About Us Products Pipeline Investors & News Careers Contact Us Privacy Policy Online Privacy Policy Effective Date: August 25, 2020 Osmotica Pharmaceuticals plc and its subsidiaries (“Osmotica”) appreciate the importance of protecting your Personal Information, which is any information that relates to an identified or identifiable individual (“Personal Information”). This Privacy Policy describes the types of information we collect and our practices for collecting, using, and disclosing such information, and applies to our websites (the “Websites”) and mobile applications that link to this Privacy Policy (Websites and mobile applications collectively referred to as “the Services”). Information We Collect Osmotica may collect the following information when you interact with the Services: your title, name, e-mail address, professional qualifications, telephone number or any other identifier that you might provide to us by which you may be contacted online or offline online identifiers (such as IP addresses, and information about your Internet connection and equipment you use to access the Services) and usage details We may collect this information: directly from you when you provide it to us automatically through the use of cookies, pixels, or other tracking technologies from third parties, such as digital media partner websites, third party data sources, analytics providers, and other service providers When you are using the Websites, third parties may collect information about your online activities over time and across third-party websites or other online services. Where we need to collect Personal Information by law or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you. The Services are not intended for children under 13 years of age, and we do not knowingly collect Personal Information from children under 13. If you are under 13 years of age, do not use or provide any information through the Services. If we learn we have collected or received Personal Information from a child under 13 without verification of parental consent, we will delete that information. How We May Use Your Information Osmotica may use information, including Personal Information, for the following purposes: to provide the functionality of the Services to communicate with you and to fulfill your requests, such as for coupons and samples to manage customer relationships to advertise products that may be of interest to you to authenticate and otherwise maintain security of the Services to conduct analytics and market research to improve the Services to carry out our obligations and enforce our rights arising from any contracts entered into between you and us in any other way we may describe when you provide the information for any other purpose with your consent We may use aggregated information and de-identified information without restriction. Tracking Technologies We use information collected through cookies, pixels, or other tracking technologies, sometimes in combination with other Personal Information, to better understand, customize and improve your experience on the Websites, as well as to manage our advertising. For example, we may use web analytics services that leverage such information to help us understand how you engage with and navigate the Websites and to allow us to offer you a more customized, relevant experience on the Websites by delivering content and functionality based on your preferences and interests. We may also use information to display interest-based ads. Meet UPNEEQ™ App If your healthcare provider uses the Meet UPNEEQ app in connection with their provisioning of healthcare services to you, the app will require your healthcare provider to take before and after photographs for the purpose of measuring eyelid distance, and the app may also require your healthcare provider to input your name and birthdate into the app. Osmotica does not collect any of this information from your healthcare provider, and the app deletes this information once your healthcare provider completes his or her session in the app. Osmotica only collects from the Meet UPNEEQ app certain identifiers relating to the healthcare provider’s device on which the app is installed, such as iPad ID, device type, and operating system type, and de-identified or aggregated usage data pertaining to the provider’s use of the app. Lawful Bases for Processing We rely on the following lawful bases to process your Personal Information for these non-exhaustive purposes: Consent We may obtain your consent to process your Personal Information in certain circumstances, which may include when you elect to receive information from us. We may also rely upon our legitimate interest in developing our business as a basis for sending you marketing information and information about our Services (see below). Performance of a Contract We rely on this lawful processing ground when we process your Personal Information to perform a contract that we have with you, or when we take steps in anticipation of entering into a contract with you, for example in connection with the provision of our Services to you and the management of our relationships with third parties. Compliance with a Legal Obligation We rely on this lawful processing ground when we process your Personal Information to meet legal and regulatory obligations that apply to us. Legitimate Interests We rely on this lawful processing ground when we process your Personal Information to provide our Services, to respond to specific requests, to manage our business operations, to manage our relationships with you and with third parties in connection with our business, and when we provide you with marketing information or other information in relation to our Services that we believe may interest you. If you wish to have more information regarding the legitimate interests we rely on, please contact us at privacy@osmotica.com. How We May Disclose Your Information We may disclose information, including Personal Information: to affiliates and other companies within our group of companies to companies and individuals who perform duties on our behalf, such as website hosting, marketing, recruitment, customer service, and analytics (see how Google Analytics uses your information at www.google.com/policies/privacy/partners/) to a third party that acquires all or a substantial portion of our business, whether by way of merger, consolidation or purchase of all or a substantial portion of our assets to comply with any court order, law, or legal process, including to respond to any government or regulatory request to protect the rights, property, or safety of Osmotica, our customers, or others for any other purpose disclosed by us when you provide the information with your consent We may disclose aggregated information and de-identified information without restriction. Information Transfers Our servers are either located in the United States or, if located in other countries, may be accessed from the United States. Please note that in countries outside your own country, and in particular outside the EU and EEA, a different standard on data protection might apply than you are used to in your own country. By sending Personal Information to us, you acknowledge and consent that your information will be transferred across national borders, including to countries outside the EU/EEA. If you live in the EEA, we may transfer Personal Information to countries for which adequacy decisions have been issued, use contractual protections for the transfer of Personal Information to third parties, such as an intra-company agreement that complies with the European Commission’s Standard Contractual Clauses or their equivalent under applicable law, or rely on third parties’ certification to the Swiss-U.S. Privacy Shield Framework, where applicable. You may contact us at privacy@osmotica.com to obtain a copy of the safeguards we use to transfer Personal Information outside of the EEA. How We Protect Your Information We have implemented measures designed to secure your Personal Information from accidental loss, unauthorized access, use, alteration and disclosure. Personal Information is stored in a central database on a secured network in the United States with stringent access controls in place. Although we have made reasonable efforts to safeguard the confidentiality of your Personal Information, we cannot promise, and you should not expect, that your Personal Information will always stay private. We cannot guarantee that unauthorized third parties will never be able to circumvent our security measures and obtain access to your Personal Information and use it for improper purposes. How Long We Keep Your Information Osmotica only keeps Personal Information for as long as necessary. When determining the appropriate retention period for Personal Information, we take into account various criteria, such as the amount, nature and sensitivity of the Personal Information, potential risk of harm from unauthorized use or disclosure, purposes for which we process your Personal Information, whether we can achieve those purposes through other means, and our business operations and legal requirements. Privacy Choices Direct Marketing Opt-Out If you no longer wish to receive promotional emails from Osmotica, you may click the “Unsubscribe” link in an email at any time. Interest-Based Advertising Opt-Out You may control interest-based advertising by clicking the AdChoices icon on an ad or by visiting the Digital Advertising Alliance’s (DAA) and National Advertising Initiative’s (NAI) opt-out pages at https://optout.networkadvertising.org/?c=1 or https://optout.aboutads.info/?c=2&lang=EN. Browser Settings While your browser may accept cookies automatically, you can change the settings on your browser to prevent our cookies from being automatically downloaded, or to notify you that they are ready to be downloaded. The latter will give you the option of whether or not you want to accept our cookies. If you decide to decline our cookies, however, some of the Websites’ features or services may not function as well as they would have had you accepted our cookies. While you cannot decline Web Beacons, you can decline all cookies and therefore render the Web Beacons ineffective. Please note that blocking cookies may interfere with your interest-based advertising opt-out preferences. The Services do not respond to “Do Not Track” signals. European Economic Area (EEA) Privacy Rights If you live in the EEA, you may have the following rights: to request access to, rectification, or erasure of your Personal Information or restrict the processing of your Personal Information to object to processing to data portability (receive and transfer your Personal Information) to lodge a complaint with a supervisory authority where processing of your Personal Information is based on consent, to withdraw your consent at any time without affecting the lawfulness of the processing of Personal Information that occurred before you withdraw consent (to make such a request, please email us at privacy@osmotica.com). California Privacy Rights California Consumer Privacy Act (CCPA) Osmotica collects Personal Information as defined by the CCPA, which is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include de-identified or aggregate information, publicly available information that is lawfully made available from federal, state, or local government records, information covered by certain sector-specific privacy laws, such as medical information under California’s Confidentiality of Medical Information Act and protected health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and some clinical trial information. In the preceding 12 months, Osmotica collected the following categories of Personal Information for the business purposes indicated above in “How We May Use Your Information”: Identifiers (e.g., real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name) Categories of Personal Information described in California Civil Code §1798.80(e) (e.g., name, signature, address, telephone number) Commercial information (e.g., products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies) Internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer’s interaction with an internet website, mobile app, or advertisement) Osmotica collects Personal Information from the following categories of sources: directly from you when you provide it to us automatically through the use of cookies, web beacons, and other tracking technologies from third parties, such as digital media partner websites, third party data sources, analytics providers, and other service providers In the preceding 12 months, Osmotica has disclosed the following categories of Personal Information to the following categories of third parties for a business purpose. Osmotica does not sell Personal Information. Personal Information Third Parties Identifiers marketing providers, other service providers Telephone number marketing providers, other service providers Internet or other electronic network activity information digital media agencies, other service providers California residents have the right to: (1) request that Osmotica disclose what Personal Information we collect, use, disclose, and sell; (2) request deletion of Personal Information; (3) opt-out of the sale of Personal Information; and (4) not receive discriminatory treatment by Osmotica for exercising these rights. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. To make a request on your behalf, an authorized agent may contact us by email with proof of your written and signed permission to do so. Osmotica may also require you to verify your identity and confirm that you gave permission. Requests to Know You have the right to request that we disclose the following information: Specific pieces of Personal Information Osmotica has collected about you; Categories of Personal Information Osmotica has collected about you, disclosed about you for a business purpose, or sold; Categories of sources from which the Personal Information is collected; Categories of third parties with whom Osmotica shares or to whom Osmotica sells Personal Information; and The business or commercial purpose for collecting and selling Personal Information. To make such a request, please email us at privacy@osmotica.com, or call us toll-free at 866-600-4799. We will generally ask you to provide certain information that we already maintain in our records so that we can verify your identity. Requests to Delete You have the right to request that we delete Personal Information about you that we collected and maintain, subject to certain exceptions. To make such a request, please call us toll-free at 866-600-4799 or email us at privacy@osmotica.com. Once we verify your request, we will delete and direct our service providers to delete your Personal Information, unless an exception applies. Nevada Privacy Rights Although Osmotica does not sell your Personal Information, Nevada residents may have the right to opt-out of the any future sale of Personal Information we have collected or will collect. To make such a request, please email us at privacy@osmotica.com. Changes to this Privacy Policy If we make any material change to this Privacy Policy, we will post notice of the changes on the Services. If we make a material change to our privacy practices that will apply to information Osmotica has already collected, we will additionally seek your affirmative consent. Contact Us You may contact Osmotica by email with questions or concerns at privacy@osmotica.com. If you live in the EEA, Osmotica Pharmaceuticals plc is the entity responsible for the processing of your Personal Information. Please submit questions, concerns, or requests to exercise your applicable rights by email to Osmotica and its Data Protection Officer at privacy@osmotica.com or write to: Osmotica Pharmaceuticals plc 400 Crossing Boulevard Bridgewater, NJ 08807 © 2021 Osmotica Pharmaceuticals plc. All Rights Reserved A public limited company Registered in Ireland Registration Number: 607944 Registered office: 25-28 North Wall Quay, Dublin 1, Ireland Terms of Use Privacy Policy