Privacy Statement

Your privacy is important to us. Eli Lilly and Company ("Lilly") has established a comprehensive privacy program, including a global privacy office and a chief privacy officer, designed to help us respect and protect your privacy rights. This Privacy Statement will let you know what Personal Information (PI) Lilly may collect, how we use it, how we protect it, and your rights and choices with respect to your PI. This Privacy Statement applies to all Lilly operations as well as websites, mobile applications and digital services (“websites”) that link to or post it. It is incorporated into and made a part of our Terms of Use for this website, which include provisions that limit Lilly’s liability.

PI We Collect and How We Use It

Depending on your interactions with Lilly, we may collect the following PI:

• Name/Alias/Signature;
• Full Date of Birth;
• Identifiable Photograph/Video/Physical Characteristics or Descriptions;
• Gender;
• Business/Professional Contact Information (e.g., title, company name, business address, business email address, business phone/fax number);
• Personal Contact Information (e.g., personal address, personal email address, personal phone/fax, personal web/internet address, family member names);
• Online identifiers that correspond to your device(s) (e.g., personal IP [Internet Protocol] address, cookies, RFID, etc.);
• Employment/Professional Job or Qualifications Information;
• Health Information;
• Biographic Information;
• Financial and Government Identifying Numbers (e.g., Social Security number);
• Criminal/Conviction Records (e.g., on Federal Exclusion list);
• Biometric Identifiers;
• Website Utilization and Social Media Use;
• Education Information;
• Commercial Information (e.g. purchasing, consuming history or tendencies);
• Inferences reflecting preferences

We collect PI from a number of sources, including

• Employees, potential employees and their family members;
• Patients and clinical/medical trial participants;
• Clinical/medical investigators and staff conducting clinical/medical research;
• Healthcare professionals;
• Adverse event reporters and subjects;
• Consumers;
• Customers;
• Investors and shareholders;
• Vendors, suppliers and contractors;
• Business partners;
• Government officials

We process/use PI for the following business or commercial purposes

• Activities for public health and interest;
• Activities as an employer to support and fulfill our obligations to our employees;
• Research and development of our products;
• Compliance with legal or regulatory obligations (e.g., adverse event reporting, exercising or defending legal claims, financial disclosure reporting);
• Business and market research;
• Market research for our products and services;
• Study recruitment;
• Marketing and sales of our products;
• Communicating information about our products, responding to requests, and registration for services;
• Providing patient assistance;
• Finance and tax activities;
• Statistical analytics;
• Event management;
• Contracting and business planning activities; and
• Administration of other legal and business processes that are in Lilly’s legitimate interest, inclusive of company record retention, safeguarding our physical and electronic workplace, and website management.

Lilly may share your PI with

• Lilly employees and affiliates;
• Healthcare professionals;
• Vendors, suppliers and contractors;
• Business partners and
• Government officials (e.g., law enforcement authorities, the courts, regulatory authorities).

Where permitted by law, Lilly may also enhance or merge information, including PI, with information obtained from third parties for the same purposes shared above. PI may also be used for profiling for the same purposes shared above. You may object to profiling via automated-decision making by contacting us using the information in the “How to Contact Us” section below.

You do not have to share your PI with us, but if you choose not to share your PI, we may not be able to provide you with certain information, products or services.

In the ordinary course of business, Lilly sometimes collects Social Security numbers to fulfill legal or regulatory obligations or for other administrative purposes. We respect the confidentiality of Social Security numbers and we avoid the unnecessary collection of them, limit access to them, and disclose them only (i) according to Lilly’s internal global privacy policy and procedures, (ii) with those third parties who are legally or contractually obligated to protect them, and (iii) as required or permitted by law.

Through this website, Lilly may

• Collect your Name and Personal Contact Information if you opt-in to receive communications (such as requests for information, responses to inquiries, newsletters, etc.). Lilly may also use this information to verify your relationship with Lilly and take other actions in order to respond to your request.
• Collect online identifiers that correspond to your device(s) that do not directly identify you in order to improve, manage and secure our websites, network systems and other assets; verify your relationship with us; understand your interests and preferences; and take other actions that may be necessary to respond to your request.
• Analyze your website usage including the date and time of your website session, geographic location, how you have navigated the website, and other information collected through our web beacons, cookies, third-party and digital advertising, Google Analytics^® and social media plug-ins. This information is collected for our legitimate business purposes.

Web beacons: A web beacon (also known as an “action tag” or “clear GIF technology”) is a tiny graphic on a web page or in an email message designed to track pages viewed or messages opened, and allows the collection of web log information. Web log information is gathered by the computer that hosts our website (called a "web server") when you visit one of our websites. We may use web beacons to help determine which email messages sent by us were opened and whether a message was acted upon. Web beacons also help Lilly analyze the effectiveness of websites by measuring the number of visitors to a site or how many visitors clicked on key elements of a site.

Cookies: A cookie is a small data file that a website can place on your computer’s hard drive where your internet browser files are kept. A cookie saves you the trouble of reentering certain information in some registration areas because cookies can be used to enable a site to “remember” information a visitor has previously inputted. A cookie also helps deliver content and features likely to be of interest to you, based on your previous activities on our site, and to track how sections of the website are used. Cookies can be placed on your computer both by us and by third parties with whom we have a relationship, such as web analytic services and advertising network services. In addition, cookies may be used to remarket employment opportunities to you in the United States. With most internet browsers or other software, you can change your browser settings to erase cookies from your computer hard drive, block all cookies or receive a warning before a cookie is stored. Please check your browser instructions to learn more about these functions. If you reject cookies, functionality of the site may be limited, and you may not be able to take advantage of many of the site's features.

• Choices about Cookies: If you would like to opt-out of, or manage, cookies used for targeted advertising, you may do so by following the options provided by the Network Advertising Initiative and the Digital Advertising Alliance. Ads displayed to you using this technology will usually have an AdChoices logo in the corner, which you can also click on to begin the same opt-out process. Additionally, if you receive ads on a social media site, you can check that site’s privacy statement and terms of use to determine how to stop seeing such ads. The European Interactive Digital Advertising Alliance keeps a website where people can opt-out of receiving interest-based advertising from some or all of the network advertising companies participating in the program. You can find information about the EIDAA here.
• Do Not Track: There are different ways you can prevent tracking of your online activity. One of them is setting a preference in your browser that alerts websites you visit that you do not want them to collect certain information about you. This is referred to as a Do Not Track (“DNT”) signal. Please note that currently our websites and web-based resources do not respond to these signals from web browsers. At this time, there is no universally accepted standard for what a company should do when a DNT signal is detected.

Third-Party and Digital Advertising: We may partner with third-party advertising networks to manage our advertising on other sites. Our ad network partners may place cookies and web beacons and similar digital markers on your browser when you visit our websites to collect information about your activities over time on this and third-party websites, apps, and other online services, to provide you targeted advertising based upon your interests. We may also share PI about you with third parties in order to have those third parties, on our behalf, directly serve advertising to you on their websites.

Google Analytics: Google Analytics may be used to help make our website work better and to help us understand what parts of the website are being utilized. Google Analytics uses technical tools, such as first-party cookies and JavaScript^® code, to collect information about visitors. The Google Analytics service tracks visitors to the site who have JavaScript enabled. Google Analytics anonymously tracks how visitors interact with a website, including where they came from and what they did on a site. Google Analytics collects the information set forth above from users. This information is used to administer and update the website, and we will assess whether the visitors to the site match the expected site demographics and determine how key audiences are navigating the content. First-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick cookie) will be used to report how your ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to visits to this site.

• Opt-Out Provision: Google Analytics offers an opt-out provision for website visitors who do not want their data to be collected. You can receive more information about this option here.
• Google's Use of Data: Google and its wholly owned subsidiaries may retain and use, subject to the terms of its Privacy Policy (located here, or at another such URL that Google may provide from time to time), information collected in your use of the Google Analytics Information Disclosures and Sharing.

Social Media Plug-ins: Our websites may use social media plug-ins to enable you to share information with others easily. When you visit our websites, the operator of the social media plug-in that is on our website can place a cookie on your computer that lets that operator recognize individuals on their website who have previously visited our sites. Social media plug-ins may allow social media websites to receive directly identifiable information about you that shows you have visited our website. The social media plug-in may collect this information for visitors, whether or not they specifically interact with the plug-in on our website. Social media plug-ins also allow the social media website to share information about your activities on our website with other users of their social media website. Lilly does not control any of the content from social media plug-ins. For more information about social plug-ins from social media websites, you should refer to those sites’ privacy and data-sharing statements.

Children's Information

This website is not intended for or designed for individuals under the age of 18. We do not knowingly collect PI from any person under the age of 18 unless a parent or guardian provides consent.

Reasons We Share PI

We may share your PI with third parties in connection with work that they do for or with Lilly, for purposes consistent with those listed above. These third parties must agree to protect the PI and to use it only as directed by Lilly.

We may also be required to disclose your information in response to lawful information requests for PI by law enforcement authorities, the courts or regulatory authorities, including complying with national security or law enforcement requests.

In the event that Lilly may decide to reorganize or divest part or all of its business, including its information databases, through a sale, divestiture, merger, acquisition or other means of transfer, then PI may be shared with, sold, transferred, rented, licensed, or otherwise provided or made available by Lilly to third parties in connection with the contemplated transaction (without your consent or any further notice to you). In such circumstances, Lilly will seek written assurances that the PI will be protected appropriately.

Where We Transfer and Work With PI

This website is owned and operated by Lilly in the United States. However, any information collected on this website may be transferred to other Lilly affiliates and third parties worldwide. These affiliates and third parties may in turn transmit PI to other Lilly affiliates and third parties. Some of Lilly’s affiliates and third parties may be located in countries that do not require the same level of data protection as the country you reside in. When transferring PI across country borders, Lilly and its affiliates utilize appropriate transfer mechanisms as applicable (which may include consent, Standard Contractual Clauses, existing adequacy decisions, etc.). Nevertheless, all of Lilly’s affiliates are required to treat PI in a manner consistent with this notice, and Lilly’s internal global privacy policies. By using this website, you consent to the collection, storage, and processing of your PI in the United States and in any country to which we may transfer your information in the course of our business operations.

EU-U.S. and Swiss-U.S. Privacy Shield

Lilly, including Lilly USA, LLC, Loxo Oncology at Lilly and Avid Radiopharmaceuticals, Inc. (“Lilly U.S.”), participates in and has certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks (“Privacy Shield”). Lilly U.S. is committed to processing the PI we received in the United States from the European Union (EU), the United Kingdom (UK) and Switzerland in accordance with the Privacy Shield Principles of Notice; Choice; Accountability for Onward Transfer; Security; Data Integrity and Purpose Limitation; Access; and Recourse, Enforcement and Liability.

If you have been directed to this Privacy Statement from a source other than Lilly.com, and there is a conflict between the terms in this Privacy Statement and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
As explained in the “Reasons We Share PI” section above, PI may be shared as appropriate with third parties that process information on behalf of, or with, Lilly U.S. Under certain circumstances, Lilly U.S. may remain liable for the acts of certain third parties if those third parties process PI originating from the EU, the UK and/or Switzerland that Lilly discloses to them in a manner that is inconsistent with the Privacy Shield Principles.

If you have any inquiries or complaints about our handling of your PI under the Privacy Shield or other appropriate transfer framework, or you want to view your PI that Lilly U.S. processes and request its correction, amendment or deletion, please contact us using the information in the “How to Contact Us” section below.

If you still have a specific privacy concern that has not been resolved after attempting to address your privacy question or concern with Lilly U.S. directly, you may choose mediation of that concern by the neutral third party, American Arbitration Association. You may submit your unresolved privacy concern to the American Arbitration Association for resolution by contacting them here:

American Arbitration Association (AAA)
AAA website
877-495-4185: Toll free
877-304-8457: Fax
casefiling@adr.org

You may also have the option to select binding arbitration for the resolution of your complaint with respect to PI originating in the EU, the UK or Switzerland. For more information on binding arbitration, see the U.S. Department of Commerce's Privacy Shield Framework: Annex I (Binding Arbitration).

Lilly U.S. is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission for purposes of enforcing compliance with the Privacy Shield. Lilly U.S. also commits to cooperate with EU Data Protection Authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) and comply with the advice given by such authorities with regard to human resources data transferred from the EU, the UK and Switzerland in the context of the employment relationship. For more information about the Privacy Shield or to view Lilly U.S.’s certification page, please visit the U.S. Federal Trade Commission’s website on Privacy Shield located here.

To obtain additional information regarding the basis for transfers and safeguards that Lilly has in place for cross-border transfers of PI, please contact us at privacy@lilly.com.

How Long We Keep PI

PI will be saved for a period of time needed to fulfill legitimate and lawful business purposes in accordance with our record retention policies and applicable laws and regulations.

How We Secure PI

We provide reasonable physical, technical and procedural safeguards to protect PI we work with and maintain. We limit access to PI to authorized employees and third parties who need access to carry out their assigned roles and responsibilities on behalf of Lilly. Although we strive to protect the PI we work with and maintain, no security system can prevent all potential security breaches.

Your Rights and Choices

Upon verification of your identity and as applicable by law, you have the right to request information from us on how your PI is being used and with whom it is being shared. Information about our process to verify your identity can be found here. You also have the right and choice to request to see and receive a copy of the PI that we have about you, request that we correct, restrict the processing of, and/or erase/delete your PI, or in France, set expectations for the handling of your data after your death.

In limited circumstances, you may have the right to have your information transmitted to another entity or person in a machine-readable format.

There may be exceptions that apply to your request.

To exercise your rights, you or your authorized representative may submit a request to Datarights@Lilly.com or by contacting us using one of the methods listed in the Contact Us section. You can find information regarding our responses to U.S. requests regarding personal information here. Instructions on appointing an authorized representative to submit U.S. requests for personal information on your behalf can be found here.

You will not be discriminated against for exercising any of your rights.

California Privacy Rights

California Civil Code Section 1798.83 entitles California residents who have an established business relationship with Lilly the right to request information regarding Lilly’s disclosure of certain PI to third parties for their direct marketing purposes. To make a request for such information, you may contact us using the information in the “How to Contact Us” section below. You can find information regarding our responses to U.S. requests regarding personal information here. Instructions on appointing an authorized representative to submit US requests for personal information on your behalf can be found here.

California Consumer Privacy Act (CCPA) entitles California residents to certain rights with regard to their PI. Those rights have been incorporated into this Privacy Statement.

We do not sell personal information.

How to Contact Us

You may make any of the above requests by using the contact information below:

Eli Lilly and Company
1-800-Lilly-Rx (1-800-545-5979)
privacy@lilly.com

You may also contact us at the above if you have questions about this Privacy Statement.

How to Submit a Complaint

If you wish to raise a complaint on how we have handled your PI, you can contact our Data Protection Officer at privacy@lilly.com, who will investigate the matter.

If you are not satisfied with our response or believe we are not processing your PI in accordance with the law, you can register a complaint with a relevant regulatory authority (e.g., a Data Protection Authority or Attorney General).

Links to Third-Party Websites

As a convenience to our visitors, this website may contain links to other sites owned and operated by third parties that we believe may offer useful information. The policies and procedures we describe here do not apply to those sites. We are not responsible for the collection or use of PI at any third-party sites. Therefore, we disclaim any liability for any third party's use of PI obtained through using the third-party website. We suggest contacting those sites directly for information on their privacy, security, data collection and distribution policies.

Changes to Our Privacy Practices

We may update this Privacy Statement from time to time. When we do update it, for your convenience, we will make the updated statement available on this page. We will always handle your PI in accordance with the Privacy Statement in effect at the time it was collected unless we provide you with the new notice and/or obtain your consent, as appropriate.