PRIVACY NOTICE - health care professionals

The data controller is Pharmacosmos A/S, Roervangsvej 30, DK-4300 Holbaek, Denmark.

Pharmacosmos A/S will collect and process your Personal Data for the purposes described below. 

To carry out our professional collaboration with you:

To carry out and continuously improve our professional collaboration regarding iron deficiency, your professional contact information such as your name, email, phone number, job title, specialisation, place of work, qualifications, address, and educational background, photo and CV may be stored in our databases.

We will process such Personal Data in relation to booking of meetings, publications, training, invitations and other collaborative work.

Our legal basis for such processing of data is the General Data Protection Regulation (“GDPR”), article 6(1)(f) - our legitimate interest in maintaining and continuously updating a CRM database containing contact information of relevant HCPs.

The Personal Data will be stored for the duration of our current or potential professional collaboration.

Contractual relations:

If we enter into an agreement with you for your provision of services or otherwise to Pharmacosmos A/S, we may, in addition to the information above, collect:

• your bank account information

• your personal identification number or authorization ID (where required)

• images, voice and video recordings

• details on services provided by you as well as any remuneration for such services

• information about circumstances which may create a conflict of interest

and process the data for the purpose of accomplishing the purpose of the agreement, performance of our contractual obligations and identification of potential conflicts of interest.

Our legal basis for such processing of your Personal Data is:

• GDPR article 6(1)(b): Performance of contract,

• GDPR article 6(1)(c): Complying with legal obligations on disclosure of transfer of value, and

• GDPR article 6(1)(f): Legitimate interest in assessing adherence to local law and industry standards, assessing fair market value and avoiding conflicts of interest in your relations with us.

The Personal Data processed to comply with the requirements of the Danish Medicines Agency to report annually regarding transfers of value, will be stored for 13 months.

Agreements will be stored for 10 years after the end of the collaboration to ensure legal and regulatory compliance and to ensure adequate documentation and protection in relation to, amongst others, future legal disputes. 

Medical Information Management System:

When entering medical queries, adverse events, and product quality complaints received from you in our Medical Information Management System, we will also record your Personal Data such as name, address, email, fax and phone number.

Our legal basis for such processing of your Personal Data is:

GDPR article 6(1)(c): Complying with legal obligations (adverse event and product quality complaints); and

GDPR article 6(1)(f): Legitimate interest in ensuring documentation of all medical queries.

The Personal Data will be retained in our Medical Information Management System for 10 years or as per the local data protection regulations, whichever is the longer, after which such data will be deleted..

Recordings:

When you give a lecture or other scientific presentation, we may take photos of and record (audio and/or video) you during such presentation for the purpose of publishing, distributing and using the photos and recordings to promote and inform about healthcare subjects, our products and our business in accordance with applicable law. Publication of the recordings may take place in any form and through any medium. When publishing the photos and recordings, we may also publish your name, job title and place of work. Our legal basis for such processing of your Personal Data is the GDPR article 6(1)(a) – your consent, or the GDPR article 6(1)(b) – our performance of a contract with you.

The recordings will be stored until the scientific presentation becomes outdated.

Your Personal Data will be treated as confidential information by those who are allowed to process your Personal Data and will only be used for the purposes described in this privacy notice.

It will be stored by Pharmacosmos A/S or a third-party hosting provider.

When needed, Pharmacosmos A/S may transfer your Personal Data to our affiliated companies and other third parties:

• Service providers assisting Pharmacosmos in its general business

• Other suppliers and vendors that we work with to assist our company, including technical support, supply services and financial institutions

• Pharmacosmos A/S’ group entities

• Public authorities, ethical committees and institutional review boards

• Local industry associations

• Journals

• Other HCP's

If your Personal Data is transferred to one of our affiliated companies or a third party located in a country outside the EU/EEA, Pharmacosmos A/S will ensure that such transfer(s) will be carried out in accordance with the applicable data protection legislation, including the GDPR.

If your Personal Data is transferred to our affiliated companies in countries outside the EU/EEA, not ensuring an adequate level of data protection, the transfer will be based on Intra-Group Agreements including the EU Commission’s Standard Contractual Clauses.

Transfers to third parties in countries outside the EU/EEA, not ensuring an adequate level of data protection, may happen on an ad hoc basis in accordance with GDPR Article 49 (1), (b) to (e), and will otherwise be safeguarded by ensuring that the third party enters into the EU Commission’s Standard Contractual Clauses.

You may request a copy of the relevant Standard Contractual Clauses by contacting Pharmacosmos A/S on: dataprotection@pharmacosmos.com 

Your Personal Data will be retained for as long as it is relevant to fulfill the purpose for which it has been registered and in accordance with any specific retention periods required by law.

When we process personal data about you, you have a number of rights under the GDPR. These rights are stated below, but please note that certain limitations, restrictions, and conditions may apply to your ability to exercise these rights. Subject to those limitations, restrictions, and conditions, your rights are: 

Right of access
You have the right to access the personal data that we process about you and obtain certain other information relating thereto.

Right to rectification and erasure
You have the right to have inaccurate or incomplete personal data about you corrected or completed and to have your personal data erased by us.

Right to restriction of processing
You have the right to obtain restriction of our processing of your personal data in specific situations.

Right to data portability
Where our processing of your personal data is based on your consent or is necessary for the performance of a contract with you and the processing is carried out by automated means, you have the right to receive the personal data about you in a structured, commonly used and machine-readable format (data portability). You may request that we transmit your personal data directly to another data controller where technically feasible.

Right to object to our processing
Where our processing of your personal data is based on our performance of a task carried out in the public interest, cf. the GDPR article 6 (1) e., or our legitimate interests, cf. the GDPR article 6 (1) f., you have the right to object, on ground relating to your particular situation, to our processing of your personal data.

Right to withdraw your consent
Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. This shall not affect the lawfulness of our processing based on your consent before the withdrawal.

Automated individual decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

 Right to complain to a supervisory authority
You have the right to lodge a complaint with a supervisory authority such as the Danish Data Protection Agency (Datatilsynet).

If you want to exercise any of the above rights, please contact our Data Protection Manager at dataprotection@pharmacosmos.com. Please note that we may require proof of your identity and full details of your request before processing it. The data will only be used to verify your identity and will not be stored for longer than needed for this purpose.

If you wish to lodge a complaint with the Danish Data Protection Agency, you may also contact it directly at dt@datatilsynet.dk.

If you have questions or you do not feel that your concerns have been addressed in this Privacy Notice, please contact us either by mail, Attention: “Data Protection Manager” to the address: Pharmacosmos A/S, Roervangsvej 30, DK-4300 Holbaek, Denmark or by email to: dataprotection@pharmacosmos.com 

From time to time, we may revise this Privacy Notice. Any such changes to this Privacy Notice will be reflected on this page. Pharmacosmos A/S recommends that you review this Privacy Notice regularly for any updates. The date on which this notice was last revised is located at the top of this Privacy Notice.