Orion Corporation Patient Safety Reporting

Privacy Statement

Updated: 14.08.2020

At Orion Corporation (“Orion”), we know you care about your personal privacy and about the terms and conditions that govern how we collect, use, disclose, transfer, and store your information. Because we are dedicated to serving your needs and respecting your preferences, we have adopted the policies and practices described in this Orion Corporation Patient Safety Reporting Privacy Statement. To read more about Orion Corporation’s management of privacy in general, please see the Orion Corporation Privacy Statement. Our Privacy Statement is located on our homepage and is also available on the webpages where personal data are requested.

Collection, Use and Disclosure of Personal Data

The purpose for processing the personal data you provide through the Orion Patient Safety reporting channels is to analyse the safety and effectiveness of Orion’s products, as well as to enable Orion Global Drug Safety to maintain its pharmacovigilance system as required by applicable pharmacovigilance legislation (e.g. by EU and FDA). Pharmacovigilance means the science and activities relating to the detection,assessment, understanding and prevention of adverse reactions and other medicine-related problems. A pharmacovigilance system including safety databases is used to fulfil Orion’s legally binding obligations in relation to pharmacovigilance and to monitor the safety of medicinal products and detect any change in their risk-benefit balance. Similar safety surveillance principles and procedures are applied for non-medicinal products as required by applicable legislation. Moreover, Orion must also process your personal data due to its responsibilities in the field of product quality, complaint handling and risk management based on applicable product quality legislation (e.g. by EU and FDA) for the purpose of investigating the quality defects and complaints and putting in place appropriate preventative actions.

We share your information with Orion’s affiliates and third parties, including licensing partners and those who assist us by performing technical operations such as data storage and hosting, if this is required for the purposes of analysing and reporting safety and quality information. We also use services of third party service providers for purposes of data collection and entry of adverse event reports for which purposes personal data is disclosed to a service provider. All these companies agree to process your personal data in accordance with this Privacy Statement. We are also obligated to submit the data to the national competent authorities as well as European Medicines Agency’s and other competent authorities’ databases for managing and analysing information on suspected adverse reactions.   

If ownership or control of Orion Corporation or all or any part of our products, services or assets changes, we may transfer your personal data to any new owner, successor or assignee, in which case we would require the new owner, succerssor or assignee to treat your personal data in accordance with this Privacy Statement. Also, personal data may be disclosed to a third party such as a health authority if we are required to do so because of an applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Orion will not disclose the collected data for commercial purposes.

Legal Basis of Processing

The legal basis of processing of the personal data for drug safety, quality management and medical questions is compliance with the Orion’s legal obligations based on binding law.  In quality management when Orion processes product complaints Orion needs to process contact details of other than the complainant or reporter of complaints, such as, the employees of Orion’s partners. In these cases the legal basis is Orion’s legitimate interest/ fulfilling its responsibilities in the field of product complaint handling where the processing is not a direct legal obligation of Orion.

Personal Data We Collect

Orion collects personal data for the above-mentioned purposes. As regards clinical trials, Orion collects patient number, patient’s sex, date of birth, certain physical traits and habits, relevant medical history, investigator’s observations, pharmacodynamics, and information on the results of tests measuring efficacy and safety of a product as described in the clinical trial information leaflet. As regards authorised medicinal products, cosmetic products, food supplements and medical devices, Orion collects all necessary information which is provided to Orion by regulatory authorities, healthcare professionals, distributors, pharmacies, customers, patients or animal owners to ensure patient safety and pharmacovigilance related legal obligations. For product quality, complaint handling and risk management purposes Orion collects names, addresses, e-mail addresses and telephone numbers of the complainant or the reporter of the complaint. Orion processes also contact details of pharmacists and the employees of its partners, suppliers and wholesalers. As regards product enquiries, Orion collects all relevant information to ensure the fulfilling of legal obligations for collecting and processing pharmacovigilance and product quality related data.

As part of pharmacovigilance operations Orion may implement risk minimisation measures with aim to optimise the safe and effective use of a medicinal product throughout its life cycle. Risk minimisation measures may include e.g. direct health care professional communication (DHPC), educational programmes and materials, controlled access programmes or other risk minimisation measures. Additional risk minimisation measures can consist of one or more interventions that are implemented in a defined target group. Such distribution systems should be auditable and therefore various type of quantitative and qualitative data is collected concerning these actions. E.g. information on training dates and participants, measures of distribution of DHPC or other materials, information on receipt of such information are collected as basic information on implementation. Orion shall record and retain this information in line with the the legal requirements.

Orion as a marketing authorization holder maintains pharmacovigilance system which needs to be documented in Pharmacovigilance System Master File (PSMF). PSMF include e.g. information on organizational structures, personnel, list of the site(s) where the pharmacovigilance activities are undertaken (including both headquarters and affiliates) and information on services subcontracted. Therefore Orion maintains also contact lists for service providers, consultants, affiliates, licensing partners and other third parties which are used as part of the pharmacovigilance system. Contact lists contain company names and addresses, names of responsible persons within those companies and their contact details (phone numbers and e-mail addresses).

Sources of Personal Data

In the context of clinical trials sponsored by Orion and partners, which are performed according to a study protocol, patient data is collected from healthcare service systems based on a data subject’s freely given informed consent, and it is derived directly from the data subject or the investigator, or from the results of testing or examinations of said clinical studies.    

As regards authorised medicinal products, cosmetic products, food supplements and medical devices, Orion  receives notifications of suspected adverse events and feedback on quality and complaints directly through its reporting channels, as well as through its subsidiaries or licensing partners, who have received reports from regulatory authorities, healthcare professionals or patients and/or consumers.

Transfers of Personal Data

The personal data collected may be processed in your country of residence or transferred to another country where Orion, its affiliates, subcontractors or other recipients of personal data are located, both inside and outside the European Economic Area (EEA).  Please find further information on the destinations of data and the global drug safety system on our webpage.This means that your personal data may be processed or stored in a country that has less stringent data protection standards than those of the EEA. If Orion transfers the personal data to its partners, it will pseudonymize the personal data, which means that direct identifying of the individual is no longer possible. We will ensure that your personal data will be processed in accordance with this Privacy Statement at all times even if it is being transferred outside the EEA. The personal data transferred outside the EEA is based on legal requirements and protected based on the adequacy decision made by the European Commission, or by appropriate contractual arrangements, such as,  by the signing of the Standard Contractual Clauses by the controller and the recipient(s). For further information, please contact Orion.

Retention of Personal Data

Orion is obligated to store all information including the personal data regarding safety of medicinal products for at least ten years after the end of the expiration of the marketing authorisation or longer if any local legislation so requires. Orion is obligated to store the product quality and feedback related information for a period of eleven years after the receipt of the feedback. 

Orion is obligated to store PSMF related data at least five years after the system as described in the PSMF has been formally terminated by the marketing authorisation holder.

Your Rights

The purpose of processing of the personal data in this register is to ensure quality and safety of Orion’s pharmaceutical and non-medicinal products, as defined in detail above. Orion is obligated under binding law to retain the data in the register for the above-mentioned time periods. However, the data is soon after collection pseudonymized, which means that the data in most cases no longer enables identification of the individual to whom it relates. Only certain identifiers are kept in order to ensure that duplicate reports can be detected. If your personal data has been reported and stored in this register, you may contact Orion to inquire whether the register contains your personal data.  Subject to legal exceptions, after you have supplied sufficient search criteria, Orion will search for your  data in Orion’s register. If data that can be identified as your personal data is found, you will be given copy of it, or you will be given a notice that the register contains no data which can be identified as your personal data.

You may also request Orion to complete or correct any inaccurate report that you have submitted through the system, or to correct or delete any data that is erroneous, unnecessary or incomplete or to request Orion to restrict the processing of personal data. You can make such a request to the person in charge at Orion through the same channel as your original report or by a personally signed or otherwise comparably verified document to the contact person of the register.

Orion Contact Information and Contact Person for the Register:

Drug Safety

Orion Corporation (Business ID 1999212-6) (“Orion”)

Address: Orionintie 1, 02200 Espoo, Finland

Contact person: Jukka Pesonen, Director, Global Drug Safety (QPPV)

Telephone: +358 10 4264937

Email: jukka.pesonen@orionpharma.com

Quality

Contact person: Tuike Ylinen, QA Manager, Quality Management

Telephone: +358 10 4263055

Email: tuike.ylinen@orion.fi

Medical Questions

Contact person: Taru Blom, Vice President R&D, Chief Medical Officer

Telephone: +358 10 4267836

Email: taru.blom@orionpharma.com

Contact information of the Data Protection Officer: privacy@orion.fi

In case you wish to use your above-mentioned rights, you can make a request to this effect by a personally signed or otherwise comparably verified document in writing to Orion’s contact person named above. Please note that all requests regarding your personal data will be subject to any applicable legal and ethical reporting, document filing or retention obligations binding on Orion.

If you are not satisfied with Orion’s response to your inquiry, you may bring the matter to the attention of the Data Protection Ombudsman.

Orion shall notify any rectification of data to the recipients to whom the data have been disclosed. However, there is no duty of notification if this is impossible or unreasonably difficult.

Questions Regarding the Privacy Statement

If you have any questions about our Privacy Statement, or any concern about privacy at Orion Corporation, please contact us by e-mail at privacy@orion.fi.

We may update or revise this Orion Corporation Patient Safety Reporting Privacy Statement at any time. When we change the Statement in a material way, a notice will be posted on our website along with the updated Privacy Statement.