Personal data and pharmacovigilance

Note to non-patient reporter:
As we do not have access to the identity of the patient concerned by the pharmacovigilance case, we kindly ask you to provide him/her with this explanatory note by the means that seem most relevant to you (email, hand-delivery, etc.) in the interests of transparency and good understanding of the processing of his/her personal data.

Who is the data controller?
Depending on the medicinal product concerned in relation to the adverse reaction or the situation motivating the report, the Data Controller (as defined in the General Data Protection Regulation) is:
– LFB SA, whose registered office is located at 3, avenue des tropiques, ZA de Courtaboeuf, 91940 les Ulis France.
– LFB BIOMEDICAMENTS, whose registered office is located at 3, avenue des tropiques, ZA de Courtaboeuf, 91940 les Ulis France.
– The Data Controller determines the purposes and means of the processing and is responsible for the protection of your personal data.

What are the purposes of the processing?
The purpose of processing your personal data is to enable the recording and evaluation of tolerance information resulting from the use of LFB medicinal products in order to guarantee their safety (continuous evaluation of their benefit/risk balance).

More specifically, the purpose of the processing is to allow:
– The collection, recording, analysis, documentation, monitoring and storage of data relating to tolerance information as well as its transmission to the health authorities when required by law and, where applicable, to our partners.
– The management of contacts, by the Data Controller. This may be you as the reporter or any other health professional who may be asked to provide details of the reported pharmacovigilance case, in compliance with medical confidentiality.

What is the legal basis for processing your data?
The processing of personal data is only lawful if it has a legal basis.

The legal basis defined in the context of this processing is compliance with a legal obligation (Article R. 5121-150 et seq. of the French Public Health Code) by the operator of the medicine.

More specifically, for special categories of data and in particular health data, their processing is necessary for reasons of public interest. The purpose of such processing is to ensure compliance with high standards of quality and safety of medicinal products.

Failure to provide the patient’s data will have no impact on their relationship with their healthcare professional.

What data do we collect?
We collect:
– The data of the reporter and of any health professional likely to provide details: surname, first name, postal, electronic and telephone contact details, and, if applicable, the speciality of the health professional concerned.
– Data relating to the person exposed to the product at the origin of the pharmacovigilance case: data allowing indirect identification of the exposed person (date of birth/age, initials), data relating to the identification of the product concerned by the pharmacovigilance case report (e.g. brand name, batch number, etc.), health data and in particular treatments administered, test results, nature of the adverse reaction(s) or any other tolerance information, personal or family history, associated diseases or events, risk factors, information relating to the method of prescribing and use of medicines and the therapeutic conduct of the prescriber or health professionals involved in the management of the disease or adverse reaction, any other data strictly necessary for the assessment of the tolerance information (professional life, consumption of tobacco, alcohol, drugs, lifestyle and behaviour, etc.).
– If necessary, and given the specific characteristics of our medicines, we may process genetic data on the patients concerned. Indeed, certain adverse effects occur more frequently in patients with genetic mutations.
– It is specified that only the data strictly necessary for the assessment of the pharmacovigilance case are processed.

We do not process the identity of the person exposed to the pharmacovigilance case unless the patient makes the notification herself/himself.

Where does the personal data we process come from?
– For the reporter: We obtain your personal data directly from you.
– For the person exposed to the product at the origin of the pharmacovigilance case: We obtain your data via a third party and more particularly one or more health professionals and/or directly from you if you contact us directly.

Who are the recipients of the personal data?
Employees of the LFB Group’s pharmacovigilance department and, where applicable, when strictly necessary for the performance of their duties, other LFB Group employees (e.g. employees of the audit department, the pharmacist in charge).
When necessary and exclusively within the framework of their vigilance activity:
– LFB SA / LFB BIOMEDICAMENTS’ data processors providing in particular the database where pharmacovigilance cases are hosted. These data processors have access to the data within the limits of their functions and under the conditions defined by the contract binding them to the data controller. LFB SA / LFB BIOMEDICAMENTS take care to choose data processor who ensure an adequate level of security given the nature of the processing. These data processors are not authorised to use the personal data received for their own purposes. Personal data is hosted by a service provider that is a certified or approved host for health data.
– The other companies of the LFB Group involved in the operation or marketing of the drug in question.
– Partners (distributors, commercial agents, pharmacovigilance service providers, etc.) of an LFB entity.
– Third party laboratories whose medicinal product would be concerned by the notification (with the exception of data directly identifying the person exposed to the product and who would have directly notified the tolerance information).
– Health professionals involved in patient monitoring and health professionals or other professionals who can provide additional information.
– Public bodies in charge of vigilance in the exercise of their missions as defined by the texts, national health authorities or agencies in Europe or outside Europe and the European Medicines Agency (EMA), with the exception of data directly identifying the person exposed to the pharmacovigilance case and who would have directly notified the tolerance information.

Is the data transmitted outside the European Union?
We may transfer personal data outside the European Union or the European Economic Area.
In such a case, we will take the necessary steps to comply with the applicable legislation:
– Transfer of your data to a country with an adequate level of protection according to the European Commission.
– Transfer subject to a legally binding commitment such as the standard data protection clauses adopted by the Commission or binding corporate rules.
– Transfer based on one of the exceptions provided for in the legislation.

How long do we keep the data?
Your data will be retained for a maximum of 70 years from the date of withdrawal of the medicinal product concerned from the market. After this period, your data will be deleted or anonymised (i.e. it will not be possible to associate you with anonymised data). Anonymised data may be used for a longer period than that specified above.

What are your rights?
Each person whose data is processing (person exposed to the product causing the pharmacovigilance case and reporter) has the following rights:
– Right of access: you can access the personal data that we hold about you.
– Right of rectification: you can ask us to correct data that is inaccurate or incomplete.
– Right to restriction of processing, in particular in the event that you dispute the accuracy of the personal data that we hold about you.
You don’t have the right to object or the right to erasure or the right to protability of your data because the processing is based on compliance with a legal obligation.

To exercise your rights, we invite you to contact the Data Protection Officer at the contact details specified below.

How to contact us?
For any questions relating to the processing of your personal data or to exercise your rights, you can contact our Data Protection Officer (DPO):
– By electronic means: privacy@lfb.fr
– By post: LFB BIOMEDICAMENTS, Legal Affairs and Compliance Department, Data Protection Officer, 3 avenue des tropiques, ZA de Courtaboeuf, 91940 les Ulis, France.
If you believe, after contacting us, that your rights over your data have not been respected, you can contact your local supervisory authority in charge of personal data protection (e.g: CNIL for France www.cnil.fr).

12/16/2021