Pharmacovigilance

As a pharmaceutical company, Aenova has a legal responsibility to monitor the safety of all products worldwide that we develop, produce or market. With the following information, we would like to inform you which personal data we process in the context of so-called pharmacovigilance and for which purposes we use this data. The scope of this statement is limited to the collection and processing of your personal data for pharmacovigilance and/or medical information inquiries. For general information about data processing at Aenova please visit: Aenova Privacy Policy

The monitoring of adverse reactions, side effects and/or interactions with other medicinal products (“event”) associated with the use of medicinal products is known as pharmacovigilance. The legally defined pharmacovigilance obligations relate to our medicinal products and allow us and the competent regulatory authorities to record events and to collect, process or use personal data in this respect. Comparable regulations exist for our medical devices and cosmetics. In the following, we therefore use the term pharmacovigilance comprehensively for the above-mentioned products.

In order to fulfill our legal responsibilities in this respect, we must collect and process information that allows a natural person to be identified, directly or indirectly ("personal data"), from a patient brought to our attention and/or the person reporting such an event. Under certain conditions, we also must report these events to the relevant regulatory authorities. In case such an event occurs, we ensure that all personal data is processed exclusively for pharmacovigilance purposes and only where relevant and appropriate in order to document, assess and report the event properly in accordance with our respective pharmacovigilance obligations.

In order to safeguard this personal data, we have implemented appropriate state of the art technical and organizational measures.

Legal basis

The legal basis for the processing of your personal data is the fulfilment of our legal obligations regarding the applicable pharmacovigilance laws and regulations, respectively the safeguarding of the considerable public and our own legitimate interests, which consist in ensuring high safety and quality standards for our products (Art. 9 Para. 2 lit. i GDPR, Art. 6 Para. 1 lit. c GDPR / Art. 6 Para. 1 lit. f GDPR in conjunction with Section 22 para. 1 lit. c BDSG).

Categories of personal data

We may need to process the following personal data (including collection, storage and further use, hereinafter together “process”):

About the patient affected by the event

Where appropriate, we can process the following additional personal data related to health and medical history of the person experiencing such an event if and to the extent this is required to process the event for pharmacovigilance purposes:

• Name and/or initials of the patient,
• Date of birth/age group, sex, weight, height
• Information on health, racial or ethnic origin and sexual life
• Medical history and state of health, including, but not limited to, for example:
  • Details of the product suspected of having caused the event, including the dosage you have been taken or were prescribed, the reason for taking or prescribing the product, and any subsequent changes to your usual medical therapy;
  • Details of any other medicines or medications you are taking or were taking at the time of the event, including the dosage you have been taking or were prescribed, the period you were taking the medicine, the reason for taking the medicine and any subsequent changes to your medical therapy,
  • Details of the event that you suffered, the treatment you received for that event, the potential long-term effects of the event on your health, and any other information about your medical history that the reporter considered relevant, including documents such as laboratory reports, medication history and patient history.

About the person reporting the event to us:

With respect to the person which has reported the event to us we can process the following data, in order to allow further inquiries by the regulatory authorities and or to further investigate the event:

• Name,
• Contact details (e.g. which may include, but not limited to, your address, e-mail address, telephone or fax number),
• Profession (this information may determine the questions you are asked about the event, depending on the assumed level of your medical knowledge about the event), and
• Relationship to the subject of the report.

Purposes of the processing

As part of meeting our pharmacovigilance obligations, we may process personal data in order to

• investigate the event,
• contact you to obtain further information about the event you reported,
• compare the information on the event with information on other events reported to us and, on this basis, analyse the safety of a production batch, product or active substance as a whole, and
• to provide mandatory reports to national and/or regional competent regulatory authorities to enable them to analyse the safety of a production batch, product, generic ingredient or active substance as a whole, together with reports from other sources. These reports contain details about the reported incident but will only contain limited personal data of the patient (note that the name of the patient will never be provided).

Transfer of personal data

As part of meeting our pharmacovigilance obligations, we may share and/or disclose personal data as follows:

• within the Aenova group to analyse and process a reported event.
• with the competent regulatory authorities, with regard to a suspected event.
• with third-party service providers of the Aenova group. Appropriate data protection security measures are implemented at our service providers to whom we pass on personal data and who are providing services on our behalf.
• with other pharmaceutical companies acting as co-marketers, co-distributors or other licensing partners, where the pharmacovigilance obligations for such a product require such exchange of safety information. Please note that also in this case appropriate data protection security measures are implemented at these business partners.
• with legal successors if the company, a therapeutic area or a specific product is sold, assigned, transferred or taken over by a third party. In this case we will require this third party to process personal data only in accordance with the applicable data protection law.
• if information about events is published (for example, in the form of case studies and summaries); in these cases, all identifiers are removed from publications to keep your identity private.

Third countries

Our pharmacovigilance databases are hosted in Germany. A transfer to third countries (outside the EU/EEA) may take place to the following recipients or categories of recipients due to compliance with the statutory reporting obligations:

• Subsidiaries of the Aenova Group which are established in a third country,
• Distributors and, where appropriate, other companies (established in a third country) acting as co-marketers, co-distributors or other licensing partners, where the pharmacovigilance obligations for a product require such exchange of safety information.
• Competent authorities.

Retention periods

We will use and store the personal data collected according to the aforementioned requirements in accordance with the respective mandatory and other legal requirements governing the storage and reporting of pharmacovigilance related information. Such mandatory requirements currently oblige us to archive the respective pharmacovigilance information, which may include personal data for the duration of the product life-cycle (i.e. until the respective product has been taken from the market) and for an additional ten years thereafter.

Your rights as data subjects

If we process personal data, the persons concerned are entitled to the following rights:

• Art. 15 GDPR Right to information Right to information about your personal data stored by us.

• Art. 16 GDPR Right of rectification Right to rectification of incorrect or incomplete personal data concerning you.

• Art. 17 GDPR Right to deletion
  Deletion of your personal data unless there is a legal obligation to keep records.

• Art. 18 GDPR Right to restrict processing If certain conditions are met, you have the right to have your personal data blocked and not processed further.

• Art. 20 GDPR Right to data transferability The right to data transferability of personal data concerning you that you have provided to us.

Please note, however, that these rights may be limited in order to fulfil our legal obligations. Your rights are not fully applicable if there is a legal basis for the processing of your personal data (e.g. information collected in the context of reporting an event cannot be deleted unless it is incorrect).

There is no automated decision-making including profiling according to Art. 22(1) and (4) GDPR.

Data subjects also have the right to file a complaint with a data protection authority.

Contact details of the data protection officer

For any questions you may have with respect to pharmacovigilance data protection or data protection in general please contact our data protection officer:

Aeonva Holding GmbH
Data Protection Officer
Berger Straße 8 - 10
82319 Starnberg (Percha)
E-Mail: datenschutz@aenova-group.com