Privacy Policy - California

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or device (“Personal Information”). Personal information does not include:

• Publicly available information from government records;
• De-identified or aggregated information;
• Information excluded from the CCPA's scope, such as:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

We have collected the following categories of Personal Information within the last twelve (12) months:

We obtain the categories of personal information listed above from the following categories of sources:

• directly from you or your caregivers or agents;
• indirectly from you or your caregivers or agents. For example, information we collect in the course of providing services;
• directly and indirectly from activity on our websites. For example, website registration information; and
• from third parties in connection with the services that we perform.

By providing your Personal Information, you agree that, where it is permitted by local law, we may use your Personal Information:

• to fulfill or meet the reason for which the information is provided, including to provide you with information, products or services that you request from us;
• to carry out our obligations and enforce our rights arising from any contracts entered into between you and us;
• to monitor our regulatory compliance;
• as necessary or appropriate to protect the rights, property or safety of us, our clients or others;
• to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations, including to generate complaints or adverse event reports;
• to meet legal requirements;
• as described to you when collecting your Personal Information or as otherwise set forth in the CCPA;
• to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred; and
• for other purposes that may be detailed on this Website.

In the preceding twelve (12) months, we have disclosed the categories of Personal Information identified under “Information We Collect” for a business purpose.

In the preceding twelve (12) months, we have not sold any Personal Information.

In addition to information collected from our customers and others, as described under “Information We Collect,” we and our service providers also collect certain information from candidates who apply for a job with Biogen and our affiliates. We collect this information to contact you about your application and evaluate your qualifications for the position. The information we collect includes your name, phone number, e-mail address, postal address, education information, employment information, inferences we may draw about you, and other information you provide us on your application or during the application processes. If you become an employee of Biogen or our affiliates, you will receive an additional notice about the categories of information and our purposes for collecting such information in the context of your employment.

The CCPA provides California residents with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

Request to Know

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive and confirm your verifiable request, we will disclose to you:

• the categories of Personal Information we collected about you;
• the categories of sources for the Personal Information we collected about you;
• our business or commercial purpose for collecting or selling that Personal Information;
• the categories of third parties with whom we share that Personal Information;
• the specific pieces of Personal Information we collected about you (also called a data access request);
• if we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
  • sales, identifying the Personal Information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.

Request to Delete

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

Request to Opt-Out

You have the right to request to opt-out of the “sale” of personal information. Because we do not sell your information, you are already opted-out of such sales.

Exercising Rights

To exercise the rights described above, please submit a verifiable request to us at our online Data Subject Request portal or by contacting us toll-free at +1(844) 430-1179. You will be asked to affirm you are a California resident and to indicate whether the request is on your behalf or for someone else.

If you make a request related to personal data about you, we will need to verify your identity. To do so, we will request that you match specific pieces of information you have provided us previously, as well as, in some instances, provide a signed declaration under penalty of perjury that you are the individual whose personal information is the subject of the request. If it is necessary to collect additional information from you, we will use the information only for verification purposes and will delete it as soon as practicable after complying with the request. For requests related to particularly sensitive information, we may require additional proof of identification. If you make a request through an authorized agent, we will require written proof that the agent is authorized to act on your behalf.

Response Timing and Format

We will process your request within the time provided by applicable law. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For Requests to Know, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• deny you goods or services;
• charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• provide you a different level or quality of goods or services;
• suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will notify you by email or through a notice on our website homepage. For our complete US Privacy Policy, click here.

If you have any concerns about the way your Personal Information has been collected or handled by Biogen, or any queries regarding this privacy statement, you can contact Biogen’s Global Privacy Office at privacy@biogen.com.

You can also write to the following address:

Global Privacy Office
Biogen MA Inc.
225 Binney Street
Cambridge, MA 02142
USA