Global drug safety privacy policy

Last update: May 2018

At Almirall, our commitment to the safety of our medicines, medical devices, cosmetics and healthcare products starts from the Research and Development (R&D) department and is maintained throughout the life of the product.

This Privacy Policy sets out the basis on which we collect Personal Data from you online, fax, e-mail, by phone, or post, as well as through any form available in any of our sites, or as part of the pharmacovigilance regulations applicable to us.  Some data about you might be communicated to us not directly by you, but by a third party (for instance, a healthcare professional) whenever they are reporting an adverse event that affected you.

For the purposes of this Privacy Policy:

- "Almirall",  "we", "us", "our" means Almirall, S.A. and/or its affiliated companies.

- "Personal Data" means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

- "Adverse Event" means a side effect occurring with a drug such as an undesired or unintended harmful event or a pregnancy in relation to the use of an Almirall product.

For more information about this document or how we process your Personal Data, you can contact our Global Data Protection Officer at the e-mail address dpo.global@almirall.com

1. Basic information

2. Additional information

2.1 Who is the controller of the data you provide?

For the purpose of the General Data Protection Regulations and any local applicable laws, the data controller of your Personal Data is the Almirall legal entity which gather your personal data in each case through any specific channel. Please find an updated list of all of our affiliates at https://www.almirall.com/our-purpose

Please note that data controller means the legal entity that decides the purposes and means of processing your Personal Data.

As part of our pharmacovigilance obligations we must review reports received from every country where we commercialize our products, either through our affiliates, either through partners and/or distributors. All the information about patients and notifiers whenever they are healthcare professionals are included, with the appropriate security measures, in our global drug safety database which is managed and maintained by the Spanish parent company Almirall, SA, with registered office at Ronda General Mitre, 151, 08022 Barcelona (Spain), fitted with CIF A-58869389 and registered in the Commercial Registry of Barcelona in Volume 21.795, Sheet 32, Page No. B-28.089. Personal Data from patients, especially in regards to health data provided, are duly anonymized.

The registration number of Almirall, S.A. in the Ministry of Health, Equality and Social Services is 1889E, and our contact telephone number is (+34) 93 291 30 00.

2.2. Which kind of Personal Data we process?

We may collect and process the following data about you:

a. If you are the notifier/reporter: we might collect contact Personal Data including your name or initials, surname, telephone number, contact e-mail and country.

b. If you are the patient and, therefore, the subject of the Adverse Event: We might collect the following Personal Data from you when you, or a third party (the "notifier") notifies us the occurrence of an Adverse Event: name or initials, surname, date of birth, gender, weight, type of adverse reaction and details associated with it, concomitant medication, relevant medical history or others. You or the third party might also provide us with other sensitive information.

The information we collect in both cases is the strictly necessary to identify you as notifier and/or to follow up the case and pursue the compliance of our pharmacovigilance obligations.

2.3. For what purposes do we need your Personal Data?

The Personal Data you provide us are collected in order to identify, quantify, evaluate and prevent potential risks arising from the use of our medicines, as well as follow-up of the specific case, if necessary, all in compliance with our legal obligations with the Competent Authorities in the field of pharmacovigilance, materiovigilance, cosmetovigilance and surveillance of healthcare products.

We will not use your data for any other purpose than those indicated above.

2.4. For how long will we keep your Personal Data?

The patient's personal data provided will be kept only for the time necessary to monitor the case according to its nature.

Once the follow-up of the reported case ends, the personal data are anonymized in a way that it is not possible to identify the patient, and they become part of our global database of pharmacovigilance, so the consideration of Personal Data ceases and, therefore, also the processing.

In relation to Personal Data of health care professional who report a side effect, they are kept during the commercial life of the product plus ten (10) years. 

2.5. Which is our lawfulness to process your Personal Data?

In this case, our lawfulness to process Personal Data of notifiers and patients is twofold. On the one hand, it is necessary for compliance by Almirall in the field of pharmacovigilance, materiovigilance, cosmetovigilance and surveillance of healthcare products and, on the other hand, pursues an aim of public interest in the area of health.

2.6. Are we going to share your Personal Data?

Except by legal obligation to share your Personal Data with Health Authorities or Public Administration, your Personal Data will not be disclosed to third parties. However, we may share your Personal Data with companies that help us to collect the Adverse Events, and follow up cases, anonymize the Personal Data when we include them into the global database, or other services strictly related to the purposes indicated above. With these companies we have signed an agreement for the provision of services that guarantees the confidentiality of the information and its processing in accordance with the applicable legislation.

Whenever information needs to be transferred to any recipient outside the European Economic Area to a country which has not received the decision of adequate level of protection issued by the European Commission, Personal Data will be duly protected by standard contractual clauses approved by the European Commission, or binding corporate rules of the data processor.

2.7. Which are your rights as data subject and how you can exercise them?

You have the right to access your Personal Data. In justified cases, you may also request the deletion, correction or limitation of the processing of your Personal Data. 

If you wish to make use of any of your rights you can contact the Department of Corporate Drug Safety of Almirall, S.A. by sending a written communication to Almirall, S.A., General Mitre, 151, 08022 Barcelona, or through our email address to dsafety@almirall.com. Remember to provide as much information as possible about your request so that we can identify you: Name and surnames, ID, email and description of the right you wish to exercise.

Finally, we inform you that you can contact the Spanish Data Protection Agency or any European supervisory entity for any claim arising from the processing of your Personal Data. You can find an updated list of such organizations by jurisdiction at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.