ABBOTT PRIVACY POLICY -
KAZAKHSTAN ONLY

For Kazakh / Russian

Effective Date: 1^st of September, 2024

Our privacy notice is part of our approach to transparency and protection of your personal information.

This Privacy Policy describes how Abbott collects, uses, and shares your Personal Information when you use our products, visit our websites and apps, and interact with us offline controlled by Abbott (collectively, the “Services”). It also tells you about the rights and choices you may have with respect to your personal information.

Abbott and/or its local affiliates (e.g., Abbott Kazakhstan LLP) (“Abbott”) is the “Owner of the Personal Data Base” for the processing of your personal data for the purposes mentioned below.

Abbott may offer certain products, programs or services that have unique or additional terms, privacy notices and/or consent forms that explain how Abbott processes information. For details on any product-specific features, notices or terms, please review the terms for those products and services.

How does Abbott define Personal Information?

“Personal Information” means information that identifies or relates to you as an individual or could be used to identify you and which is submitted to and/or collected and used by Abbott via its website. Personal Information includes “personal data” as that term is defined in applicable Kazakhstan data protection laws. Personal Information may not include information that has been made anonymous, which means information that no longer identifies you individually or can be related to you as an individual, or has been de-identified, or aggregated. Examples of Personal Information include, but are not limited to, your name, email address, mailing address, phone number, date of birth, gender, online identifier or other identification number.

Abbott will comply with the requirements of Kazakhstan legislation on collection, processing and protection of biometric data. According to Article 1.1 of the Law on Personal Data, biometric data is personal data that characterizes physiological and biological features of the personal data subject, on the basis of which his/her identity can be established.

How does Abbott collect Personal Information?

Abbott collects Personal Information online and offline in a few different ways:

• Personal Information that you provide. We may collect Personal Information and other information that you provide when you use our Services, attend Abbott programs or events, participate in research, and any other data that you may choose to submit or provide. With your permission, we may also collect data from another source like a device or social media account. Such information may include, but not be limited to, contact information (such as your name, postal address, e-mail address, telephone number, user ID, and password), date of birth, professional credentials, experiences, activities, skills, preferences, hobbies and interests.
• Personal Information from public or third-party sources. We may collect data from public sources including, but not limited to, social media and other websites that enable social sharing. We may also collect Personal Information from government agencies, public or third-party information sources, third-party service providers, or business partners. In addition, we also may collect information from industry and patient groups and associations or combine information we have collected from multiple sources. We may engage third-party service providers to provide certain interactive features on our Services. Your use of these interactive features is voluntary, and we may retain the information that you submit through these features. For example, we may offer an interactive chat feature on our Services to assist you with your order and for other customer service purposes. When you participate in the interactive chat, either with a virtual or live agent, the contents of the chat may be captured and kept as a transcript. By using these features, you understand that our vendors may process the information obtained through the feature to provide the service on our behalf.
• Personal Information collected from devices you use to connect with us or use our Services. Abbott collects data through our websites and apps and automatically from devices you use to connect to our Services. See our Cookie Policy to know more on how we use cookies and similar technologies in this website.
• Personal Information collected with business partners. We sometimes work with other organizations to provide you with our Services. When that happens, we require that information be protected.

If you choose to submit any Personal Information relating to other people, you represent that you have the authority to do so and permit us to use the information in accordance with this Privacy Policy.

From time to time, we may use or augment the Personal Information we have about you with information obtained from other sources, such as public databases, social media platforms and other third parties. We may also combine information we get from a third-party with information we already have, and we may combine information that we have collected offline with information we collect online. To protect your privacy, you should not provide Abbott with any information that is not specifically requested.

You may also give us permission to access certain personal information maintained by other service providers. For example, you may link your social media or Google account to Abbott, which allows us to obtain information from those accounts (such as your friends or contacts). The information we obtain from these services often depends on your settings or the applicable provider’s privacy policies, so please check those policies before granting Abbott access. You agree that we are not responsible for any acts or omissions by these social media service providers.

What Personal Information does Abbott collect, and how do we use it and share it?

This table offers an overview of what personal information does Abbott collect, and how do we use it and share it. This is not an exhaustive list and only some parts would apply depending on the type of user, the case, and the processed information. Abbott may offer certain products, programs or services that have unique or additional terms, privacy notices and/or consent forms that explain how Abbott processes information. For details on any product-specific features, notices or terms, please review the terms for those products and services.

Abbott may share your personal information with a third party in connection with the sale or transfer of one of its product lines or divisions so that the buyer can continue to perform the processing of personal data for the purposes above mentioned, where applicable. Abbott may be required to disclose your personal information to respond to authorized information requests from government authorities or law enforcement agencies or when otherwise required by law. In certain cases, Abbott may also disclose your personal information to legal advisers and auditors, when required and legally permitted.

Abbott may also share provide access to your personal information to vendors with whom Abbott contracts to carry out business activities on its behalf (e.g., customer support services, delivery services, online payment services and fraud detection services, cloud, or hosting providers, marketing activities, where applicable, etc.). If Abbott provides your personal information to vendors to assist us with our business activities, it is Abbott’s practice to require those vendors to keep your personal information confidential and to use your personal information only to perform functions following Abbott’s instructions, including its erasure or return upon termination of their services.

According to Article 7.1 of the Law of the Republic of Kazakhstan "On Personal Data and their Protection" dated May 21, 2013 N 94-V ("Personal Data Law"), the collection and processing of your personal data is allowed with your consent, except in cases established by Article 7.5 and Article 9 of the Personal Data Law. In accordance with Article 7.5 of the Personal Data Law, if your personal data was previously disseminated to publicly available sources with your consent, it is allowed to be collected again without your consent with reference to that source. According to Article 9 of the Personal Data Law, collection and processing of your personal data without your consent is allowed in cases established by the laws of the Republic of Kazakhstan, including, but not limited to, cases of (i) law enforcement bodies, courts and other authorized state bodies that initiate and consider cases of administrative offenses or enforcement proceedings, (ii) implementation of international treaties ratified by the Republic of Kazakhstan, or (iii) protection of constitutional rights and freedoms of individuals, if obtaining consent from a personal data subject is impossible.

What personal information does Abbott use for marketing?

Abbott may share with third parties for marketing and advertising purposes the following categories of Personal data:

• Identifiers
• Internet or other electronic network activity information
• Geolocation data

We may allow certain companies to place tracking technologies, such as cookies or tracking pixels on our websites. Those companies receive information about your interaction with our websites that is associated with your browser or device and may use that data for targeted advertising (i.e., to serve you relevant ads on our websites or others).

You may unsubscribe from any marketing-related email that we send you by clicking the “unsubscribe” link at the bottom of the email.

Does Abbott transfer personal information to different jurisdictions?

Abbott may transfer your personal information to other jurisdictions different from the country where you are based, and where required, after having obtained your consent. These countries may include the United States, where Abbott is headquartered, and other countries which may not guarantee the same level of protection of personal data as the one in which you reside.

To safeguard your personal information, we will only make such transfers as necessary to use your personal information as described in this policy and only transfer your personal data as permitted by Kazakhstan’s privacy/data protection law.

Which are your Privacy Rights?

The applicable data protection law grants you comprehensive data protection rights to your personal information. Some or all of the following rights might be granted by the laws of your country or region:

• The right to require the erasure of your personal information;
• The right to rectify any wrong or incomplete personal data that Abbott holds about you;
• The right to opt out at any time of processing activities based on legitimate interest (e.g., on some occasions, opt-out from receiving marketing material from us)]. This will be noted at the bottom of any email you receive from us;
• The right to access the personal data that Abbott holds about you;
• The right, in some cases, to object to the processing of your personal data on legitimate grounds;
• The right not to be subjected to automated decision making intended to evaluate certain personal aspects relating to you, such as analytics based on conduct. Please refer to the Cookies Policy for more information on how to exercise this right if it is indicated that cookies are being used;
• Where you have provided your personal data to us with your consent or as part of a contract, the right to the portability of that personal data to another person or, if it’s technically feasible for us to do so, to another company;
• The right to lodge a complaint with your national data protection supervisory authority or to receive compensation for any damage you suffer; and
• The right to withdraw your consent to Abbott’s processing of your personal data, without detriment or negative consequences (e.g., withdraw your consent for receiving marketing communications, if consent is the lawful basis for such processing).

Your rights under the Law of the Republic of Kazakhstan "On Personal Data and its Protection" dated May 21, 2013 N 94-V (the "PDL") Article 24.1 and the relevant by-laws include:

• to know about the presence of their personal data with an owner and/or operator and third party, as well as to receive information containing:
  • evidence of the fact, purpose, sources, ways of collection, and processing of the personal data;
  • list of the personal data; and
  • time of processing of the personal data, including the time of its storage;
• to request the owner and/or operator amend and supplement their personal data if any grounds are confirmed by relevant documents;
• to request the owner and/or operator and third party block their personal data in cases where information of a breach of conditions regarding the collection or processing of personal data is available;
• to request the owner and/or operator and third party destroy their personal data where the collection and processing were made in breach of law and in other cases established by the PDL and other regulatory acts;
• to revoke their consent to collect, process, distribute in public sources, transfer to third parties, and cross-border transfer personal data except for in cases envisaged by PDL Article 8.2;
• to consent or object to the owner and/or operator's distribution of their personal data in public sources of personal data;
• to the protection of their rights and legal interests, including compensation for moral and material damage; and
• to exercise other rights provided by the Personal Data Law and other laws of the Republic of Kazakhstan.
• The right to lodge a complaint with the authorized body in the field of personal data protection, the Information Security Committee of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan. You can file a complaint online at https://eotinish.kz/ru.

Please note that these rights could be rejected or limited according to the applicable data protection regulations or may depend on additional requirements.

How does Abbott protect the privacy of children?

Abbott does not knowingly collect or use any personal information from children, except if explicitly indicated in the Privacy Notice. We do not knowingly allow children to order our products, communicate with us, or use any of our online services.

If you are a parent and become aware that your child has provided us with information, please contact us at the above email address, and we will work with you to address this issue.

How does Abbott keep Personal Information Secure?

It is Abbott’s practice to apply appropriate security measures to the processing of personal information, however, the confidentiality of personal information transmitted over the Internet cannot be guaranteed. Personal information can be accessed by a restricted number of Abbott employees. We train our employees about the importance of privacy and how to handle and manage customer data appropriately and securely. We urge you to exercise caution when transmitting personal information over the Internet, especially personal information related to your health. Abbott cannot guarantee that unauthorized third parties will not gain access to your personal information; therefore, when submitting personal information to Abbott Web Sites, you must weigh both the benefits and the risks.

When collecting and processing personal data on the territory of the Republic of Kazakhstan, Abbott will fulfill the obligations on personal data protection provided for by the Kazakhstani legislation: transfer of information through protected communication channels and (or) with the use of encryption, compliance with the requirements to the applied means of cryptographic protection of information, other obligations on personal data protection. However, this cannot completely eliminate the possibility of information security incidents related to illegal access to personal data by intruders.

We urge you to exercise caution when transmitting personal information over the Internet, especially personal information related to your health, where applicable.

We may provide links to websites and other third-party content that are not owned or operated by Abbott. You should check the privacy policies of any third-party sites different from this one before submitting personal information.

Personal information can be accessed by a restricted number of Abbott employees. We train our employees about the importance of privacy and how to handle and manage personal information appropriately and securely.

How can I contact Abbott?

Abbott Kazakhstan LLP
Kazakhstan, 050060, Almaty,1 Yedil Yergozhin St., of. 90
+7 727 244 75 44 +7 727 244 76 44

You may direct any queries you have about our processing of your personal information or you may request any of the above rights by contacting emea-dpo@abbott.com

Please indicate the specific right that you want to exercise and for which Abbott product, website or business division, as applicable, in the subject line of the e-mail. Whenever possible and applicable, please use the same email address used for the registration to make a request of a personal data right. We will do our best to respond to all reasonable requests in a timely manner.

How Will I Know Whether Abbott Has Updated This Policy?

Without prejudice to your rights under applicable law, Abbott reserves the right to amend this Privacy Policy without prior notice to reflect technological advancements, legal and regulatory changes and good business practices. In certain jurisdictions, registered users will be notified by email of any changes and relevant information will be posted on the Abbott Web Site.

If Abbott changes its privacy practices, an updated version of this Privacy Policy will reflect those changes and we will notify you of such changes by updating the effective date at the top of this Privacy Policy.