Global Privacy Notice

At F. Hoffmann-La Roche Ltd (“Roche”), we are committed to protecting your personal information. This Global Privacy Notice (“Notice”) explains what information we collect, how we use it, how we protect it, and the choices you have regarding your personal information. 

The "Data Controller" is F. Hoffmann-La Roche Ltd, Grenzacherstrasse 124, CH-4070 Basel, Switzerland unless stated otherwise in this notice. A Data Controller is the legal entity that is ultimately responsible for the processing of your personal information if it determines the purposes and means of the processing activity.

This Notice applies specifically to Roche websites that link to it. While our sites may link to third-party websites, we do not control and are not responsible for their privacy practices or the content on such third-party websites.

For detailed information regarding US-specific rights and disclosures, please refer to our US Supplemental Privacy Notice. This website is not intended for children under 16. We do not knowingly collect data from minors under the age of consent without verifiable parent or guardian consent. Parents have the right to view or request the deletion of information provided by their child until such child is reaching the age of consent under applicable laws and regulations.

• We maintain a comprehensive, dedicated internal data privacy governance framework supported by specific privacy policies to ensure consistent data protection and accountability across our global operations.

• Swiss Law as our baseline: As a Swiss-headquartered company, we use Swiss data privacy laws as our global baseline for privacy and security.

• Global adaptability: We ensure compliance with local laws wherever they are stricter than our baseline.

Roche is a global group of legal entities. Depending on the specific context of our interaction with you, F. Hoffmann-La Roche Ltd and other legal entities within the Roche Group may act as independent or joint controllers under applicable data privacy laws.

• How to get information: In cases of joint controllership, you may always contact the Global Privacy Office (as described in the "How to Contact Us" section) to obtain more information on how your personal information is processed or to exercise your rights.

• Specialised & affiliate notices: You may also consult specific dedicated privacy notices that apply to specialized areas, such as our Privacy Notice for Pharmacovigilance. In the context of recruitment and job application processing activities, please consult our dedicated privacy notice: Recruitment Privacy Notice . Additionally, you should consult the privacy notices of Roche Group affiliates as they apply to your local interactions. You find a link to the websites of Roche affiliates, including the access to local Privacy Notices, from this section of the website: “Our websites”

To improve our services and accelerate medical innovation, Roche utilizes AI-powered workflows and tools for data processing. We do this in strict compliance with applicable data privacy laws (anchored by our Swiss baseline) as well as region-specific AI regulations that apply to the use and development of AI solutions, such as the EU AI Act.

• Purpose: We use these technologies to analyze website performance, personalize your experience, and assist in complex data processing tasks, such as pharmacovigilance, product safety and research.

• Governance: All AI-driven processing is conducted in compliance with applicable laws ensuring human oversight where required and maintaining the same rigorous security standards applied to all our data operations.

We use personal information for marketing activities and to maintain general communication with our customers, partners, and website visitors.

• Global Customer Relationship Management (CRM) system : We may process your personal information within a global CRM System to manage these interactions.

• Tailored experience: We may use this data to tailor our communications and offerings to provide the best possible experience based on your professional interests or previous interactions with Roche.

• Choice: Where required, we will obtain your consent before sending marketing materials. You may opt-out of marketing at any time.

When you attend one of our events or visit our booth in tradeshows or conferences, we collect and process your personal information. 

• Registration: We may need your personal information to handle registration and attendance, including to ensure adequate organization.

• Communication: We may reach out to inform you about event updates (e.g. changes to location or time; webinar links; agenda) or for post-event activities such as sharing presentations among participants and feedback collection.

• Promotion: If you agree, we may also reach out to send you information about Roche products and services, medical information, and other Roche sponsored events and congresses. You can always unsubscribe (opt-out) from promotions.

This information may be collected through online forms or by scanning your conference badge.

If the event includes videorecording or photography taking: 

• Pre-event: You will be informed in advance.

• For in-person events: There will be signs and communication displayed on site. If you are a participant and you do not wish to be featured in photos, please inform the event staff and/or take leave when you notice pictures are being taken. If you are a speaker and you do not wish to be featured, please inform our staff in advance. 

• For virtual events: The host will inform the participants before they start the recording. The tool will also display a notice when the recording starts. If you are a participant and do not wish to be recorded, please do not open your camera and remain on mute. If you are a speaker and you do not wish to be recorded, please inform our staff in advance.

• Post-event: You can always reach out to Roche to request the deletion of your data, to object to the data processing, or, where applicable, to withdraw your consent.

Personal information  is any information that directly or indirectly identifies you, such as your name, email, or technical data that identifies your device.

We use Cookies and similar tracking technologies to keep our website running smoothly, analyze performance, and deliver content tailored to your interests. We ensure you have full control over the digital footprints you leave behind.

• How we manage your consent
  To give you genuine control, we utilize a centralized Cookie Consent Management Tool designed to comply with global privacy standards. By default, all non-essential cookies are turned off. We will only activate performance, functional, or marketing cookies if you give us your consent (opt-in). You find more detailed information in our Cookie Policy and in the Cookie Banner displayed to you. 
  

• You are in control
  Changed your mind? You can revisit your choices, withdraw your consent, or tweak your preferences at any time by clicking the "Cookies" link located in the footer of our website. Alternatively, you can manage or block cookies directly through your internet browser settings.

Roche operates in over 100 countries around the world. To facilitate scientific collaboration, to provide you with services or information, and to maintain secure centralized IT systems, your information may be transferred to other entities of Roche Group or third-party service providers based in regions outside of your country of residence.

• Compliance framework: In countries where local laws do not offer "adequate" protection, we use specific legal instruments—"transfer mechanisms"—to bind the recipient of the data to stricter privacy rules. That is particularly important for the transfer of your personal information to Switzerland and the onward transmission of such data to affiliates of Roche Group and service providers. If and as required by applicable law, we also honour data residency or data localization requirements. 

• Transfer mechanisms: We use the high protection standards of Swiss law and the EU GDPR as our global standard but acknowledge the heterogenous requirements that exist around the world. We implement official safeguards including, but not limited to the European Commission’s Standard Contractual Clauses (SCCs) with the Swiss and/or UK Addendum as required, the Standard Contracts for the Transfer of Personal Data Abroad (Turkey), the Standard Contractual Clauses for Personal Data Transfer Outside the Kingdom (Saudi Arabia), the Southeast Asian Nations’ Model Contractual Clauses (APAC) and the Model Contractual Clauses for the International Transfer of Personal Data (Latin America). Within Roche Group we have established a Roche Intra-Company Data Transfer Agreement that builds on these safeguards for cross-border data transfers and ensures a high level of protection of personal information throughout the entire Roche Group. 

• When we work with third party service providers, we ensure contractually that these service providers follow strict data privacy policies in full compliance with applicable laws and regulations, and that these service providers have established adequate technical and organizational measures (TOMs) to protect the integrity and confidentiality of your personal information. Again, while we cannot guarantee absolute security we apply Swiss standards under the Swiss Federal Data Protection Act as the global baseline and honor stricter requirements as they apply to the processing of your personal information. 

• Security measures: We have implemented robust Technical and Organisational Measures (TOM) based on the requirements of Swiss law and the EU GDPR. 

• Retention and deletion: We generally keep your data for three (3) years after our last interaction with you. However, many retention periods are based on regulatory requirements (such as pharmacovigilance or product safety, which may require storage for 10 years or more). We maintain an internal deletion schedule in order to ensure that we delete personal information relating to you in compliance with applicable law. 

• Early deletion: We also delete data earlier if required by law or if such data is no longer needed.

Your specific rights

Data protection laws grant you specific "Data Subject Rights" to ensure you remain in control of your personal information. 

Depending on your place of residence or other trigger points regarding the legal framework applicable to the processing of personal information relating to you (e.g. your citizenship), you may exercise the following rights. Please note that some of these rights may be subject to certain legal conditions and requirements.

• Right of access: Request a copy of the personal information we hold about you.

• Right to rectification: Ask us to update or correct inaccurate information.

• Right to erasure: Request that we delete your personal information when it is no longer necessary.

• Right to restriction of processing: Ask us to "pause" the use of your data in certain circumstances.

• Right to data portability: You may have the right to receive your data in a machine-readable format. This right is subject to specific conditions, typically applying only to data you provided to us.

• Right to object: Object to us processing your data based on our "legitimate interests."

• Right to withdraw consent: If we are processing your data based on your consent, you can withdraw it at any time.

How to exercise your rights

To exercise any of these rights, please contact the Global Privacy Office by e-mail at global.privacy@roche.com or as described in the “How to Contact Us” section below.  You may also launch a complaint with the respective data protection authority.

This Notice is subject to periodic review and may be changed at any time to reflect updates in our practices, technology, or legal obligations. We recommend that you review this Notice regularly to stay informed about how we are protecting your personal data.

F. Hoffmann-La Roche Ltd
Grenzacherstrasse 124
CH-4070 Basel / Switzerland
E-mail: global.privacy@roche.com