Data Protection Notice for Members of Healthcare Professions

1.    What kind of personal data do we collect and for what purposes do we use it?

"Personal Data" means information relating to you or another identifiable individual.
The following categories of data may be collected and processed about you, if applicable: 
•    Identification data: name, gender, date of birth, identity card or passport data
•    Addresses and contact details: Postal address, e-mail addresses, telephone number, fax number, organizational data such as company/organization, department, function
•    Permissions and their use: IP addresses or user accounts, online services or business applications used, 
•    Use of e-mail newsletters: type of access to the e-mail, the type of end device, operating system and browser, IP address 
•    Activities, tasks and occupation: curriculum vitae, specializations, professional affiliation, data on education or scientific activities (if you provide services for us), data on participation in webinars, seminars and projects, publications, participation in clinical trials,  employer, type of specialization, Austrian ÖÄK-Number, license number(s) including National Provider Identifier (NPI) incl. expiration date, countries/states/districts of the license, previous engagements with Boehringer Ingelheim, date and country of such engagements and the amount and method of payment of transfers of value. 
•    Interests: Topics about which you request information from us
•    Information related to our products and your interactions with us: preferences and wishes
•    Financial and banking data when you provide services for us or to reimburse costs
•    Preferences for travel or dietary restrictions

a.    Requested and agreed services 

We collect your data to be able to provide you with agreed or requested services:
•    if you register on our websites or apps and use them;
•    if we conclude contracts with you for consulting services, lectures or in other cases;
•    if you take part in training courses or events;
•    if you send us inquiries about products or possible side effects. 

The processing of your data is necessary to fulfill the agreed service or to carry out pre-contractual measures and to answer your inquiries and is therefore based on Article 6 (1) b) GDPR. The processing of your data is necessary for the conclusion of the contract.
Non-provision of your data would mean that we cannot enter into a contractual relationship with you.

b.    Provision of information

When we contact you to advise you or provide you with information, we collect personal data to further adapt our information and consultancy to your preferences and wishes:

After personal meetings and consultations, our representatives note which topics you would like more information on and which topics you are less interested in. If our representatives show you information on tablets during visits, the tablet also stores how long which pages/information were displayed to you.

You can separately object to this at any time, including by notifying our representatives.

E-mail newsletter: If you receive e-mail newsletters, we store if and when the email was successfully delivered, whether and when you opened them, and which links you clicked on and when. In addition, the type of access to the e-mail, the type of the device, the operating system and the browser, as well as the IP address are documented.

You can separately object to this at any time, including by notifying our representatives.

We store your inquiries, which you send to us by e-mail, via the websites or by other means.
The processing of your data for the provision of information is carried out based on our legitimate interests in accordance with Article 6 (1) f) GDPR:
•    Ensure lawful and efficient business communication,
•    Support professional exchange, and 
•    To boost sales of our products. 
If necessary, we will obtain your consent (Article 6 (1) a) GDPR. We will only send you e-mail newsletters if you have given your consent. 

The provision of your data is voluntary. Failure to provide your data would, however, mean that we cannot provide you with optimized services and products.

c.    Disclosure of transfers of value and fair-market-value

According to the EFPIA Code of Practice and the Pharmig Code of Conduct, pharmaceutical companies are required to disclose all transfers of value received by health care professionals or organizations. 
Direct payments (such as fees for consulting services and conducting studies) and indirect benefits (payment of registration fees, accommodation and travel costs and expenses) are considered. 

To comply with these obligations, Boehringer Ingelheim processes your personal data and transmits it to the Boehringer Ingelheim company organizing the event. 
Based on the personal data provided (e.g. CV), Boehringer Ingelheim will assess reasonable fees for events and service fees and launch an internal approval process to ensure adherence to compliance and fair market value rules. 

The processing is carried out based on our legitimate interests pursuant to Article 6 (1) f) GDPR, namely the fulfilment of legal or regulatory requirements and the EFPIA Directive (EFPIA Code of Practice) and the Pharmig Code of Conduct in relation to the disclosure of value transfers.

d.    Usage data on websites, apps, online seminars

If you have given your separate consent, we store usage data when you as a registered user visit our websites, apps or online seminars or contact us via video telephony (e.g. with Veeva-Engage, Zoom or MS Teams).
Usage data is data that is generated when using these services: 
•    username and ID as well as, if applicable, e-mail address, 
•    the type of device used, the operating system and the browser 
•    pages viewed, clicks, downloaded materials, as well as 
•    the times and duration of usage, in the case of (video) telephony (image and) sound signals.

You can withdraw your consent at any time with future effect.

e.    Optimal consultation for you: How do we use your data for this?

Our goal is to offer you added value with our information and services - tailored to your interests, preferences and wishes. 
We would like to explain how we do this here:

•    Our consultancy is provided by our Boehringer Ingelheim representative that uses his or her notes and meeting minutes to customize the consultancy.  
•    We use the additional information, which the Boehringer Ingelheim representative collected during visits, to optimally select our content, the communication channels and our type of communication. This is based on questions like: 

• What is your area of expertise?  
• What are your preferred treatments? 
• Do you use our online services, or do you prefer personal contact? 
• Do you publish regularly? 
• How engaged are you in scientific associations? 
• Which materials are you more interested in, which less, etc.? 
• Do you attend seminars and, if yes, which ones?

We evaluate the data collected to align our further communications on these findings. Therefore, you will receive information and offers which are tailored to your interests, preferences and wishes. This is considered profiling according to Art. 4 (4) GDPR. However, you are not subject to any decision that produces legal effects on you or significantly affects you in a similar manner.
This processing is based on our legitimate interest in accordance with Article 6 (1) f) GDPR, namely the support of the creation of a network of experts for optimal professional exchange and for efficient business communication.

The provision of your data is voluntary. Failure to provide your data would, however, mean that we cannot offer any services that are specifically tailored to your needs.

f.    Dispense of medical samples

We process your personal data when submitting not-for-sale medical samples. The processing of your personal data serves as evidence for the submission of medical samples and is necessary to fulfill a legal obligation to which we, as the marketing authorization holder, are subject to (see. § 58 (3) of the Medicinal Products Act - Arzneimittelgesetz; Art. 6 (1) c) GDPR).

The provision of your data is required by law. Failure to provide your data would have the consequence that no medical samples can be provided to you. 

The proof of submission of the medical sample must be submitted to the Federal Agency for Safety and Health Care (BASG) upon request. For the delivery and supply of medical samples, only the data necessary for the proper supply of medical samples is being processed, such as first name, last name, e-mail address, address details and opening hours of the ordination, exact product name and number of medical samples, will be transferred to the logistic company commissioned by us. Your data will not be transferred to other third parties.

g.    Reporting obligations to authorities

As a pharmaceutical company Boehringer Ingelheim is subject to specific regulations, e.g. on pharmacovigilance. Some of these laws require us to send your pharmacovigilance reports to regulators or other authorities worldwide. 

We only provide personal data to authorities if we are legally obliged to do so. The data processing is based on a legal obligation according to Article 6 (1) c) GDPR. Further details on data processing in connection with pharmacovigilance can be found in our data protection policy on pharmacovigilance.

h.    Data from public sources (for the management of master data and for consultation)

We collect personal data about health care professionals from public or external sources, to verify their professional qualifications and identity. The data also helps us to communicate and consult you according to your interests and preferences:

MedTrix GmbH
To inform and advise you, we maintain your contact data and information about your specializations with the help of MedTrix database, a database operated by MedTrix GmbH, Grünbergstraße 15/1, 1120 Wien, with up-to-date contact and specialization data for medical professionals.

Monocl
To be able to get in touch with suitable stakeholders, we use the cloud-based platform from Monocl AB, Redegatan 1B, 42679 Västra Frölunda, Sweden, a database with current contact and specialization data for medical professionals. As part of this platform, we collect your contact details as well as information about your specializations, your professional career, your publications, the number and type of clinical trials carried out and the obtainment of grant funds. 
This is profiling according to Art. 4 (4) GDPR. However, you are not subject to any decision that produces legal effects on you or significantly affects you in a similar manner.

Publicly available sources of information (publications, websites, memberships)
We collect publicly available information about your publications, participation in seminars, memberships in scientific or professional associations, whether you operate a website and how it is designed.
The processing is based on our legitimate interests in accordance with Art 6 (1) f) GDPR, namely, to ensure lawful and efficient business communication and to support the creation of an expert network for professional exchange. 

Austrian medical association
We match your ÖÄK number (license number of the Austrian Medical Association) to perform a plausibility check on your entries. This serves the verification of your professional qualifications and your identity.

i.    Further purposes

If necessary, we process your personal data for other purposes: 
•    Fulfilment of our legitimate interests (Art. 6 (1)(f) GDPR), including the following: (i) completion of corporate transactions (e.g., restructuring, sale or assignment of assets, merger); (ii) protecting, enforcing and defending our rights, property and interests.
•    Fulfilment of legal obligations, court orders or other binding official decisions (Art. 6 (1) (c) GDPR).
•    in the context of contractual relationships (Art. 6 (1) (b) GDPR).

2.    To whom do we transfer personal data?

We may share personal information with third parties.

a.    Reporting obligations to regulatory authorities and enforcement of rights

As a pharmaceutical company Boehringer Ingelheim is subject to specific health regulations, e.g. on pharmacovigilance (§§ 75 i et seq. of the Austrian Medicines Act). Some of these laws require us to send your data to regulators or other authorities worldwide (including countries that may have a different level of data protection than the EU). We only provide the authorities with personal data if we are legally obliged to do so. 
The data processing is based on a legal obligation in accordance with Art. 6 (1) (c) GDPR. Further details on data processing in connection with pharmacovigilance can be found in our data protection policy on pharmacovigilance.

To protect our rights or the rights of third parties, we may also disclose data to rights holders, consultants and authorities in accordance with legal provisions.

b.    Service provider

We engage service providers to process your personal data for the purposes described in this data protection notice. These service providers process the data only on our behalf, in accordance with our instructions and under our control. We ensure by means of a separate contract that our service providers comply with data protection obligations (e.g. with our data processors by concluding corresponding data processing agreements).
The following types of service providers may be commissioned to process personal data on behalf of Boehringer Ingelheim:

•    address database operators
•    advertising agencies
•    communication agencies
•    consultants
•    event agencies
•    financial auditors
•    IT service providers
•    logistics companies
•    market research agencies
•    printing companies
•    publishers
•    streaming service providers
•    training agencies 
•    translators
•    travel agencies

c.    Boehringer Ingelheim-Companies

As part of a global group of companies, we involve other Boehringer companies that support us in data processing. Please find here an overview of the major Boehringer Ingelheim companies. These group companies process the data solely for the purposes stated in this data protection policy. This data processing is based on our legitimate interest in accordance with Art. 6 (1) f) GDPR, namely the efficient organization of our corporate administration and business communication.

d.    MedTrix Database

If we receive inaccurate personal information from the MedTrix database, we will inform MedTrix GmbH of the inaccuracy. After validation by MedTrix GmbH, this data is made available to other companies with whom MedTrix GmbH cooperates.

e.    Data transfer to recipients outside the EU

Some of these service providers and Boehringer companies process personal data outside the EU. In such cases, Boehringer Ingelheim ensures an adequate level of data protection to comply with European law (usually through EU standard contractual clauses published by the European Commission). For further information on the legal basis for the data transfer to or by service provider to third countries please contact us via the address mentioned under 5. 

3.    How long do we store personal data?

We will retain personal information for as long as necessary for the business purpose or purposes for which it was collected. 

Data that we collect during our cooperation with you, e.g. e-mail correspondence, will be kept for a period of three years.

We store data that we collect in connection with the request and submission of medical samples for 5 years (§ 58 (3) Medicinal Products Act (Arzneimittelgesetz - AMG) in conjunction with § 15 (1) Regulation on Operating Instructions for Medicinal Products (Arzneimittelbetriebsordnung - AMBO)).

For tax law reasons, we store business-related documents and accounting documents as well as the associated records from our contractual relationship for a period of seven years in accordance with § 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung - BAO).

4.    What are your rights?

a.    Withdrawal of consents: You can withdraw your consents any time with future effect. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
b.    Right to information: You can request access to your personal data at any time. If you have provided personal data based on a contract or consent, you have the right to receive this data in a common and machine-readable format. You can revoke your consent at any time with future effect.
c.    Right to deletion, correction, restriction, data portability: Under certain conditions, you may also request the deletion, correction or restriction of the processing of your data. If your personal data is transferred to a country outside the EU that does not provide adequate protection, you may request a copy of the contract that ensures adequate protection of personal data. 
d.    Right to objection: If we use your personal data based on legitimate interest, you can object to the processing of your data. In this case, we will no longer process your data unless our interests prevail. You can object to the use of your data for direct marketing purposes, e.g. to receive mailing campaigns, at any time without further consideration.
e.    Right to complaint: If, despite our obligation to process your data lawfully, contrary to expectations, a violation of your right to lawful processing of your data occurs, you have the right to file a complaint to the Austrian data protection authority or another data protection supervisory authority in the EU, at your place of residence or work.

5.    Contact details

If you have any further questions about our use of personal data, this data protection information or would like to exercise your rights, you can contact us at any time or you can contact our data protection officer directly:

Boehringer Ingelheim RCV GmbH & Co KG
– Data Protection Officer –
Dr.-Boehringer-Gasse 5-11
1120 Vienna, Austria
E-Mail: datenschutzbeauftragter.AT@boehringer-ingelheim.com

If you have any questions or concerns about the processing of your personal data, you can also contact a supervisory authority. Responsible for Boehringer Ingelheim is:
Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
Telephone: +43 1 52 152-0
E-Mail: dsb@dsb.gv.at
Website: www.dsb.gv.at

6.    What happens if we change this privacy policy?

We will update this privacy policy from time to time. We will inform you about any changes to our Privacy Policy by publishing the new Privacy Policy here. If there are significant changes, we will publish an eye-catching notice on our website or send you an e-mail. If necessary, we also ask for your prior consent. You should review this Privacy Policy regularly for changes.

7.    Further data protection notices

Please note that in certain situations, additional data protection notices apply (for example, contracts for clinical trials).