Privacy statement

Based on your selection above the Johnson & Johnson company shown below in the “Contact us” tile is the legal entity you interact with and the data controller of your personal data. If more than one company is shown please check the relevant legal entity that is indicated in the channel where you interact with us (e.g., email, website, mobile app, contract) to identify the relevant one for you. If you have any questions about this privacy statement or about how we process personal data, please reach out to us.

Important! If you wish to contact us specifically to exercise your rights in relation to your personal data, please use a method listed in the tile “How to exercise your privacy rights”.

Based on your selection above, the following notices may supplement this Privacy Statement to you, as applicable:

We and our service providers collect personal data that you provide to us directly, we collect automatically, we receive indirectly from third parties we have a relationship with, or information from registries or publicly available sources.

Information you provide to us directly

• When you provide personal data to us through your use of our digital services such as when you sign up for a newsletter, make a purchase, register an account, attend a meeting, conference, training or other event, post on our social media pages or product review pages, or contact customer service or any of our contact centers
• When you get in touch with us to provide feedback, to make a request or ask a question, including those related to medical information
• When you provide us with information about our products related to undesirable side effects and interactions, lack of effectiveness, quality complaints and/or other aspects related to the safety or quality of our products
• When you take part in research studies, including clinical trials and market research studies, interviews or surveys
• When we are engaged with you in a contractual relationship for the provision of services and you provide us with information for us to perform our obligations under that contract
• When you provide us with information during day-to-day interactions with our sales representatives
• When you share information via “testimonials” (your experience of living with a disease or condition).

Information we collect automatically

We might collect information as listed below either directly from you or via third parties. This type of information may not always reveal your specific identity or may not directly relate to you and may therefore not always be considered to be personal data. However, where this is the case, we may use and disclose such information according to the purposes and the legal basis as described in this Privacy Statement, except where we are required to do otherwise under applicable law. If we combine such information with personal data, we will treat the combined information as personal data as long as it is combined.

• When you use and navigate our digital services we might automatically collect information from you, such as when you click on links or conduct a search, the pages you have visited, the website you came from and the searches you have performed. In this context we might use “cookies” or similar technologies to collect the personal data, as permitted by applicable laws. We and our service providers may use the information for the following purposes:
  
  • For security reasons
  • To facilitate navigation
  • To display information more effectively
  • To personalize your experience and to select which of our advertisements or offers are most likely to appeal to you and display them while you are using our Services, as permitted by applicable laws
  • To track your responses to our advertisements, as permitted by applicable laws
  • To recognize your computer or device, in order to make your navigation experience easier, such as to remember what is in your shopping cart
  • To gather statistical information about your usage of our digital services in order to continually improve their design and functionality, to understand how individuals use them, and to assist us with resolving questions regarding them
  • To calculate usage levels, diagnosing server problems and administering the website or app
  • To derive your approximate location from your IP address or through your browser, such as your Media Access Control (MAC) address, computer type (Windows or Mac), screen resolution, operating system name and version, and internet browser type and version. In this case we may collect similar information if you access our digital services through a mobile device. We and our service providers may use the information to ensure that our digital services function properly.
  • To use pixel tags, web beacons, clear GIFs, or other similar technologies, which may be used in connection with some pages and HTML formatted email messages related to our websites or apps. We and our service providers may use the information for the following purposes:
    
    • To track the actions of users and email recipients, namely to automatically monitor and collect information on how you engage with the email content we send to you, to help us understand when/if you have opened the email, and what contents and features in the email are of interest to you. When you engage with our email content such as clicking a link to a web page, or accessing a document, we may collect information such as your IP address and type of browser to help us identify you, so that we can personalize the contents as well as tailor the look and feel of the browsing experience in a way that is relevant to your needs and preferences
    • To measure the success of our marketing campaigns and compile statistics about the usage of our digital services
    • To use other technologies, like reCAPTCHA, which is a test to tell humans and bot or automated accesses apart when you use our digital services.

Where applicable, you will be informed about the cookies and other devices implemented in the Cookie Policy, available in the digital service you use. When required by applicable law you may be prompted to confirm your cookies preferences.

As permitted by applicable laws, and subject to your cookie preferences, we may use third party advertising companies to serve advertisements regarding goods and services that may be of interest to you when you access and use our digital or online services, based on information relating to your access to and use of such services on any of your devices. To do so, these companies may place or recognize a unique cookie on your browser (including by pixel tags). They may also use these technologies, along with information they collect about your online use, to recognize and serve advertisements to you across the devices you use such as a mobile phone and a laptop.

You will have the opportunity to manage your cookies preferences, as applicable, by following your browser’s or preference center’s instructions or even by modifying your settings; however, if you do not accept them, you may experience some inconvenience in your use of the website or app. You may also not receive advertising or other offers from us that are relevant to your interests and needs.

To learn more about cookies, please visit http://www.allaboutcookies.org.

Information we receive from third parties or collect from publicly available sources

• We receive information from Johnson & Johnson affiliates. A list of our affiliates is available here
• From healthcare providers, patient advocacy groups, educational institutions, and other business partners which may be in the context of clinical research, market research, disease awareness campaigns, mentoring programs, training events, adverse events or managing complaints etc.
• From caregivers that might provide us with information about you in the context of a service or the submission of a product safety or quality complaint
• From other third parties that would have the relevant authority to provide personal data related to you
• From other third-party information providers, including industry dedicated services such as, among others, MedScape, IQVIA, Veeva, Sermo, G-med, and Google advertising network
• From third parties with whom we jointly market a product
• From data brokers who are in the business of collecting or aggregating information about you sourced from publicly available databases
• From publicly available sources like social media networks, for example when you post on your social media profiles or in any other digital service in which you might be registered about our company, our products and more in general about different drugs and diseases, in which case we may engage in social media listening
• From your social media profiles, such as on LinkedIn, X, Instagram, Facebook and Medscape. For example, if you connect your social media account to your services account, you will share certain personal data from your social media account with us, such as your name, e-mail address, photo, and contacts or friends

Unless we have collected your consent or we have another legal basis, we will receive only unidentified or aggregate information.

If you submit any personal data relating to another individual to us, for example if you are a caregiver or a healthcare professional and are providing us with information about a patient, you represent that you have the authority to do so as permitted by and complying with applicable law and to permit us to use the information in accordance with this Privacy Statement.

It is important to us that you understand the types of personal data we collect, how we use that personal data, and the legal basis for such collection, processing, and use. Because these details vary across our different businesses and the individuals with whom we interact, we provide the dropdown choices above, which are tailored to your relationship with us.

In any event, unless we specifically request it we ask that you do not send us and you do not disclose any special categories of personal data (sensitive personal data such as social security number, government ID, or national ID number, racial or ethnic origin, political opinions, religion or other beliefs, health, biometric data or genetic data, criminal background, or trade union membership) on or through our digital services or otherwise to us.

We may use new tools and technologies, including artificial intelligence (AI), in connection with our products, services, and operations. Where personal data is processed by these technologies, such processing is limited to the purposes described in this Privacy Statement and/or any supplemental privacy notices provided at the time of data collection.

We treat the training of AI models as a distinct use of personal data. Therefore, we will only use your personal data for this purpose where we have a separate and valid legal basis under applicable data protection laws—such as your consent or our legitimate interests—and have met all relevant legal requirements including implementing safeguards and ensuring transparency.

Furthermore, we do not use AI or other automated technologies to make decisions that may produce legal or similarly significant effects concerning you, except in limited circumstances where:

• You have been clearly informed of such automated processing,
• The processing is permitted by applicable law, and
• You are provided with meaningful information about the logic involved, as well as the opportunity to request human intervention or review.

Johnson & Johnson collects personal data from minors in limited cases, subject to obtaining verified parental/guardian consent, as applicable. In processing the personal data of minors, we consider the age of majority as defined by the applicable law as well as the type of communications we provide. If personal data about minors has been provided to us by mistake and you would like to request that such personal data be removed, please follow the instructions described in the section Your rights to your personal data.

We may share your personal data with our affiliates and third parties.
The types of third-parties we may share your personal data with include:

• Johnson & Johnson affiliates
  We may share your personal data with our affiliates for the purposes described in this Privacy Statement. A list of our affiliates is available here
• Third-party co-branding and co-marketing partners
  We may share your personal data with our third-party partners with whom we offer a co-branded or co-marketed product or service
• Third-party service providers
  We may share your personal data with our third-party service providers, who provide services such as website hosting and moderating, mobile application hosting, data analysis, payment processing, order fulfillment, infrastructure provision, IT services, customer service, email and direct mail delivery services, auditing and other services
• Vendors
  We may also share your personal data with vendors we engage with directly or indirectly in the organization of local and international training and events, such as venues, transportation companies, as applicable
• Third-party advertising partners
  Where applicable, to improve the effectiveness of our communication with you and our marketing campaigns, we may share your personal data with our third-party advertising partners, including social media, medical journals and publishers, such as, but not limited to, Facebook, LinkedIn, X and Medscape
• Research and collaboration and licensing partners
  To enable clinical and medical research and collaboration, or healthcare technology innovation and development, your personal data may be shared with our research and collaboration partners, our licensing partners and our technology partners
• Healthcare Providers and Healthcare Professionals
  We may share your personal data with healthcare providers and healthcare professionals
• Posting and Social Sharing
  By using our digital services, you may elect to disclose personal data
  
  • On profile pages, blogs, product reviews, and other services to which you are able to post information and content (including our social media pages). Please note that any information you post or disclose through these services will become public and may be available to other users and the general public
  • Through your social sharing activity. When you connect your services account to your social media account, you will share personal data with your friends associated with your social media account, with other users, and with your social media account provider.
  By doing so, you understand that the use of shared personal data will be governed by the social media provider’s own privacy statement.
  
• Other situations:
  
  • In the event of a reorganization, merger (when a brand or one of our businesses with which you’ve shared personal data is sold to another company), divestiture, acquisition, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings) we may need to share your personal data with the third parties involved. In such events we will ensure that the party receiving your personal data will abide by the terms of this Privacy Statement.
  • We may also use and disclose to third parties your personal data to enforce our terms and conditions, comply with legal process or applicable laws, which may include laws outside your place of residence, and in response to requests from public or government authorities, including authorities outside your place of residence.
  • For other legal reasons:
    
    • To ensure compliance with and enforce our terms and conditions and policies
    • To protect our rights, privacy, safety or property, and/or that of our affiliates, you or others
    • For audits, to verify that our internal processes function as intended and to address legal, regulatory, or contractual requirements
    • For fraud prevention and security monitoring purposes, for example, to detect and prevent cyberattacks or attempts to commit identity theft
    • To comply with obligations relating to scientific research such as when performing interventional clinical trials or obligations associated with manufacturing pharmaceutical products.
  • To aggregate and/or anonymize personal data so that it will no longer be considered personal data. We do so to generate other data for our use, which we may use and disclose for any purpose, as it no longer identifies you or any other individual; and
  • For data analysis, for example, to improve the efficiency of our services.

Where applicable laws require, we will obtain your consent for sharing your personal data with third parties.

Your personal data may be stored and processed in any location where we have facilities or service providers. By the use of our services or by providing consent to us (where required by law), your information may be transferred to other locations. For example, if you are in the European Union, your information may be transferred to the United States, which may provide for different data protection rules. Nonetheless, appropriate contractual and other measures are in place, in accordance with local requirements or applicable law, to protect personal data when it is transferred to our affiliates or third parties in other locations. Some locations outside your place of residence are recognized as providing an adequate level of data protection. Consult the links to learn more about locations recognized as adequate by:

• The European Economic Area
• Switzerland
• United Kingdom

For transfers to locations not deemed adequate, we have ensured that appropriate measures are in place to protect your personal data, including by ensuring that the recipient is bound by Standard Contractual Clauses as may be provided for in applicable laws where you reside. You may obtain a copy of these measures by contacting us in accordance with the Section Who controls your personal data and how to contact us.

You can exercise any of your rights by using any of the method(s) provided in the tile How to exercise your privacy rights above.

Your right to withdraw your consent

When processing is based on your consent (e.g., for us to deliver marketing communications or newsletters), you have the right to withdraw your consent at any time. Note that this will not affect our processing of your personal data based on consent before your withdrawal.

Specifically, if you withdraw your consent for receiving marketing communications from us, we may still send you communications that are necessary for managing our relationship with you such as transactional communications, account authentication, scheduling a meeting, and responding to your inquiries.

Please note that in these cases we may not be able to directly remove your personal data from the databases of our affiliates or third-party partners with which we have already shared your information, and in such case we will notify our affiliates or third-party partners of your request.

Your additional rights regarding our processing of your personal data

Consistent with applicable law, you also have the right to request:

• Information about the personal data we collected, used or shared or otherwise disclosed
• Access to your personal data
• An electronic copy in a structured, commonly used and machine-readable format of the personal data you provided to us for purposes of transmitting it to another company
• Correction of inaccurate information we hold about you
• Deletion of your personal data when foreseen by applicable law
• Restriction of processing of your personal data when foreseen by applicable law, such as while we are processing your correction or objection request. While processing is restricted, your personal data will remain stored by us, but we will not process it except with your consent, for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or reasons of important public interest
• Object to the processing for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing
• Object to processing of your personal data (including profiling) on grounds relating to your situation in certain cases
• Object to being subject to a decision based solely on automated processing, including profiling, which produces legal effects for you or similarly significantly affects you.

Please note that, if you exercise your right to correct or delete your personal data, we may need to retain certain information for record-keeping purposes and/or to complete any transactions that you began prior to requesting a correction or deletion (e.g., when you make a purchase, you may not be able to correct or delete the personal data provided until after the completion of such purchase).

You have the right to be free from unlawful discrimination for exercising your rights.

For your protection, we may only implement requests with respect to the personal data associated with the email address that you use to send us your request, and we may need to verify your identity. To do so, we may request additional personal data from you, such as email address or postal address.

We will respond to your request as soon as reasonably practicable and consistent with applicable law. If circumstances cause any delay in our response, you will be promptly notified and provided with a date for our response.

If we are not able to satisfy your request, you may lodge a complaint with the competent supervisory authority:

• Argentina: https://www.argentina.gob.ar/aaip
• Australia: https://www.oaic.gov.au/
• Brazil: https://www.gov.br/anpd/pt-br
• Canada: https://www.priv.gc.ca/en/
• Chile: https://www.gob.cl/
• China: http://www.cac.gov.cn/
• Colombia: https://www.sic.gov.co/
• Costa Rica: https://www.prodhab.go.cr/
• El Salvador: https://www.defensoria.gob.sv/
• European Economic Area: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
• Hong Kong: https://www.pcpd.org.hk/
• Israel: https://www.gov.il/he/Departments/the_privacy_protection_authority
• Japan: https://www.ppc.go.jp/
• Korea: https://www.pipc.go.kr/np/
• Malaysia: https://www.pdp.gov.my/ppdpv1/
• Mexico: https://www.gob.mx/buengobierno/
• New Zealand: https://www.privacy.org.nz/
• Panama: https://www.antai.gob.pa/
• Peru: https://www.gob.pe/anpd
• Russia: https://rkn.gov.ru/
• Serbia: https://www.poverenik.rs/
• South Africa: https://inforegulator.org.za/
• Switzerland: https://www.edoeb.admin.ch/
• Turkey: http://www.kvkk.gov.tr/
• United Kingdom: https://ico.org.uk/
• Uruguay: https://www.gub.uy/unidad-reguladora-control-datos-personales/

We take utmost care of, and we are responsible for taking reasonable steps to protect your personal data from unauthorized access, amendment or disclosure and from improper use, loss or intrusion. We use reasonable organizational, technical, and administrative measures designed to protect personal data under our control. Where appropriate these can include technical solutions like firewalls, intrusion detection or encryption and organizational and physical controls such as training staff on identification of data incidents, locked filing cabinets where data may be stored, if at all, and risks or access restrictions.

To determine the level of protection required in each case, we appropriately assess the nature of your personal data together with the risk of a security incident occurring.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us following the instructions in the section Who controls your personal data and how to contact us.

We will retain your personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law.

The criteria used to determine our retention periods include:

• the length of time we have an ongoing relationship with you and provide a service to you
• whether there is a legal/regulatory obligation to which we are subject
• whether retention is advisable in light of our legal position (such as in regard to certification requirements, applicable statutes of limitations, litigation, or regulatory investigations).

Our services may contain links to sites of third parties, including to those with whom you might have created your own account to allow you to make a payment to us in the context of a service previously requested. This privacy statement does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating any site, app, or other online service that is available through our digital services or to which our digital services contain a link. In addition, we are not responsible for the information collection, use, disclosure, or security policies or practices of other organizations, such as Facebook/Meta, Apple, Google, Microsoft, or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer, including with respect to any personal data you disclose to other organizations through or in connection with our apps or our social media pages.

We may change this privacy statement from time to time. Any changes will become effective when we post the revised privacy statement on this page. We recommend that you regularly review this privacy statement.