This Privacy Notice is addressed to:

  • the adverse event reporters providing patient safety information concerning our products.
  • individuals requesting medical information or submitting quality complaints; and
  • individuals that are the subject of adverse events, medical information queries, product quality complaints, and legal investigations or proceedings

This notice provides you with information on how Novartis Pharmaceuticals (HK) Limited (hereinafter: “Novartis”, “we”, “our” or “us”) processes your personal data acting as a data controller. Novartis is committed to protecting your personal information and to being transparent about the information we are collecting and what we do with it. We invite you to read this Privacy Notice carefully, as it contains important information for you.

What Personal Data do we process, for which purpose and why is this justified?

We process your Personal Data for the purposes of monitoring the safety of medicinal products and medical devices, which includes detecting, assessing and preventing adverse events and reporting to health authorities and for any other purposes imposed by law and authorities. The processing of your Personal Data is based on our legal obligations regarding the safety of medicinal products and medical devices.

If you report an adverse event concerning one of our products, we will ask for your name and contact details in order to be able to contact you in case additional information is needed and/or to respond to your report. We will also collect information about your qualification in case you are a healthcare professional. Depending on your adverse event report and if necessary for the assessment, we may also process the following data categories:

  • Patient identification data, such as: number, identification code, demographic information (age, year or date of birth, sex, weight, height);
  • Health data: treatments administered, examination results, nature of the adverse effect(s), personal or family history, diseases or associated events, risk factors; information on how the prescribes medicines were used as well as the therapy management.

Additionally, if necessary for an adverse event assessment we may also collect and process:

  • Information on ancestry and descent of the person, whether it is a newborn, information on pregnancy and/or breastfeeding;
  • Occupational data: current and past occupations;
  • Information regarding consumption of tobacco, alcohol, drugs;
  • Information on lifestyle, life habits and behaviors, including, e.g., dependency, physical exercise (intensity, frequency, duration), diet and eating behavior, sex life;
  • Ethnicity, in cases where the Summary of Product Characteristics (SmPC) includes specific information relating to the ethnic origin and according to the criteria defined in the SmPC.

Who has access to your Personal Data?

We will not share, or otherwise transfer your Personal Data to third parties other than those indicated in this Privacy Notice. In the course of our activities and for the same purposes as those listed in this Privacy Notice, your Personal Data can be accessed by, or transferred to:

  • The Head of Patient Safety and their teams;
  • The general manager and their representatives, within the limits of their attributions;
  • Members of the legal and regulatory affairs department, depending on their responsibility;
  • Audit department to check compliance with regulatory or internal requirements;
  • Other Novartis Group companies;
  • Other pharma companies whose product may be at stake (without disclosing your identity);
  • Health care providers concerned by the report;
  • Service providers acting on behalf of Novartis, such as providers of IT systems, hosting providers and adverse events processing services (e.g., translation services).

The above third parties are contractually obliged to protect the confidentiality and security of your Personal Data, in compliance with applicable law. Your Personal Data can also be accessed by or transferred to the Department of Health or international regulatory, enforcement, or other authorities where we are required by applicable law or at their request. Your Personal Data may also be processed, accessed or stored in a country or region outside of the country/region where you are located. If we transfer your Personal Data to external companies in other jurisdictions, we will make sure to protect your Personal Data by (i) applying the level of protection required under the local data protection/privacy laws applicable to the exporting Novartis entity, and (ii) acting in accordance with our policies and standards.

How long do we store your Personal Data?

We will take all the reasonably measures to protect your Personal Data. Additionally, we only store Personal Data for a as long as we reasonably consider necessary for achieving the purposes set out in this Privacy Notice and as it is required and/or permissible under applicable laws.

How do we deal with children’s information?

We do not knowingly collect Personal Data from children under the age of 18 without obtaining prior consent from a person with parental responsibility (e.g. a parent or legal guardian), other than to inform the child that we must have parental consent before collecting personal information.

What are your rights and how can you exercise them?

Under the conditions provided for by the applicable regulation, you have the right to:

  • Access your Personal Data as processed by us;
  • Ask for correction or erasure of your Personal Data;
  • Request the restriction of processing of your data to specific categories of processing;
  • File a complaint with the competent data protection authorities.

You may request the deletion of your Personal Data, but Novartis might have a legal obligation to maintain such data, so these requests might not always be fulfilled.

If you have questions regarding how we use your Personal Data or if you wish to exercise the above rights, please email us at [email protected].

We may change or update this Privacy Notice by publishing a new version on this website.