Data protection policy - Pharmacovigilance
SUBSTIPHARM
Rules governing the processing of personal data applicable to Pharmacovigilance cases
At Substipharm, we collect your personal data in order to prevent, monitor, evaluate and manage adverse health events and unusual situations (hereinafter referred to as “Pharmacovigilance“) that may be linked to our products. We need to collect and process your personal data in order to deal with the pharmacovigilance case.
The legal basis for this, required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter also referred to as “GDPR“), is the legal obligation of Substipharm in accordance with Directive 2010/84/EU, EU Regulation No. 1235/2010, and EU Implementing Regulation No. 520/2012. Under no circumstances may the information collected be used for any purpose other than that provided for herein.
I) Data Collected and Purpose of Processing
In accordance with the provisions of Article 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Article 55 of the amended Act of 6 January 1978, certain personal information is collected by Substipharm in the context of Pharmacovigilance.
The purpose of the data processing is to manage and monitor notifications of adverse health events or unusual situations, and to communicate with the person who has notified the event or the healthcare professional who can provide details of the event, as detailed below (hereinafter referred to as the “Purpose“).
At Substipharm, we only collect and store data that is relevant and meets the Purpose of the processing. The data that may be collected by Substipharm and the details of its Purpose are as follows:
A. Personal data relating to the person exposed to a Pharmacovigilance case:
Data collected | Detailed Purpose |
Identity: – Initials – Medical record number – Age or age group – Date of birth – Gender – Stage of pregnancy if person exposed during pregnancy – Weight – Height | Indirectly identify the person exposed to the adverse health event and carry out a Pharmacovigilance analysis
|
Drug in question: – Name of drug – Dosage – Batch number, etc. | Assess and analyse the Pharmacovigilance case |
Health-related data, including: – treatments administered – test results – nature of adverse reaction(s) – personal or family history – any related illnesses or events – risk factors – information on how drugs are prescribed – information on how drugs are used – information on the treatment plan implemented by the prescribing physician or healthcare professionals handling the illness or adverse health event.
| Assess the adverse health event or unusual situation |
Private data provided that it is necessary: – occupation – smoker/non-smoker – alcohol consumption – recreational drug use – lifestyle and behaviour patterns
| Assess the Pharmacovigilance case |
Private data provided that it is necessary: – ethnicity | Data relating to ethnic origin may be collected by Substipharm when a document presenting the drug’s characteristics validated by a competent authority (e.g. the summary of product characteristics for medicinal products) states, on the basis of scientific research, that a person’s ethnic origin could have an impact on the product’s efficacy or safety
|
B. Personal data of the person who contacts Substipharm to report or provide details of the health event:
According to the situation, the person who has reported the incident is one of the persons referred to in the French Public Health Code: a member of a health authority, a healthcare professional, the person exposed to the adverse health event or their family or friends, the person(s) with parental authority, the beneficiary in the event of death, or an approved patient association.
If the adverse health event is reported directly by the person exposed to it, their identity has to be revealed. The information provided is strictly limited to what Substipharm needs to know in order to meet its pharmacovigilance obligations, and for a period strictly limited to what is necessary to meet those obligations.
Data collected | Detailed Purpose: |
Contact details: – Surname – First name – Postal address (if e-mail address not available) – E-mail address – Telephone number – Area in which the healthcare professional works (if the person reporting the incident is a healthcare professional)
| Provide information on and follow up the Pharmacovigilance case Medical validation of the pharmacovigilance case (for healthcare professionals) |
II) Who do we share your personal data with?
A. Within the European Economic Area:
Within the Substipharm company or Group, we may share your personal data with the following recipients:
- the Pharmacovigilance department;
- other Substipharm departments involved in data processing;
- other Substipharm Group entities within the European Economic Area.
We may also share your data with service providers and subcontractors acting on behalf of Substipharm for the Purposes of processing. The latter will be considered “processors“ under the GDPR.
All these recipients have access to personal data only insofar as they need it for the Purpose of the processing.
The data is disclosed or transmitted in accordance with the security requirements of the GDPR.
B. Transfers outside the European Economic Area:
The data collected by Substipharm is processed, stored and archived in the European Economic Area. However, by way of exception, data may be transferred outside the European Economic Area if this is necessary for the implementation of the pharmacovigilance system, or if required by a foreign national health authority or agency or an international one. In this case, the data is only transferred to countries recognised by the European Union as providing an adequate level of protection, or by implementing measures to control the transfer and guarantee the level of protection required by the GDPR.
III) How long personal data is kept ?
The length of time data is kept is determined by the Purpose and by a Public Health interest, as well as by the random and unpredictable nature of the health incidents. In addition, developments in medical and scientific knowledge may lead to Pharmacovigilance data being re-evaluated several years after incident reports have been recorded.
The history of pharmacovigilance cases is kept on file for between 10 and 70 years from the date on which the drug is withdrawn from the market.
IV) Your rights
When a health event is reported to us and we process your personal data as a consequence, you have the following rights:
- Right of access: i.e. the right to access the data about you that Substipharm processes;
- Right of rectification: i.e. the right to rectify any data about you that is inaccurate or incomplete;
- Right to limitation: i.e. the temporary freezing of your data for the time needed to carry out checks, should you dispute the accuracy of the data.
Insofar as the legal basis for processing such data is compliance with a legal obligation, data subjects do not have the right to object to this processing. Neither do they have the right to have their personal data deleted or ported.
V) Contacting us
If you want to contact Substipharm about your personal data, you can write:
By post to:
Substipharm
24 rue Erlanger
75016 Paris, France
By e-mail to: dataprivacy@substipharm.com
Substipharm will send you a reply within one month of receipt of your request in accordance with Article 12 of the GDPR. If Substipharm has complex requests to deal with or a very large number of requests, the period within which it sends you a reply may be extended by a further two months. If this is the case, you will be informed within one month of receipt of your request.
You may also lodge a complaint with the supervisory authority in your Member State (CNIL in France) at any time.
The person who has reported the adverse health event must communicate the above-mentioned information to the person exposed to the Pharmacovigilance case so that they are aware of it.
