Privacy Notification for Individuals Seeking Medical Information

In connection with your medical information enquiry, Lundbeck’s headquarter in Denmark (H. Lundbeck A/S) will (as data controller) receive, process, use and disclose personal data about you as described in more details in this Privacy Notification.

This Privacy Notification also applies to processing carried out by your local Lundbeck company when involved in the handling of your medical information enquiry. In such case, the local Lundbeck company will act as an independent data controller.

H. Lundbeck A/S and your local Lundbeck company are hereinafter referred to as “Lundbeck” or “we”.

Lundbeck will process your personal data according to applicable legislation, including the EU General Data Protection Regulation (“GDPR”).

What categories of personal data are we processing and for what purposes?

We collect and process personal data about you as received when you provide us with your medical information enquiry. The following types of personal data may be processed:- Contact information (name / initials, address, country of residence, e-mail address, phone number);

- Your title;
- Your job position;
- Your gender;
- Your preferred greeting;
- Your preferred salutation;
- Information on health and medication;
- Other information (only if voluntarily provided as part of the medical information enquiry).We process your personal data for the purposes of (i) being able to provide you with an answer to your medical information enquiry; (ii) enabling product quality investigations, should your enquiry relate to a product quality issue; (iii) enabling proper safety reporting escalation, should your enquiry relate to an adverse event linked to a Lundbeck product.This is done to ensure high standards of quality and safety of our medicinal products and to enhance patient care and patient safety.

How did we obtain your personal data?
The personal data is collected:

- Directly from you as part of your medical information enquiry.

When we collect personal data directly from you, you provide the personal data on a voluntary basis. You are not obliged to provide any information to Lundbeck.

What is the legal basis for our processing of your personal data?

The legal bases for our collection and processing of your personal data as set out above are (depending on the circumstances):

- Legal obligation to establish a scientific service in charge of information about the medicinal products placed on the market as set out in Article 98 of Directive 2001/83/EC on the Community code relating to medicinal product for human use, cf. GDPR Article 6 (1) (c);
- Local legislation (please contact your local Lundbeck company for more information).

Will we disclose your personal data to third parties?

To accommodate inspection requests and to continuously ensure the high standards of quality and the safety of Lundbeck’s products, we disclose and share your personal data with the following
recipients:

- Relevant local or regional health authorities (globally);

- Other entities in the Lundbeck group (only if relevant).

The disclosure to third parties is done in accordance with the legal bases listed above – i.e. Article 111 of Directive 2001/83/EC on the Community code relating to medicinal product for human use,
cf. GDPR Article 6 (1) (c), or local legislation, as applicable.

Lundbeck as data processor

In situations where a business partner (typically, another pharmaceutical company) has the medical information responsibility or responsibility to handle adverse event requests, Lundbeck will share your request and any personal data contained herein directly with the respective business partner for them to handle your enquiry. In such case Lundbeck shares your data according to instructions from the relevant business partner and they will reach out to you directly to respond to your question or concern. 

Will we disclose your personal data to data processors?

Lundbeck will disclose and transfer your personal data to our medical information vendor, who will process your personal data on our behalf and in strict accordance with our instructions. Such processing is subject to the provision of sufficient guarantees by the data processor to implement appropriate technical and organisational measures to ensure the protection of your rights as a data
subject.

Will we transfer your personal data to recipients in countries outside the EU/EEA?

In order to comply with applicable legislation, we may transfer your personal data to relevant health authorities outside the EU/EEA. The legal basis for such transfer is GDPR Article 49 (1) (d), as the transfer is deemed necessary for important reasons of public interest (public health).

Furthermore, if relevant in order to handle your request, your personal data may be transferred to a private recipient in a country outside of EU/EEA not providing the same level of protection as within the EU/EEA. Lundbeck will in this case ensure that such transfer(s) will be carried out in accordance with the applicable data protection legislation, including the GDPR. Such transfer may only take place if we can ensure an adequate level of data protection by ensuring that the recipient enters into the EU Standard Contractual Clauses with Lundbeck. The Standard Contractual Clauses are available in several languages here.

If your personal data gets transferred to other entities in the Lundbeck group, the transfer will be based on the Lundbeck Intra-Group Data Protection Agreement or the Lundbeck Binding Corporate Rules (once approved and implemented). More information regarding this can be obtained by contacting your local Lundbeck company or Lundbeck’s Group Data Protection Officer (dataprivacy@lundbeck.com).

How long will we store your personal data?

We store your personal data for as long as necessary to fulfil the purposes described above, however, for no longer than the lifetime of the Lundbeck product in question plus additional 10.

Your rights

Subject to certain exceptions and restrictions set out in applicable legislation, you enjoy the right to request access to your personal data, to have your personal data rectified, to have your personal data deleted, and to have the processing thereof restricted.

If you are not satisfied with Lundbeck’s handing of your request, you have the right to lodge a complaint with the competent supervisory authority, e.g. the Danish Data Protection Agency (Datatilsynet) or the national supervisory authority in your country. A list of all EU authorities is available here.

Contact details of Lundbeck and Lundbeck’s Group Data Protection Officer

Should you have any questions regarding the protection of your personal data, or if you wish to exercise your rights, please contact H. Lundbeck A/S, your local Lundbeck company or Lundbeck’s Group Data Protection Officer (DPO) by using the below contact details:

H. Lundbeck A/S
Ottiliavej 9
2500 Valby
Denmark
Phone no.: +45 3630 1311
Lundbeck’s Group Data Protection Officer (DPO):
E-mail: dataprivacy@lundbeck.com