Data Protection Notice for Pharmacovigilance in Human Pharma

1.    Handling of the report (sharing with Boehringer Ingelheim companies and authorities)

As a pharmaceutical company, Boehringer Ingelheim is subject to certain obligations related to the detection, evaluation, understanding and prevention of adverse reactions or other drug-related problems, also known as pharmacovigilance obligations. Pharmacovigilance obligations require us to process information that may allow us to identify, directly or indirectly, an individual, i.e. the patient and/or the person reporting the adverse event (personal data).

The processing of the following personal data may be necessary:

About the reporter:

• Full name, initials, and contact details (which may include your address, e-mail address and phone number), profession (e.g., physician, pharmacist).

About the patient: 

• Initials (as provided) never the patient’s name; gender; age / date of birth / age group;
• Details related to the Boehringer Ingelheim product suspected to cause the reaction, such as administration information, batch number;
• Further details related to the adverse event: Course and outcome of the adverse event, start and end date, first-time user?, information on concomitant medications and/or diseases; seriousness of the event; view of patient and/or reporter on possible causal relationship between Boehringer Ingelheim product and adverse event;

The contact details are necessary to establish follow-up contact with the reporter to obtain high-quality and complete information about adverse events. If the reporter does not wish to provide their contact information to Boehringer Ingelheim or the authorities, the reporting person's name field will be entered as "Withheld" or "Denied".

We may process your personal data in order to: (i) analyze the reported adverse event; (ii) contact the reporter for further information; (iii) compare and analyze the information about the adverse event with information about other adverse events that Boehringer Ingelheim has become aware of worldwide through our global pharmacovigilance database operated by Boehringer Ingelheim International GmbH; and (iv) report pharmacovigilance-relevant information to health authorities worldwide.

The personal data provided will be used exclusively for these purposes. The legal basis for the processing of personal data, including special categories of personal data, is Art. 9 (2) (i) GDPR in conjunction with §§ 75 i) et seq. of the Austrian Medicinal Products Act and, in addition, in the case of transfers of data to countries outside the EU in conjunction with Art. 49 (1) GDPR.

2.    To whom do we transfer personal data? 

We may share personal information with third parties. 

a.    Reporting obligations to regulators and enforcement of rights

In order to comply with legal reporting obligations and to protect our rights and/or the rights of third parties, we may share and disclose personal data to rights holders, advisors and courts as well as competent authorities in accordance with the law. (e.g. mandatory reporting in case of suspected adverse event). 
 
b.    Service provider

We engage service providers to process your personal data for the purposes described in this data protection notice. These service providers process the data only on our behalf, in accordance with our instructions and under our control. We ensure by means of a separate contract that our service providers comply with data protection obligations (e.g. with our data processors by concluding corresponding data processing agreements).  
 
c.    Boehringer Ingelheim Companies

As part of a global group of companies, we involve other Boehringer Ingelheim companies that support us in data processing (e.g. as part of our pharmacovigilance obligations to analyze and process a reported adverse event). Please click here for a list of the major consolidated Boehringer Ingelheim companies.  
These group companies process the data exclusively for the purposes stated in this data protection information as joint controllers in accordance with Art. 26 GDPR.  
 
 
d.    Other pharmaceutical companies

We may share pharmacovigilance-related information, which may include personal information, with other pharmaceutical companies that are marketing, sales or other licensing partners of the Boehringer Ingelheim group of companies if existing pharmacovigilance obligations for a Boehringer Ingelheim product require such an exchange of safety information. These companies will only process the data on our behalf, under our instructions, under our control and in accordance with this Privacy Notice.

e.    Data transfer to recipients outside the EU

Some of our service providers and Boehringer Ingelheim companies process personal data outside the EU. In these cases, Boehringer Ingelheim ensures an adequate level of data protection in order to comply with the requirements of European law (this is usually done by means of EU Standard Contractual Clauses published by the European Commission). For further information on the legal basis of data transfers to or by individual service providers to third countries, please contact us at the contact address mentioned in point 4.

3.    How long do we store personal data?

As adverse event reports are important for public health reasons, reports of adverse events will be kept for at least 10 years after the withdrawal of the product in the last country where the product is placed on the market. The storage period is set out in Commission Implementing Regulation (EU) No 520/2012. Where required by EU or national law, the data of the notification must be kept for a longer period of time.

4.    What are your rights?

a.    Withdrawal of consents: You can withdraw your consents any time with future effect. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.  
b.    Right to information: You can request access to your personal data at any time. If you have provided personal data based on a contract or consent, you have the right to receive this data in a common and machine-readable format. You can revoke your consent at any time with future effect.
c.    Right to deletion, correction, restriction, data portability: Under certain conditions, you may also request the deletion, correction, or restriction of the processing of your data. If your personal data is transferred to a country outside the EU that does not provide adequate protection, you may request a copy of the contract that ensures adequate protection of personal data. 
d.    Right to objection: If we use your personal data based on legitimate interest, you can object to the processing of your data. In this case, we will no longer process your data unless our interests prevail. You can object to the use of your data for direct marketing purposes, e.g. to receive mailing campaigns, at any time without further consideration.
e.    Right to complaint: If, despite our obligation to process your data lawfully, contrary to expectations, a violation of your right to lawful processing of your data occurs, you have the right to file a complaint to the Austrian data protection authority or another data protection supervisory authority in the EU, at your place of residence or work.

5.    Contact details

If you have any further questions about our use of personal data, this data protection information or would like to exercise your rights, you can contact us at any time or you can contact our data protection officer directly:

Boehringer Ingelheim RCV GmbH & Co KG
– Data Protection Officer –
Dr.-Boehringer-Gasse 5-11
1120 Vienna, Austria
E-Mail: datenschutzbeauftragter.AT@boehringer-ingelheim.com

If you have any questions or concerns about the processing of your personal data, you can also contact a supervisory authority. Responsible for Boehringer Ingelheim is:

Österreichische Datenschutzbehörde
 Barichgasse 40-42
 1030 Vienna
Telephone: +43 1 52 152-0
E-Mail: dsb@dsb.gv.at
Website: www.dsb.gv.at

6.    What happens if we change this privacy policy?

We will update this privacy policy from time to time. We will inform you about any changes to our Privacy Policy by publishing the new Privacy Policy here. If there are significant changes, we will publish an eye-catching notice on our website or send you an e-mail. If necessary, we also ask for your prior consent. You should review this Privacy Policy regularly for changes.

7.    Further data protection notices

Please note that in certain situations, additional data protection notices apply (for example, contracts for clinical trials).