1. Responsibilities

1.1 Responsible person

Responsible for the processing of your personal data is:

Cheplapharm Switzerland LLC
Huebweg 18-20
4102 Binningen
Switzerland

1.2 Responsibilities

Medical and scientific affairs/pharmacovigilance

1.3 Contact details of the data protection advisor

André Weinert 
Wirtschaftskontor Weinert 
WKW Beratungsgesellschaft mbH
Beim Wendentor 1
18055 Rostock
Germany
Tel: +49 0381-8170820
E-Mail: datenschutz@cheplapharm.com

2. Information on the processing of personal data

2.1 Purpose of data processing

We process your personal data, to the extent necessary, for the following purpose(s):

• Personal data are collected and processed in order to answer and follow up on medical-scientific inquiries. The purpose of data storage is to collect and consolidate information and knowledge about the modes of action of medicinal products and medical devices, as well as to record, evaluate and prevent product complaints and adverse reaction reports. Data processing is carried out in the public interest and to safeguard public health.

The processing of personal data primarily serves the purpose of fulfilling our legal obligations. In addition, personal data may be processed on the basis of your consent or on the basis of our overriding or legitimate interests.

In the case of adverse reaction reports, personal data is processed to comply with applicable legal obligations in the area of drug safety. In the context of drug safety, there may also be a legal obligation to transmit data to health authorities.

2.2 Sources of personal data

We also process personal data that we receive from third parties, namely doctors, pharmacies and business partners.

2.3 Categories of personal data

If personal data are not obtained from the data subject, the data controller shall notify the data subject of the categories of personal data.

We obtain the following personal data from third parties:

• Initials of a name
• contact data (e-mail, telephone number, address)
• Purpose-related health data (e.g. date of birth/age, gender, height and body weight).

The duty to inform does not apply if the data subject already has the relevant information; the processing is provided for by law; the person responsible is a private person who is legally bound to secrecy or there is a case of restriction of the right to information for the media pursuant to Art. 27 FADP. If the personal data is not obtained from the data subject, the obligation to provide information also does not apply if the information is not possible or would require a disproportionate effort.

2.4 Storage duration

The storage period contains information about how long we will store your personal data or when it will be deleted.

• Because medical/scientific inquiries, product complaints and adverse reaction reports in the area of drug safety are made in the public interest and to safeguard public health, they are retained in accordance with applicable law.

In the area of drug safety, data on approved drugs are retained for as long as the drug is approved and for at least 10 years after the expiration of the approval. However, data must be retained longer if required by applicable law.

2.5 Automated decision making

As a responsible company, we do not use automated individual decision-making when collecting your personal data.

2.6 Data recipient

2.6.1 Disclosure of personal data outside the company / authority

The term "disclosure" is defined in Art. 5 lit. e FADP as "the transmission or making available of personal data".

In the public interest and to safeguard public health, we as a pharmaceutical company are required by law to forward relevant information to health authorities. The relevant information is forwarded to the national pharmacovigilance center of the Swiss Agency for Therapeutic Products, Swissmedic, and in some cases to their regional centers. The evaluated reports are entered into Swissmedic's national database in a completely anonymized form. Swissmedic, in turn, forwards all reports to the International Centre for Drug Safety of the World Health Organization (WHO). In the adverse reaction reports to the authorities, relevant information on the respective case is transmitted as a matter of priority. Personal data is only transmitted to a limited extent.

The following categories of personal data are transmitted:

• About the patient: earmarked health data (e.g. date of birth/age, gender, height and body weight), initials of a name, contact data (e-mail address, telephone number, addre
• About the reporter: Name, professional position, contact details (e-mail address, telephone number, address).

Data is transferred to business partners for the purpose of maintaining the pharmacovigilance database and within the scope of legal requirements.

Personal data may also be transferred to contractual partners in countries where data protection regulations differ from those in Switzerland and the level of data protection is lower or for which there is no adequacy decision by the Swiss Federal Council. In this case, contracts are concluded with EU standard contractual clauses adapted to Swiss law and agreements are made that provide adequate and appropriate guarantees for compliance with the applicable data protection regulations.
Your personal data will be transferred to Germany.

2.6.2 Intention to transfer to a third country or international organization

The transfer of personal data to an "international organization" or to controllers, order processors or other recipients in a country outside Switzerland, the European Union (EU) and the European Economic Area (EEA) entails particular data protection risks from the perspective of the data subject.

• We are required by law to submit relevant information to the Swissmedic Pharmacovigilance Center.

2.6.3 Adequacy decision of the Federal Council

Personal data may be disclosed abroad if the Federal Council has determined that the legislation of the state in question or the international body ensures adequate protection.

• We do not transfer your personal data to a country or international organization without an adequate level of data protection, without providing the necessary legal safeguards.

2.6.4 Guarantees and receipt of guarantees

If there is no adequacy decision by the Federal Council, personal data may be disclosed abroad if appropriate data protection is ensured by guarantees.

• We transfer your personal data to a recipient in a third country only after prior conclusion of EU standard contractual clauses adapted to Swiss law and approved by the European Commission.

3 Rights of the data subjects

3.1 Right to information

Any person may request information from the data controller as to whether personal data concerning him or her is being processed; if this is the case, he or she has a right to information about this personal data.

• You have the right to information about the personal data we process about you. In the case of a request for information that is not made in writing, we ask for your understanding that we may then require evidence from you that proves that you are the person you claim to be.

3.2 Right to rectification

The data subject may request that inaccurate personal data be corrected.

• You have a right to rectification, i.e. you can request us to correct your incorrect personal data without delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.

3.3 Right to deletion

The data subject shall have the right to request the data controller to delete relevant personal data without undue delay, and the data controller shall be obliged to delete personal data without undue delay.

You have the right to request that we delete your data immediately. We are obliged to delete personal data immediately if one of the following reasons applies:

• purposes for which the personal data was collected shall cease to apply.
• You revoke your consent to processing. There is no other legal basis for the processing.
• You object to the processing. There is no other legal basis for the processing.
• The personal data were processed unlawfully.
• The deletion of personal data is necessary to comply with a legal obligation under applicable law to which the controller is subject.
• The personal data was collected in relation to information society services offered.

3.4 Right to object to processing

The data subject has the right to object at any time to the processing of personal data concerning him or her.

• In particular, you have the right to object to the processing of your data in connection with direct marketing if this is carried out on the basis of a weighing of interests. For this purpose, please contact the person responsible for the processing.

3.5 Right to data portability

Any person may request from the data controller the release of his or her personal data disclosed to him or her in a commonly used electronic format, the data controller processes the data automatically and the data is processed with the consent of the data subject in direct connection with the conclusion or performance of a contract between the data controller and the data subject. The data subject may also, under the same conditions, request the controller to transfer his or her personal data to another controller, if this does not require a disproportionate effort.

• You have the right to receive the data you have provided in a structured, common and machine-readable format from the controller and to have it transferred to another controller.

3.6 Right to report to a supervisory authority

The data subject has the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC) if the person believes that the processing of your personal data violates data protection regulations, in particular the FADP.

Contact details of the FDPIC:
Federal Data Protection and Information Commissioner
Feldeggweg 1
3003 Bern