Global privacy policy for the interaction with healthcare professionals

Date of update: January 2024

This document describes how we process personal data in Almirall Group in our interaction with healthcare professionals and health managers.

The first section consists of basic information that you should know. In the second section you can find additional information that broadens and complements the basic information.

If you have any questions regarding this privacy statement, you can contact our Data Protection Officer at dpo.global@almirall.com.

1. Basic information

2. Additional information

2.1. WHO IS THE CONTROLLER OF THE HEALTHCARE PROFESSIONALS AND HEALTH MANAGERS' PERSONAL DATA?

The controller is the legal entity belonging to the Almirall’s group that operates in each of the jurisdictions where the healthcare professional and / or the health managers has his/her professional address. You can find an updated list and contact information for each of our subsidiaries on our corporate website by clicking on the following link: https://www.almirall.com/our-purpose.

Almirall parent company is Almirall S.A, a Spanish company with registered office at Ronda General Mitre 151, 08022 Barcelona, with VAT number A-58869389, registered at the Companies Registry of Barcelona at Volume 21795, Sheet 32, Page no. B-28.089 and with the Ministry for Health and Consumer Affairs Registration Number - 1889E.

You can contact Us at the telephone number (+34) 93 291 30 00.

You can get in contact with our Data Protection Officer at dpo.global@almirall.com.

2.2. WHAT PERSONAL DATA DO WE PROCESS?

The personal data that we store and process for the purposes indicated in the following section are:

a) Contact information: this category of personal data includes, for example, your name and surname, your professional address (workplace), your telephone and fax number, your specialty, as well as your email address, identification code, your signature and other contact information. You might have given us voluntarily your information by filling in a form, either through our contact with you, or we might have extracted it from professional directories, or from other sources accessible to the public. The company IQVIA Information, S.A. also provides us your contact information for the purposes indicated in the following section.

b) Information about you that we gather: we document and include in our customer relationship tools, information about the visit by our sales representative, about your interests, your interaction with us, your capacity for influence and decision, etc.

c) Banking and financial information: this information is only processed if it is necessary to pay for your services or reimburse your expenses in relation to any specific activity.

d) Other Professional information: such as publications, characteristics of clinical research activities, advisory boards, academic positions, honors, awards and other relevant professional information.

2.3. FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

We process your data in order to manage our relationship with healthcare professionals and health managers, including:

a) Visit of our sales representatives and/or other Almirall representatives to provide you with updated information about our products and our services and answer your specific questions on medical information;

b) Invitations to scientific meetings and/or medical education activities, both our own and those we sponsor and consider that may be of your interest;

c) Distribution of free samples of our products;

d) Adapt our interaction and previous communications based on your specialty, professional habits, as well as the interest shown in our products;

e) Ensuring Almirall's regulatory compliance in pharmacovigilance matters. In relation to this purpose, you can find more information by visiting our website www.almirall.com and accessing our Global Pharmacovigilance Statement;

f) Ensuring compliance with Almirall's legal or deontological obligations regarding transparency in relation to Transfers of Value (TOV) that we can make in your favor as a result of an activity or the provision of a service. In this case we will prior inform you in advance about the applicable privacy statement to this particular data processing;

g) Recruitment and evaluation of suitability for participation in clinical trials and other research studies, advisory committees, presentations, provision of services, etc, to ensure Almirall complies with the Fair Market Value in relation to the fees related to these activities (Medical Tiering), in compliance with the legal obligations to which Almirall is subject, the codes of conduct to which Almirall is signatory or good market practices regarding the ethics standards in Almirall, as the case may be. This processing permits to match your data with the object of the engagement with you and determine the fair market value for any fees.

h) Carrying out surveys and market studies related to the medical/health sector;

i) Sending communications by electronic media and direct marketing, by any channel, to healthcare professionals to inform about new products and new approved indications of existing products, news or Almirall activities that may be of your interest. In this sense, we can also analyze the use you make of them (for example, if you click on the links received). In relation to this purpose, if your data comes from your registration on any of our web pages or mobile applications, in each of them you will have provided the specific processing conditions and previously you will have given your specific consent for each of the purposes;

j) To provide you with Medical Information in relation to our products and to respond to your general enquiries.

2.4. HOW LONG WILL WE STORE YOUR DATA?

Your data will be stored as long as it is correct and you remain linked to a health-related profession, during the maximum period required by Law or as required by sectorial self-regulation, without prejudice to the fact that, due to legal requirements, this temporary period may be extended.

2.5. WHICH IS OUR LAWFUL BASIS TO PROCESS YOUR PERSONAL DATA?

Our lawful basis to process your personal data, according to the specific purpose may be one of the following:

• Purposes (a), (b), (d) and (g): necessary for the achievement of the legitimate interest of the Controller, in particular.
  • Purpose (a): This purpose is based on the legitimate interest for contacting with healthcare professionals to schedule a visit to inform about our products and services, allowing us to inform directly of this to you. This processing is beneficial for us, since it allows to inform about our products and services, as well as for the healthcare professionals as they can be informed about offers and services available in their respective professional sector.
    
    The processing is necessary, as well as proportionate, for contacting HCPs and health managers to inform them about our products and services.
    
    In addition, taking into account (i) the nature of the data, that is to say, identification and professional details about the HCPs; (ii) the way this data is processed to manage our relationship with those data subjects; (iii) and the reasonable expectation of this processing that the data subjects may have, we can conclude that the impact of this processing about the rights and freedoms of the data subjects does not result invasive nor disproportionate.
  • Purpose (b): This purpose related to the invitation of healthcare professionals to scientific or medical meetings and training is based on the legitimate interest since it is a way for publishing our products and services, as well as promoting in the professional healthcare environment, creating in turn an “Almirall” community.
    
    This processing is also beneficial for the data subjects as they have the opportunity to increase their contacts network and to improve their knowledge by attending to meetings and trainings.
    
    The processing activity is deemed as necessary and reasonable as it helps us to reach our objectives of marketing, taking into account (i) the nature of data, that is to say, identification and professional details about the HCPs; (ii) the way this data is processed to manage our relationship with those data subjects; (iii) and the reasonable expectation of this processing that the data subjects may have; We can conclude that the impact of this processing is not invasive nor disproportionate to the rights of the data subjects.
  • Purpose (d): To adapt our interaction and communications to the specialty, professional habits and interests expressed by the data subjects, through data obtained from internal sources is as well based on our legitimate interest. It allows to have a simpler, more efficient and personalized communication with each one of our interlocutors, and to specify with more precision the products or services that must be offered to each one.
    
    This processing is also beneficial for these data subjects, since they have the opportunity to receive interactions and/or communications from us in a personalized way.
    
    The processing activity is deemed as necessary and reasonable, as it allows us to personalize our interactions and / or communications with respect to those interested, bearing in mind that (i) the elaboration of a profile is carried out with the data that we obtain only from our own sources; (ii) such data is processed in such a way that the communications are adapted to the preferences expressed by the data subjects; and, (iii) there is a reasonable expectation regarding this processing; We can conclude that the impact of this processing is not invasive nor disproportionate to the rights of the data subjects.
  • Purpose (g): Recruitment and evaluation of suitability for participation in clinical trials and other research studies, advisory committees, papers, provision of services, etc. It is based on our legitimate interest to contact any of the professionals with whom we interact for carrying out collaboration activities, such as getting your opinion in any study, promotion of our products and services, etc. and matching the payments to the Fair Market Value. However, in some countries, this processing activity may be based on the legal obligations to which Almirall is subject in the field of compliance with Fair Market Value with HealthCare Professionals, in attention to the applicable laws.
    
    This processing is also beneficial for those data subjects as they have the opportunity to participate in clinical trials and other research studies, advisory committees, etc. Likewise, the processing is necessary since it allows us to contact professionals of the healthcare environment for their participation in our research activities.
    
    Also, taking into account (i) the nature of the data, which are merely identifying and professional data of the data subjects; (ii) the way this data is processed to manage our contact with them; and, (iii) the reasonable expectation regarding the processing; We can conclude that the impact of this processing is not invasive nor disproportionate to the rights of the data subjects.
• Purposes (c) and (h): The legal basis for such purposes is the consent given by the data subject. Such consent may have been given through a clear affirmative action that reflects a manifestation of free, specific, informed, and unequivocal will of the data subject to accept the data processing.
• Purpose (e): The legal basis for this purpose is the fulfilment of legal obligations arising from sector self-regulation, as well as public interest in health
• Purpose (f): depending on each jurisdiction, the legal basis for this purpose can be the fulfillment of legal obligations to which Almirall is subject in the field of transparency, on data subject’s consent for individual disclosure or, as the case may be, subject to Almirall’s legitimate interest to comply with the obligations established in the Pharmaceutical Codes arising from sector self-regulation
• Purpose (i): The legal basis for such purpose is the consent given by the data subject. Such consent may have been given through a clear affirmative action that reflects a manifestation of free, specific, informed, and unequivocal will of the interested data subject to accept the data processing. Likewise, the legal basis may also be the fulfillment of contractual obligations or to manage pre-contractual relationships.
• Purpose (j): The legal basis for this purpose is the fulfillment of the regulatory obligations to which Almirall is subject as a pharmaceutical company, as well as our legitimate interest in providing you with information about our products. These inquiries may be related to product information, scientific information (Medical Information), as well as any other type of questions that you may ask Almirall. This processing is also beneficial for the data subjects, as they can request clarifications about Almirall’s products and/or other related scientific matters. Likewise, the processing is necessary since it allows us to provide you with the necessary information because of the requests we may receive from you. Also, taking into account (i) the nature of the data, which are merely identifying data, and the content of your inquiry; (ii) the way in which this data is processed to provide medical information or other type of information; and, (iii) the reasonable expectation regarding the processing, we can conclude that the impact of this is not invasive or disproportionate to the rights of the data subject.

2.6. WITH WHOM WILL WE SHARE YOUR DATA?

Your data may be transferred to public bodies and authorities (administrative or judicial), as long as they are required in accordance with legal and regulatory provisions. Personal data regarding transfers of value will be disclosed as fully detailed in our privacy statement related to such processing which will be timely informed.

Likewise, we may share your data with companies that help us carry out the different purposes indicated in section 2.3. above with which we have signed service agreements that ensure the processing of your data on a confidential basis and under the legislation applicable at any time.

Whenever information needs to be transferred and that requires an International Transfer of personal data to a subsidiary or supplier in a country that has not received the decision of the appropriate protection level issued by the European Commission, the data will be duly protected by the standard contractual clauses approved by the European Commission, the binding corporate rules applicable to data processors, or other mechanisms that ensure appropriate safeguards for international transfers.

2.7. WHAT RIGHTS DO YOU HAVE IN RELATION TO YOUR PERSONAL DATA AND HOW CAN YOU EXERCISE THEM?

You have the right to access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its erasure when, among other reasons, the data is no longer necessary for the purposes that were collected.

In certain circumstances, you may request the limitation on the processing of your data, in which case we will only keep them for the exercise or defense of claims.

Also, in certain cases and for reasons related to your particular situation, you may object to the processing of your data. Almirall, S.A. will stop processing your data, except for compelling legitimate reasons, or the exercise or defense of possible claims.

Additionally, you can exercise the right to data portability, as well as withdraw the consents provided at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

To exercise your rights, you can send a written request addressed to the Global Commercial Operations of Almirall "Almirall S.A.", to our postal address "Ronda del General Mitre 151, -08022- Barcelona".

Finally, we inform you that you can contact any European supervisory entity for any claim arising from the processing of your personal data. You can find an updated list of said organizations by jurisdiction at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

ADDITIONAL PRIVACY INFORMATION FOR U.S. Residents

If you are a United States of America resident and you want to learn more about your privacy rights in the US, please visit our Privacy Policy at https://www.almirall.us/