For Washington residents and individuals whose consumer health data is collected in Washington, please see the
F. Hoffmann-La Roche Ltd (“Roche,” “we,” “our,” or “us”) values your privacy and the protection of your Personal Data. This Privacy Notice (“Notice”) explains how we collect, store, use, share, transfer, delete, and process information collected from or about you known as Personal Data (defined further below in this Notice).
This Notice describes the types of Personal Data that Roche may collect or process from United States (“US”) residents, how we may use and disclose that Personal Data, and how you may exercise any rights you may have regarding our processing of your Personal Data.
This Notice applies to Personal Data collected or processed by us from or about US residents:
Through online activities and services we offer (through websites, web surveys, newsletters, applications, email, online messaging services/channels, and otherwise) (“Online Services”);
Related to activities we undertake in recruiting participants for participation in clinical trials or activities related to identifying and contracting with study investigators and their staff;
In connection with post-approval pharmacovigilance and adverse events, complaints, and reports;
When we provide products and services directly to you and in other situations where you interact with us, including but not limited to interacting with us through our telephone customer service centers, through email or SMS/text messages, or by visiting our physical sites and offices or our events (e.g., tradeshows and conferences) (such products and services, together with Online Services, are collectively referred to as, the “Products and Services”);
If you are a resident of California: when you interact with us in a professional capacity, for example, if you are a healthcare provider or an employee of a company with which we do business, or when we undertake employment recruiting activities of California residents; or
Anywhere this Notice is posted or referenced.
Roche may provide you with a different privacy notice in certain specific situations, in which case that privacy notice or policy will apply to the Personal Information collected or processed in that specific situation, rather than this one. For example, if you are a participant in a clinical study, clinical trial, or other regulated health-related research, you should receive a separate privacy notice regarding the Personal Data we process for those purposes. That privacy notice—and not this Notice— governs our processing of such Personal Data. If you provide us with Personal Data of anyone other than yourself (such as a patient or family member), please note that you are responsible for complying with all applicable privacy and data protection laws prior to providing that information to Roche (including obtaining consent, if required).
Please review this Notice carefully. To the extent permitted by applicable law, by providing us your Personal Data or otherwise interacting with us, you are agreeing to this Notice.
“Personal Data” is any information—as electronically or otherwise recorded—that can be used to identify a person or that we can link to or associate with a specific individual.
Personal Data may include information considered sensitive in some jurisdictions, such as biometric information, genetic information, health information, financial account information, specific geolocation, ethnic or racial origin, information concerning your sex life or your sexual orientation, social security number, driver’s license, state identification card, passport number, and other similar information. Data that could be considered Sensitive Personal Data is highlighted with an asterisk (*) in the chart below.
We will process any Personal Data we collect in accordance with applicable law and as described in this Notice (unless, as explained above, a separate policy or notice governs). In some circumstances, if you do not provide us with your Personal Data, certain Products and Services may be unavailable to you.
The chart below identifies the categories of Personal Data that we collect and use and the types of data elements associated with each.
The types of Personal Data we collect and disclose depends on your relationship with Roche. Not all of the categories listed in the following charts may apply to you. If the nature of your relationship with Roche changes, additional categories of Personal Data may also apply.
CONSUMERS (INCLUDING THOSE INTERESTED IN OUR PRODUCTS, SERVICES, OR CLINICAL TRIALS), PATIENTS, CAREGIVERS, FACILITIES VISITORS. The following table provides detail for those who interact with us as (i) consumers – those showing interest in our products and/or services, (ii) individuals interested in participating in clinical trials, (iii) patients using our products/services and their caregivers, and (iv) facility visitors, with respect to the category of Personal Data collected, the source of that information, the purposes for collection and sharing/disclosure, and the categories of third parties to whom the category of Personal Data is shared.
CALIFORNIA PROFESSIONALS. The following table provides detail for residents of California who interact with us as (i) health care providers and their staff, (ii) clinical investigators and their staff, (iii) employees of companies with whom we conduct business, including employees of service providers, with respect to the category of Personal Data collected, the source of that information, the purposes for collection and sharing/disclosure, and the categories of third parties to whom the category of Personal Data is shared.
CALIFORNIA JOB APPLICANTS. The following table provides detail for residents of California who interact with us applicants for jobs, with respect to the category of Personal Data collected, the source of that information, the purposes for collection and sharing/disclosure, and the categories of third parties to whom the category of Personal Data is shared.
Mergers and Acquisitions. In addition to the uses set forth above, in certain circumstances, we will use and disclose your Personal Data to facilitate a merger, consolidation, transfer of control or other corporate reorganization in which Roche participates, or pursuant to a financial arrangement undertaken by Roche and your Personal Information will be disclosed to the buyer, assignee, or transferee.
Data Retention. We will retain your Personal Data for as long as needed or permitted to fulfill the purpose(s) for which it was collected or obtained, and as outlined in this Privacy Notice. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject that affects the Personal Data; and (iii) whether retention is determined to be necessary or advisable for Roche due to applicable statutes of limitations, litigation, or other legal or regulatory obligations. Roche takes reasonable steps to dispose of Personal Data upon the expiration of retention periods taking into consideration these litigation, legal, or regulatory obligations.
De-Identification. Roche may de-identify your Personal Data, which means it will remove certain data from your Personal Data, such as Contact Information, such that the resulting data would not be able to identify you or anyone else as the subject of the data. The de-identified data will no longer be Personal Data and may no longer be subject to data protection laws. We will not attempt to re-identify you or anyone else from this de-identified data and if we disclose it to third parties, we will require that they commit to not attempting to re-identify you or anyone else from the de-identified data. We will use de-identified data for our business purposes.
The law of the state in which you reside or in which your Personal Data is collected may have specific requirements in connection with Personal Data that is linked or is reasonably capable of being linked to you and that identifies your past, present, or future physical or mental health status (“Consumer Health Data”). Please note that the collection of consumer health data subject to the Washington State My Health My Data Act (the “MHMDA”) is addressed in the separate Washington Consumer Health Data Privacy Policy and is not covered by this Section.
To the extent your Personal Data constitutes “Consumer Health Data,” the categories of Consumer Health Data being collected; the manner in which it will be used; the categories of sources from which it is collected; the categories of third parties and affiliates with whom it is being shared; the purposes of collecting, using and sharing it; and the manner in which it will be processed are all provided in the “
To the extent that the state in which you live requires us to provide certain rights to you in connection with your Consumer Health Data, we will provide the following rights to you based on your state’s law:
● To request our confirmation that we are collecting, sharing, or selling your Consumer Health Data;
● To request to review and to make changes to any of your Consumer Health Data;
● To request that we delete your Consumer Health Data;
● To request a list of all third parties with whom we have shared or sold your Consumer Health Data;
● To request that we stop collecting, sharing, or selling your Consumer Health Data;
To exercise any of these rights, follow the procedure explained in the “
A third party may collect Consumer Health Data over time and across different websites or online services when you use any of our websites or Online Services. For more information, see the“
This Section (and the Notice more generally) is effective as of the “Last Updated” date above. We will notify you of changes to this Section (and the Notice more generally) as described in the “
To the extent permitted by applicable law, including in accordance with your consent where required by applicable law, we may engage in the following activities:
We may use your contact details to contact you to determine whether you would like to initiate a business relationship with us or to send you marketing emails. If you do not wish to receive such marketing emails, you may opt out by declining to receive such emails when registering or in our subsequent communications by following opt-out or unsubscribe instructions included in the email or at other information collection points on the Online Services.
We may display advertisements to you regarding Products and Services that we believe are relevant to you based on your activities on the Online Services or on other web or digital properties. Such advertisements may be shown on our Online Services or the online services of others. We achieve this by using, and allowing third parties (e.g., Facebook, LinkedIn) to use certain cookies, eTags, pixels, web beacons, and other tracking technologies to track your activities on our Online Services and other online services. For more information about these activities and how to manage or opt out of them, please click on the "Your Privacy Choices" link at the bottom of our website.
We may make customer offers to you based on your activities across different Online Services, including activities on other web or digital properties or your other interactions with Roche that are not via the Online Services (e.g., regional offers based on the location of your office listed on order forms).
We also perform statistical analyses of the users of our Online Services to improve the functionality, content, design, and navigation of the Online Services.
On certain of our websites, we use Google Analytics, to help us understand how users engage with this and other of our websites. Google Analytics may track your activity on our sites (i.e., the pages you have seen and the links you have clicked on) and helps us measure how you interact with the content that we provide. This information is used to compile reports and to help us improve the sites. The reports we receive disclose website trends without identifying individual visitors. You can learn about Google’s practices by going to
Certain web browsers and other programs may transmit “opt-out” signals, also called a Global Privacy Control (or GPC) signal (we refer to these as “GPC Signals”), to websites with which the browser communicates. In most cases you will need to change your web browser’s settings or add an application to your web browser to enable your browser to send a GPC Signal. Roche’s websites will recognize GPC Signals for website users differently, based on the location of the user when they access our websites. For users that access our websites from U.S. states that have laws requiring recognition of GPC Signals, we will recognize and apply the GPC Signal to inactivate all of the cookies for that website, except for cookies that are necessary for the website to operate (“Strictly Necessary Cookies”). Additionally, if you are accessing our websites from one of these states, you can determine if your browser GPC Signal has been recognized by clicking on the “Your Privacy Choices” link in the footer of the website that will include a short message at the top of the preference center indicating that your GPC Signal has been received. For users from states not currently requiring recognition of the GPC Signal, our website servers may recognize and apply the GPC Signal for only targeted advertising cookies, but will not apply the GPC Signal to functional, performance or social media cookies. Further, a specific GPC Signal acknowledgement notice will not be included in the preference center, but you can always check and adjust your cookie settings by going to the Your Privacy Choices link in the footer of this website.
Where allowed by law, as described above, we use your Personal Data to provide you with targeted advertisements or marketing communications we believe may be of interest to you. In some jurisdictions, you may have the right to opt out of these types of targeted advertisements. See the Opt-out of Sale or Sharing or Processing of Sensitive Data section below to do so.
For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page by going to
You can opt out of some targeted advertising using the below links:
Facebook:
Google:
Additionally, you can opt-out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at:
Certain of Roche’s practices may be considered the sale or sharing of Personal Data under applicable law. You may have the right to opt-out of the sale of Personal Data, opt-out of sharing of Personal Data for purposes of cross-context behavioral advertising, which in other states is the right to opt-out of targeted advertising, and the right to limit the use of sensitive Personal Data. To exercise these rights, please see the “Your Rights Regarding Your Personal Data” section below.
To the extent we offer any public or group forums on our Products and Services, such as newsfeeds, blogs, message boards, or similar tools (“Interactive Features”), the posts or comments you make may be public and viewed by others. You should use care before posting information about yourself, including Personal Data. You acknowledge and understand that you have no expectation of privacy or confidentiality in the content you submit to Interactive Features over the Products and Services. Except when required to do so by applicable law, we assume no obligation to remove Personal Data you post on our Products and Services, and your disclosure of any Personal Data through the Interactive Features is at your own risk.
Roche offers certain programs that may provide discounts or savings on products and services (“Program(s)”), that provide individuals who enroll with personalized and/or bundled product discounts, product vouchers, promotional opportunities, and/or other benefits (“Program Benefits”). Program participants opt in by signing up for a Program online. Roche collects and uses your personal information, including information you voluntarily provide us (such as your name and email address), commercial information (such as your purchase history), information we collect automatically, and information from other sources to operate the Program and related services, including to send you Program Benefits and the other uses described in this Privacy Notice.
Based on our reasonable and good faith estimate, Roche receives value from the Program through increased customer loyalty and increased sales, but we do not assign a actual monetary value to the personal information we collect in connection with the Program. Further, the precise value of your participation in the Program will vary depending on the discounts you take advantage of and purchases you make, as well as other factors. Some benefits to you may also be intangible, such as increased knowledge of and familiarity with products that you may get from participating in the Program. In general, however, Roche estimates in good faith that the value provided by Program Benefits to customers is equal to or greater than the value we receive from the personal information collected from you through the Program. Roche incurs a variety of expenses for providing Program Benefits, including administrative and technical expenses associated with maintaining the Program and costs associated with discounts on purchases.
Participation in the Program and the financial incentives it provides are voluntary. By providing your personal information when signing up for the Program, you are affirmatively opting-in to our financial incentive Program. You may unsubscribe from Program emails you receive at any time by clicking the unsubscribe link in the emails.
Service providers acting on our behalf must execute agreements requiring them to maintain confidentiality and to process Personal Data as necessary to perform their functions in a manner consistent with this Notice, other applicable privacy notices, and as explicitly permitted or required by applicable laws, rules, and regulations.
We may combine information we collect, including Personal Data, with Personal Data that we may obtain from third parties.
Our Products and Services may contain links to other websites, applications, products, or services that are not owned or operated by Roche, such as social media websites and applications like Facebook and Twitter. You should carefully review the privacy policies and practices of other websites, products, and services as we cannot control and are not responsible for privacy policies, notices, or practices of third-party websites, applications, products, and services.
Please note that in many circumstances, we cannot effectively do business with you without processing some Personal Data about you (e.g., your contact information). For example, when you contact our customer service representatives, we may require you to provide information to authenticate your identity to assist you with your request. If you are unable to provide this information, we may be unable to process your request.
To the extent that the state in which you live has a data protection law that requires us to offer some or all of the following rights to you, we will provide the following rights to you based on your state’s law:
To opt-out of sharing your Personal Data for cross-context behavioral advertising or, in other states, to opt-out of targeted advertising;
To request access to and a copy of your Personal Data, including to provide your Personal Data directly to another organization, i.e., a right to data portability;
To request to know about the Personal Data we process about you or, in other states, to request to acknowledge our processing of your Personal Data;
To request that we correct your Personal Data;
To request that we delete your Personal Data;
To request that we limit the processing of your Sensitive Personal Data;;
To opt-out of processing of Sensitive Personal Data;
To appeal the denial of a request; and
To lodge a complaint with the data protection authority in your jurisdiction.
You can opt-out of sharing personal data or opt-out of targeted advertising for any website you visit by clicking on the Your Privacy Choices link located at the bottom of that website. To learn if you have the other above rights in the state in which you live and to exercise any of these rights with respect to your Personal Data, please complete the form located
We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. We may,after receiving your request, require additional information from you to honor your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.
In the event you wish to make a complaint about how we process your Personal Data, please contact us at
When we receive your Personal Data from our customers and process your Personal Data on their behalf, we do so at their request and subject to their instructions. We do not have control over our customers’ privacy and security practices and processes. If your Personal Data has been submitted to us by a Roche customer and you wish to exercise any of the above-mentioned rights, please contact the relevant customer directly.
Consistent with applicable laws and requirements, Roche has put in place physical, technical, and administrative safeguards designed to protect Personal Data from loss, misuse, alteration, theft, unauthorized access, and unauthorized disclosure consistent with legal obligations and industry practices. However, as is the case with all websites, applications, products, and services, we unfortunately are not able to guarantee security for data collected through our Products and Services. In addition, it is your responsibility to safeguard any passwords, ID numbers, or similar individual information associated with your use of the Products and Services.
We generally retain Personal Data for as long as needed for the specific business purpose or purposes for which it was collected. In some cases, we may be required to retain Personal Data for a longer period of time by law or for other necessary business purposes. Whenever possible, we aim to de-identify the information or otherwise remove some or all information that may identify you from records that we may need to keep for periods beyond the specified retention period.
If you are a patient, please note that this Notice is distinct from your Healthcare Provider’s HIPAA Notice of Privacy Practices, which describes how your Healthcare Provider uses and discloses individually identifiable information about your health that it collects, as well as any other privacy practices it applies. Roche collects, uses, and discloses any Personal Data it receives from your Healthcare Provider in accordance with its HIPAA-required agreements with your Healthcare Provider.
We reserve the right to change this Notice from time to time. We will alert you when changes have been made by indicating the date this Notice was last updated as the date the Notice became effective or as otherwise may be required by law. It is recommended that you periodically revisit this Notice to learn of any changes.
If you have questions or comments about this Notice or about how your Personal Data is processed, please contact us by one of the methods below:
Email:
Mail: F. Hoffmann-La Roche Ltd, Attn: Privacy Office, 9115 Hague Road, Indianapolis, IN 46256
Phone: (800) 975-7105
We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. Note that your request to exercise your data privacy rights must be done through the web form and 800 number listed under Your Rights Regarding Your Personal Data. We may, after receiving your request, require additional information from you to honor your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.
This website contains information on products which is targeted to a wide range of audiences and could contain product details or information otherwise not accessible or valid in your country. Please be aware that we do not take any responsibility for accessing such information which may not comply with any legal process, regulation, registration or usage in the country of your origin.