In this Data Privacy Statement, “Grünenthal”, “we”, “us” and ‘’our’’ refers to Grünenthal GmbH, Aachen, Zieglerstraße 6, 52078 Aachen, Germany.
As a science-based pharmaceutical company, we may process personal data about any individual that requests medical information about our pharmaceutical products.
We take the privacy and security of your personal data very seriously. In particular, with this privacy statement, we would like to inform you about the data we may collect from you or other persons, the purposes of processing these data, the way the data are collected and processed, and to what extent they are transmitted to third parties. We also explain which rights you have with regards to this data and provide useful contact details in case you have questions or concerns.
The collection and processing of personal data is carried out in accordance with the applicable law, namely the General Data Protection Regulation (GDPR).
Who is responsible for the processing of your personal data?
When you request medical information about our products, any personal data provided will be processed by Grünenthal GmbH or by the corresponding Grünenthal entity of the country where you are calling from. You can find more information about our entities in this link, and about how that entity processes any personal data reported, in the privacy statement available in its corresponding website.
What types of personal data do we process?
In general, we will process information such as:
- Your name, profession and contact data
- The circumstances of the event/enquiry/complaint itself
- Any other data that you report about individuals that take the medicinal product. This might include data about individuals (e. g. patients), that experience adverse reactions, such as name or initials, age, gender, details of our products that were applied as well as other information regarding the context of the enquiry.
For what purposes do we process personal data?
We process the personal data in order to answer to the inquiry and maintain our medical information database up to date. In case we record the call, we will use the recordings for quality monitoring and internal training purposes.
If your enquiry includes information related to an adverse event, the data reported will also be processed in order to investigate the event, follow up if further information is necessary and define required actions. You can find more information on how we process personal data collected in the context of adverse events in the following link: https://www.grunenthal.com/en/footer-links/data-protection-notice
Furthermore, if your enquiry is related to a product quality complaint, we will use it to evaluate, classify and assess the product complaint, to follow up on your request and to maintain this information in our database.
In exceptional cases, we might process your personal data for other purposes, as described in our privacy statement for Business Partners, Suppliers and other Third Parties.
What is the legal basis for the processing of the personal data?
The legal basis for the processing of your personal data is our legitimate interest to follow-up on enquiries and provide a Medical Information service in line with applicable laws (Art. 6 (1) (f) GDPR). If we record the call (only in certain countries, according to local regulations), the legal basis is also our legitimate interest to monitor the quality of the service we provide (Art. 6 (1) (f) GDPR), except if you are calling from a country where it is a legal requirement to record such call (Art. 6 (1) (c) GDPR).
If the enquiry is related to an adverse event or a product quality complaint, the legal basis is the necessity for us to comply with a legal obligation to which we are subject according to Art. 6 (1) (c) GDPR, and art. 9 (2) (i) GDPR (processing is necessary for reasons of public interest in the area of public health, on the basis of Union or Member State law).
Who will be the recipients of the personal data?
Your personal data will be processed by contracted third parties, such as vendors that support us with the handling of your enquiry or the investigation of adverse reactions, software vendors and IT solution providers. We use Grunenthal proprietary and standard industry solutions to process your data in a safe environment and we ensure that all our service providers process personal data securely, both contractually and factually.
In addition, we may be required to share certain personal data with health authorities, licensing partners and other entities of the Grünenthal group. We will not share any personal data that is not strictly necessary with any of these third parties. When possible, we will apply techniques, such as pseudonymization or encryption, to render the personal data unintelligible to any person who does not need to access, or is not authorised to access, the personal data for the purposes described above.
Will the personal data be transferred to third countries?
Some of the data recipients are located in countries outside the European Union, where there is a lower level of data protection. This is justified by Art. 49 (1) lit. d) GDPR. In such cases, Grünenthal will ensure that a sufficient level of protection is provided for your data, e.g. by concluding specific agreements with these contractual partners. Grünenthal will apply the EU-Standard-Contractual Clauses to such transfers wherever feasible.
How long will the personal data be processed for?
Information in relation to medical enquiries or product quality complaints will be kept for 5 years, unless we are legally obliged to keep the data for a longer period or for as long as we can claim a legitimate interest.
If your enquiry includes information about an adverse event, the data will be stored in our systems at least 10 years after the respective product has been withdrawn from the market.
What are your data privacy rights?
The following rights are available to you based on applicable privacy laws:
- Right to information about personal data on you stored by us
- Right to deletion or restriction of processing, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or in the event that the processing serves the enforcement, exercise or defence of legal claims
- Right to correct your personal data
- Right to object to processing on grounds of your own legitimate interest, public interest or our profiling, unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or that such processing is for the purposes of asserting, exercising or defending legal claims
- Right to data transferability
- Right to complain to a supervisory authority
If you want to exercise your rights, please address your request to dataprivacy.de@grunenthal.com
You may also directly contact our Data Protection Officer by using the following email address: datenschutz.grunenthal@two-towers.eu