1. Who We Are and What We Do

Tanner Pharma Group (collectively, “TPG”, “Tanner”, “we”, “us”, or “our”) is a global pharma services company that provides access to pharmaceuticals through separate legal entities.

These entities include Tanner Pharma Group, Inc., TannerLAC, Inc. (Tanner’s licensing, acquisitions and commercialization division, and including TannerLAC UK Limited), TannerGAP, Inc. (Tanner’s division which provides global access to medicine via named patient supply), TannerCTS, Inc. (Tanner’s clinical trials sourcing division) and TannerMAP, Inc. (which assists biopharmaceutical companies to supply patients and markets with medicines where said medicines are not registered or are not commercially accessible through TannerGAP, Inc., Tanner Pharma UK Limited, Tanner Pharma CH GmbH and Tanner Pharma IE Limited in accordance with applicable law).

TPG is committed to protecting the privacy and security of your personal information and we will always treat you and your data with the respect you deserve and in accordance with applicable law. TPG maintains administrative, technical, and physical safeguards designed to protect personal information, as described in Section 8.

The purpose of this Privacy Notice (“Notice”) is to help you understand our information collection, usage, and disclosure practices and your rights and choices with respect to your personal information. This Notice applies to personal information we collect through our websites and online services, including www.tannerpharma.com and any Tanner-operated online ordering portals that link to this Notice, and in the course of our business operations.  Additional disclosures for residents of certain jurisdictions, including California and other U.S. states, appear in Section 13.

2. What We Do with Your Information and How We Use Your Information

This Notice does not apply to, and TPG is not responsible for, any third-party websites which may be accessible through links from this website. If you follow a link to any of these third-party websites, they will have their own privacy policies and you will need to check these policies before you submit any information to such third-party websites.

We will only use your information where we are permitted to do so by applicable law. In addition to using your information to deliver the programs, services, products, or information you request, and for the other purposes described in this Notice, we may also use it:

• to provide customer support;

• to provide you with information about the Services, our other products, programs, or services, your accounts, and notices;

• to deliver marketing communications that may be of interest to you;

• to advertise our services on third-party websites and platforms and to measure the effectiveness of our advertising, as described in Section 11;

• to personalize your experience and better tailor content to you;

• to help us, our subsidiaries, affiliates, and business partners better understand our audiences, evaluate user interest in the Services, improve the Services, and perform other market research activities;

• for our business purposes, such as data analysis; audits; monitoring and prevention of fraud, infringement, and other potential misuse of the Services; modifying the Services; determining the effectiveness of our promotional campaigns; and operating and expanding our business activities; and

• as we believe to be necessary or appropriate: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of our affiliates; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

We may combine, aggregate, or anonymize any of the information we collect from you with information we may collect from or about you from any other online or offline source. Where we aggregate or de-identify information so that it can no longer reasonably be linked to you, we will maintain and use it in de-identified form and will not attempt to re-identify it, except as permitted by applicable law.

Legal bases for processing (EEA, UK, and Switzerland). Where the EU General Data Protection Regulation, the UK GDPR, or the Swiss Federal Act on Data Protection applies, we process your personal information on the following legal bases: (a) where necessary to perform a contract with you or your organization, or to take steps at your request before entering into a contract; (b) where necessary to comply with our legal and regulatory obligations (for example, pharmacovigilance and adverse event reporting, and “know your client” and anti-money laundering checks); (c) where necessary for our legitimate interests, such as operating, securing, and improving our websites and services, marketing our services to business customers, and understanding interest in our services, provided those interests are not overridden by your interests or fundamental rights and freedoms; and (d) with your consent, where required by applicable law, including for non-essential cookies and similar technologies. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

3. What Information We Collect About You

• Basic personal details such as your name and job title (when provided);

• Contact data such as your telephone number and postal or email address;

• Financial data such as payment related information or bank account details (when supplied);

• Information provided to us by or on behalf of our clients or generated by us in the course of providing our services;

• Identification and other background verification data (such as a copy of passports or utility bills or evidence of beneficial ownership or the source of funds to comply with client due diligence, “know your client” program, compliance with anti-money laundering laws and as collected as part of our client acceptance and ongoing monitoring procedures) as needed for TPG’s business to be in compliance with applicable law;

• Demographic data such as your address, preferences or interests;

• Website usage and other technical data such as details of your visits to our websites and/or information collected through cookies and other tracking technologies;

• Online identifiers and device information, such as your IP address, browser and device type, operating system, cookie and advertising identifiers, and approximate location derived from your IP address; and

• Any other information relating to you that you may provide.

Children. Our websites and services are intended for business and professional audiences and are not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us using the details in Section 12.

4. How We Obtain the Information About You

We may collect or receive your information in a number of different ways:

• Where you provide it to us directly, for example by corresponding with us by email, or via other direct interactions with us such as completing a form on our website;

• Where we monitor use of, or interactions with, our websites, any marketing we may send to you, or other email communications sent from or received by TPG;

• Third party sources, for example, where we collect information about you to assist with know your client checks as part of our client acceptance procedures or where we receive information about you from recruitment agencies for recruitment purposes;

• From advertising, analytics, and business information providers, for example information about the organization associated with an IP address, as described in Section 11;

• Using cookies and similar technologies: Cookies are small text files stored directly on your device. Similar technologies include pixels, tags, scripts, and software development kits. We use cookies to collect information such as time spent on the Services, pages visited, the pages you view immediately before and after you access the Services, the search terms you enter, and other information about your use of the Services.

Cookies allow us to recognize you and personalize your experience, to facilitate navigation, and to display information more effectively. We also use cookies to gather statistical information about the use of the Services in order to understand how they are used, improve them, and resolve questions about them.

If you do not want information collected through the use of cookies, most browsers allow you to automatically decline cookies or to be given the choice of declining or accepting cookies from a particular site. You can also manage your preferences for non-essential cookies and similar technologies at any time by clicking the CookieYes icon button or the Do Not Sell or Share My Personal Information link in the footer of our websites, or using our webform found here: https://www.tannerpharma.com/contact-us, and, if you are a resident of certain U.S. states, opt out of the sale or sharing of your personal information or targeted advertising as described in Section 13.

5. Who We Share Your Information With

TPG is a global company and as such any information that we collect, or you provide us may be shared with and processed by any TPG entity among our global network.

We may also share your information with a variety of the following categories of third parties:

• to business partners who offer products or services jointly with us or with our subsidiaries or affiliates;

• to third parties that provide services to us, such as fulfilling requests for information, answering calls, administering programs or projects, assisting in research and development, or delivering advertisements or other communications;

• to advertising and analytics partners, such as Google and LinkedIn, which collect information through cookies and similar technologies on our websites, as described in Section 11;

• as required by law, such as to law enforcement, to health authorities to report possible adverse events, during government inspections or audits, as ordered or directed by courts or other governmental agencies, or in order to comply with a subpoena or other legal process;

• when we believe in good faith that disclosure is necessary to protect legal rights or the security or integrity of the Services; protect your safety or the safety of others; investigate fraud, a breach of contract, or a violation of law; or respond to a government request;

• in connection with, or during negotiations of, any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets.

We may also process your information to comply with our regulatory requirements or in the course of dialogue with our regulators as applicable, which may include disclosing your information to government, regulatory or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so. Where permitted, or unless to do so would prejudice the prevention or detection of a crime, we will direct any such request to you or notify you before responding.

6. Which Countries We Transfer Your Information To

As a global company, we cannot limit our processing of an individual’s information to the country in which that individual is based. In the course of providing our services, we may need to transfer information to locations outside the jurisdiction in which you provide it or where you are viewing our website.

If you are based in the European Economic Area (EEA), the United Kingdom, or Switzerland, this will mean that your information may be transferred to, accessible from, and/or stored at, a destination outside those jurisdictions in which data protection laws may not be as comprehensive as in the EEA.

Regardless of the location of our processing, we will impose the same data protection safeguards that we deploy inside the EEA and implement appropriate measures to ensure that your information is protected in accordance with applicable data protection laws. TPG has a data sharing agreement in place signed by all TPG entities which includes the European Commission’s standard contractual clauses and the UK and Swiss equivalents.

Similarly, where a third-party service provider processes the information of EEA residents on our behalf, we will ensure that appropriate measures are in place to ensure an adequate level of protection for your information, such as by including the European Commission’s standard contractual clauses (and the UK and Swiss equivalents) in our agreements with such service providers, or by relying on the service provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where applicable.

Please contact us as directed below if you would like to see a copy of the specific safeguards applied to the export of your information.

7. How Long We Keep Your Information

We will retain your information for as long as is necessary to fulfil the purpose for which this data was collected and any other permitted linked purpose (for example, certain transaction details and correspondence related to any services we provide may be retained until the time limit for claims in respect of the transaction has expired or in order to comply with applicable legal and regulatory requirements regarding the retention of such data).

If your information is used for two purposes, we will retain it until the purpose with the latest period expires; but we will stop using it for the purpose with a shorter period once that period expires. Our retention periods are also based on our business needs, good industry practice and applicable legal requirements.

8. How We Protect Your Information

We recognize that information security is an integral element of data privacy.

While no data transmission (including over the Internet or any website) can be guaranteed to be secure from intrusion, we implement a range of commercially reasonable physical, technical and procedural measures to help protect information from unauthorized access, use, disclosure, alteration or destruction in accordance with data protection law requirements.

Information that you provide to us is stored on our secure servers or our service providers’ secure servers and accessed and used subject to our security policies and those agreed with our service providers.

9. What Are Your Rights in Relation to Your Information

Depending on where you are located, and subject to applicable law (including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and U.S. state privacy laws), you may have the right to require us to:

• provide you with further details on the use we make of your information;

• provide you with a copy of information that we hold about you;

• provide the information you have provided to us in a structured, commonly used, and machine-readable format, and transmit it to another organization (data portability);

• update any inaccuracies in the information we hold;

• delete any information that we no longer have a lawful ground to use;

• where processing is based on consent, to withdraw your consent so that we stop that particular processing;

• object to any processing based on the grounds of legitimate interests unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and

• restrict how we use your information whilst a complaint is being investigated.

You may also ask us not to process your information for marketing purposes. You can exercise your right to prevent such processing at any time by using an unsubscribe facility or contacting us at DataPrivacy@tannerpharma.com.

We are also required to take reasonable steps to ensure that your information remains accurate. Please let us know of any changes to the information that you have provided to us by contacting us at DataPrivacy@tannerpharma.com.

While it is our policy to respect the rights of individuals, please be aware that your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g., the prevention or detection of crime), our interests and some of these rights may be limited (for example the right to withdraw consent) where we are required or permitted by law to continue processing your information to defend our legal rights or meet our legal and regulatory obligations.

If you contact us to exercise any of these rights, we will check your entitlement and respond within the time period required by applicable law (for example, within one month under the GDPR and UK GDPR, or within 45 days under the California Consumer Privacy Act), which may be extended where permitted by law.

If you are not satisfied with our use of your information or our response to any exercise of these rights, you have the right to complain to the data protection supervisory authority in the country where you live or work, or where you believe a violation occurred. Contact details for certain authorities are provided in Section 13.

10. Who Is the Data Controller of Your Information

As indicated above, TPG is made up of a number of different entities. Depending on where you are located and the location from which services are provided, the data controller of your information processed by us under this Notice will be different. Generally, the controller is the TPG entity with which you interact or that provides the relevant services to you or your organization. The controllers for residents of the EEA, the UK, Switzerland, and the United States are identified in Section 13.

11. How We Use Cookies and Similar Technologies (Cookie Policy)

When you visit our websites we and our third-party partners may place cookies and similar technologies (such as pixels, tags, and scripts) on your device. A cookie is a small data file stored on your device to help improve functionality or tailor information to provide visitors with more relevant pages. This Cookie Policy section details the cookies employed by us.

We may also analyze website traffic to identify what visitors find most interesting so we can tailor our websites accordingly.

Categories of technologies. We and our third-party partners use three categories of cookies and similar technologies on our websites, as set forth in the table below: (a) strictly necessary technologies, which are required for our websites to function and cannot be switched off; (b) analytics and performance technologies, which help us understand how visitors use our websites so we can improve them; and (c) advertising and marketing technologies, which help us deliver and measure advertising on third-party websites and platforms.

Advertising and analytics partners. We work with third-party advertising and analytics providers, such as Google LLC (including Google Analytics and Google Ads) and LinkedIn Corporation (including the LinkedIn Insight Tag), and Microsoft Corporation (including Clarity) to advertise our services, measure the effectiveness of our advertising campaigns, and understand how visitors use our websites. These providers may use cookies, pixels, and similar technologies to collect information about your visits to our websites and your interactions with our advertisements, such as pages visited, advertisements clicked, actions taken on our websites, and online identifiers such as your IP address and device identifiers. We and these providers use this information to measure conversions, evaluate advertising performance, and, where permitted by law, deliver advertising that may be of interest to you. These providers may combine this information with information they collect about you on other websites and services and may use it for their own purposes in accordance with their own privacy policies, including Google's Privacy Policy (https://policies.google.com/privacy), LinkedIn's Privacy Policy (https://www.linkedin.com/legal/privacy-policy), and Microsoft’s Privacy Policy (https://www.microsoft.com/en-us/privacy/privacystatement). For more information about how Google uses information from websites that use its services, see https://policies.google.com/technologies/partner-sites.

Your choices. Where required by applicable law, including in the EEA, the UK, and Switzerland, we use analytics, performance, advertising, and marketing technologies only after you have provided consent. You may manage or withdraw your consent at any time by clicking the CookieYes icon button or the Do Not Sell or Share My Personal Information link in the footer of our websites, calling our toll-free number at +1 888 755 6188, using our webform found here: https://www.tannerpharma.com/contact-us, or by contacting us at DataPrivacy@tannerpharma.com. Depending on where you live, you may also have the right to opt out of the sale or sharing of your personal information for targeted (cross-context behavioral) advertising, as described in Section 13.

12. How You Can Contact Us

If you have any questions about this Notice or how we process your information, please contact us by sending an email to DataPrivacy@tannerpharma.com or by mail at:

Tanner Pharma, Attn. Privacy Team, 1808 Associates Lane, Suite A Charlotte, NC 28217

13. Complaints and Jurisdiction Specific Provisions

Complaints about Tanner Pharma Group’s handling of your personal information may also be made to the appropriate Privacy Commissioner:

Residents of Switzerland. The entity responsible for the collection and processing of Personal Data for residents of Switzerland is Tanner Pharma CH GmbH, Alte Steinhauserstrasse 21, CH-6330, Cham, Switzerland. To exercise your rights, the Data Protection Officer may be contacted via DataPrivacy@tannerpharma.com. You may direct your questions or concerns to:

The Federal Data Protection and Information Commissioner (FDPIC) Email: info@edoeb.admin.ch Phone: +41 (0)58 462 43 95)

Residents of the European Economic Area (EEA). The entity responsible for the collection and processing of Personal Data for residents of the EEA is Tanner Pharma IE Limited, 1 Horgan's Quay, Cork, T23 E6TD, Ireland. To exercise your rights, the Data Protection Officer may be contacted via DataPrivacy@tannerpharma.com. You may direct your questions or concerns to:

The Data Protection Commission (Ireland), www.dataprotection.ie, or to the supervisory authority in the EEA country where you live or work.

Residents of the UK. The entity responsible for the collection and processing of Personal Data for residents of the UK is Tanner Pharma UK Limited, The Tithe Barn, Harpendenbury Farm, Redbourn, St Albans, Hertfordshire, AL3 7QA. If you are a resident of the UK, you may direct your questions or concerns to the UK:

Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (Email: casework@ico.org.uk); (Phone: 0303 1231113).

Residents of the United States. The entity responsible for the collection and processing of Personal Data for residents of the United States is Tanner Pharma Group, Inc., 1808 Associates Lane, Suite A, Charlotte, NC 28217, United States.

Residents of California and Other U.S. States.

This section applies to residents of California and other U.S. states with comprehensive consumer privacy laws and supplements the rest of this Notice. Terms such as “personal information,” “sensitive personal information,” “sale,” “share,” and “targeted advertising” have the meanings given to them under applicable law.

Personal information we collect and disclose. In the preceding 12 months, we have collected the following categories of personal information: identifiers (such as name, email address, IP address, and online identifiers); personal information described in Cal. Civ. Code § 1798.80(e) (such as contact and financial information); commercial information; internet or other electronic network activity information; approximate geolocation derived from IP address; professional or employment-related information; education information (for job applicants); and inferences drawn from the foregoing. We do not collect sensitive personal information. We collect this information from the sources described in Section 4, use it for the purposes described in Section 2, and disclose it for business purposes to the categories of recipients described in Section 5. We retain each category of personal information for as long as reasonably necessary for those purposes, using the criteria described in Section 7.

Sale and sharing. We do not sell personal information for money. However, we allow certain advertising and analytics partners, such as Google and LinkedIn, to collect identifiers and internet or other electronic network activity information through cookies and similar technologies on our websites, as described in Section 11. This may be considered a “sale” or “sharing” of personal information, or processing for targeted advertising, under applicable U.S. state laws. We do not knowingly sell or share the personal information of consumers under 16 years of age. We use sensitive personal information only for purposes permitted under applicable law (see Cal. Code Regs. tit. 11, § 7027(m)) and do not use it to infer characteristics about you.

Your rights. Subject to applicable law, you may have the right to: (a) know what personal information we have collected about you, including the categories of personal information, the sources, the purposes, and the categories of third parties to whom we disclose it, and to obtain a copy of specific pieces of personal information; (b) request deletion of your personal information; (c) request correction of inaccurate personal information; (d) opt out of the sale or sharing of your personal information and of targeted advertising; and (e) not receive discriminatory treatment for exercising these rights.

How to exercise your rights. You may submit a request by calling our toll-free number at +1 888 755 6188, emailing DataPrivacy@tannerpharma.com or using our webform found here: https://www.tannerpharma.com/contact-us. We will verify your request by matching information you provide with information we maintain, and we may ask for additional information for that purpose. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may ask you to verify your identity directly. If we decline your request and you reside in a state that provides a right to appeal, you may appeal by emailing DataPrivacy@tannerpharma.com with the subject line “Privacy Request Appeal.”

How to opt out. You may opt out of the sale or sharing of your personal information and targeted advertising by clicking the “Do Not Sell or Share My Personal Information” link in the footer of our websites. We also treat opt-out preference signals, such as the Global Privacy Control, as a valid request to opt out for the browser or device sending the signal. When we detect such a signal, we will display a confirmation that your opt-out request has been processed. Our websites do not respond to “Do Not Track” browser signals, for which there is no common industry standard, but we do honor opt-out preference signals as described above.

14. How We May Update This Privacy Notice

We may update this Notice from time to time to reflect changes in our practices or applicable law. When we do, we will revise the “Last Updated” date below and, where the changes are material, we will provide notice through our websites or by other appropriate means as required by applicable law. We encourage you to review this Notice periodically.

15. Last Updated

Last Updated: October 9, 2026