UK & Ireland Privacy Statement for interactions with healthcare professionals

Last updated: October 2023

UK & Ireland Privacy Statement for interactions with healthcare professionals

This document forms part of the overall Almirall Limited privacy statement and describes how we process personal data in relation to our interactions with healthcare professionals (HCPs).

If you have any questions regarding this privacy statement, you can contact our DPO at dpo.global@almirall.com.

1. Basic information

2. Additional Information

2.1. WHO IS THE CONTROLLER OF HCP’S DATA?

The data controller of your personal data is Almirall Limited, with registered address at Harman House, 1 George Street, Uxbridge, Middlesex, UB8 1QQ registered in England and Wales: company number 6320852.

For more information about this document or how we process your personal data, you can contact our Global Data Protection Officer at the e-mail address dpo.global@almirall.com.

You can contact Almirall Limited at the telephone number +44(0)2071602500.

If you are based in the EU and have any questions about our privacy statement, your rights regarding your personal data, or how we use your personal data, please do not hesitate to contact our appointed EU representative, Symmetry Solutions Ltd, at:

- Email: almirall@symmetrygroup.ie

- Post: FAO Almirall EU Rep, Symmetry Solutions Ltd, The Tara Building, 11-15 Tara Street, Dublin 2, D02RY83, Ireland.

2.2. WHAT PERSONAL DATA DO WE PROCESS?

We might collect and process the following data about HCPs:

a) Contact information: this category of personal data includes, for example, your name and surname, your professional address (workplace), your telephone number, your specialty, your email address, identification code, signature, and other contact information. You might have given us your information voluntarily by filling in a form, or from website cookies, or through our contact with you, or we might have extracted it from professional directories, or from other sources accessible to the public. The company IQVIA Information, S.A. also provides us with your contact information for the purposes indicated in section 2.3 below.

b) Information about you that we gather: we document and include in our customer relationship tools information about the visit or interaction with our sales representatives, about your interests, your interaction with us, your capacity to influence and decision making, etc.

c) Banking and financial information: this information is only processed if it is necessary to pay for your services or reimburse your expenses in relation to any specific activity.

d) Other professional information: such as publications, characteristics of clinical research activities, advisory boards, academic positions, honors, awards and other relevant professional information.

2.3. FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

We may process your personal data for one or more of the following purposes:

a) Interactions with our sales representatives and / or other Almirall representatives to provide you with information about our products / services and answer your specific questions on Medical Information and / or other general queries;

b) Invitations to scientific and/or medical education meetings / events, including Almirall owned meetings and those we sponsor, and which may be of interest to you;

c) Distribution of samples of our products;

d) Customising communications on Almirall products / services in line with your preferences, your specialty, professional habits, as well as the interest shown in our products;

e) Ensuring Almirall's regulatory compliance in pharmacovigilance matters. You can find more information within our UK & Ireland Drug Safety Privacy Statement.

f) Ensuring compliance with Almirall's transparency obligations in relation to transfers of value that we can make to you as a result of an activity or the provision of a service. In this case we will inform you in advance about the applicable privacy statement relevant to this particular data processing;

g) Recruitment and evaluation of suitability for participation in clinical trials and other research studies, advisory committees, presentations, provision of services, etc, to ensure Almirall complies with the Fair Market Value in relation to the fees related to these activities (Medical Tiering), in compliance with the legal obligations to which Almirall is subject, the codes of conduct to which Almirall is signatory and/or good market practices regarding the ethics standards in Almirall, as the case may be. This processing is used to match your data with the object of the engagement and determine the fair market value for any fees.

h) Carrying out surveys and market research activities related to the medical/health sector;

i) Sending you communications, by any channel, to inform you about Almirall products, services, activities, and / or news that may interest you. We can also conduct analytics to assess how you engage with our communications (for example, if you click on a link received). In relation to this purpose, if your data comes from your registration on any of our web pages or mobile applications, in each of them you will have provided the specific processing conditions and previously you will have given your specific consent for each of the purposes.

2.4. HOW LONG WILL WE STORE YOUR DATA?

As a principle, your data will be stored as long as it is necessary to fulfil the purposes identified in 2.3. above. This can be as long as it is correct and you remain linked to a health-related profession, for the period required by law or as required by the relevant pharmaceutical industry codes of practice, without prejudice to the fact that, due to legal requirements, this temporary period may be extended.

Particularly, for Medical Information and general enquiries, the personal data will be kept for the time necessary for resolution. After a maximum period of one (1) year following the provision of a response your personal data will be made unidentifiable. For Pharmacovigilance purposes, after the maximum period of one (1) year following the closure of the adverse event case, your data will be made unidentifiable. Data will be stored securely in line with legal requirements to which Almirall is subject. You can learn more in our UK & Ireland Drug Safety Privacy Statement.

2.5. WHICH IS OUR LAWFUL BASIS TO PROCESS YOUR PERSONAL DATA?

Our lawful basis to process your personal data, according to the specific purpose may be one of the following:

• Purposes (a), (b), (d) and (g): necessary for the achievement of the legitimate interest of the Controller, in particular.
  • Purpose (a): This purpose is based on the legitimate interest for contacting HCPs to schedule a visit to inform you about our products and services. This processing is beneficial for us, since it allows us to inform HCPs about our products and services, including offers, services and medical information.
    
    The processing is necessary, as well as proportionate, for contacting HCPs to inform them about our products and services.
    
    In addition, taking into account (i) the nature of the data, that is to say, identification and professional details about the HCPs; (ii) the way this data is processed to manage our relationship with those data subjects; and (iii) the reasonable expectation of this processing that the data subjects may have, we can conclude that the impact of this processing about the rights and freedoms of the data subjects is not invasive nor disproportionate.
  • Purpose (b): This purpose of processing your data in relation to the invitation of HCPs to scientific or medical meetings and training is based on the legitimate interest since it is a way for communicating information about our products and services, as well as promoting in the professional healthcare environment, creating in turn an “Almirall” community.
    
    This processing is also beneficial for the data subjects as they have the opportunity to increase their contacts network and to improve their knowledge by attending meetings and training.
    
    The processing activity is deemed as necessary and reasonable as it helps us to reach our objectives of marketing, taking into account (i) the nature of data, that is to say, identification and professional details about the HCPs; (ii) the way this data is processed to manage our relationship with those data subjects; and (iii) the reasonable expectation of this processing that the data subjects may have; We can conclude that the impact of this processing is not invasive nor disproportionate to the rights of the data subjects.
  • Purpose (d): To adapt our interaction and communications to the specialty, professional habits and interests expressed by the data subjects, through data obtained from internal sources is as well based on our legitimate interest. It facilitates a simpler, more efficient and personalized communication with HCPs, and to specify with more precision the products or services that are relevant to each one.
    
    This processing is also beneficial for these data subjects, since they have the opportunity to receive interactions and/or communications from us in a personalized way.
    
    The processing activity is deemed as necessary and reasonable, as it allows us to personalize our interactions and / or communications with HCPs, bearing in mind that (i) the creation of a profile is carried out with the data that we obtain only from our own sources; (ii) such data is processed in such a way that the communications are adapted to the preferences expressed by the data subjects; and, (iii) there is a reasonable expectation regarding this processing; We can conclude that the impact of this processing is not invasive nor disproportionate to the rights of the data subjects.
  • Purpose (g): Recruitment and evaluation of suitability for participation in clinical trials and other research studies, advisory committees, papers, provision of services etc. It is based on our legitimate interest to contact any of the HCPs with whom we interact for carrying out collaboration activities, such as getting your opinion in any study, promotion of our products and services, etc. and matching the payments to the Fair Market Value. However, in some countries, this processing activity may be based on the legal obligations to which Almirall is subject in the field of compliance with Fair Market Value with HealthCare Professionals, in attention to the applicable laws.
    
    This processing is also beneficial for these data subjects as they have the opportunity to participate in clinical trials and other research studies, advisory committees, etc. the processing is necessary since it allows us to contact HCPs for their participation in our research activities.
    
    Also, taking into account (i) the nature of the data, which are merely identifying and professional data of the data subjects; (ii) the way this data is processed to manage our contact and payments with them; and, (iii) the reasonable expectation regarding the processing; We can conclude that the impact of this processing is not invasive nor disproportionate to the rights of the data subjects.
• Purposes (c) and (h): The legal basis for such purposes is the consent given by the data subject. Such consent may have been given through a clear affirmative action that reflects a manifestation of free, specific, informed, and unequivocal will of the data subject to accept the data processing.
• Purpose (e): The legal basis for this purpose is the fulfilment of legal obligations, as well as public interest in health.
• Purpose (f): The legal basis for this purpose is legitimate interest based on Almirall’s duty to comply with the transparency obligations to which Almirall is subject as member of Pharmaceutical Industry Associations, both in the United Kingdom and Ireland. This processing is not only beneficial for Almirall, but also for the entire society, as the disclosure of the relationships between Almirall and HCPs enhances the transparency of the pharmaceutical industry towards patients and other stakeholders.
• Purpose (i): The legal basis for such purpose is the freely given consent by the data subject. Depending on the context, the legal basis may also be the fulfilment of contractual obligations or to manage pre-contractual relationships.

2.6. WITH WHOM WILL WE SHARE YOUR DATA?

Your data may be transferred to public bodies and authorities (administrative or judicial), as long as they are required in accordance with legal and regulatory provisions. Personal data regarding transfers of value will be disclosed as fully detailed in our privacy statement related to such processing which will be timely informed.

We may share your data with selected partners, who are third-parties contracted by us that help carry out the different purposes indicated in section 2.3 above. All such partners have signed a services agreement and / or data processing agreement to ensure that the processing of your data is on a secure and confidential basis, and in compliance with the legislation applicable at any time.

Whenever information needs to be transferred and that requires an International Transfer of personal data, Personal Data is duly protected by standard contractual clauses approved by the European Commission and/or UK standard contractual clauses, binding corporate rules of the data processor or other mechanisms that ensure appropriate safeguards for international transfers.

2.7. WHAT RIGHTS DO YOU HAVE IN RELATION TO YOUR PERSONAL DATA AND HOW CAN YOU EXERCISE THEM?

(i) Your right to be informed:

This privacy statement provides you with information on the purpose for processing your personal data. This includes the right to be informed about the source of personal data if we hold it through engagement of a third party (such as the Onekey database controlled by the company IQVIA).

(ii) Your right of access:
You have the right to obtain confirmation that your personal data is being processed, have access to your personal data, and other supplementary information – (as provided in this legally compliant privacy notice). Accordingly, Almirall will provide details of the information we hold about you on request.

(iii) Your right to rectification:
Almirall will rectify any personal data that is inaccurate or incomplete. If any inaccurate personal data has been disclosed to third parties, Almirall will inform them of the rectification where possible.

(iv) Your right to erasure:
You have a right to have your personal data erased and to prevent processing in specific circumstances, as set out under the GDPR. For example, where the personal data is no longer necessary in relation to the purpose for which it was originally collected / processed or when you withdraw consent or when you object to the processing and there is no overriding legitimate interest for continuing Almirall’s processing.

(v) Your right to limit or restrict processing:
You can require Almirall to restrict the processing of your personal data, for example where you contest the accuracy of the contact date used. In such case, Almirall will pause, continue to store the data but do nothing else with it, and will re-consider the processing and the accuracy of the data.

(vi) Your rights in relation to profiling:
You have the right not to be subject to solely automated decisions and if Almirall makes any such automated decisions, you have a right to have a person review the decision.

(vii) Your right to data portability:
This refers to your right to obtain a transferable copy of your information we hold on our servers and databases so you or we can move it to another data controller or location.

(viii) Your right to object:
You have the absolute right to object to processing of your personal data if it is for direct marketing. This is not something Almirall intends to do often but is listed as one of our business purposes at clause 2.3 above. Linked to this you have a contingent right to object to the processing of data where the processing is based on either the conditions of public interest or our legitimate business interests. Furthermore, you have the right to prevent processing that is likely to cause unwarranted substantial damage or distress to you.

To exercise your rights, you can send a written request addressed to Almirall Ltd, Harman House, 1 George Street, Middlesex, Uxbridge UB8 1QQ.

You can contact the Information Commissioner’s Office (ICO); https://ico.org.uk or any European supervisory entity for any claim arising from the processing of your personal data. You can find an updated list of said organisations by jurisdiction at https://edpb.europa.eu/about-edpb/about-edpb/members_en.