Data Protection Notice for Medical Information Service and Related Purposes

 

Last amended 3 November 2021, v.02

 

1. INTRODUCTION

Biomapas role. While making medical information inquiries about a medicinal product, natural person provides his/her Personal Data to UAB “Biomapas” (registered office at K. Donelaicio str. 60, Kaunas, Lithuania, legal entity code 135750888) (hereinafter referred to as “Biomapas”) and/or to Biomapas group affiliate companies or each of Biomapas’ or affiliate companies’ contractors (all together referred to as the “Biomapas Group”) which service Biomapas clients and provides medical information on their behalf. The Biomapas and the Biomapas Group will collect, process and use Personal Data for medical information and related purposes as defined below.

Upon receipt of your separate consent Biomapas may use medical information call record for medical information service improvement as defined below.

Purpose and content of the Notice. The purpose of this Data Protection Information Notice for Medical Information Service and Related Purposes (hereinafter – the “Notice”) is to inform persons and their representatives (when applicable) about data processing during medical information service delivery and for related purposes, data processing and transfer procedures within and outside the Biomapas Group.

This Notice explains how:

• Biomapas, acting as the Processor to and on behalf of Biomapas clients (Controllers acquiring medical information services), processes and protects Personal Data when Data Subjects make a medical inquiry about one or more of Biomapas client’s (which most often is international pharmaceutical company engaged in manufacturing and marketing medicinal products) products (Personal Data processing for medical information service delivery purpose);
• Biomapas upon receipt of your separate consent and while acting as the Controller, processes and protects your medical information call record for Biomapas medical information service delivery IT systems (Personal Data processing for improvement of Biomapas medical information IT systems).

 

Applicability of the Notice:

• supplements global and local data protection policies, notices or guidance (hereinafter – “Additional Policies“) of Biomapas and/or Biomapas Group, which set out the principles that apply to the use of Personal Data throughout Biomapas. The lists and examples below are non-exhaustive and may not be fully representative for every Data Subject addressed by this Notice. Wherever such Additional Policies are in any respect inconsistent with this Notice, this Notice shall only apply to the extent that it is consistent, or may be made consistent, with that Additional Policy;
• is without prejudice to applicable local data protection/privacy laws which prevail over this Notice;
• supplements – but does not replace and is without prejudice to – any specific local privacy notices, policies or procedures that have been distributed to or agreed with relevant persons, if any, or that may be implemented in the future.
• is applicable only if the Privacy Policy of Biomapas Group client (e.g., Marketing Authorization Holder for specific product) does not apply to the Personal Data processing. If the Privacy Policy of Biomapas Group client does apply, the Data Subject will be informed about that in an audio recording played when contacting Biomapas to make a medical inquiry by phone.

The Data Protection Officer. The Data Protection Officer contact email: data.protection@biomapas.com. Any queries in relation to Personal Data described in this Notice or enforcement of any of the below Data Subject’s rights shall be addressed to the Data Protection Officer via email as described in Section 4 of this Notice.

 

 

2. COLLECTION, PROCESSING AND USE OF PERSONAL DATA FOR MEDICAL INFORMATION SERVICE DELIVERY PURPOSE

Biomapas will use the information including Personal Data of Data Subjects (or other persons) provided to Biomapas about themselves (or other persons) via any channel (e.g., directly via email or contacting Biomapas through one of Biomapas Group contractors, or through Biomapas Group websites, or by calling Biomapas) in connection with medical inquiries to take the necessary actions regarding received medical inquiry.

Biomapas (any of Biomapas Group companies) will process the Personal Data under the following circumstances, unless the medical inquiry concerns pharmacovigilance related issues (e.g., safety vigilance or product quality), then Data Protection Information Notice for Pharmacovigilance Purposes shall also apply:

Purposes of Data Processing	Legal basis of Data Processing	What Personal Data is processed?	Retention period
to register and administer (e.g., answer and follow-up) medical inquiries.	legitimate interest of Biomapas clients (Marketing Authorization Holders of medical products) (GDPR Article 6 (1)(f)) to implement statutory obligation to deliver medical information about their medicinal products to general public. your (explicit) consent (GDPR Articles 6(1)(a) and 9(2)(a)) whenever you provide health data during medical information enquiry.	your name and surname (collected only if you choose to disclose your name), your country of residence, contact details (address, email address, telephone number), health data, your medical inquiry, response provided to medical inquiry, any further communication, recording of phone call (if inquiries made by phone), other data which you share with us in your communication.	Biomapas Group archives and stores the medical information data on behalf of Biomapas Group client for 10 years after the end of the calendar year during which the information was collected, unless otherwise agreed with the relevant Biomapas Group client. Longer retention period may be applied in certain occasions when Biomapas Group client is subject to stricter data retention laws.

 

BY MAKING A MEDICAL INQUIRY ABOUT BIOMAPAS CLIENT’S MEDICINAL PRODUCT THROUGH ANY CONTACT CHANNEL MENTIONED IN SECTION 2 OF THIS NOTICE AND BY VOLUNTARILY DISCLOSING YOUR OR THIRD PERSON’S HEALTH DATA IN SUCH AN INQUIRY, YOU EXPRESSLY CONSENT THAT BIOMAPAS CLIENT, AS DATA CONTROLLER, AND BIOMAPAS GROUP, ACTING ON ITS CLIENT’S BEHALF AS DATA PROCESSOR, TOGETHER WITH ITS SERVICE PROVIDERS ENGAGED IN MEDICAL SERVICE DELIVERY, WILL PROCESS THE DISCLOSED HEALTH DATA FOR MEDICAL INFORMATION SERVICE DELIVERY PURPOSE, UNDER THE TERMS AND CONDITIONS DEFINED IN SECTION 2 OF THIS NOTICE.

WHENEVER LOCAL LAWS OF YOUR RESIDENCE JURISDICTION SO REQUIRE, BY MAKING A MEDICAL INQUIRY ABOUT BIOMAPAS CLIENT’S MEDICINAL PRODUCT THROUGH ANY CONTACT CHANNEL MENTIONED IN SECTION 2 OF THIS NOTICE YOU ALSO CONSENT TO THE TRANSFER OF THE PERSONAL DATA WHICH YOU HAVE DISCLOSED DURING MEDICAL INFORMATION INQUIRY TO THE COUNTRIES OUTSIDE YOUR RESIDENCE JURISDICTION (E.G. TO THE MEMBER STATES OF THE EU, THE USA, SOUTH KOREA AND/OR OTHERS) INCLUDING COUNTRIES WHICH MAY NOT GUARANTEE PERSONAL DATA PROTECTION STANDARDS ADEQUATE TO ONES APPLICABLE IN YOUR RESIDENCE JURISDICTION. WHENEVER LOCAL LAWS OF YOUR RESIDENCE JURISDICTION SO REQUIRE, YOU MAY BE REQUESTED TO PROVIDE WET INK CONSENT TO THIS END.

YOU MAY REFUSE TO GIVE CONSENT BY NOT DISCLOSING YOUR OR THIRD PERSON’S HEALTH DATA IN YOUR MEDICAL ENQUIRY.

BIOMAPAS CLIENT AND BIOMAPAS GROUP DO NOT REQUIRE YOU TO PROVIDE YOUR OR THIRD PARTY’S HEALTH DATA. MEDICAL INFORMATION SERVICE MAY BE USED WITHOUT DISCLOSING HEALTH DATA. IF YOU HOWEVER CHOOSE TO VOLUNTARILY DISCLOSE THIRD PARTY’S HEALTH DATA WHILE MAKING MEDICAL INQUIRY, YOU CONFIRM THAT YOU HAVE PROVIDED SUCH THIRD PERSON WITH THIS NOTICE IN ADVANCE TO MAKING THE INQUIRY AND THAT YOU HAVE RECEIVED EXPRESS CONSENT CONFORMING WITH THE TERMS SET OUT HEREIN FROM SUCH THIRD PERSON TO SO DISCLOSE HIS/HER HEALTH DATA AND THAT YOU WILL PRESENT SUCH CONSENT TO BIOMAPAS CLIENT OR BIOMAPAS UPON REQUEST.

YOU MAY WITHDRAW THE CONSENT YOU HAVE ALREADY GIVEN FOR HEALTH DATA PROCESSING FOR MEDICAL INFORMATION SERVICE DELIVERY PURPOSE AT ANY TIME BY SENDING RESPECTIVE NOTIFICATION TO THE DATA PROTECTION OFFICER VIA EMAIL AS DESCRIBED IN SECTION 4 OF THIS NOTICE. THE WITHDRAWAL OF YOUR CONSENT SHALL NOT AFFECT THE LAWFULNESS OF PROCESSING BASED ON CONSENT BEFORE ITS WITHDRAWAL.

Data sources. Biomapas client receives your personal data through Biomapas Group companies and/or Biomapas contractors (if applicable) from the person making the medical inquiry who as the case may be is:

• patient/customer (you);
• healthcare processional (e.g., your doctors, pharmacists, nurses);
• third person (e.g., your family member of a patient/legal guardian/customer).

Biomapas Group companies and/or Biomapas contractors (if applicable) may receive medical inquiry through the below listed channels:

• phone communication.
• email communication.
• personal communication e.g text messages, online chats, personal interviews, telephone conversations, live speeches .
• any of Biomapas Group websites, social media.
• postal letter.

Terms and conditions for Data Processing. Personal Data may be collected, stored, maintained and transferred, both digitally and in a material medium, by any means such as email and internet connection which are selected considering the nature of the data processed, to ensure safe handling and prevent unauthorised access to Personal Data. During the handling of the reports Biomapas may carry out the following actions:

• receiving the medical inquiry via e-mail, websites, phone calls, postal letters, personal information sharing.
• registering and processing the medical inquiry into Biomapas own databases, including databases used by Biomapas Group client to which Biomapas provide medical information related services.
• following-up the medical inquiry (i.e., asking questions in connection with the medical inquiry request if the originally provided or available information is not sufficient for the complex evaluation of the case, and/providing answer to medical inquiry request, if such answer could not be provided during the initial communication).
• transferring and disclosing data on medical inquiries to recipients listed in Section 2 of this Notice below.

When Biomapas handles (including discloses) Personal Data, Biomapas always ensures confidentiality of the Personal Data, applies restricted access to the Personal Data, imposes contractual safeguards on Biomapas Group contractors and partners as well as service providers, operates internal procedures in order to comply with Biomapas data protection obligations, operates sufficient technical and organizational measures to protect the Personal Data, and ensures the data protection principles, especially the principle of data minimisation and time and purpose limitation, are adhered to.

You are not obliged to provide your Personal Data to Biomapas client and Biomapas. However, Biomapas client and Biomapas Group, acting on its behalf, will not be able to analyse and provide answer to your medical information inquiry without processing your Personal Data.

Transfer of Personal Data. Biomapas client and/or Biomapas Group may share Personal Data with Biomapas client’s company group. To the minimal extent and only when justified by objective necessity Biomapas client and/or Biomapas Group may share Personal Data with Biomapas contractors and/or commercial partners (e.g. entities Biomapas Group client commercializes pharmaceutical products with; medical information service partners, companies offering IT tools for medical information service delivery; professional legal advisors). Biomapas Group restricts access to Personal Data processed on client’s behalf within internal Biomapas Group departments on need-to-know basis.

Whenever third-party service provider (e.g. Biomapas Group company, Biomapas contractor, IT service provider) (acting as the data sub-processor) is engaged, Biomapas will (i) diligently choose such third-party service providers, and (ii) ensure that such third-party service providers adopt adequate technical and organizational security measures to safeguard Personal Data and use Personal Data only as instructed by Biomapas and appropriate company of Biomapas Group and for no other purposes.

Due to cross-border nature of medical information service, Biomapas Group may transfer Personal Data to the mentioned entities (Biomapas client, Biomapas Group and its contractors) residing in the European Economic Area (“EEA”) and outside EEA, including in countries which do not adduce the same level of protection of Personal Data as in the EEA. Biomapas will only carry out Personal Data transfers outside the EEA where Biomapas is confident that the level of protection applied to Personal Data will be similar as if it had remained within the EEA. In such case where Personal Data is transferred outside the EEA, Biomapas will apply proper protection measures (e.g., Biomapas will apply appropriate internal rules or European Commission approved Standard Contractual Clauses) in order to ensure that Personal Data is adequately protected against unauthorized processing in such countries.

 

3. COLLECTION, PROCESSING AND USE OF PERSONAL DATA FOR THE DEVELOPMENT OF BIOMAPAS MEDICAL INFORMATION IT SYSTEMS

Upon receipt of consent from you, Biomapas (any of Biomapas Group companies) as a Controller may also process the Personal Data under the following circumstances:

Purposes of Data Processing	Legal basis of Data Processing	What Personal Data is processed?	Retention period
to develop Biomapas IT systems used to provide medical information services	your (explicit) consent (GDPR Articles 6(1)(a) and 9(2)(a))	recording of phone call.	Personal data are kept for one (1) year after the end of the calendar year during which Personal Data was received.

 

BY CLICKING A BUTTON INDICATED IN THE PRIVACY NOTICE ANNOUNCED BEFORE YOU HAVE STARTED MEDICAL INFORMATION CALL, YOU EXPRESSLY CONSENT THAT ALL DATA YOU HAVE DISCLOSED IN THE MEDICAL INFORMATION TELEPHONE CALL, INCLUDED HEALTH DATA, IF ANY, WILL BE PROCESSED BY BIOMAPAS, AS DATA CONTROLLER, AND IT’S IT SERVICE PROVIDERS, FOR BIOMAPAS MEDICAL INFORMATION IT SYSTEM DEVELOPMENT PURPOSE UNDER THE TERMS AND CONDITIONS DEFINED IN SECTION 3 OF THIS NOTICE.

YOU MAY REFUSE TO GIVE CONSENT BY NOT CLICKING A BUTTON INDICATED IN THE PRIVACY NOTICE BEFORE THE CALL. AS A RESULT, BIOMAPAS WILL NOT BE ABLE OT DEVELOP MEDICAL INFORMATION IT SYSTEM TOOLS AND TO PROVIDE BETTER SERVICE, INCLUDING TO YOU IN THE FUTURE.

BY CHOOSING TO VOLUNTARILY DISCLOSE THIRD PARTY’S HEALTH DATA DURING MEDICAL INFORMATION TELEPHONE CALL, YOU CONFIRM THAT YOU HAVE PROVIDED SUCH THIRD PERSON WITH TERMS AND CONDITIONS DEFINED IN SECTION 3 OF THIS NOTICE IN ADVANCE TO THE CALL AND THAT YOU HAVE RECEIVED EXPRESS CONSENT CONFORMING WITH THE TERMS SET OUT HEREIN FROM SUCH THIRD PERSON TO SO DISCLOSE HIS/HER HEALTH DATA AND THAT YOU WILL PRESENT SUCH CONSENT TO BIOMAPAS CLIENT OR BIOMAPAS UPON REQUEST.

YOU MAY WITHDRAW THE CONSENT YOU HAVE ALREADY GIVEN FOR BIOMAPAS MEDICAL INFORMATION IT SYSTEM DEVELOPMENT PURPOSE AT ANY TIME BY SENDING RESPECTIVE NOTIFICATION TO THE DATA PROTECTION OFFICER VIA EMAIL AS DESCRIBED IN SECTION 4 OF THIS NOTICE. THE WITHDRAWAL OF YOUR CONSENT SHALL NOT AFFECT THE LAWFULNESS OF PROCESSING BASED ON CONSENT BEFORE ITS WITHDRAWAL.

Data sources. Biomapas receives your personal data (medical inquiry call record) from the person making the medical inquiry phone call who as the case may be is:

• patient/customer (you);
• healthcare processional (e.g., your doctors, pharmacists, nurses);
• third person (e.g., your family member of a patient/customer).

Terms and conditions for Data Processing. Personal Data may be collected, stored, used for the development of Biomapas IT systems, maintained including transferred digitally by any means such as email and internet connection which are selected considering the nature of the data processed, ensure safe handling and prevent unauthorised access to Personal Data.

Transfer of Personal Data. Biomapas will not share personal data for IT system development purpose with any Biomapas Group companies. To the minimal extent and only when justified by objective necessity Biomapas may share Personal Data with few Biomapas programmers and contractors (e.g. companies or IT professionals engaged in IT system development).

Whenever third-party service provider (e.g. Biomapas contractor, IT service provider) (acting as the processor) is engaged, Biomapas will (i) diligently choose such third-party service provider, and (ii) ensure that such third-party service provider adopt adequate technical and organizational security measures to safeguard Personal Data and use Personal Data only as instructed by Biomapas and for no other purposes.

Biomapas will process Personal Data for medical information IT system development purpose in Lithuania (the EU). To that end Personal Data will be transferred to the EU and will be processed in compliance with General data protection regulation requirements. Personal data will not be transfer from the EU outside EEA for this purpose. In such case where Personal Data is transferred to the EU from outside the EEA, Biomapas will apply proper protection measures in order to ensure that Personal Data is adequately protected against unauthorized processing.

 

4. RIGHTS OF DATA SUBJECTS

To reflect the newest changes in data protection law, and Biomapas Group commitment to transparency, Biomapas continuously adopt Privacy Policy. Biomapas Group encourages all Data Subjects to review Privacy Policy.

Each Data Subject has a right, if applicable, to withdraw any of his/her consents for Personal Data processing (at any time, without affecting the lawfulness of processing before the consent given for data processing was withdrawn), to know (to be informed) about the processing of his/her Personal Data, to access Personal Data held about him/her and obtain a copy of Personal Data, to have inaccurate Personal Data corrected or to have Personal Data erased and to restrict or object processing of Personal Data for legitimate reasons. Each Data Subject has the right to data portability and to lodge a complaint with the State Data Protection Inspectorate as well as other competent authority in the country of Data Subject’s residence.

The Biomapas does not take decision upon automatic processing of Data Subject and/or its representative’s Personal Data, including profiling.

Please note, that the above-mentioned rights may be limited. Biomapas Group client (as well as Biomapas, Biomapas Group company and/or Biomapas contractor when acting on client’s behalf) may be obliged by law to process certain data related to the handling of medical inquiries. In these cases, Biomapas as well as Biomapas Group clients are not allowed to delete some of Personal Data processed under this Notice. Of course, to the extent allowed by law Biomapas will suspend processing of and delete Personal Data upon the request of the Data Subject.

For any questions related to Personal Data processing, implementation of Data Subject’s rights as well as applied data protection measures, the Data Subject may contact Biomapas Data Protection Officer via email: data.protection@biomapas.com pursuant to the procedure described in the Privacy Policy.

You can also complain to your local Data Protection Authority if you are unhappy with how we have used your data. Biomapas is located in Lithuania and the contact details of Lithuanian Supervisory Authority are as follows:

State Data Protection Inspectorate, address: L. Sapiegos str. 17, LT-10312 Vilnius, Lithuania, email: ada@ada.lt, website: https://vdai.lrv.lt/en/.

 

4. ACKNOWLEDGEMENT WITH THE NOTICE

It is not an ultimate situation that Biomapas receives information directly from the Data Subjects (persons who directly require product-related medical information). Informing Data Subjects about their data processing is a privacy principle. Biomapas Group is bound by this obligation even if the Personal Data is not received directly from the Data Subject her/himself. However, in some cases Biomapas does not possess enough information about the Data Subject (including the lack of contact data). In such cases Biomapas is not able to directly contact the Data Subjects and/or inform them directly, after Biomapas receives an information on them from the reporter.

For cases, when the source of information (i.e., reporter) is not the Data Subject her/himself, Biomapas suggest and encourage the reporter to inform the Data Subject (directly affected person) about the existence and availability of this Notice and information available via Biomapas Privacy Policy. It is desirable to share the link to this Privacy Policy, or at least refer to the content and/or the environment where the Notice can be found.