Privacy Notice for Pharmacovigilance, Medical Information, and Product Quality Complaints

We process personal data for the purposes below, and we do not process personal data unless we have a proper justification in law:

Please note that in some countries, consent is the basis on which personal data is processed.

For the purposes listed in this Privacy Notice, we collect and use the following categories of personal data:

• information about individuals that report adverse events or a special case scenario (such as exposure during pregnancy, breastfeeding, overdose, lack of efficacy, etc.) or make medical information queries or product quality complaints, including healthcare professionals and carers. This allows us to respond to queries and seek additional information as needed. The data we collect may include your name, email and/or postal address, phone number, and place of work (for healthcare professionals). If you are a healthcare professional, we may also collect information in order to confirm that you are a healthcare professional;
• patients details, including name, hospital record numbers, age or date of birth, sex, weight, height, race, whether pregnant and/or breastfeeding, ethnicity (where the Summary of Product Characteristics includes specific information relating to ethnic origin), and occupational data (where this is strictly necessary for the evaluation of the adverse event); and
• where strictly necessary and relevant for the purposes described in this Privacy Notice, patient health and lifestyle information, including but not limited to nature of adverse effects, examination results, personal or family medical history, diseases or associated events, risk factors, information about the use of medicines and therapy management, physical exercise, diet and eating behaviour, sexual life/contraception, and consumption of tobacco, alcohol, and drugs.

We do not share or otherwise transfer personal data to third parties other than those indicated in this Privacy Notice. Personal data may be accessed by or transferred to:

• our personnel (including those in our Patient Safety, Medical Information, Quality Assurance, and Legal departments) and other Novartis Group companies;
• other pharmaceutical and medical device companies, if the adverse event, request for information, or complaint relates to one of their products; and
• service providers acting on behalf of Novartis companies, such as IT system and data hosting providers, and adverse event processing service providers (including call centre providers). These third parties are contractually obliged to protect the confidentiality and security of personal data, in compliance with applicable law.

Personal data may also be shared with:

• healthcare professionals involved in an adverse event, request for information, or complaint;
• health authorities including the European Medicines Agency (EMA) which controls the EU EudraVigilance database (https://www.ema.europa.eu), as well as the US Federal Drug Agency (FDA); and
• a national and/or international regulatory, enforcement, public body or court where we are required to do so by applicable law or regulation or at their request.

Personal data may be processed, accessed, or stored in a country outside the country where you are located, which may not offer the same level of protection of personal data.

If we transfer personal data to external companies in other jurisdictions, we will protect personal data by (i) applying the level of protection required under the data protection/privacy laws applicable to Novartis Pharma AG; (ii) acting in accordance with our policies and standards; and (iii) for Novartis companies located in the European Economic Area (“EEA”), unless otherwise specified, only transferring your personal data on the basis of standard contractual clauses approved by the European Commission. You may request additional information in relation to international transfers of personal data and obtain a copy of the adequate safeguard put in place by exercising your rights as set out below.

For intra-group transfers of personal data, the Novartis Group has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection relating to transfers of personal data outside the EEA and Switzerland. You can read more here.

We will only store the above personal data for as long as we reasonably consider necessary for achieving the purposes set out in this Privacy Notice and as required under applicable laws.

You have the right to:

• access your personal data and, if you believe that it is incorrect, obsolete or incomplete, to request that it is corrected or updated;
• request the erasure of your personal data or the restriction of its use;
• if the processing is based on your consent, to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
• object, in whole or in part, to the processing of your personal data; and
• request portability of your personal data (i.e. for it to be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format).

We may apply exceptions to these rights where appropriate and in accordance with local law.

If you have a question or want to exercise the above rights, please click here.

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.

If you want to contact our Data Protection Officer, please email [email protected] or write to Global Data Privacy Office, Novartis Pharma AG, Lichtstrasse 35, 4056 Basel, Switzerland.