UCB PRIVACY POLICY RELATING TO PHARMACOVIGILANCE, UCB PRODUCT QUALITY COMPLAINTS AND MEDICAL QUERIES 1. WHO WE ARE AND HOW YOU CAN CONTACT US UCB or we means UCB S.A., a Belgian company with registered office at 60, Allée de la recherche, 1070 Anderlecht and its affiliates. For more information on the contact details of the UCB affiliate in your jurisdiction, please visit the ‘UCB Worldwide’ overview at https://www.ucb.com/worldwide and select your country. As controller, i.e. the legal entity that decides on the why and how information relating to you (personal data) is collected and processed by us in the context of safety reporting or pharmacovigilance and UCB product quality complaints and queries, we respect your right to privacy. Pharmacovigilance is defined by the European Medicine Agency as the science and activities relating to the detection, assessment, understanding and prevention of adverse effects or any other medicine-related problem. We will only process your personal data as described in this Policy and in accordance with the relevant data protection legislation, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR). We have a data protection officer (DPO), who can be contacted by any of the following means for any privacy-related questions, including regarding how we collect, store and use your personal data: E-mail: dataprivacy@ucb.com; or Regular mail: To the attention of the (global) Data Protection Officer, Allée de la recherche 60, 1070 Anderlecht or to the attention of the local UCB Data Protection Officer at the postal address of the UCB affiliate in your jurisdiction. For more information, please visit https://www.ucb.com/worldwide and select your country. 2. THE REASON BEHIND THIS PRIVACY POLICY This Policy governs the collection, use and retention by UCB of personal data for pharmacovigilance purposes, including safety reporting and product quality complaints. This Policy applies to (i) patients reporting safety information including but not limited to adverse events or submitting a quality complaint relating to any one of UCB’s products (Patients); and (ii) any individual reporting safety information including but not limited to adverse events or a quality complaint relating to any one of UCB’s products on behalf of the patient (e.g. a patient’s relative, caregiver, healthcare professional - or HCP – such as a doctor, a pharmacist, a nurse, UCB employee, UCB service provider or partner etc.) (Safety Information Reporters or SI Reporters). This Policy consists of five main components and informs you about: Who we are and how you can contact us; The reason behind this Policy; The purposes for which we process your personal data, the related legal basis under GDPR and applicable retention periods; What your rights are in relation to the personal data we hold about you and how you can exercise them; and Further details on how we process (including transfer) your personal data. This Policy may be updated periodically to reflect changes in our personal data processing activities. In that case we will inform you of any significant changes by posting a prominent notice on UCB websites or by informing you through the same channel we usually use to communicate with you. 3. THE PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA AND APPLICABLE LEGAL BASIS The table below indicates per purpose (i) the categories of personal data we collect and process concerning you, (ii) the source, (iii) how long we retain your personal data, (iv) who we share it with, and (v) the relevant legal basis under GDPR. 1. In order to (i) monitor the safety and safe use of UCB medicinal products and medical devices, including through adverse event detection, follow-up and reporting to the competent health authorities in the EU or EU Member States; and (ii) otherwise comply with its obligations under EU and EU Member State laws relating to the safety of medicinal products and medical devices or as imposed by competent EU or EU Member State health authorities: read more UCB Collects the following personal data about you: 1. The SI Reporter's: a) identification data: including full name, initials, ID code, title, address, e-mail address and telephone number; b) qualification(*): profession (to determine if you are a HCP, caregiver or a member of the general public); c) country of residence(*) or if that is not available the is not available, the country where the notification was received or where the review took place; d) relationship with the Patient to whom the pharmacovigilance report pertains; e) other information about the SI Reporter that may be required under applicable national law; 2. The Patient's: a) identification data(*): Patient ID code, initials, medical record number (from general practitioner, specialist, hospital),; b) information about the Patient’s treating HCP; c) personal characteristics(*): date of birth or age, gender, weight, height; d) safety information reported regarding any one of UCB’s products: including but not limited to pregnancy, medication errors, overdose, misuse, lack of efficacy, occupational exposure, abuse, withdrawal reactions, off-label use, drug-food interactions, suspected use of counterfeit / falsified medicine or tampering, unexpected benefits, drug-drug interactions, worsening of an existing disease etc. e) health data related to an adverse event - to the extent strictly needed to assess the adverse event in accordance with applicable laws: Information regarding the adverse event (seriousness, date, unique identification number, suspected adverse reaction(s)); treatments administered (including start and end dates); information on how the prescribed medicines were used as well as the therapy management; examination results, nature of the adverse effect(s); personal or family history, diseases or associated events, risk factors, lab reports (if applicable); gestation period when reaction/event was observed in the foetus, weight, height or gender, last menstrual date and/or gestation period at time of exposure (to the extent applicable); relevant medical history and concurrent conditions; concomitant medicinal products, which are suspected to be unrelated to the adverse reaction and past-medical drug therapy; Additionally, but only to the extent that this is strictly necessary for the assessment of the adverse event, UCB may also collect and process occupational data (current and past occupations) and information on lifestyle, life habits and behaviours( including for instance: dependence, physical exercise, diet and eating behaviour, etc.); f) Other safety information which UCB is required to collect in accordance with applicable law; Failure to provide the personal data with an(*) prevents UCB from reporting the adverse event in accordance with applicable laws. UCB obtains this personal data from: The Patient; The SI Reporter; Our distributors; Partners Third party suppliers UCB retains (**) your personal data for: 10 years following the end of the marketing authorisation in any country where the relevant UCB medication was placed on the market In the context of quality assurance: relevant information will be retained for 10 years. UCB shares your personal data with: Competent EU or EU Member State regulatory and government agencies/authorities UCB affiliates, partners and third-party processors (as detailed in section 5.A) UCB relies on the following GDPR legal basis: a) Processing necessary for compliance with our legal obligations (including but not limited to pharmacovigilance/ adverse event reporting legislation); b) Processing necessary for the performance of a task carried out in the public interest, as pharmacovigilance is a key public health function (i.e. monitoring the safety of medicines, reducing the risks and increasing the benefits of medicines); c) For health data or other special categories of personal data, the aforementioned legal basis under a) or b) will be coupled with processing necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law. close 2. In order to enable UCB to (i) respond to complaints relating to quality and/or effectiveness, stability, reliability, safety, performance or usage of UCB medicinal products or medical devices; (ii) respond to medical information and other queries relating to our products; (iii) prevent misuse of our services and products; and (iv) improve our services and products: read more UCB Collects the following personal data about you: The information set out under processing activity 1 above, to the extent required to handle product complaints and medical information queries and to the extent strictly needed to improve our products and services Other information which you share with us when contacting us regarding a product complaint or query. UCB obtains this personal data from: The Patient; The SI Reporter; Our distributors; Partners Third party suppliers UCB retains (**) your personal data for: In the context of quality assurance: relevant information will be retained for 10 years UCB shares your personal data with: Competent EU or EU Member State regulatory and government agencies/authorities UCB affiliates, partners and third-party processors (as detailed in section 5.A) UCB relies on the following GDPR legal basis: a) Processing necessary for compliance with our legal obligations regarding purpose 2(i) set out above; b) Processing necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract regarding purpose 2(ii) set out above c) Processing necessary for the purpose of the legitimate interests pursued by UCB to ensure the quality and safety of its products, regarding purpose 2(iii) and 2(iv) set out above. To this end, UCB strives to maintain a fair balance between our need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out above under section 1 “Who we are and how you can contact us”. d) For health data or other special categories of personal data, the aforementioned legal basis under a), b) and c) will be coupled with processing necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law. close 3. In order to enable UCB to comply with its obligations under applicable foreign/non-EU laws and regulations relating to safety reporting or as imposed by competent (non- EU) health authorities: read more UCB Collects the following personal data about you: The information set out under processing activity 1 above, to the extent required under foreign applicable laws and regulations. Failure to provide the personal data with an (*) prevents UCB from reporting the adverse event in accordance with applicable laws. UCB obtains this personal data from: The Patient; The SI Reporter; Our distributors; Partners Third party suppliers UCB retains (**) your personal data for: For as long as required as per our legal obligations UCB shares your personal data with: Competent regulatory and government agencies/authorities UCB affiliates, partners and third-party processors (as detailed in section 5.A) UCB relies on the following GDPR legal basis: a) Processing necessary for the purpose of the legitimate interests pursued by UCB to comply with its legal and regulatory obligations under foreign law including but not limited to pharmacovigilance/ adverse event reporting legislation and industry guidelines and to ensure the quality and safety of its products. To this end, UCB strives to maintain a fair balance between our need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out above under section 1 “Who we are and how you can contact us”. b) For health data or other special categories of personal data, the aforementioned legal basis will be coupled with processing necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy. close 4. In order to enable UCB to conduct audits and defend its interests in pending or threatened litigation: read more UCB Collects the following personal data about you: The categories of personal data set out under processing activity 1 above UCB obtains this personal data from: The Patient; The SI Reporter; Our distributors; Partners Third party suppliers UCB retains (**) your personal data for: For as long as required as per our legal obligations. E.g. in relation to adverse event related information for a period of 10 years following the end of the marketing authorisation in any country where the relevant UCB medication was placed on the market For the duration of the exercise or defence of the relevant legal claim, legal proceedings or transaction UCB shares your personal data with: Our legal advisors, auditors UCB affiliates and third-party processors (as detailed in section 5.A) UCB relies on the following GDPR legal basis: a) Processing necessary for compliance with our legal obligations b) To the extent the processing is not covered under compliance with legal obligations, processing necessary for the purpose of the legitimate interests pursued by UCB to ensure the quality and safety of its products, to conduct its business and defend its interests against legal claims and in legal proceedings. To this end, UCB strives to maintain a fair balance between our need to process your personal data and the preservation of your rights and freedoms, including the protection of your privacy. For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out above under section 1 “Who we are and how you can contact us”. c) For health data or other special categories of personal data, the aforementioned legal basis will be coupled with: processing necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; and processing necessary for the establishment, exercise or defence of legal claims close (**) We will retain your personal data in accordance with the retention periods set out in the table above. These retention periods, included in our data retention policy, are dictated by: applicable statutory/legal requirements; industry guidelines; and for those data categories for which no express statutory or legal requirements apply, certain other determining factors such as the need to prove or enforce a transaction or contract, enforce our policies, etc. We will delete your personal data once the abovementioned retention periods will have expired or if you object to our processing of your personal data, except where we need to hold on to such data for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, for compliance with a European Union or European Union Member State legal obligation which requires such further processing, or where we need to prove or enforce a transaction or contract, or enforce our policies. 4. YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM A. Your rights Right to access read more You have the right to obtain confirmation from us as to whether or not we process personal data concerning you, and if so, the right (as far as this does not adversely affect the rights and freedoms of others) to obtain a copy of your personal data from us. For more information, please check section 4.B “How to exercise your rights”. close Right to rectification read more You have the right to ask us to rectify without undue delay any inaccurate personal data concerning you. You can also ask us to complete incomplete personal data regarding you by providing us with a supplementary statement containing such additional information. For more information, please check section 4.B “How to exercise your rights”. close Right to erasure read more You have the right to ask us to erase without undue delay personal data concerning you, where one of the following grounds applies: Your personal data are no longer necessary in relation to the purposes for which they were processed; You object to the processing of your personal data (for more information on the right to object, see further below) and there are no overriding legitimate grounds for such processing; Your personal data have been unlawfully processed; Your personal data must be erased for compliance with a European Union or European Union Member State legal obligation to which UCB is subject. Please note that your right to erasure will not apply to the extent that processing is necessary for: exercising the right of freedom of expression and information; compliance with a European Union or European Union Member State Law to which UCB is subject; reasons of public interest in the area of public health in accordance with article 9(2)(h) and (i) GDPR as well as article 9(3) GDPR; archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with the relevant provisions of the GDPR; the establishment, exercise or defense of legal claims. For more information, please check section 4.B “How to exercise your rights”. close Right to restriction of processing read more You have the right to obtain from UCB restriction of processing by UCB of your personal data where one of the following applies: You contest - in good faith - the accuracy of personal data regarding you and held by us, in that case the restriction of processing will apply for a period enabling us to verify the accuracy of your personal data; The processing is unlawful and you oppose the erasure of your personal data and request restriction of their use instead; We no longer need your personal data, but you require them for the establishment, exercise or defense of legal claims; You have objected to the processing of your personal data by UCB in accordance with the relevant GDPR provision, in that case the restriction of processing will apply for a period enabling us to verify if our legitimate grounds override yours. Please note that notwithstanding the above, we are still allowed to continue storing your personal data (throughout the period of restriction) or to process your personal data for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person. If you have requested restriction of processing, we will inform you before the restriction of processing is lifted. For more information, please check section 4.B “How to exercise your rights”. close Right to data portability read more You have the right (insofar this does not adversely affect the rights and freedoms of others) to receive the personal data concerning you, that you have provided to UCB, in a structured, commonly used and machine-readable format and to transmit those data to another controller, without hindrance from UCB, where the processing is: based on a contract; and carried out by automated means For more information, please check section 4.B “How to exercise your rights”. close Right to objection to processing read more You have the right to object at any time, on grounds relating to your specific situation, to the processing of your personal data by UCB which is based on UCB’s pursuit of its legitimate interests as a controller. In that case UCB will no longer process your personal data, unless: UCB demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms; or For the establishment, exercise or defense of legal claims. You have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. For more information, please check section 4.B “How to exercise your rights”. close B. How to exercise your rights If you wish to exercise any of the rights mentioned above, please contact us as set out under section 1 above (“Who we are and how you contact us”). Please clearly identify the right(s) you wish to exercise and include your contact details (including a valid e-mail or postal address) so that we can respond to your request. Please note that you may be asked to provide proof of your identity. When you contact us to exercise any of the rights mentioned above, we will respond to your request within one month following receipt of the request. This period may be extended by two additional months where necessary, but in that case we will inform you of any such extension within one month of receipt of your initial request together with the reasons for the delay. Right to lodge a complaint with supervisory authority In accordance with article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the European Union Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that UCB’s processing of your personal data infringes the GDPR. Please visit the website of the relevant national supervisory authority for more information on how to submit such a complaint. 5. MORE DETAILS ON HOW WE PROCESS YOUR PERSONAL DATA A. Who we share your personal data with. Principle We will disclose your personal data only as described in this Policy (as further detailed above), as may be updated from time to time. UCB affiliates and third party processors UCB transfers or discloses your personal data to its personnel, affiliates, our third party service providers processing personal data on UCB’s behalf for the purposes set out above and our partners (including e.g. other pharmaceutical companies) with whom we have a collaboration agreement and who have a need to know this information. Third party service providers include IT services and website hosting companies, (internet) connectivity providers, as well as service providers that provide technical and administrative support for the processing of adverse events (e.g. our call center). These service providers provide their services from locations within the EU and outside of the EU. Other third parties include regulatory and government agencies (see further below in this Policy), our advisors and external counsel, our auditors and potentially, third parties with whom UCB may merge or which may be acquired by UCB (see further below in this Policy). Compliance with laws and legal proceedings UCB will disclose your personal data where: UCB is required to do so by applicable law, by a governmental body or by a law enforcement agency; To establish or exercise our legal rights or defend against legal claims; To investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our policies or as otherwise required by law. Other If a third party acquires all (or substantially all) of our business and/or assets, we will disclose your personal data to that third party in connection with the acquisition. However, such disclosure will occur subject to and in accordance with applicable data protection laws, including the GDPR. UCB will transfer your personal data to its affiliates, including our affiliates outside of the EEA. In that case UCB relies on UCB’s Binding Corporate Rules, which can be accessed through the following link: https://www.ucb.com/UCB_BCRs.pdf. The transfer of your personal data to third party service providers (as set out above under section 5A) in countries outside of the EEA that do not ensure an adequate level of (data) protection occurs on the basis of Standard Contractual Clauses that have been executed between UCB and the relevant third party service provider. You may - by exercising your rights set out above under section 4.B (How to exercise your rights) - obtain a copy of the relevant safeguard UCB has put in place or ask UCB to redirect you to the place where they have been made available. In the absence of the aforementioned appropriate safeguards, UCB may – to the extent permitted under and in accordance with applicable data protection laws (including the GDPR) - rely on a derogation applicable to the specific situation at hand (e.g. the data subjects’ explicit consent, the necessity for the performance of an agreement, the necessity for the establishment, exercise or defense of legal claims). B. International transfers
