Privacy Notice – Pharmacovigilance, Medical Information Requests, Product Quality Complaints

  1. Introduction 


At EL PHARMA, as part of the PHOENIX group, patient safety, product quality and the protection of personal data are of utmost importance.

This Privacy Notice explains how personal data is processed when you:

  • report a suspected adverse event;
  • provide other safety-related information concerning a medicinal product;
  • report a product quality complaint;
  • request medical information;
  • contact us regarding a pharmacovigilance-related matter.


This Privacy Notice describes how EL PHARMA and, where applicable, affiliated PHOENIX group companies collect, use, store, disclose or otherwise process personal data in connection with pharmacovigilance activities, medical information requests and product quality complaints. Such processing is carried out in accordance with applicable data protection laws, including Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), and applicable pharmacovigilance, product quality and medicinal product legislation, including Directive 2001/83/EC, Regulation (EC) No 726/2004, Commission Implementing Regulation (EU) No 520/2012, applicable national laws and Good Pharmacovigilance Practice (“GVP”) requirements.

  1. Why do we collect and process safety information?

Pharmacovigilance legislation requires pharmaceutical companies and their partners to collect, assess, investigate and retain safety information, including information relating to adverse events and product quality complaints.

This supports the monitoring of the benefit-risk profile of medicinal products, fulfilment of regulatory reporting obligations and protection of public health.

Safety information may include suspected adverse reactions, lack of efficacy, overdose, misuse, medication errors, occupational exposure, off-label use, exposure during pregnancy or breastfeeding, product quality complaints and other information relevant to the safety, quality or appropriate use of a product.

Key terms used in this Privacy Notice

  • Pharmacovigilance means activities relating to the detection, assessment, understanding and prevention of adverse effects or any other medicine-related problems, including activities required to monitor the safety of medicinal products and other healthcare products during their use.
  • Adverse event means any untoward medical occurrence in a patient, clinical trial subject or user administered or exposed to a medicinal product or other relevant healthcare product, which does not necessarily have a causal relationship with that product. An adverse event may include any unfavourable and unintended sign, symptom, disease or abnormal laboratory finding temporally associated with the use of the product, whether or not considered related to it.
  • Product quality complaint means any written, electronic or oral communication indicating or alleging a potential deficiency or concern related to the identity, quality, durability, reliability, safety, effectiveness, performance, packaging, labelling or possible falsification of a product, including complaints that may contain safety information.
  • Medical information request means any unsolicited request from a healthcare professional, patient, consumer or other requester seeking scientific, medical or product-related information about a medicinal product, medical device or other relevant healthcare product, including information on use, safety, efficacy, dosage, administration, compatibility, interactions, product information or other clinically relevant aspects.

 

  1. Who is responsible for processing your personal data?

Depending on the circumstances, the controller may be:

  • the relevant Marketing Authorisation Holder (“MAH”);
  • a local EL PHARMA or PHOENIX group affiliate;


The entity responsible for processing your personal data depends on the relevant Product, Territory, applicable laws and the contractual arrangements. Where PV data is collected by EL PHARMA or another PHOENIX group Affiliate on behalf of a Marketing Authorisation Holder or other Partner, such data may be forwarded to the relevant Marketing Authorisation Holder, Partner or other responsible entity for pharmacovigilance assessment, processing and regulatory reporting.

Where EL PHARMA or a PHOENIX group Affiliate is subject to its own legal or regulatory reporting obligations, it may act as controller for the processing necessary to comply with those obligations. Personal data may also be shared with competent regulatory authorities, including competent national authorities, where required by applicable law.

  1. What personal data may we process?

 
Depending on the nature of the report or enquiry, we may process:

Information about the patient

When you (the patient) report Safety Information, we collect the following Personal Data:

  • patient’s initials;
  • patient’s contact details;
  • patient’s age or date of birth;
  • patient’s gender;
  • patient’s weight and height;
  • patient’s medical history, current illnesses, laboratory test results, concomitant medicinal products, etc.);
  • details on medicinal product involved (name, strength, indication, batch, expiry date, etc.);
  • patient’s dosing;
  • details related to the adverse event (i.e. ; Symptoms, Duration, etc.)
  • start date of the therapy and discontinuation date;
  • onset date of the adverse event;
  • treatment of the event;
  • outcome of the event (recovered/not recovered) and resolved date.

 

Information about the reporter

  • name and surname, where necessary to identify or contact the reporter;
  • reporter type, profession, occupation, country and/or relationship to the patient, where relevant;
  • contact details, such as e-mail address and/or telephone number, where needed for acknowledgement, assessment or follow-up;
  • postal address or other contact information, only where relevant for handling the report, enquiry, complaint or follow-up;
  • where the reporter is a healthcare professional, professional qualification, workplace or other information necessary to verify professional status, where relevant;
  • information needed to document the original source of safety information, such as whether the source is a healthcare professional, patient, consumer, regulatory authority, literature source or other reporter.
  • reporter contact details may be used for follow-up and may be shared with the relevant partner only where necessary and where appropriate data protection safeguards are in place.

 

Other information 

Any information voluntarily provided that is relevant for the assessment, follow-up, documentation, reporting or response to a safety report, medical information request or product quality complaint, including information contained in correspondence, forms, reports or supporting documentation.

Please provide only information that is relevant to the matter being reported.

  1. Legal basis for processing

 

Personal data

Where pharmacovigilance obligations apply, personal data is processed primarily on the basis of Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the relevant controller is subject. In addition, where EL PHARMA or another PHOENIX group Affiliate collects, processes or transfers PV data under a PVA/SDEA or other contractual arrangement with a Marketing Authorisation Holder or Partner, such processing may also be carried out for the purpose of fulfilling applicable contractual pharmacovigilance responsibilities and related legitimate interests.

Special categories of personal data

Where the information includes health data or other special categories of personal data, processing is carried out primarily on the basis of Article 9(2)(i) GDPR – processing necessary for reasons of public interest in the area of public health, including ensuring high standards of quality and safety of medicinal products.

Where relevant in individual cases, additional legal bases may apply, including Article 6(1)(f) GDPR where processing is necessary for legitimate interests, Article 6(1)(b) GDPR where processing is necessary to respond to a request, and Article 9(2)(f) GDPR where processing is necessary for the establishment, exercise or defence of legal claims.

Personal data processed for pharmacovigilance purposes will not be used for promotional purposes.

  1. Reporting adverse events, medical enquiries and quality complaints

 

When submitting a report, enquiry or complaint, please provide information that is accurate, complete and relevant to enable appropriate assessment, follow-up, documentation and reporting.

Please do not include information that is not relevant to the adverse event, medical information request or product quality complaint.

If additional information is required to assess the matter or comply with applicable safety or quality obligations, EL PHARMA or a relevant partner may contact you for follow-up.

 

  1. Who may receive your personal data?

 

Personal data may be disclosed, where necessary, to:

  • EL PHARMA’s Partners – Marketing Authorisation Holders;
  • EL PHARMA and PHOENIX group companies involved in pharmacovigilance activities;
  • Pharmacovigilance service providers acting on behalf of the relevant controller;
  • Competent regulatory authorities, including national competent authorities and the European Medicines Agency (EMA);
  • Pharmacovigilance reporting systems, including EudraVigilance where applicable;
  • Auditors, inspectors, legal advisers and other parties where required by law.
  • IT, database, hosting, archiving and other technical service providers supporting pharmacovigilance, medical information or quality complaint processes.

 

Recipients will receive only the information necessary for the relevant purpose and will be required to protect the data in accordance with applicable legal, contractual, confidentiality and internal policy requirements.

 

  1. International transfers of personal data

 

Pharmacovigilance activities may involve the exchange of safety information with Marketing Authorisation Holders, manufacturers, PHOENIX group affiliates, service providers and competent regulatory authorities in different countries. Where possible, personal data is processed within the European Union, the European Economic Area or countries recognized as providing an adequate level of data protection.

Where personal data must be transferred to a country that is not recognized as providing an adequate level of protection, the relevant controller or processor will implement appropriate safeguards in accordance with applicable data protection laws, such as the European Commission’s Standard Contractual Clauses or another legally recognized transfer mechanism.

 

  1. How long do we retain personal data?

 

Pharmacovigilance data and documents are retained in accordance with applicable EU GVP requirements, local company procedures and contractual obligations under the relevant PVA/SDEA. Unless a different retention period is required by applicable law, internal procedures or partner-specific contractual arrangements, pharmacovigilance source documents are retained for at least ten (10) years after expiry of the relevant Marketing Authorisation.

Records relating to medical information requests or product quality complaints that do not form part of a pharmacovigilance case may be subject to different retention periods, depending on applicable laws, contractual obligations, internal policies and the nature of the request or complaint.

 

  1. Your data protection rights

 

Subject to applicable law, you may have the following data protection rights in relation to your personal data:

  • the right to request access to your personal data;
  • the right to request rectification of inaccurate or incomplete personal data;
  • the right to request erasure of your personal data, where applicable;
  • the right to request restriction of processing, where applicable;
  • the right to object to processing, where applicable;
  • the right to data portability, where applicable; and
  • the right to lodge a complaint with a competent data protection supervisory authority.

 

Please note that some of these rights may not apply, or may be limited, where the processing of personal data is necessary to comply with pharmacovigilance obligations, product quality obligations, regulatory reporting duties, legal obligations, public health requirements or other applicable legal obligations.

Please note, that each request will be assessed individually in accordance with applicable data protection laws and internal procedures. Where the request relates to processing carried out by another controller, such as the relevant Marketing Authorisation Holder, manufacturer or other business partner, the request may be forwarded to that entity or handled in cooperation with that entity, as appropriate.

 

  1. Contact

 

For reporting suspected adverse events, submitting medical information requests or reporting product quality complaints, please use the relevant contact details made available on the Contact page of the applicable EL PHARMA or PHOENIX group website.

For any questions relating to data protection, including the exercise of your data protection rights, please refer to the Data Protection Officer contact addresses listed on the Contact page of the applicable EL PHARMA or PHOENIX group website.

Alternatively, you may contact us via the general EL PHARMA contact address at: representation@phoenixgroup.eu.

Your request will be assessed in accordance with applicable data protection laws and internal procedures. Where appropriate, your request may be forwarded to, or handled in cooperation with, the competent data protection contact, Data Protection Officer, Marketing Authorisation Holder, manufacturer or other responsible entity.

Where the relevant Marketing Authorisation Holder, manufacturer or other business partner is responsible for the processing of your personal data, please also refer to the privacy notice made available by that entity, where applicable.

 

  1. Changes to this Privacy Notice

 

This Privacy Notice may be amended where necessary to reflect changes in applicable laws, regulatory requirements, pharmacovigilance processes or internal procedures.

The version published on this website is the current version of the Privacy Notice.