Privacy Statement for Pharmacovigilance Data

Bayer takes product safety and your privacy seriously

Bayer Middle East FZE, Dubai, U.A.E (hereinafter “Bayer”, “us”, “our” and “we”) develops and markets prescription and over the counter medicines as well as medical devices and cosmetics, for human and veterinary use (“Bayer Health Products”). As a pharmaceutical company, Bayer has a legal responsibility to monitor the safety of all Bayer Health Products worldwide that we have in development or are marketing in any country.

Humans and animals vary in their biological reactions to medicinal products or medical devices and not all adverse reactions or events (side effects) associated with the use of medicinal products and medical devices can be detected during clinical development, not even by the most comprehensive clinical trials. Capturing adverse events, however rare they may be in absolute terms, in the development and marketing phase from worldwide sources is of paramount importance.

Such monitoring of adverse events is called Pharmacovigilance (“PV”). PV requirements exist to allow us and competent regulatory authorities (such as the European Medicines Agency and other authorities) to manage adverse events and to protect public health and ensure high standards of quality and the safety of Bayer Health Products.

Our Pharmacovigilance obligations require us to process certain information, which allow to directly or indirectly identify a person, (“Personal Data”) of a patient and/or the reporter of an adverse event that we receive in order to comply with strict obligations to perform benefit-/risk assessments of Bayer Health Products continuously and report suspected adverse reactions or events to relevant regulatory authorities.

This Pharmacovigilance Privacy Statement (“Statement”) provides important information to you about how we process Personal Data for PV purposes, in line with our obligations under applicable data privacy laws and in particular the EU General Data Protection Regulation ((EU) 2016/679) (“GDPR”).

All Personal Data is processed exclusively for PV purposes and only where relevant and appropriate to document, assess and report your adverse event properly in accordance with our Pharmacovigilance obligations.

If you have any questions about this Statement or about how we use your Personal Data, please contact us via our contact details at the end of this Statement.

1. Categories of Personal Data

We may need to process (includes collecting, storing or otherwise using) the following Personal Data:.

I. About the Patient

• patient name and / or initials;
• date of birth / age group, sex, weight, height;
• information about health, racial or ethnic origin and sexual life;
• medical history and status, which may for example include:
  
  • details of the Bayer Health Product suspected to cause the adverse event, including the dosage you have been taking or were prescribed, the reason you have been taking or were prescribed the Bayer Health Product and any subsequent change to your usual regimen;
  • details of other medicines or remedies you are taking or were taking at the time of the adverse event, including the dosage you have been taking or were prescribed, the period of time you were taking that medicine, the reason you have been taking that medicine and any subsequent change to your regimen;
  • details of the adverse event you suffered, the treatment you received for that event, and any potential long-term effects the adverse event has caused to your health; and other medical history considered relevant by the reporter, including documents such as lab reports, medication histories and patient histories.

II. About the Reporter:

• name;
• contact details (which may include your address, e-mail address, phone number or fax number);
• profession (this information may determine the questions you are asked about an adverse event, depending on your assumed level of medical knowledge); and
• relationship with the subject of the report.

2. Purpose of processing (“PV Purposes”)

As part of meeting our Pharmacovigilance obligations, we may process Personal Data to:

• investigate the adverse event;
• contact you for further information about the adverse event you reported;
• collate the information about the adverse event with information about other adverse events received by Bayer to analyze the safety of a production batch, Bayer Health Product or active ingredient as a whole; and
• provide mandatory reports to national and/or regional competent regulatory authorities so that they can analyze the safety of a production batch, Bayer Health Product, generic or active ingredient as a whole.

3. Transfer of personal data

As part of meeting our Pharmacovigilance obligations, we may share and/or disclose Personal Data:

• within the Bayer Group in order to analyse and process a reported adverse event;
• with competent regulatory authorities, in respect of a suspected adverse event;
• with third party service providers of the Bayer Group; these service providers may include safety database providers, call centre operators, and in the event that you disclose details of your suspected adverse reaction to our market researchers, that particular market research provider. Please note that we have appropriate data protection safeguards in place with our service providers with whom the Bayer Group shares Personal Data and who are providing services or functions on our behalf;
• with other pharmaceutical companies who are our co-marketing, co-distribution, or other license partners of the Bayer Group, where pharmacovigilance obligations for a Bayer Health Product require such exchange of safety information. Please note that we have appropriate data protection safeguards in place with such business partners with whom the Bayer Group shares Personal Data and who are providing services or functions on our behalf;
• with a third party successor in business in the event of a sale, assignment or transfer of a specific Bayer Health Product, related project or therapeutic area, in which case we would require the buyer, assignee or transferee to treat that Personal Data in accordance with applicable data protection laws;
• when publishing information about adverse events (such as case studies and summaries); in such cases, we will remove identifiers from any publication to keep your identity private.

I. Third countries

Our Pharmacovigilance databases are hosted in Germany by Bayer. However, we may need to transfer your Personal Data to other members of the Bayer Group or to third party business partners and regulatory bodies. These may be based outside of the European Economic Area (“EEA”) in a country for which the European Commission has not decided that it ensures an adequate level of data protection (“Third Country”).

Whenever we need to transfer your Personal Data for the PV Purposes to a third party business partner located in a Third Country, we apply standard data protection clauses adopted by the European Commission as appropriate safeguards. You can obtain a copy of them by contacting our Data Privacy Officer using the contact details set out below.

4. Keeping your Personal Data secure

We have implemented appropriate state of the art technical and organisational measures to safeguard Personal Data processed for the PV Purposes, including safeguards and procedures designed to restrict access to Personal Data to those employees who need it to perform their job responsibilities.

We maintain physical, electronic and procedural measures to safeguard Personal Data from accidental loss, destruction or damage and unauthorised access, use and disclosure.

Where reasonably possibly, we process Personal Data in key coded/pseudonymized form.

5. Retention periods

We will use and store your Personal Data in accordance with mandatory legal requirements governing storage and reporting of Pharmacovigilance related information. Such mandatory requirements oblige us to archive PV information which may include Personal Data at least for the duration of the product life-cycle and for an additional ten years after the respective medicinal product and medical devices has been taken from the market.

6. Legal basis for processing your personal data

Bayer processes PV relevant Personal Data, including special categories of personal data, in accordance with the GDPR

• to comply with legal obligations under applicable Pharmacovigilance laws and regulations and its legitimate interests in ensuring the PV Purposes (Art 6 GDPR),

considering that

• PV EU or Member State law has been issued for reasons of substantial public interest in the area of public health and safety of medicinal products or medical devices (Art 9 GDPR).

7. Information regarding your rights

You have the right to:

• request information about your Personal Data processed by Bayer;
• request correction of your Personal Data if incorrect or incomplete. During the assessment of this request, you have the right to restrict the processing of your Personal Data;
• request transfer of your Personal Data to you or another person in a commonly utilizable format;
• file a complaint with a data protection authority;
• object to processing of your Personal Data as far as such processing is only based on Bayer’s legitimate interest.
• request the deletion of your Personal Data if they are no longer necessary for the purposes of processing or there is no legal ground for their further processing.

Please note however, that these rights may be limited in order to fulfil Pharmacovigilance obligations. Your rights are limited where there is a legal ground for processing your Personal Data, for example we cannot delete information that has been collected as part of an adverse event report unless it is inaccurate. We may require you to provide proper identification before we comply with any request to access or correct your Personal Data.

8. Contact

For any questions you may have with respect to data privacy for pharmacovigilance data or data privacy in general, please contact our company data protection officer via email or at the following address:

Data Protection Officer of Bayer Middle East FZE:
Bayer Middle East FZE
Office Park Building Block B, 5th Floor
PO BOX 500829, Dubai, United Arab Emirates

Further and general information about data privacy at Bayer you will find in the Privacy Statement.