We, EL PHARMA ROMANIA S.R.L. (hereinafter referred to as EL PHARMA), distribute prescription and over the counter medicines as well as medical devices; we also perform certain pharmacovigilance activities in the name and on behalf of our business partners, herein Marketing Authorisation Holders (MAHs).
The safety of all products that are marketed by EL PHARMA has to be monitored to ensure patient safety. MAH needs to be able to get in touch with people who contact us about the products we distribute, to follow-up and obtain further information, give answers to requests or to send requested material.
This Privacy Notice describes how we collect and use personal data to help us fulfil our duty to monitor the safety of all products (MAH´s pharmacovigilance obligations) and to ensure the quality and safety of all the products we distribute. It also describes how we collect and use personal data in order to provide responses to medical inquiries.
All personal data is processed under applicable data privacy laws and in particular the EU General Data Protection Regulation ((EU) 2016/679) (“GDPR”), exclusively for pharmacovigilance purposes and only where relevant and appropriate to document, assess and report an adverse event in accordance with our pharmacovigilance obligations.
Client/ Data Controller
When EL PHARMA, acting solely as wholesaler, receives information or reports of possible adverse reactions in relation to the products it distributes, EL PHARMA acts as Data Controller.
There are cases when EL PHARMA processes data related to such reports as Data Processor for the relevant MAH, during the provision of pharmacogivilance servicies; in such cases, the categories of personal data required are determined by MAH and more categories of data than those listed below may be processed.
For more information on the processing of personal data by MAHs, please refer to the privacy policies available on their websites; MAH’s identification data is available on the relevant medicine leaflet.
Categories of Personal Data
For pharmacovigilance purposes, the recording and evaluation of adverse events, we may collect the following data:
- Information about Patient
- name and/or initials
- date of birth/age/age group
- gender, weight and height
- gastation period including possible long-term follow-up information
- medical history considered relevant
- medicines taken at the time of the adverse event (including dosage, indication, period of administration or other relevant information)
- details of the adverse event (including the treatment received for that event, and any potential long-term health effects the adverse event has caused)
- Information about Reporter
- name
- contact details (may include address, e-mail address, phone number or fax number)
- profession (this information may determine the questions asked about an adverse event, depending on the assumed level of medical knowledge)
When we receive questions of a medical nature relating to the therapeutic area of the medicine or requests for scientific information, we process data such as name, surname, email address, telephone number, profession, specialisation, age, health data, any other data mentioned in the question or which may result from the correspondence.
Use of Personal Data
As part of meeting pharmacovigilance obligations, we will share personal data to MAH, to allow the MAH to meet its legal obligations to investigate the adverse event. Please note that in order to achieve this, the MAH or, at its request, EL PHARMA, may contact the reporter to obtain additional information about the reported adverse event.
Personal data provided in the context of a medical inquiry are processed for the purpose of providing a response and, where appropriate, for further documentation to establish the safety of the product.
Transfer of Personal Data
As part of meeting our Pharmacovigilance obligations, we will disclose personal data:
- with MAH, as part of a legal obligation as well as to enable it to investigate the adverse reaction
- with national competent regulatory authorities and/or regional authorities, such as the European Medicines Agency
- with third party service providers of MAH (these service providers may include safety database providers)
When EL PHARMA acts as Data Processor of the MAH, the personal data collected in a pharmacovigilance report or a medical inquiry for a specific product is transferred to MAH for the purpose of investigating the respective adverse reaction or the safety of the product. For this purpose, your personal data may be transferred to countries outside the European Economic Area, where their protection may be subject to the fulfilment of certain criteria such as nationality, justification of a ground or ensuring the confidentiality of the investigation procedures in that country.
Security of Personal Data
Information provided as part of an adverse event report is electronically stored within MAH´s database. Appropriate data protection safeguards are in place with our service providers. We maintain physical, electronic and procedural measures to safeguard personal data from accidental loss, destruction or damage and unauthorized access, use and disclosure. Where reasonably possibly, we process personal data in key coded/ pseudonymised form.
Retention Period
We will use and store personal data in accordance with mandatory legal requirements governing storage and reporting of pharmacovigilance related information. Such mandatory requirements oblige us to archive pharmacovigilance information which may include personal data at least for the duration of the product life-cycle and for an additional ten years after the respective medicinal product or medical devices has been taken from the market or for the period indicated by MAH in its capacity of Data Controller. Personal data processed to answer medical inquiries will be stored for the period indicated by the MAH.
Information Regarding Patients’, and more generally Reporters’ Rights
Patients/ Reporters have the right to:
- request information about their personal data
- request correction of their personal data if incorrect or incomplete
- file a complaint with a data protection authority
Contact: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
- restrict or object the processing of their personal data;
- request the deletion of their personal data if they are no longer necessary for the purposes of processing or there is no legal ground for their further processing. Please note that for legal reasons, we cannot delete information that has been collected as part of an adverse event report unless it is inaccurate.
Please note that we may require you to provide proper identification before we comply with any request regarding your personal data.
Legal basis of the processing activities
Our legal basis in relation to personal data processings for pharmacovigilance purpose is Article 6(1)(c) in combination with Article 9(2)(i) of the GDPR.
For medical inquiries, our legal basis is the legitimate interests in order to respond to the request and meet our contractual obligations assumed to MAH in accordance with Article 6(1)(f) of the GDPR.
If the request includes information relevant for drug safety, we may be required by law to report patients/reporters’ data to regulatory authorities as processing of health data is necessary for reasons of public interests. This is done in accordance with Article 6(1)(c) and Article 9(2)(i) of the GDPR.
We may collect and process patients’ health information, e.g. received as part of a medical inquiry, that is not directly related to drug safety information. For this we need your express consent. In this specific case, our legal basis for processing health data is Article 6(1)(a) and Article 9(2)(a) of the European GDPR.
Contact Information
For questions or concerns about this Privacy Notice, please e-mail dataprotection@elpharma.ro. We will use reasonable efforts to answer your question promptly or resolve your problem.
Version: 27.05.2024