Healthcare Professionals Privacy Notice

(a)        Transfers of value

Purposes of the processing: As a member of the European Federation of Pharmaceutical Industries and Associations (EFPIA), Biogen complies with the codes enacted by EFPIA, including the EFPIA Code on Disclosure of Transfers of Value adopted on 24 June 2013 and the corresponding applicable national disclosure codes (the “ToV Codes”). Accordingly, Biogen collects, records, publishes and shares information, regarding any transfer of value made to HCPs as of 1 January 2015. In particular, Biogen is obliged to record the precise amount of direct and indirect payments, whether in cash, in kind or otherwise, made to an HCP or for an HCP’s benefit including the respective types of non-monetary benefits received by Biogen (directly or indirectly), e.g., services rendered by a third-party vendor engaged by Biogen, the relevant reporting period for a transfer of value and the purpose of the transfer of value.

The reporting period is the relevant calendar year. Disclosures shall be made once a year, generally no later than 30 June for the preceding calendar year. Information disclosed shall remain in the public domain for a minimum of 3 years after the time such information is first disclosed. Biogen shall give the HCP advance notice of the publication of his/her data and shall inform the HCP precisely what information will be disclosed. Where funding and payment were provided for the purpose of research and development, this information will be published in anonymous form (on an aggregate basis) without disclosing the identity of the HCP.

What personal data is processed:

• name;
• contact details (postal address, e-mail address, phone number or fax number);
• professional information (such as practice/specialism and HCP identification number); and
• transfer of value details (such as contribution to costs related to educational events, including registration fees, travel and accommodation expenses, fees for services, including speaker and consultancy services, the funding and payment of research and development work, including non-clinical studies, clinical trials and non-interventional studies and the payment for the transfer of any intellectual property rights associated with research and development work).

How we obtain the personal data: Directly from the HCP when entering into a contract and during our relationship.

Retention period: No longer than necessary for the purposes for which it has been collected and in accordance with any specific retention periods required by law. The period is generally 5-10 years but if related to clinical development the maximum period is 25 years from the end of the life of the concerned Biogen product.

(b)       Product complaints and adverse events

Purposes of the processing: Pharmacovigilance laws require us to collect product complaints and other safety information to enable us to monitor the safety of all products that we market or have in clinical development. These obligations include taking detailed records of every unwanted, untoward, unintended or harmful event in relation to the use of a Biogen medicinal product (“adverse event”) passed to us, which allows the adverse event to be evaluated and collated with other adverse events or complaints recorded about that product. To help us meet these obligations and ensure the safety of our products, we collect personal data about HCPs and may use HCP personal data to:

• investigate the adverse event or product complaint;
• contact the HCP for further information about the adverse event or product complaint reported;
• collate the information about the adverse event or product complaint with information about other adverse events or product complaints received by us to analyse the safety of a batch, Biogen product or active ingredient as a whole; and
• provide mandatory reports to national or regulatory authorities so that they can analyse the safety of a batch, Biogen product, generic or active ingredient as a whole, alongside reports from other sources.

Information provided as part of an adverse event report is shared within Biogen on a worldwide basis through Biogen’s Global Safety Database, hosted in the United States by Biogen, Inc. Biogen is also obliged to transfer adverse event data to national regulatory authorities for their databases and to the European Medicine Agency’s EudraVigilance database.

What personal data is processed:     

• name;
• relationship with the subject of the report;
• contact details (address, e-mail address, phone number or fax number); and
• profession/specialism (this information may determine the questions an HCP is asked about an adverse event, depending on their assumed level of medical knowledge).

How we obtain the personal data: We collect this information directly from the HCP when they provide us with information in relation to an adverse event that has affected a patient. We may also collect this information from a patient or another third party reporting an adverse event that affected the patient (such as caregivers or other medical professionals).

Retention period: For adverse event reports: for at least 50 years after the date of the expiry of the marketing authorisation of the product.  For product complaints and investigations: at least 10 years after closing the investigation.

(c)        Customer relationship management

Purposes of the processing: Biogen collects and uses HCP personal data in order to administer our relationship with an HCP (such as to arrange visits) and to build a profile about the HCP, in order to understand his/her areas of expertise and topics of interest better.

What personal data is processed:

• name;
• contact details (address, e-mail address, phone number or fax number);
• opinions on Biogen and our products/therapeutic areas gained through feedback or satisfaction surveys; and
• academic and professional information (such as employment history, academic background, field of expertise and specialisation, publications and public speeches, interest in Biogen products and treatment habits, etc.).

How we obtain the personal data: Biogen collects most of this information directly from the HCP through field force conversations and feedback surveys, but we may also collect information from publicly available sources (including the internet and through social media listening) and from industry databases that contain details about HCPs (for example, to make sure the record that Biogen maintains about the HCP is up-to-date and accurate, or to supplement incomplete information).

Retention period: No longer than necessary for the purposes for which it has been collected, but for a maximum period of 3 years after the collection of the data.

(d)       Key Medical Experts

Purposes of the processing: Biogen collects and uses personal data about HCPs who are considered Key Medical Experts (KMEs) in their field. Biogen engages KMEs for various purposes (such as to participate in market research, present or speak to internal or external audiences, to participate in advisory boards or attend any other meetings or events, including congresses, etc.) and requires information to build a profile about the KME.

What personal data is processed:

• name;
• contact details (address, e-mail address, phone number or fax number); and
• academic and professional information (such as employment history, academic background, field of expertise and specialisation, publications and public speeches, interest in Biogen products and treatment habits, etc.).

How we obtain the personal data: Biogen collects most of this information from publicly available sources (including HCP databases, the internet and through social media listening) but also from interactions with the KME directly.

Retention period: No longer than 10 years from the date of collection of the data.

(e)        Business relationship management

Purposes of the processing: Biogen collects and uses HCP personal data to administer, determine if it should enter into, or renew, a business relationship with an HCP (for example, to perform studies, surveys or market research, present or speak to internal or external audiences, to participate in advisory boards or attend any other meetings or events, including congresses). We require this information to:

• evaluate an HCP’s professional history for our due diligence purposes as a responsible company (including compliance with anti-bribery and corruption laws);
• determine an HCP’s level of remuneration based on their professional qualifications;
• organise any travel and accommodation on an HCP’s behalf; and
• ultimately, enter into, or renew, a contract with the HCP.

What personal data is processed:

• name;
• hotel rewards code or frequent flyer number;
• passport details (such as passport number and validity dates);
• gender;
• date of birth;
• emergency contact details (such as name and phone number of next of kin);
• contact details (address, e-mail address, phone number or fax number); and
• academic and professional information (such as employment history, academic background, field of expertise and specialisation).

How we obtain the personal data: Biogen collects most of this information directly from the HCP when they provide us with their curriculum vitae. We also collect information about HCPs from publicly available sources to evaluate compliance with anti-bribery and corruption laws. This information is only processed where relevant and necessary to evaluate a HCP’s background properly and to meet our commitment to deal only with valid and ethical business partners.

Retention period:  For so long as is necessary to comply with our legal obligations and best practice for a responsible company in its dealings with external stakeholders, but for no longer than 3 years from the date of collection. 

(f)        Healthcare market research by research vendors

Purposes of the processing: Biogen collects and uses personal data about HCPs when they are invited to, and participate in, market research studies or surveys, conducted by an independent research vendor, which is usually a controller under data protection law and will provide respondent HCPs with a requisite privacy notice explaining the research project and related privacy rights.

What personal data is processed: If Biogen is also deemed a controller under data protection law, we will not typically receive any personal data of a respondent HCP ourselves, but may provide the research vendor with the following data of HCPs whom we recommend should be included in the research project (however the vendor ultimately decides whom to include in the respondent list):

• name; and
• contact details (address, e-mail address, phone number or fax number).

Retention period: For no longer than 5 years from the end of the research.

(g)       Grants, donations and sponsorship applications

Purposes of the processing: Biogen collects and uses personal data about HCPs when they make, or a healthcare organisation that they work for makes, an application for a grant, donation or sponsorship. We require this information to:

• consider a conflict of interest that has been disclosed or investigate a possible conflict of interest;
• evaluate the HCP’s professional history for our due diligence purposes as a responsible company (including the HCP’s compliance with anti-bribery and corruption laws); and
• determine the HCP’s, or their employer healthcare organisation’s, eligibility to receive the grant, donation or sponsorship.

What personal data is processed:

• name;
• professional title;
• contact details (such as postal address, e-mail address and telephone number); and
• academic and professional information (such as employment history, academic background, field of expertise and specialisation, publications and public speeches, interest in Biogen products and treatment habits).

How we obtain the personal data: Biogen collects most of this information directly from the HCP when we receive an application from the HCP, or the healthcare organisation that they work for, to receive a grant, donation or sponsorship. We may also collect information about an HCP from publicly available sources to evaluate the HCP’s compliance with anti-bribery and corruption laws or a conflict of interest. This information is only processed where relevant and necessary to evaluate the HCP’s background properly and to meet our commitment to only award grants, donations and sponsorship to valid and ethical business partners.

Retention period:  For so long as is necessary in order for us to comply with our legal obligations and best practice for a responsible company in managing its grant, donation and sponsorship applications, and in its dealings with other organisations, but for no longer than 10 years from the date the relevant application was received.

(h)          Legally required communications

Purposes of the processing: In certain cases, Biogen is legally required to send a specific communication to HCPs, for example as a condition of a licence for a product or because of identified safety issues.

What personal data is processed:

• name; and
• contact details (such as postal address, e-mail address and telephone number).

How we obtain the personal data: Either from our own internal sources or from HCP database providers who can provide us with accurate HCP contact details or send the communications on Biogen’s behalf.

Retention period: For no longer than necessary for the purposes for which has been collected and in accordance with any specific retention periods required by law, but for a maximum period of 25 years from the end of the life of the concerned Biogen product. 

(i)           Medical information

Purposes of the processing: To maximise patient safety in using Biogen products, Biogen provides a medical information service to respond to enquiries from consumers, patients, and healthcare professionals relating to any aspect of use or information surrounding a Biogen product.

What personal data is processed:

• name;
• contact details, such as address, e-mail address and/or phone number;
• details of the enquiry; and
• additional physician professional information (for example, in order to verify that we are liaising with a qualified doctor).

How we obtain the personal data: We usually receive the data from the HCP directly (for example, when the HCP e-mails or phones us) or from a third party which passes this information on to us, such as a distributor, homecare programme, or contact centre which takes calls on our behalf.

Retention period:  For no longer than necessary for the purposes for which the data has been collected and in accordance with any specific retention periods required by law. In general, we keep personal data for medical information purposes for up to 6 years from the date of collection of the data.

(j)        Clinical trials

Biogen collects and processes personal data about HCPs (including principal investigators and study site coordinators) in connection with the services they provide as study staff in conducting a clinical trial or study for which Biogen is a sponsor for the following three main purposes:

• Verify study staff professional background and qualifications

  Purposes of the processing: We collect information about HCPs to assess the HCP’s suitability to perform their tasks in conducting the clinical trial or study.

  What personal data is processed: HCP’s academic and professional information (such as employment history, academic background and training, field of expertise and specialisation, and professional practicing or licensing details).

• Communicate with study staff HCPs in the ordinary course of business

  Purposes of the processing: We collect and use the personal data of HCPs to manage and administer our relationship with these HCPs.

  What personal data is processed: The information we may collect about study staff includes full name and contact details (such as postal address, e-mail address, phone number or fax number).

• Manage and administer financial payments to study staff HCPs.

  Purposes of the processing: We collect and use HCP personal data for compensation or reimbursement purposes.

  What personal data is processed: The additional information we collect about HCPs is financial details (such as bank account details).

How we obtain the personal data: We collect this information about HCPs directly from the HCP or from third parties (such as the HCP’s employer or publicly available sources).

Retention period: For no longer than 25 years from the end of the life of the concerned Biogen product. 

(k)        Educational support and training

Purposes of the processing: Biogen collects and uses personal data about HCPs to be able to provide them with educational support and training.

What personal data is processed:

• name;
• professional title;
• contact details (such as e-mail address, postal address including the name of the hospital where the HCP works, and telephone number); and
• other relevant academic and professional information to determine the HCP’s eligibility for educational support and training, and the appropriate level of educational support and/or training. 

How we obtain the personal data: Biogen collects most of this information directly from the HCP when we receive a request for educational support and/or training, or the healthcare organisation that they work for. 

Retention period: For no longer than 10 years from the date of collection of the data.

(l)        Meetings and events

Purposes of the processing: Biogen collects and uses personal data about HCPs when they register for, attend, or participate in, virtual or in-person meetings or events.

What personal data is processed: The personal data that we collect about an HCP will depend on whether the HCP is attending the event or participating in it, however, this typically includes:

• name;
• contact details (address, e-mail address, phone number or fax number); and
• additional physician professional information (for example, in order to verify that the HCP is, in fact, an HCP.

How we obtain the personal data: Biogen collects most of this information directly from the HCP when they register for the meeting or event or confirm their participation in it, or the healthcare organisation that they work for.

Retention period: For no longer than 10 years form the date of collection of the data. 

(m)      Access programmes

Purposes of the processing: Biogen funds access programmes designed to provide access to investigative Biogen products to eligible patients that their HCP considers would benefit from the treatment.  Biogen collects and uses personal data about HCPs to determine their patient’s eligibility in a Biogen access programme, to create an online HCP account in order to facilitate orders for Biogen products if such access is granted, and to administer the access programme. 

What personal data is processed:

• name;
• hospital and department;
• contact details (including e-mail address, postal address and telephone number); and
• other information relevant to the patient’s eligibility to enrol in the Biogen funded access programme (such as the HCP’s professional opinion on whether the patient meets the inclusion criteria, the anticipated need of the patient to gain access to the Biogen product and the potential benefits to the patient if access was granted, etc.)

How we obtain the personal data: Directly from the HCP.

Retention period: For no longer than 25 years from the end of the life of the concerned Biogen product. 

(n)       ClinicalTrials.gov & BiogenTrialLink.com websites

Purposes of the processing: Biogen is required to register all its clinical trials on www.clinicaltrials.gov, which is a registry and results database for clinical studies involving human subjects (“CTG”). The website is operated by the United States National Library of Medicine at the National Institute of Health, 8600 Rockville Pike, Bethesda, MD 20894, USA.  Each CTG record presents summary information about a study protocol and includes contact information for the study locations. The site information on CTG is then automatically populated into the Biogen Trial Link website (www.biogentriallink.com) which is a digital platform that allows patients, caregivers, healthcare providers, and study sites to learn about Biogen clinical trials - past, present, and future (“Biogen Trial Link”).  Both websites provide trial transparency, support patient access, and help to operationalise clinical studies.

What personal data is processed:

• full name;
• professional title/role;
• institution;
• institution address;
• general institution e-mail address;
• general institution contact number;
• HCP direct e-mail address; and
• direct line telephone number or mobile number.

How we obtain the personal data: Directly from the HCP.

Retention period: For no longer than 25 years from the end of the life of the concerned Biogen product.

(o)       Patient recruitment websites

Purposes of the processing: Biogen administers patient recruitment websites that enable HCPs to provide their information in order that they can be contacted to learn more about a clinical trial for which Biogen is recruiting patients. 

What personal data is processed:

• name; and
• contact details (address, e-mail address, phone number or fax number).

How we obtain the personal data: Directly from the HCP.

Retention period:  For a maximum period of 30 days after the closure of patient enrolment in the clinical trial about which the HCP is enquiring.

(p)       Patient support programmes

Purposes of the processing: Biogen collects and uses personal data about HCPs who are involved in a support programme funded by Biogen to support and guide patients who have been prescribed a Biogen product as part of their treatment of a particular disease.

What personal data is processed:

• name;
• medical centre details;
• nature of the HCP’s relationship with the patient;
• details of the HCP’s involvement in the patient’s care; and
• details of any contact the HCP may have had with a patient support programme provider nurse or member of staff.

How we obtain the personal data: Directly from the patient of the HCP who is enrolled in the support programme.

Retention period: For so long as the HCP’s patient is enrolled in the support programme.  If the patient leaves the programme: 6 years from the date of last contact with the HCP.  Biogen will store and process the personal data it holds about you which does not directly identify you, for statistical purposes for 25 years from the end of the life of the product.

(q)       Targeted advertising

Purposes of the processing: Biogen occasionally places advertisements on social media websites, such as LinkedIn, and provides the social media site with HCP personal data in order to check if Biogen’s HCPs are members of the site, so that the site owner can match its own data about you to provide advertisements about our goods and services that may be of interest to you. This allows us to send you content, scientific information or initiatives that are more tailored to your interests through the social media site.

What personal data is processed:

• name;
• contact details (address, e-mail address, phone number or fax number); and
• professional information (such as practice/specialism and HCP identification number).

How we obtain the personal data: Directly from the HCP through interactions with Biogen and from publicly available sources such as HCP databases.

Retention period: For no longer than 5 years from the date of collection.

Biogen may, from time-to-time also need to make the personal data of HCPs available to third parties. Such parties include:

(a)        Affiliates

We may disclose personal data to our affiliated companies for the purposes described in this Privacy Notice. A full list of Biogen affiliates can be found at www.biogen.com under “Contact Us”. The following countries, where affiliates are located, are deemed to provide an adequate level of data protection under their data protection laws by the Federal Council: Countries of the European Economic Area, Argentina, Canada, Japan, New Zealand, the Republic of Korea and the United Kingdom. For all other affiliates, Biogen has controller-to-controller Standard Contractual Clauses in place to provide an adequate level of data protection.

(b)       Service providers and business partners

Biogen may use service providers to provide services to us which may require disclosure of HCP personal data to such third parties. These include service providers which:

• provide or host IT, technology or data storage systems or solutions;
• provide clinical trials and studies support;
• provide marketing or market research services;
• support the creation and dissemination of disease education and product campaigns and materials, corporate communication and public relations activities;
• provide consulting services, such as advisory boards and faculty;
• assist in the management of third party queries, such as complaints, medical information and safety reporting; and
• support in the organisation of congresses, events and meetings.

Biogen may also disclose HCP personal data to business partners such as:

• external scientists and healthcare professionals to review and assist us with healthcare compliance activities;
• institutions and other organisations with whom we collaborate to support our clinical or commercial activities (such as for clinical studies and patient support programmes);
• other companies with which we collaborate regarding joint development, distribution and/or marketing of particular products or services; and
• parties providing advisory services, monitoring and relevant corrective/preventive actions, such as consultants, auditors, accountants, advisers, legal counsels and similar agents.

Service providers and business partners will only be permitted to process HCP personal data for purposes that are consistent with this Privacy Notice and will be required to protect the personal data in accordance with all applicable data protection laws. If not located in Europe, service providers and business partners are mainly located in the USA. If the party is located in a country deemed to provide an adequate level of data protection under its data protection laws by the Federal Council, we rely on that adequacy decision for the transfer. For all other countries, Biogen has controller-to-processor or controller-to-controller (as applicable) Standard Contractual Clauses in place to provide an adequate level of data protection.

(c)        Regulatory and governmental bodies

In certain circumstances, we may be required to provide HCP personal data requested by regulatory and health authorities including governmental bodies, data protection authorities, tax authorities, or courts in case of disputes. Where permitted and feasible, and to protect your right to privacy, Biogen will take reasonable steps to remove or anonymise information that may directly or indirectly identify you and restrict to the minimum the amount of personal data we submit or transfers to such parties. We will also take appropriate measures to ensure that the requester understands the sensitive nature of the personal data that they may receive.

We reserve the right to alert and cooperate with law enforcement authorities in investigating and prosecuting users who violate our rules or engage in behaviour that is illegal or harmful to individuals or the personal data for which we are responsible.

(d)       Corporate transactions

We may disclose HCP personal data to a third party, or their advisers, in connection with a corporate reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock, including in connection with any bankruptcy or similar proceedings. If these third parties are located in countries deemed to provide an adequate level of data protection under their data protection laws by the Federal Council, we rely on that adequacy decision for the transfer. For all other countries, Biogen puts controller-to-controller Standard Contractual Clauses in place to provide an adequate level of data protection.

An HCP may contact Biogen at any time if they would like to access to their personal data or require information about the personal data that we hold about them (such as the source of the personal data). An HCP may object to the processing of their personal data for legitimate reasons, request restriction of the processing of it, and may also request the correction or erasure of it. An HCP may also have the right to data portability.

Where Biogen processes HCP personal data on the basis of the HCP’s consent, the HCP may withdraw their consent at any time without any prejudice by contacting us using the contact details below or, in the case of an e-mail, by clicking the unsubscribe function within the e-mail. This does not affect the lawfulness of the processing before the withdrawal of consent.

Please note that some of these rights are limited by applicable data protection law and we have the right to collect, process and hold HCP personal data to perform our legal obligations (for example: data regarding an adverse event). We may require an HCP to provide additional information necessary to confirm their identity before we comply with any request made.

Under data protection laws, a "controller" is the legal entity that is responsible for protecting your personal data and helping you to exercise your data protection rights. Biogen is the controller of HCP personal data in relation to this Privacy Notice. If you are an HCP and you have questions or concerns about this Privacy Notice or the processing of your personal data or would like to exercise your rights as outlined above, you can contact Biogen’s Data Protection Officer by e-mailing: privacy@biogen.com.