PRIVACY NOTICE – CHIESI.COM
Under Article 13 of Regulation (EU) 2016/679 on the protection of individuals regarding the processing of personal data (hereinafter "GDPR")

Dear User,

This privacy notice is provided by Chiesi Farmaceutici S.p.A., including its affiliates (together “Chiesi

Group“ or “Chiesi”) in compliance with the applicable privacy regulations and is aimed at informing you on how we process your personal data upon submission of request for medical information.

The independent data controller of your personal data is the company of the Chiesi Group based in the country that you select during the submission of your request, in accordance with table n. 1 of this privacy notice.

If you are submitting your request to a Chiesi Group company based in the European Union, your data will be processed according to Regulation (EU) 679/2016 (“GDPR”).

PURPOSES OF THE PROCESSING AND TYPES OF DATA PROCESSED

Your personal data will be processed to handle and respond to your medical information request. For example, you may submit questions about therapeutic indications, drug interactions, ingredients, storage conditions or request for available scientific evidence on a topic to assist clinical decision making.

For the above-mentioned purposes, Chiesi will process only your identification data (e.g., name, surname, e-mail, country, your role – i.e., nurse, patient, caregiver, healthcare professional, other – and, in some countries i.e., Spain, your phone number and your city) and any other information voluntarily included in your Request.

Except for pharmacovigilance purposes, the processing of so-called special data as defined by art. 9 of the GDPR (such as data relating to health) and / or data relating to minors is expressly excluded. More information about the processing of personal data for pharmacovigilance purposes is available here.

LEGAL BASIS OF THE PROCESSING:

The provision of your data, for the aforementioned purposes, is optional but necessary to allow us to respond to your request. Therefore, any refusal to provide such data will make it impossible for Chiesi to handle your request.

We also inform you that your consent represents the legal ground for the processing. Moreover, your data could be processed even without your prior consent, to fulfil legal obligations (in case of pharmacovigilance obligations), to comply with laws and regulations, enforce or defend Chiesi’s rights in court, pursue legitimate interests.

 HOW WE SHARE YOUR PERSONAL DATA

Chiesi may share your Personal Data with other companies, organizations, and individuals if any of the following circumstances occur:

• With your express consent: after obtaining your consent, we may share your Personal Data with certain third parties or categories of third parties;
• In compliance with laws and regulations: we may share your Personal Data if required under the applicable laws and regulations to handle legal disputes or requests by administrative or judicial authorities;
• With service providers: we may also disclose your Personal Data to companies providing services to us or on our behalf.

In the latter case, Chiesi will ensure the legitimacy of such processing and will sign appropriate data processing agreements with the relevant companies, organizations, and individuals with whom your Personal Data will be shared, requiring them to comply with applicable privacy laws, principles herein included, and implement appropriate security measures.

How We Protect Your Personal Data

The security of your Personal Data is our priority. Chiesi implements appropriate security measures to safeguard your Personal Data against unauthorized access, disclosure, or loss, including:

• Reasonable measures to ensure that Personal Data is collected in compliance with the minimization and purpose limitation principles. We retain your Personal Data for a limited time as specified in the following section unless an extension of the retention period is required or permitted by law;
• A set of technologies to ensure the confidentiality of Personal Data, ranging from encryption, strong passwords, two-factor authentication to firewalls and dedicated software to protect servers from external attacks;
• Selection of our business partners and service providers based on strict qualification criteria and obligation to comply with our Personal Data protection standards secured through specific contractually binding provisions. In addition, we perform audits and other assessments to verify their compliance with the above requirements;
• We conduct privacy and data protection training, carry out tests to verify subject matter knowledge, and other activities to increase awareness of Personal Data protection among employees and contractors.

RETENTION PERIOD OF YOUR PERSONAL DATA

Your Personal Data are processed through electronic, digital, and physical means in compliance with the lawfulness, fairness, transparency and the other principles set forth by the applicable data protection law, including data minimization and storage limitation principles.

We keep your Personal Data until we address your Request and for no more than the time necessary to manage all the activities connected to it, in any case for the maximum period of 10 (ten) years.

Information related to pharmacovigilance and adverse events is kept for minimum of ten (10) years after the withdrawal of the medicinal product in the last country where the product is marketed, as per EMA GVP Guidelines Module I “PV Systems and their quality systems” (ref. § I.C.1.4 “Specific quality system processes of the marketing authorisation holder in the EU”). After these periods, your Personal Data will be deleted or made anonymous unless otherwise provided for by law.

USERS RIGHTS

Access, rectification, cancellation, data portability, restriction of processing, objection to processing, and revocation of consent.

Chiesi provides specific channels so that you can access, modify, oppose and/or limit the processing of your data, as well as request their cancellation or portability to other parties and revoke your consent.

We invite you to contact the Data Protection Officer (DPO) to obtain the list of data processors, obtain the list of parties with whom your data has been shared and request the exercise of your rights listed above. DPO contact details are available in the table below, divided by country. 

If you believe that Chiesi is not processing your Personal Data in accordance with this notice or applicable law, you may exercise your rights by lodging a complaint with your country Data Protection Authority.

For further information about Chiesi’s privacy policy, please click on the following link.

TABLE 1