries, where the level of protection of Personal Data may be different than in your country. If we do so, we will comply with applicable data protection laws, in particular by relying on an EU Commission adequacy decision, on contractual protections for the transfer of your Personal Data, on Binding Corporate Rules, or on the EU-U.S. Privacy Shield framework. For more information about how we transfer Personal Data outside of Europe, or to obtain a copy of the contractual safeguards we use for such transfers, please contact us as specified below.

7. Data Security and Data Retention

We use physical, managerial, and technical safeguards that are designed to improve the integrity and security of Personal Data that we collect, maintain, and otherwise process.

We take measures to delete your Personal Data or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep it for a longer period. When determining the retention period, we take into account various criteria, such as the type of products or services provided to you, the nature and length of our relationship with you, mandatory retention periods and the statute of limitations.

8. Third-Party Services

Our Services may contain features or links to websites and services provided by third parties. Any information you provide via these websites or services is provided directly to these third-party operators and is subject to their privacy policies, even if accessed through our Services. We encourage you to learn about these third parties’ policies before providing them with your Personal Data.

9. Changes and Updates to this Policy

We may update this Policy from time to time to reflect changes in our privacy practices. If we modify this Policy, we will indicate the date of the latest revision above.

10. Our Contact Information

Coherus is the entity responsible for the processing of your Personal Data. If you have any questions or comments about this Policy, our privacy practices, or if you would like to exercise your rights with respect to your Personal Data, please contact us by email at [email protected].

Coherus
333 Twin Dolphin Drive, Suite 600
Redwood City, California 94065
United States

LEGAL DISCLAIMER

Coherus BioSciences (“Coherus”) maintains the Coherus web site as a service to the internet community. The Coherus web site has been designed to provide general information about Coherus, its people and its products. These pages are not intended to provide investment or medical advice nor do they provide instruction on the appropriate use of products produced or supplied under development by Coherus, its partners, related companies, or its licensors or joint venture partners. Users of this Web site should be aware that products under development described herein have not been found safe or effective by any regulatory agency and are not approved for any use outside of clinical trials. Access and use of the Coherus web site is subject to the terms and conditions set forth herein and all applicable laws, statutes, and/or regulations. Coherus may revise these terms and conditions from time to time without further notice by updating this posting.

Coherus will use reasonable efforts to include accurate and up-to-date information on the Coherus web site but Coherus makes no warranties or representations as to the accuracy of information presented on the Coherus web site. In addition, any information presented on the web site as of a particular date may only be accurate as of such date and Coherus disclaims any responsibility to update such information. Coherus shall not be held responsible for any action taken that is based on the information presented on the Coherus web site, and all users of the Coherus web site agree that all access and use of the Coherus web site, and any and all content presented on the Coherus web site, is at the user’s own risk. Neither Coherus nor any party involved in creating, producing or delivering this site shall be liable for any direct, incidental, consequential, indirect, or punitive damages arising out of user’s access, use, or inability to use the Coherus web site, or any errors or omissions in the content of the Coherus web site. Any communication or material you transmit to Coherus via the Coherus web site or Internet electronic mail is transmitted by you on a nonconfidential basis. Coherus makes no promise, express or implied, not to use such communication or material for any purpose whatsoever, including reproduction, publication, broadcast and posting.

It is the policy of Coherus to enforce its intellectual property rights to the fullest extent permitted under law. All product names, regardless of whether or not they appear in large print or with a trademark symbol, are trademarks of Coherus, its affiliates’ related companies, or its licensors or joint venture partners, unless otherwise noted. The entire content of the Coherus web site, including any images or text, is copyrighted and may not be distributed, downloaded, modified, reused, reposted, or otherwise used except as provided herein without the express written permission of Coherus. The use or misuse of these trademarks, copyrights, or other materials, except as permitted herein, is expressly prohibited and may be in violation of copyright law, trademark law, communications regulations and statutes, and other laws, statutes and/or regulations.