This Privacy Policy is applicable to the processing of personal data obtained as a consequence of notifications received concerning adverse reactions, or any other information that may be relevant for pharmacovigilance purposes, in relation to different aspects of medicines belonging to or marketed by ROVI (inefficacy, prescriptions do not coincide with technical specifications, etc.)

Who is the Data Controller for your data?

• • Identity: Laboratorios Farmacéuticos ROVI, S.A. (Rovi) – Tax Id No.: A-28041283
• • Postal address: Julián Camarillo, 35, 28037 Madrid
• • Telephone: 91 375 62 30
• • E-mail: protecciondedatos@rovi.es

Who is the entity’s Data Protection Officer (DPO) and how can they help you?

The DPO’s role is provided for by law and has the main functions of informing and advising the entity on the personal data obligations to which it is subject and overseeing compliance with these obligations. Furthermore, the DPO acts as a point of contact with the entity for any issue concerning personal data processing and, therefore, if you so wish, you may contact them:

• • Contact details of DPO: dporovi@rovi.es

What personal data are collected?

Data concerning the patient:

• • Contact details
• • Country, data of birth, age, gender, weight, height.
• • Medical history (e.g. other pathologies, surgical procedures, diagnoses, allergies, pregnancies, etc.) and pharmacological history (other medicines used by the patient).
• • Information on the adverse reaction (e.g. severity, date on which it began, clinical evolution of the reaction, etc.).

Data concerning the notifier

• • Name and surnames.
• • Contact details (telephone, fax and e-mail).
• • City/province
• • Profession/speciality

For what purpose do we process your personal data

Personal data will be processed to investigate, detect, assess, understand and prevent adverse events and any other problems related to the medicines belonging to or marketed by ROVI, in order to evaluate the specific case and thus comply with the entity’s pharmacovigilance obligations, which allow the risks associated to the use of medicines to be identified and assessed. To fulfil this purpose, ROVI may contact the persons who have notified adverse reactions to obtain further information thereon.

For how long will we be processing your data?

Your data will be stored until Rovi’s legal liability in relation to pharmacovigilance becomes statute-barred. Specifically, Rovi must keep all pharmacovigilance-related documentation for at least 10 years as from the date on which marketing of the product ceases. Therefore, personal information related to the safety of the medicines is kept for that period.

What is the legal basis for processing your data?

The processing is necessary for reasons of public interest in the area of public health, in order to ensure that the medicines meet high standards of quality and safety (art. 9.2.i of the GDPR), and to allow compliance with the legal obligations applicable to Rovi in respect of pharmacovigilance. Taking account of the foregoing, it is totally necessary for ROVI to process your data for the purposes described and, therefore, the provision of data to this end is obligatory. Otherwise, ROVI would be prevented from complying with its legal obligations.

To whom will your data be communicated?

The data may be communicated to the following third parties:

• • The rest of the ROVI Group companies, the identities of which may be consulted on http://www.rovi.es/company/company.php, in order to analyse and process the information notified.
• • National and international regulatory bodies and entities.
• • Health professionals who carry out pharmacovigilance activities.
• • Companies with which ROVI holds licence or marketing agreements for medical products.

All these data transfers address compliance with ROVI’s legal pharmacovigilance obligations.

Notwithstanding the foregoing, personal data that identify the patient or the notifier are not provided in the aforementioned data transfers, except to ROVI Group companies.

What are your rights when you provide us with your data?

Any person has the right to obtain confirmation of whether or not we are processing personal data that concern them. Data subjects have the right to access their personal data, to request the rectification of inaccurate data or, where applicable, request their erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

In the conditions set out in the General Data Protection Regulation, data subjects may request restricted processing of their data or the portability thereof, in which case we will only store them in order to comply with legal actions and to lodge or defend ourselves against complaints.

All the rights mentioned above may be exercised using the means of contact stated at the beginning of this clause, attaching a copy of the national identity document.

You may lodge a complaint with the Spanish Data Protection Agency (contact details available at www.agpd.es) or, where applicable, another competent supervisory authority against any violation of your rights, especially if you have exercised them without obtaining satisfaction. You may also obtain further information on your rights by contacting said authorities.

In the event you provide third-party data, you are responsible for informing the third party concerned in advance of all the provisions of this clause and of article 14 of the General Data Protection Regulation, under the conditions set out in said article.