September 2024

This Privacy Notice is addressed to:

  • individuals reporting adverse events/special case scenarios, providing safety information concerning our products, requesting general medical information, and submitting product quality complaints; and
  • individuals that are the subject of adverse events/special case scenarios, medical information queries, and product quality complaints.
     

Novartis is committed to protecting personal information and being transparent about its collection and use. This notice provides you with information on how Novartis Pharmaceuticals Canada Inc.  and/or its affiliates which act as Marketing Authorization Holders for medicinal products (“Novartis”, “we” or “us”) process personal information. 

We invite you to read this Privacy Notice carefully. Should you have any further question, we invite you to contact our Privacy Officer at [email protected].

Definitions

“Applicable Privacy Laws” means any legislation, regulation, recommendation or opinion applicable to privacy and the protection of Personal Information, including, where applicable, the Act Respecting the Protection of Personal Information in the Private Sector (Québec), Personal Information Protection and Electronic Documents Act (Canada) as well as any other applicable legislation, regulation, recommendation or opinion replacing, adding to or amending, extending, reconstituting or consolidating the Applicable Privacy Laws.

“personal information” means any information which relates to a person and allows that person to be identified either directly or indirectly. 

“Products” means all treatments we currently offer via our Innovative Medicines Division.

What personal information do we collect and use and how?

For the purposes listed in this Privacy Notice, we collect and use the following categories of personal information:

  • information about individuals that report adverse events or a special case scenario (such as exposure during pregnancy, breastfeeding, overdose, lack of efficacy, etc.) or make medical information queries or product quality complaints, including healthcare professionals and careers. This allows us to respond to queries and seek additional information as needed. The data we collect may include your name, email and/or postal address, phone number, and, for healthcare professionals, place of work  and information in order to confirm that you are a healthcare professional;
  • patients details, including name, hospital record numbers, age or date of birth, sex, weight, height, race, whether pregnant and/or breastfeeding, ethnicity (where the Summary of Product Characteristics includes specific information relating to ethnic origin), and occupational data (where this is strictly necessary for the evaluation of the adverse event); and 
  • where strictly necessary and relevant for the purposes described in this Privacy Notice, patient health and lifestyle information, including but not limited to nature of adverse effects, examination results, personal or family medical history, diseases or associated events, risk factors, information about the use of medicines and therapy management, physical exercise, diet and eating behaviour, sexual life/contraception, and consumption of tobacco, alcohol, and drugs.
     

Minors’ personal information

If your child has submitted personal information and you would like to request that such personal information be deleted, please contact us as explained below under How can you contact us? [NTD: Insert link to the section.]

How do we obtain your consent?

We collect, use and disclose your personal information with your consent or as permitted or required by law. How we obtain your consent (that is, in what manner) will depend on the circumstances, as well as the sensitivity of the information collected.

Your consent may be express or implied, depending on the circumstances and the sensitivity of the personal information in question.If you choose to provide personal information to us, we assume that you consent to the collection, use and disclosure of your personal information as outlined in this Privacy Notice.

Typically, we will seek your consent at the time your personal information is collected. Where we want to use your personal information for a purpose not previously identified to you in this Privacy Notice, we will seek your consent prior to our use of such information for this new purpose.

If you provide personal information about another individual to us, you are responsible for obtaining their consent to enable us to collect, use and disclose their information in accordance with this Privacy Notice.

You may withdraw your consent to our collection, use or disclosure of your personal information at any time by contacting us using the contact information in the “What are your rights and how can you exercise them?” [NTD: Insert link to the section.] section below. However, before we implement the withdrawal of consent, we may require proof of your identity. In some cases, withdrawal of your consent may mean that we will no longer be able to provide certain Products.

Why do we collect and use personal information?

We process personal information for the purposes below, and we do not process personal information unless we have a proper justification in law

Purposes

Monitoring the safety of medicinal products and medical devices, which includes detecting, assessing, following up on, and preventing adverse events, and reporting adverse events to health authorities.

Responding to medical information queries, for example in relation to availability of products, clinical data, dosing and administration, formulation and stability, and interactions with other drugs, foods, and conditions.

Responding to quality complaints regarding our products, such as any fault of quality and/or effectiveness, stability, reliability, safety, performance, or usage.

Performing non-interventional studies using safety monitoring data to evaluate the reproductive toxicity risk when a product might be used during pregnancy. For this purpose, we may periodically follow up with relevant healthcare professionals to collect information on the outcome of the pregnancy and the development of the child after birth.

Answering other questions or requests and improving our products and services.

Complying with our policies and legal, regulatory, and compliance requirements, as well as conducting audits and defending litigation.

 

Please note that in some countries, consent is the basis on which personal information is processed.

Who has access to personal information?

We do not share or otherwise transfer personal information to third parties other than those indicated in this Privacy Notice.

In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal information can be accessed by, or transferred to the following categories of recipients, on a need to know basis to achieve such purposes

  • our personnel (including those in our Patient Safety, Medical Information, Quality Assurance, and Legal departments) and other Novartis Group companies;
  • other pharmaceutical and medical device companies, if the adverse event, request for information, or complaint relates to one of their products; and
  • service providers acting on behalf of Novartis companies, such as IT system and data hosting providers, and adverse event processing service providers (including call centre providers). These third parties are contractually obliged to protect the confidentiality and security of personal information, in compliance with applicable law. We also require that they only use your personal information for the limited purposes for which it is provided. When our service providers no longer need your personal information for those limited purposes, we require that they dispose of the personal information. In some circumstances, we may permit our service providers to retain aggregated, anonymized or statistical information that does not identify you.  We do not authorize the service providers to disclose your personal information to unauthorized parties or to use your personal information for their direct marketing purposes. 
  • healthcare professionals involved in an adverse event, request for information, or complaint;
  • health authorities including Health Canada, the European Medicines Agency (EMA) which controls the EU EudraVigilance database (https://www.ema.europa.eu), as well as the US Federal Drug Agency (FDA); and
  • a national and/or international regulatory, enforcement, public body or court where we are required to do so by applicable law or regulation or at their request, including public and government authorities outside your country of residence.
     

Additionally, we may use and disclose your personal information when we believe such use or disclosure is permitted, necessary or appropriate: 

  • under applicable law, including laws outside your country of residence; 
  • to comply with legal requirements;
  • to enforce the terms of the agreements for our products and services;
  • to protect our operations or those of any of our affiliates or subsidiaries; 
  • to protect our rights, privacy, safety or property, and/or those of our affiliates, you or others; and
  • to allow us to pursue available remedies or limit the damages that we may sustain. 
     

In addition, we may transfer your personal information and other information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries or other assets.

If we otherwise intend to disclose your personal information to a third party, we will identify that third party and the purpose for the disclosure, and obtain your consent.

Where is personal information stored?

Personal information may be processed, accessed, or stored in a country outside the country or province where you are located. While such information is outside of your country, it is subject to the laws of the country, or province, in which it is located, which may not offer the same level of protection of personal information, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country or province.

If we transfer personal information to external companies in other jurisdictions, we will protect personal information by applying the level of protection required under the Applicable Data Privacy Laws;(ii) acting in accordance with our policies and standards.

You may request additional information in relation to international transfers of personal information and obtain a copy of the adequate safeguard put in place by exercising your rights as set out below.

How long do we store personal information?

We will only store the above personal information for as long as necessary for achieving the purposes set out in this Privacy Notice or as permitted under applicable laws.

How do we protect your personal information?

We have implemented the organizational, technical, and administrative security measures necessary to ensure the protection of the personal information under our control and that are reasonable given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored. However, you are solely responsible for implementing safeguards to protect the security and integrity of your computer system.

Unfortunately, no data transmission or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us in accordance with the How can you contact us? [NTD: Insert link to the section.] section below.

What are your rights and how can you exercise them?

Depending on the Applicable Privacy Laws, you have the right to:

  • access your personal information and, if you believe that it is incorrect, obsolete or incomplete, to request that it is corrected or updated;
  • request the erasure or the de-indexation of, of your personal information;
  • if the processing is based on your consent, to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
  • request portability of your personal information (i.e. for it to be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format).We may apply exceptions to these rights where appropriate and in accordance with local law.
     

If you have a question or want to exercise the above rights, please click here.

If you are not satisfied with how we process your personal information, please address your request to our at [email protected], who will investigate your concern.

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.

How can you contact us?

If you want to contact our Data Protection Officer, please email us at: [email protected] or write to Data Privacy Office, Novartis Pharmaceuticals Canada, 700 St-Hubert, Montreal, Quebec, H2Y 0C1

Updates to this policy

This Privacy Notice was last updated in September 2024.

We may change this Privacy Notice. Changes or additions will be notified through our usual communication channels (e.g. via our website) and will become effective immediately.