Privacy Notice – Pharmacovigilance, Medical Information Request, Quality Complaints | Swixx BioPharma

Privacy Notice – Pharmacovigilance, Medical Information Request, Quality Complaints

Swixx Biopharma Privacy Notice – Pharmacovigilance, Medical Information Request, Quality Complaints

Ensuring patient/consumer safety is of utmost importance to Swixx Biopharma AG, having its principal office at Neuhofstrasse 5A, CH-6340 Baar, Switzerland, registered under the number CHE-147.465.430, email info@swixxbiopharma.com, phone: +41 41 5523 440 (hereinafter referred to as “Swixx Biopharma AG”) and its Affiliates, as well as to the marketing authorisation holders or manufacturers whose Products we represent. We take the safe and compliant use of all products in Swixx Biopharma portfolio very seriously. We may need to contact individuals who reach out to us about the Products in order to follow-up and obtain further information, give answers to requests or to send required information. This Privacy Notice describes how we collect, use, store or otherwise process personal data to help us fulfil Swixx Biopharma or marketing authorization holders/manufacturers duty to monitor the safety of all products including medicines we market or have in clinical development (also known as pharmacovigilance obligations) and to ensure the quality and safety of all products.
The Privacy Notice is applicable to medicinal products, cosmetic products, food supplements and medical devices since the international (including European) regulations on such products require similar safety and quality monitoring.

What definitions are used in this Privacy Notice?
“Adverse Event” means an unwanted, unintended, or harmful event in relation to the use of a Product. With respect to medical devices, it also includes “incidents” and for cosmetics "serious undesirable effects", but for ease of reading, only the term “adverse event” will be used in this Privacy Notice.
“Affiliate” means Swixx Biopharma affiliate in a relevant territory. A list of Affiliates and their contacts can be found at https://www.swixxbiopharma.com/en/countries/ .
“aRMM” means additional Risk Minimisation Measures, which are intended to reduce important risks associated with the Product that cannot be adequately managed by routine measures such as Product labelling. aRMMs may include educational materials for HCPs and patients, such as brochures and alert cards, or other measures, for example-controlled distribution systems, to minimize the occurrence or severity of adverse events.
"DHPC” means Direct Healthcare Professional Communication, a written communication about new important risk/benefit information about medicinal product(s) delivered directly to individual HCPs by the MAH or by a competent authority, to inform the HCPs of the need to take certain actions or adapt their practices in relation to use of concerned medicinal product(s).
“Data Controller” means an entity or a person who determines the scope of Personal Data processing and other important processing activities, including but not limited, retention period, methods of Personal Data processing, security measures.
“Data Processor” means an entity or person who processes Personal Data on behalf of Data Controller following the instructions given by the Data Controller.
“Data Subject” means a natural person, whose Personal Data may be processed.
“Data Sub-Processor” means an entity or a person who helps to process the Personal Data for the Data Processor. In respect of pharmacovigilance service provision for the MAHs, usually the Affiliate is the Data Sub-Processor.
“EU” means European Union.
“HCP” means a healthcare professional.
“Joint Controller” means 2 or more entities which are related in a way that processing of Personal Data are required for both activities and together determines the scope of Personal Data processing.
“MAH” means a marketing authorization holder/manufacturer of a particular Medicinal Product.
“Partner” means the marketing authorization holder/manufacturer which we represent and/or provide pharmacovigilance, medical, quality related services. A list of our Partners can be found at https://www.swixxbiopharma.com/en/partnering/ .
“Personal Data” means information in any format that can be used, directly or indirectly, alone or in combination with any other information, to identify a person.
“Product” means a medicinal product, a medical device, a cosmetic product, a food supplement which Swixx Biopharma Group of Companies represent and are responsible for handling of pharmacovigilance, medical, quality requirements.
“Product Safety” means activities related to the management of the safety profile of the Product, including but not limited to the collection, record, storage, and reporting of adverse events and other safety information, the implementation of aRMM, the handling of medical information requests, and the Product quality complaints.
“Swixx Biopharma Group of Companies” means Swixx Biopharma AG and/or its Affiliates/subsidiaries or other type of entities belonging to same ownership and/or governance structure and which list, including contact details are available at website www.swixxbiopharma.com . “We”, “Us”, “Our” may be used in this Privacy Notice for a reference of Swixx Biopharma AG and the Affiliate(s).
“Quality Complaint” means a claim or expression of displeasure, dissatisfaction or annoyance with a Product, Product related materials or Product related information. A complaint may be related to, among other things, identity, purity, potency, safety or quality of the Product. Notwithstanding the definition of the Quality Complaint, if the complaint involves a medical event in a patient, it is regarded as an Adverse Event.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

What is the scope of this Privacy Notice?
The Privacy Notice is addressed to:

individuals reporting adverse events, submitting quality complaints, requesting medical information; and
individuals that are the subject of the Adverse Event, Quality Complaint or indicated in the Medical Information Request whilst their Personal Data was received from third parties, e.g., HCPs, lawyers, relatives, or other members of the public; and
individuals receiving the information in relation to aRMM or DHPC.

This Privacy Notice applies to information we process about you collected online or during face-to-face meeting, by phone, fax, e-mail or post, or as part of the Adverse Event, Quality Complaint reporting or responding to Medical Information Request or implementing aRMM or distributing DHPC under regulations applicable to us and the Partners.

Who is the Data Controller, Data Processor and Data Sub-Processor?
EU and local legal requirements impose specific obligations on MAHs to ensure the safety of their Products. Therefore, any Personal Data processed in connection with Product Safety activities is processed to comply with these legal obligations. Accordingly, the Data Controller in this respect is the Partner having MAH status over the Product. The Partner’s contact details and further information on data protection can be found on the Partner’s official website.
Swixx Biopharma AG, acting as a representative of the Partner and/or as a provider of pharmacovigilance, medical, or quality-related services on behalf of the Partner, assumes the role of a Data Processor, while its Affiliates act as Data Sub-Processors. Contact details of Swixx Biopharma Group of Companies can be found on our official website www.swixxbiopharma.com .
However, in certain cases, Swixx Biopharma AG or an Affiliate may also hold the Marketing Authorization for the Partner’s Product. In such a case, the data controller relationship between Swixx Biopharma AG (or the Affiliate) and the Partner will be determined based on the specific allocation of roles and responsibilities, and may qualify either as Joint Controllership or as Independent Controllership under applicable data-protection laws.
For operational purposes, Swixx Biopharma AG and its Partners may use their Affiliates as Data Processors and/or Sub-Processors, as well as engage third parties to perform certain functions, for example, to provide IT helpdesk services, communication facilitation, software solutions (e-tools) used for information storage and management, etc.

What is purpose and legal basis for processing your Personal Data?
In general, the Personal Data described in the following chapters of this Privacy Notice are processed for the purpose of managing Adverse Event reports, Quality Complaints, responding to Medical Information Requests, and implementing aRMM or distributing DHPC.
Seeking to provide more detailed information regarding purpose and legal basis of the Personal Data processing, following purposes include:

Processing of received Adverse Event reports, Quality Complaints, Medical Information Request;
Monitoring the safety of the Products, which includes detecting, assessing, following up on, and preventing Adverse Events;
Responding to Quality Complaints regarding the Products and to meet Product’s quality control requirements;
Reporting of the Adverse Events, Quality issues to competent authorities;
Responding to Medical Information Requests;
Implementing aRMM by sending or otherwise providing information or performing other actions related to aRMM implementation and recording these actions.

EU and local legal requirements obligate the MAH to maintain effective pharmacovigilance and Product quality systems in order to record, assess, and prevent Adverse Events and Product Quality issues, as well as to provide medical information related to the Product and to implement aRMM or distribute DHPC approved by the competent authorities.
Accordingly, your Personal Data is processed based on a legal obligation and for reasons of public interest in the area of public health, pursuant to Articles 6(1)(c) and 9(2)(i) of the GDPR, in particular under the European Commission Implementing Regulation (EU) No 520/2012, Regulation (EC) No 726/2004, Directive 2001/83/EC, Regulation (EU) 2017/745 and other applicable EU and local legislation.
However, we may request your consent (under Article 6(1)(a) GDPR) for follow-up communications, or process certain Personal Data based on our and/or the Partner’s legitimate interests (under Article 6(1)(f) GDPR) to maintain records of received and responded Medical Information Requests, Product Quality Complaints, Adverse Event reports, and implemented aRMM activities of distributed DHPC, for the purpose of correspondence archiving in order to establish, exercise, and/or defend legal claims.

What Personal Data do we process?

I. Pharmacovigilance and Quality Complaints
We collect Personal Data about you when you or a third party (representative, HCP, etc.) provides us or the MAH with information in relation to an Adverse Event or Quality Complaint that affected a particular individual.
Pharmacovigilance, quality and regulatory requirements require the MAH to take “detailed records” of every passed Adverse Event report, Quality Complaint to allow the event to be evaluated and collated with other adverse events, quality complaints and be recorded about that Product.
The Personal Data that we may process:

full name;
signature;
contact details, e.g. phone number, email, post address;
reporter status: patient / consumer or representative of the consumer, HCP, representative of the legal entity, e.g. wholesaler, healthcare service provider, health authority, etc.
if reporter is the HCP or representative of legal entity: title/specialization, workplace;
information about individual who suffered the adverse event or faced the quality issue: age, gender, weight, height, medical history, information about used product / device (duration, dosage, concomitant products/devices used), features of adverse event/quality issue;
voice of data subject, when a voice message is left;
other information provided in the report of Adverse Event and/or Quality Complaint.

II. Medical Information Request
Medical Information Request regarding a particular Product can be provided by the HCP, patient/ consumer, representative of wholesaler, health authority, etc. In order to handle and maintain records of the Medical Information Request, the following personal data may be processed:

full name;
signature;
contact details, e.g. phone number, email address, post address;
requestor status: HCP, patient/consumer, representative of health authority, wholesaler, healthcare service provider;
requestor’s workplace and position when requestor is a representative of health authority, wholesaler or healthcare service provider;
voice of data subject, when a voice message is left;
other information provided in the Medical Information Request.

III. Individual belonging to the intended aRMM or DHPC audience
aRMM or DHPC may require providing additional information to HCPs, as well as to the healthcare institutions or HCPs associations, patients or patients organizations in relation to Product Safety or to collect additional information about the Patient, HCP as part of aRMM implementation or for distributing of DHPC. Due to this reason, we may process following information:

full name;
contact details: email, phone number, address;
signature;
data subject status: HCP, representative of healthcare institution or/and wholesaler and/or health authority, patient;
in terms of patient: unique patient ID, gender, diagnosis, treating physician’s name, surname and hospital, dosage of the Product, date of the last mandatory diagnostic (laboratory) test and its result, vaccination information and other patient related information, if required for aRMM;
in terms of the HCP: specialization, workplace.

What is your personal data source?
We may obtain your Personal Data when you, your representative, HCP or representative of the legal entity, e.g. wholesaler, healthcare service provider, contact us or the MAH.
In addition, if your full name, specialization, workplace, e-mail address, or phone number are publicly available, we may collect such information from public professional sources (e.g. official registers, legal entities‘ websites, databases, publications) based on our or the MAH’s legitimate interest to identify and contact relevant HCP for the purpose of disseminating safety and risk minimisation information required under aRMM or DHPC.

What is the retention period?
In accordance with legal regulation, the MAHs must retain all Product-related documents for at least the time period of the market authorization and plus at least 10 years following its expiry. Therefore, personal information related to pharmacovigilance activities (Adverse Events, aRMM, DHPC), Quality Complaints of Products will be retained for this time period, unless shorter or longer process of Personal Data processing is required and lawfully allowed pursuant to applicable legal regulation.
However, the Personal Data originated through the Medical Information Request is typically stored for a period regulated by the laws permitting to establish, exercise and/or defend legal claims.

Who are the recipients of your personal data?
Due to the nature of Swixx Biopharma activities, personal data may be transferred to the following recipients:

Competent health and/or regulatory authorities;
Swixx Biopharma Group of Companies, listed at https://www.swixxbiopharma.com/en/countries/ ;
Partners;
Consultants, IT providers, communication facilitation and other service providers.

Taking into account that Swixx Biopharma and/or Partners affiliates and subsidiaries may be located outside the European Economic Area and/or Switzerland and fully or partially some operational functions can be performed outside of the European Economic Area and/or Switzerland, your Personal Data might be transferred from your residence territory to third-countries.
The transference of the Personal Data will always comply with GDPR established models and measures of personal data transference to third-countries, in particular:

If Personal Data shall be transferred to Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom under the GDPR and the Law Enforcement Directive (LED), the United States (commercial organisations participating in the EU-US Data Privacy Framework) and Uruguay, the relevant European Commission decision of providing adequate protection of personal data shall be used (a particular decision can be found at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en ).
If Personal Data shall be transferred in a territory where the absence of an adequacy decision by the European Commission and/or Swiss Federal Data Protection and Information Commissioner (as applicable) exists, the Standard Contractual Clauses approved by the European Commission shall be used or other safeguard measures stipulated in Chapter V of the GDPR or/and in a Section 3 of Chapter 2 of the Swiss Federal Act on Data Protection (as applicable) may be applied for transferring Personal Data to third countries and/or international organization.

What are your data subject rights?
You, as a data subject, have the following rights regarding the processing of your personal data:

to be informed about how and why Swixx Biopharma uses your personal data (this Privacy Notice serves that purpose);
to request a copy of the Personal Data that Swixx Biopharma holds about you and details of how it is used;
to amend or rectify your Personal Data if any information is incorrect or outdated;
to data portability;
to request the erasure of your Personal Data;
to request that Swixx Biopharma ceases or restricts processing of your Personal Data;
to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (note that Swixx Biopharma may still need to retain certain data where required by law);
to obtain a copy of the appropriate safeguards used for data transfers to third countries or international organizations;
to lodge a complaint with the supervisory authority in your country of work (see https://www.edpb.europa.eu/about-edpb/about-edpb/members_en ) or with the Swiss Federal Data Protection and Information Commissioner (see https://www.edoeb.admin.ch/en ), as applicable.

How can you exercise your rights or get more information?
If you would like to access, review, correct, delete, or port the personal data we have collected about you, assert a right regarding your personal data, or discuss how we process your data, please contact us at data@swixxbiopharma.com . We will respond within one calendar month.
Please note that if you would like to report an adverse event, quality complaint, or request medical information, please contact us using contact details provided at https://www.swixxbiopharma.com/en/countries/ .