Notice to Suppliers with regards to Lilly Consent decree

Mandatory Requirements for Compliance with Agreements with the United States Federal Trade Commission, as well as with the Offices of Eight States’ Attorneys’ General*

This is formal notice to any third-party organization currently working with or being considered to work with consumer personal information (PI) on behalf of Dermira, Inc. (Dermira), a wholly-owned subsidiary of Eli Lilly & Company (Lilly).

On May 15, 2002, Lilly’s USA division entered into a Consent Order with the United States Federal Trade Commission (“Consent Order”) stemming from a situation in 2001. Lilly also entered into voluntary Assurances with eight states (“States’ Assurances”) stemming from the same underlying situation. The Consent Order and States’ Assurance, in nearly identical terms, require Lilly to take certain actions to address privacy issues within Lilly’s operations regarding the handling of consumer PI, including providing these documents to you for your review and understanding.

All third parties that work with US consumer PI in any manner for Dermira are required to comply with the privacy and security measures articulated by Dermira, as well as with relevant terms of the Consent Order and States’ Assurance with respect to the US consumer PI handled on Dermira’s behalf.

If you have any questions, please contact your Dermira point of contact. Thank you.

*California, Connecticut, Idaho, Iowa, Massachusetts, New Jersey, New York, and Vermont