Medical Information Enquiries Privacy Notice

Last updated: 23.04.24

Contents

  1. Scope of this Notice
  2. Definitions
  3. Data Controller
  4. Purpose of processing your personal data
  5. Sources of personal data
  6. Categories of personal data
  7. Legal basis for processing your personal data
  8. Sharing of your personal data
  9. Location of your personal data
  10. Retention of your personal data
  11. Security of your personal data
  12. Your rights regarding the processing of your personal data
  13. Modification of this Privacy Notice
  14. Communication

1. Scope of this Notice

At ELPEN Pharmaceutical Co Inc. (hereinafter “ELPEN”, “the Company”, “we”, “our” or “us”), we respect your privacy, and we take all reasonable and necessary efforts to process your personal data in accordance with applicable data protection and privacy laws and regulations, at the EU or national level. This privacy notice is intended to explain how ELPEN (acting as a Data Controller) will process your personal data for the purposes of management of medical information enquiries.

2. Definitions

For the purposes of this Privacy Notice: 

‘Personal Data’ means any information relating to an identified or identifiable natural person (the "data subject"); an identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier such as a name, an identity number, location data, an online identity identifier, or one or more factors specific to physical, viral, genetic, mental, economic, cultural or social identity of that individual.

‘Special categories of personal data’ means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or membership of a trade union, as well as the processing of genetic data, biometric data for the undeniable identification of a person, data relating to health or data relating to the sexual life of a natural person or sexual orientation.

‘Health data’ means personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about his / her state of health.

‘Processing’ means any act or set of operations carried out with or without the use of automated means in personal data or in sets of personal data such as the collection, registration, organization, structuring, storage, adaptation or change, retrieval, retrieval of information, use, disclosure by transmission, dissemination or any other form of disposal, association or combination, restriction, erasure or destruction.

'Controller' means a natural or legal person, a public authority, a service or another body which, alone or jointly with others, defines the purposes and the manner in which personal data are processed; where the purpose and method of processing are determined by Union law or the law of a Member State, the controller or the specific criteria for his appointment may be provided for by Union law or the law of a Member State.

'Data Protection Officer' means the natural person designated by the controller and the processor for the reasons provided for by law, on the basis of his professional qualifications and his expertise in the field of data protection law and practices, with a primary duty to participate in all issues related to the protection of personal data.

‘Consent’ of the data subject: any indication of will, free, specific, explicit and in full knowledge, by which the data subject expresses agreement with a declaration or with a clear positive action to process the personal data they concern it.

3. Data Controller

ELPEN Pharmaceuticals Co Inc, 95 Marathonos Avenue, 190 09, Pikermi, Attica, Greece Phone: +30 211 1865 000, Email: info@elpen.gr, Website: www.elpen.gr.

Data Protection Officer (DPO)
Athena Eleftheriadou, Attorney at Law, DPO, ELPEN Pharmaceuticals Co Inc, 95 Marathonos Avenue, 190 09, Pikermi, Attica, Greece
Email: dpo@elpen.gr
Phone: +30 211 1865000 (int. 200)

4. Purpose of processing your personal data

ELPEN Pharmaceuticals Co Inc  protects your personal data, which processes, in accordance with applicable legislation, and in full compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data).Any personal data provided by you to ELPEN which relates to a medical enquiry may be used to process your enquiry appropriately, follow up with you to request additional information and to respond to your enquiry. After handling your enquiry, we will also further maintain a record of your enquiry and related personal information, for as long as necessary, in a medical information database for future historic reference, record keeping, auditing and compliance purposes as well as for the establishment, exercise or defense of legal claims. Where required by applicable law (such as for safety vigilance and product quality and safety purposes), we will also share your enquiry with the relevant internal department within ELPEN and we may also be required to report the relevant safety and quality data to regulatory authorities in and outside of the EEA. To the extent that the processing of such data is subject to the General Data Protection Regulation (2016/679), we collect and process your data in order to comply with our legal obligations (Article 6(1)(c) and Article 9(2)(i)).

Your data will not be used for any other purposes. If you do not wish to provide your personal details to us, we will not be able to contact you back or further deal with your request.

5. Sources of personal data

The personal data that we collect may come directly from you. If you are a patient, we may also be given personal data about you by a third party (such as a healthcare professional or a patient’s relative), who has become aware of a medical information request that is related to you. To the extent that the processing of such data is subject to the General Data Protection Regulation (2016/679), we collect and process your data in order to comply with our legal obligations (Article 6(1)(c) and Article 9(2)(i)).

6. Categories of personal data

We process the following categories of personal data for the purposes described in this privacy notice: Information about the individuals who make medical information enquiries [including healthcare scientists (i.e., physicians, dentists and pharmacists), health carers, consumers/ patients, patients’ organizations and patients’ associations]. We may collect your name, contact details, affiliation/profession and your relationship with the subject of the request. Furthermore, we may collect personal data such as age, date of birth, gender, race, weight and height, whether pregnant and/or breastfeeding, details of product causing reaction, information on dosage, frequency and administration modalities, reasons product was prescribed, changes to usual regime, possible medication errors and occupational exposure, details of other medicines or remedies being taken, details of an adverse reaction, treatment received, patient’s health condition and other medical history considered relevant, health and lifestyle information (some of which is special category personal data), where necessary and relevant for the purposes set out in this notice, including physical exercise, diet, sexual life, contraception, consumption of drugs, tobacco, alcohol, ethnicity, religion and sex life.

7. Legal basis for processing your personal data

We collect and process your data to respond to your enquiries and to comply with our legal obligations and industry regulations to provide a medical information service for our medicinal products and medical devices. We will also rely on our legitimate interests to further store and maintain medical information related data, to the extent

required, in a medical information database for future historic reference, record keeping, auditing and compliance purposes as well as for the establishment, exercise or defense of legal claims.

If your medical information enquiry consists of or requires the further reporting of an adverse event, your data (including special categories of personal data) will be processed to comply with our legal safety vigilance obligations imposed on ELPEN by EU and national health and privacy laws and regulations. If your medical enquiry consists of a product complaint, your data may be processed to comply with our legal obligations in the context of drug and product safety.

8. Sharing of your personal data

We may share your personal data with:

  • Other pharmaceutical companies if the medical information enquiry relates to one of their products,
  • third parties which are ELPEN’s partners or service providers, such as IT system and data hosting providers, insurers and professional advisors such as lawyers, accountants and auditors. These third parties are contractually required to protect the confidentiality and security of personal data,
  • third parties in relation to a business sale/purchase or restructuring,
  • healthcare professionals involved in a medical information request,
  • regulatory bodies, health authorities (in the EU and worldwide), tax authorities, data protection supervisory authorities, law enforcement bodies, government authorities, courts, tribunals, arbitrators, where we are required to do so by applicable law, regulation or their request,
  • any other person with your consent.

9. Location of your personal data

Your personal data may be processed in a state outside the state where you are located, which may not offer the same level of protection to personal data. If we transfer your personal data to any party mentioned above, which is located outside the EEA, we shall take appropriate measures to protect it and comply with the privacy legal framework Such measures may include i.e. entering into standard contractual clauses etc.

10. Retention of your personal data

We will retain your personal information for as long as we reasonably consider necessary for achieving the purposes set out in this privacy notice, including satisfying any legal, regulatory, accounting or reporting requirements. Personal data retained as part of a medical information inquiry are kept for a minimum of 10 and maximum of 15 years after receipt and closure of the enquiry.

The above retention period can be extended if required by law or for other compelling legitimate grounds of ELPEN, which override the interests, rights and freedoms of the data subjects concerned, or for the establishment, exercise or defense of legal claims.

11. Security of your personal data

ELPEN shall take all necessary measures to protect your personal data and protect it from accidental loss and unauthorized access, use, modification or disclosure. Moreover, we maintain physical, electronic and procedural measures with due regard to the risks presented by the processing in question, to safeguard the security of the processing of the personal data and in particular, at the time of collection, during their transmission as well as during storage, to prevent them from being distorted, damaged or accessed by unauthorized third parties.

12. Your rights regarding the processing of your personal data

You have the right to access your personal data and, in some cases, to require us to restrict, erase or rectify them or to object to our processing them, and the right of data portability. In some cases, exemptions may apply to the rights that you have in relation to your personal data. For example, the law may prevent us from being able to erase or restrict processing of your personal data.

In addition, if you have exercised some or all of your rights and you continue to have concerns about the way we process your personal data, you may, in any case, contact and file a complaint with the competent supervisory authority, in this case, the Greek Data Protection Authority:

Data Protection Authority: Kifissias Av. 1-3, ZIP Code 115 23, Athens Telephone Center: 210 6475600, Fax: 210 6475628, Email: contact@dpa.gr.

13. Modification of this Privacy Notice

ELPEN reserves the right to modify and / or update this Privacy Notice at any time. Please review regularly the published Privacy Notice on Medical Enquiries. In the event of material changes to this, a relevant publication will take place on the company's website and the "update date" of this Notice will be modified accordingly. You may, also, be informed by other means via e-mail or other communications provided by you to ELPEN. 

14. Communication

For any questions regarding personal data and this Privacy Notice, you can contact our company directly: ELPEN, 95, Marathonos Avenue, PC 190 09, Pikermi, Attiki, Tel.: 2111865000,

Data Protection Officer (DPO)
Athena Eleftheriadou, Attorney at Law, DPO ELPEN Pharmaceuticals Co Inc, 95 Marathonos Avenue, 190 09, Pikermi, Attica, Greece
Email: dpo@elpen.gr
Phone: +30 211 1865000 (int. 200)