PHARMACEUTICAL SECURITY INSTITUTE, INC.
October 2023
Privacy Statement
The Pharmaceutical Security Institute (“PSI”) is a membership organization all of whose
activities implicate efforts to remedy the Counterfeiting and distribution of pharmaceuticals in
violation of law (“Counterfeiting”), through interaction with its Members and coordination asneed be with Governments, medical control agencies, and law enforcement and other authorities.
PSI respects your privacy and provides this Privacy Statement to inform you of our Privacy
Policy, which sets forth the practices and choices you can make about the way your personal datais collected and how that information is used.
PSI complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the Swiss-U.S.
Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
Pharmaceutical Security Institute, Inc., and has certified to the U.S. Department of Commercethat it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles)with regard to the processing of personal data received from the European Union in reliance on
the EU-U.S. DPF. PSI has certified to the U.S. Department of Commerce that it adheres to the
Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to theprocessing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If
there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles
and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data
Privacy Framework (DPF) program, and to view our certification, please visit
https://www.dataprivacyframework.gov/. PSI is the data controller responsible for your Personal
Data.
1.

NoticeInformation collected and stored automatically
PSI does not collect or store information from its website automatically, and thus does not give,sell or transfer to third parties any such information.
Cookies
A “cookie” is a file placed on your computer’s hard drive or in memory by a web site that allows
the web site to monitor your use of the web site, usually without your knowledge. PSI uses nocookies to track Personal Data, but it may use cookies to establish state and flow control for
applications accessible over the Web.
Security and Consent to Monitor
For site security purposes, and to ensure that this Web site remains available to all visitors, all
network traffic may be monitored in order to identify unauthorized attempts to upload or change

OHSUSA: 4132-6208-5397.1

information, or otherwise cause damage or conduct criminal activity. To protect the system fromunauthorized use and to ensure that the system is functioning properly, individuals using thiscomputer system are subject to having their activities monitored and recorded by authorized
systems personnel. Anyone using this system expressly consents to such monitoring and isadvised that if such monitoring reveals evidence of possible abuse or criminal activity, system
personnel may provide the results of such monitoring to appropriate officials. Unauthorized
attempts to upload or change information, or otherwise cause damage to this Web site, arestrictly prohibited and may be punishable under applicable law. Except for visitors who
voluntarily provide PSI with personally identifying information, and except for authorized
enforcement investigations such as discussed herein, no attempts are made to identify
individual visitors to this Web Site or their usage habits while visiting this Web site.
Personal Data Otherwise Provided To PSI
Personal Data may be collected or provided to PSI about alleged Counterfeiting incidents andrelated activities by telephone, letter, facsimile, e-mail to datacontroller@psi-inc.org, or othermeans of communication. PSI uses such Personal Data only for the purposes for which it was
voluntarily submitted or originally collected or subsequently authorized by the individual,
namely (i) the collection of data about alleged pharmaceutical Counterfeiting and related
activities, (ii) the analysis of such data, the use of such data or analyses in connection withformulating and implementing anti-Counterfeiting strategies, (iii) facilitating investigations ofsuspected criminal activity, and/or (iv) communicating with governmental regulatory or law
enforcement personnel or legal counsel. Personal data may comprise one or more of thefollowing: names and nationalities, dates of birth, the grounds for suspecting that the subjects areengaged in illegal conduct, and any prior criminal activity. This processing is necessary for the
purposes of the legitimate interests pursued by PSI to protect the public health, share informationon the counterfeiting of pharmaceuticals and initiate enforcement action through the appropriate
authorities.
Except as stated in this Privacy Policy, PSI does not send any Personal Data to any third party.
Secondary Notice
PSI will notify any individual if at any time PSI adopts a policy to use the individual’s Personal
Data in a manner other than for which PSI had originally collected or processed such data, as
described above, and inform each such individual of the new policy. In such event, any suchindividual will be given the opportunity to choose (opt out) that PSI will not use such data inaccordance with the new policy, as set forth in item 2, Choice, below.
Inquiries and Complaints
In compliance with the EU-U.S. DPF and the Swiss-U.S. DPF, Pharmaceutical Security Institute,
Inc. commits to resolve DPF Principles-related complaints about our collection and use of yourpersonal information. EU and UK and Swiss individuals with inquiries or complaints regarding
our handling of personal data received in reliance on the EU-U.S. DPF and the Swiss-U.S. DPF
should first contact Pharmaceutical Security Institute, Inc. at:Todd Ratcliffe
OHSUSA: 4132-6208-5397.1-2-

President & CEO
The Pharmaceutical Security Institute, Inc.
8100 Boone Blvd Ste 220
Vienna, Virginia 22182-2683
tratcliffe@psi-inc.org
Phone: (703) 848-0161:
The inquiry or complaint needs to include the following information to enable PSI to verify thatit originates from you:Your unique username and password, or if you did not supply PSI witha username and password when you first submitted the information, aphysical or electronic signature;
Identification of the individually identifying information to which yourinquiry or complaint relates;
Identification of any material that you are requesting that PSI remove or
disable access to, and information reasonably sufficient to permit PSI tolocate the material;
Information reasonably sufficient to permit PSI to contact you, such as
your address, telephone number, and if available, an electronic mailaddress at which PSI may contact you; andA statement that the information in the inquiry or complaint is accurate.
2.

ChoicePSI uses Personal Data only for the purposes for which it was voluntarily submitted or originallycollected or subsequently authorized by the individual. PSI will give the opportunity to any
individual about whom Personal Data has been provided to choose (“opt out”) that PSI will not(a) disclose such individual’s Personal Data to a third party except as consistent with the DPF
Programs, or (b) use such Personal Data for a purpose that is incompatible with the purpose(s)for which it was originally collected or subsequently authorized by such individual. PSI may
disclose Personal Data in response to lawful requests by public authorities, including to meetnational security or law enforcement requirements.
Opt-in Regarding Sensitive Information
PSI does not generally solicit or collect Personal Data specifying an individual’s medical or
health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs,
trade union membership or information specifying the individual’s sex life (collectively“Sensitive Information”). PSI will only collect and use Sensitive Information as permitted by the
DPF Programs and applicable law and will ask such individual in advance to agree (“opt in”) to

OHSUSA: 4132-6208-5397.1-3-

supply such information. Among other exceptions, PSI will not follow opt-in procedures where
processing of data is necessary for the establishment of legal claims or defenses.
3.

Onward Transfer

PSI may transfer Personal Data to a regulatory or law enforcement agency where consistent withpublic interest or law enforcement requirements as provided for in the DPF Programs. PSI at aminimum would make such a transfer only for the purpose of establishing, exercising, or
defending against legal claims, or for the prevention, investigation, or detection of violations oflaw. Neither PSI nor any of its members has any control over regulatory or law enforcement
agencies that may be potential transferees. Applicable law in different jurisdictions may affectthe confidentiality of the information voluntarily submitted by an individual to PSI andtransferred to such agencies. As a result, PSI cannot make any assurances as to whether or not
any such agency will keep such personally identifying information confidential.
PSI may also forward Personal Data to its Members as may be in conformity with the DPF
Programs, including without limitation pursuant to an agreement requiring that a Member
provide at least the same level of privacy protection as is required from PSI under the DPF
Programs Principles. PSI acknowledges that liability may attach in connection with certain actsof onward transfer.
4.

Security

PSI has taken reasonable measures to assure that Personal Data that it collects or has been
supplied to it is retained in a secure manner. Only authorized users, bound by confidentiality
agreements, are granted access to the data stored by PSI. Remote access to the Personal Data is
not available.
PSI has appointed a Chief Security Officer (“CSO”) who is in charge of PSI’s security policy
and who monitors compliance with this policy. PSI also requires employees to review andadhere to this Privacy Policy, in addition to their general agreement as to the maintenance ofconfidentiality.
PSI holds periodic security training and compliance evaluation sessions for all its employees
which include a discussion of PSI’s Privacy Policy, awareness of its discipline process, how totake action to protect data and equipment in the event of disaster, and training on PSI’s back-up
procedures and methods of safe disposal of data.
International Transfers of your Personal Data.
Your Personal Data may be transferred to and stored in countries outside of the jurisdiction you
are in where we and our third party recipients have operations. If you are located in the European
Union ("EU"), your Personal Information will be processed in the United States; theseinternational transfers of your Personal Information are made pursuant to the DPF Programs toensure an adequate level of protection for that Personal Data.

OHSUSA: 4132-6208-5397.1-4-

Data Integrity
PSI seeks to ensure that all Personal Data that it maintains is up to date, accurate, complete andrelevant.
PSI will retain Personal Data only for as long as necessary to fulfil the purposes it was collected
it for as set out above. To determine the appropriate retention period for Personal Data, PSI
consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm fromunauthorized use or disclosure of Personal Data, the purposes for which PSI processes that
Personal Data and the applicable legal requirements.
5.

Access to Your Personal Data

If you are based in the EU or a jurisdiction with similar privacy laws, subject to any exemptions
provided for under applicable law that we may rely on, you have the following rights in respectof Personal Data that we hold about you:

Right to object. You have a right, in some circumstances, to object to any processing
based on our legitimate interests. There may, however, be compelling reasons forcontinuing to process your Personal Data, and we will assess and inform you if that isthe case.



Right of access. You have the right to obtain access to your Personal Data along withcertain related information.



Right of portability. You have the right, in certain circumstances, to receive a copy of
the Personal Data you have provided to us in a structured, commonly used, machinereadable format that supports re-use, or to request the transfer of your Personal Data to
another person.

Right to rectification. You have the right to obtain rectification of any inaccurate or
incomplete Personal Data we hold about you without undue delay.

Right to erasure. You have the right, in some circumstances, to require us to erase your
Personal Data without undue delay if the continued processing of that Personal Data is
not justified. Right to restriction. You have the right, in some circumstances, to require
us to limit the purposes for which we process your Personal Data if the continued
processing of the Personal Data in this way is not justified, such as where the accuracy of
the Personal Data is contested by you.

You also have the right to lodge a complaint to your local EU data protection authority. Further
information about how to contact your local data protection authority is available at:
http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
Irrespective of where you are based, with exceptions permitted under the DPF Programs, youhave the right to access any Personal Data that PSI retains about you in order to correct, amendor delete inaccurate information.

OHSUSA: 4132-6208-5397.1-5-

In the event that you wish to exercise any of these rights, please contact PSI at
datacontroller@psi-inc.org. In order to be able to access your Personal Data, you must provide
PSI with your unique username and password, or if inapplicable, a physical or electronic
signature.
PSI may deny access to Personal Data to any individual as may be permitted under the DPF
Programs or applicable law. For example, such denials may arise where, in PSI’s opinion, theinformation about such individual cannot readily be separated from the information that relates
to alleged Counterfeiting and related activities, or any confidential commercial information of
PSI’s members, or generally where (i) necessary to protect important countervailing public
interests, such as national security, public security, or public health, (ii) in PSI’s opinion suchaccess would interfere with (a) the execution or enforcement of the law, including theprevention, investigation or detection of offenses or the right to a fair trial, or (b) private causesof action, including the prevention, investigation or detection of legal claims or the right to a fairtrial, (iii) employee security investigations or grievance proceedings would be prejudiced, (iv)the confidentiality necessary in monitoring, inspection, and regulatory functions connected withsound management would be prejudiced, (v) in PSI’s opinion the burden or expense of providing
access would be disproportionate to the risks created to the individual’s privacy in the case inquestion, or (vi) in PSI’s opinion the rights of persons other than the individual would likely beviolated.
PSI may charge a reasonable fee for providing access to Personal Data.
6.

Enforcement

The DPF Programs Principle relating to enforcement has three components: dispute resolution,verification, and remedies, each of which is a part of PSI’s Privacy Policy.
A.

Dispute Resolution Procedure

If you have an inquiry or complaint regarding PSI’s compliance with the DPF Programs
Principles, you should first contact PSI in writing, informing that person of any specific inquiry
or complaint you may have about PSI’s collection, retention or usage of your Personal Data.
In compliance with the EU-U.S. DPF and the Swiss-U.S. DPF, Pharmaceutical Security Institute,
Inc. commits to refer unresolved complaints concerning our handling of personal data received inreliance on the EU-U.S. DPF and the Swiss-U.S. DPF to the International Centre for Dispute
Resolution of the American Arbitration Association, an alternative dispute resolution provider
based in the United States. If you do not receive timely acknowledgment of your DPF
Principles-related complaint from us, or if we have not addressed your DPF Principles-related
complaint to your satisfaction, please visit ICDR-AAA DPF IRM Service for more informationor to file a complaint. The services of International Centre for Dispute Resolution of theAmerican Arbitration Association are provided at no cost to you.
The Federal Trade Commission has jurisdiction over PSI’s compliance with the EU-U.S. Data
Privacy Framework (EU-U.S. DPF) and the Swiss-U.S. Data Privacy Framework (Swiss-U.S.
DPF).DPF Programs Verification

OHSUSA: 4132-6208-5397.1-6-

On a periodic basis, but not less frequently than once every year, PSI conducts its own objective
DPF Programs compliance review procedure. PSI also verifies that its Privacy Policy, as set
forth herein, is accurate, comprehensive, prominently displayed, and completely implemented,
including implementation of appropriate employee training and other internal procedures.
B.

Remedies

The sanctions for non-compliance with the DPF Programs principles range from suspension fromthe DPF Programs to the award of damages to individuals for privacy violations. Other sanctions
include public notice of non-compliance and injunctions. Persistent non-compliance with DPF
Programs principles may result in the loss of its benefit. These sanctions will be enforced by theentities to which a dispute has appropriately been referred. Unless otherwise required by law,
sanctions shall not include compensatory or punitive damages.
OTHER PROVISIONS
Notice and Procedure for Making Claims of Copyright Infringement
Alleged Copyright Infringement: If you believe that material posted on this Web site infringes
your copyright, you must submit a notification in writing. To be effective, your notification must
include the following:
A physical or electronic signature of a person authorized to act onbehalf of the owner of the exclusive right that you claim has been
infringed;
Identification of the copyrighted work you claim has been infringed;
Identification of the material that you are requesting that PSI remove or
disable access to, and information reasonably sufficient to permit PSI tolocate the material;
Information reasonably sufficient to permit PSI to contact you, such as
your address, telephone number, and if available, an electronic mailaddress at which PSI may contact you;
A statement that you have a good faith belief that use of the material in
the manner complained of is not authorized by you, or the law; andA statement that the information in the notification is accurate, andunder penalty of perjury, that you are authorized to act on behalf of theowner of an exclusive right that is allegedly infringed.
Upon receipt of the written Notification containing the information set forth above:
PSI shall remove or disable access to the material that you allege isinfringing;

OHSUSA: 4132-6208-5397.1-7-

PSI shall forward your written notification to the party who provided
the material;
PSI shall take reasonable steps to promptly notify the party who
provided the material that PSI has removed or disabled access to thematerial.
Counter Notification:
If you object to PSI’s removal or disabling of access to your material in response to a written
notification, you may serve PSI with a Counter Notification. To be effective, a Counter
Notification must be a written communication provided to PSI’s Designated Agent that includes
substantially the following:
A physical or electronic signature of the person submitting the Counter
Notification;
Identification of the material that has been removed or to which accesshas been disabled and the location at which the material appeared
before PSI removed it or disabled access to it;
A statement under penalty of perjury that the person submitting theCounter Notification has a good faith belief that the material was
removed or disabled as a result of mistake or misidentification of thematerial;
The name, address, and telephone number of the person submitting theCounter Notification, and a statement that the person submitting theCounter Notification consents to the jurisdiction of Federal District
Court for the judicial district in which the person submitting theCounter Notification is located, or if the address of the person
submitting the Counter Notification is outside of the United States, forany judicial district in which PSI may be found, and that the person
submitting the Counter Notification will accept service of process fromthe party who provided the original Notification or an agent of such
person.
Upon receipt of a Counter Notification containing the information set forth above:
PSI shall promptly provide the party who served the original
Notification with a copy of the Counter Notification; andPSI shall inform the party who served the original Notification that it
will replace the removed material or cease disabling access to it withinten (10) business days.
PSI shall replace the removed material or cease disabling access to the material within ten (10) tofourteen (14) business days following receipt of the Counter Notification, provided PSI’s
OHSUSA: 4132-6208-5397.1-8-

Designated Agent has not received notice from the party who served the original Notificationthat an action has been filed seeking a court order to restrain the person submitting the Counter
Notification from engaging in infringing activity relating to the material on PSI’s Web site.
DISCLAIMER
PSI is not responsible for the content of any off-site pages that are referenced by or that reference
to the PSI Web site. PSI is not responsible for any defamatory, offensive, misleading, or illegal
conduct of other users, links, or third parties, and the risk of injury from the foregoing rests
entirely with the visitor.
Links from the PSI Web site to other sites, or from other sites to the PSI home page, do notconstitute an endorsement by PSI. The links are for convenience only. It is the responsibility ofthe visitor to evaluate the content and usefulness of information obtained from other sites.
All information provided by PSI at this Web site is for the convenience of interested visitors andvisitors. The information is based on reports from various third party sources whose credibility
and knowledge are unknown to PSI. PSI has not independently verified the accuracy of any
information. PSI updates information only as new information is submitted. Individual visitors
may use the information as they see fit. PSI does not guarantee the accuracy, completeness,timeliness, or correct sequencing of information, PSI is not responsible for errors or omissions,or for the use of, or results obtained from the use of, the information.
Reference to any specific commercial products, processes, or services by trade name, trademark,manufacturer, or otherwise does not constitute or imply endorsement, recommendation, or
favoring by PSI.
Modification of This Web Site Privacy Policy and Terms of Use.
PSI reserves the right to amend this Web site Privacy Policy and Terms of Use and will alert youthat changes have been made by indicating the date they were last updated. Your continued useof this Web site after the Web site Privacy Policy and Terms of Use have been amended signifies
that you have agreed to any and all new terms.
PSI’S WEB SITE PRIVACY POLICY AND TERMS OF USE WERE LAST UPDATED ON
AUGUST 1, 2018.
Contact Information.
If you have any questions or comments regarding PSI’s Privacy Policy, privacy practices orterms of use, please contact PSI at datacontroller@psi-inc.org.

OHSUSA: 4132-6208-5397.1-9-