Pharmacovigilance Privacy Notice

Mundipharma EDO GmbH (“Mundipharma EDO”, “MEDO”, “we” or “us” or “our”) is responsible for monitoring and reporting safety data of certain products (defined below). This Privacy Notice describes how Mundipharma EDO processes (e.g. collects, uses, stores, and shares) your personal data to help fulfil such obligations, known as pharmacovigilance obligations.

This Privacy Notice is reviewed and updated from time to time. If we update the terms, we will provide notice through our home page, or by other means, so you can to review the changes. Please check back if you wish to submit an adverse event.

This Privacy Notice supplements other privacy notices that we may provide on our website or through other means from time to time when we are processing your personal data.

HOW DO WE COLLECT PERSONAL DATA ABOUT YOU?

We may collect personal data provided by you directly to us or as part of the adverse event reporting requirements applicable to Mundipharma EDO. If you are a patient, we may also be provided with information about you by another person (such as a medical professional or relative) reporting an adverse event that affected you. We will handle all such information in accordance with this Privacy Notice.

WHY DO WE PROCESS YOUR PERSONAL DATA? 

An adverse event (or side effect) is any untoward medical occurrence in a patient administered a product that may or may not be caused by the treatment. Pharmacovigilance laws require us to collect specific data relating to adverse events to ensure that our products are safe to use and effective. This includes using and sharing your personal data to:

WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU? 

A minimum amount of information must be collected for a ‘reportable’ adverse event. The more information you provide regarding the adverse event, the more helpful this will be to meet our reporting obligations. If you do not want us to contact you to collect further information about the adverse event, you can say so when you report the adverse event.

Patients

The personal data that we may collect about you when you are the subject of an adverse event report includes:

The data described in the last five bullets are considered as a special category of data called “sensitive data”, which require a higher level of protection under data protection laws.

The information collected is only processed where relevant and necessary to document your reaction properly and for the purpose of meeting our pharmacovigilance obligations.

Reporters

The personal data that we may collect about you when you report an adverse event is your:

THE BASIS FOR USING YOUR INFORMATION 

Our processing of your personal data requires a legal basis. In general, we will only process your personal data using one or more of the following bases:

As mentioned above, we are under a legal obligation to process your personal data relating to adverse events. The evaluation of the safety and effectiveness of the product is also in the public interest.

As a pharmaceutical company we have a legitimate interest in using information relating to your health and care to undertake pharmacovigilance-related activities, including research. When processing your personal data on the basis of our legitimate interests, we must maintain a balance between our legitimate interests and your privacy.

WHAT WILL HAPPEN IF I DON’T PROVIDE INFORMATION?

If you do not provide information requested in connection with an adverse event, we will also be less likely to identify safety and/or efficacy issues regarding our products and deal with them appropriately.

SHARING YOUR PERSONAL DATA

Mundipharma EDO limit access to your personal data to those of our and our Associates’ employees, agents, contractors, professional advisers (such as lawyers, bankers, auditors, accountants and insurers), service providers (such as IT system providers and regulatory service providers), and other third parties who have a business need to know, including pharmaceutical companies who are our commercial or licence partners and also are required to exchange product safety information. If they are a data processor, they must only process your personal data on our instructions and they are subject to a duty of confidentiality.

We are under a legal obligation to share adverse event information regarding our products with national and international authorities (including the European Medicines Agency’s EudraVigilance database) in accordance with pharmacovigilance laws. We are unable to control their use of your data.

LOCATION OF PERSONAL DATA WE COLLECT

Global Safety Database

Our pharmacovigilance obligations require us to analyse adverse event reports received from every country where we provide pharmacovigilance services to our Associates. To meet these requirements, we collate and report information provided as part of an adverse event through a Global Safety Database. We have procedures in place to remove duplicate reports from the Global Safety Database. The Global Safety Database, is hosted in the United States by a company within the Mundipharma global network of independent associated companies. It is administered and supported by our pharmacovigilance team, as well as teams from Canada and the United States. We also engage service providers to support our pharmacovigilance obligations, which may be located outside of Europe.

International transfers

We may transfer your personal data worldwide as part of the Global Safety Database, including to countries where the legal protections over personal data may be less than under your country’s national law. If we transfer your personal data outside of Europe to our and our Associates’ employees, agents, contractors, professional advisers, service providers or to third parties that collaborate with us, your data will be protected with safeguards such as contracts and suitable security measures. You can request information about such transfers by contacting us using the details below.

DATA RETENTION

The study site and the Sponsor are required to keep the data relating to adverse events for a minimum number of years after marketing authorisation for the product no longer exists. Subsequently, we will retain such data for the purposes set out above where the law and applicable ethical requirements allows it.

AUTOMATED DECISION MAKING

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

YOUR RIGHTS

In general, you have the following rights with respect to your personal data:

These rights may be limited by applicable law. Please contact our Pharmacovigilance representative at Syneos Health on Global Toll Free Number: 1-877-464-7787 or at [email protected]or our Data Protection contact using the details below if you wish to exercise your rights.

Mundipharrma EDO has assigned a responsible person for overseeing our compliance with data protection law, which you may contact at [email protected]; or c/o the Legal Department, Mundipharma EDO GmbH, St. Alban-Rheinweg 74, CH-4020 Basel, Switzerland in case of any questions or concerns regarding the processing of your personal data. Please explain your relationship and/or interactions with us, as well as the specifics of your query when contacting us. We may require you to provide proper identification before we comply with any request to access or correct your data.

If you are unhappy with how we process your personal data, you have a right to complain to the the Swiss Federal Data Protection and Information Commissioner (“ICO”). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

DATA CONTROLLER

The entity registered as the Marketing Authorisation Holder for the product, indicated in the patient information leaflet, is the data controller responsible for processing of adverse event information for marketed products. Mundipharma EDO may also act as a data controller when performing its pharmacovigilance obligations.

DEFINITIONS USED IN THIS PRIVACY NOTICE

“Associates”means any organisation within the Mundipharma global network of independent associated companies.

“data controller”means the company or organisation that, alone or jointly with others, determines the purpose and means of processing personal data.

“data processor”means the company or organisation that processes personal data on behalf of the data controller.

“personal data”means information that relates to any living identifiable individual (e.g. you, your medical practitioner or your family member).

“products”medicinal products and devices marketed through the Mundipharma global network of independent associated companies or used in research studies, for which Mundipharma Research have pharmacovigilance obligations.

© January 2019 Mundipharma EDO GmbH.