Safety and Quality Reporting Privacy Notice

(a) Patients (subject of the report) We collect personal data about a patient in relation to a reported adverse event or product complaint associated with that patient. We may receive the data from the patient directly or from a third party reporting the adverse event or product complaint. Reporters may include health care professionals, relatives or other members of the public. The personal data that we collect may be limited by national laws, but generally includes:

• name or initials;
• gender;
• weight and height;
• age or age category/group (such as adult, elderly or child) and date/year of birth;
• details of the product associated with the adverse event or product complaint, including the dosage taken or prescribed, the reason for being prescribed the product, any subsequent change to the patient’s usual regimen, duration of use, lot number and number of units involved;
• details of other medicines or remedies the patient is taking or was taking at the time of the adverse event or product complaint, including the dosage, the period of time the patient was taking the other medicine, the reason the patient was taking that other medicine and any subsequent change to the patient’s regimen;
• details of the adverse event experienced such as the outcome, causality, etiology and diagnosis, the treatment the patient received for that adverse event, and any long-term effects the event has had on the patient’s health;
• details of the product complaint such as the complaint description, product administration status, association with an adverse event and product use training;
• other medical information considered relevant, including risk factors and pregnancy; and
• other medical history or familial history considered relevant, including documents such as laboratory reports, medication histories and patient histories.

(b) Reporters

Biogen is required by law to make follow-up enquiries on reported adverse events and product complaints. We must therefore keep sufficient information about reporters to allow us to contact them for additional information once we have received the adverse event or product complaint report. The personal data that we may collect about reporters includes:

• name;
• contact details (address, e-mail address, phone number or fax number);
• profession/specialism (this information may determine the questions a reporter is asked about an adverse event or product complaint, depending on his/her assumed level of medical or product knowledge); and
• relationship with the subject of the report. Where the reporter is also the patient who is the subject of a report, this information may be combined with the information the patient provides in relation to the adverse event or product complaint.

As part of our safety and quality reporting obligations, we may use patient and reporter personal data to:

• investigate the adverse event or product complaint;
• contact reporters for further information about the adverse event or product complaint reported;
• collate information about the adverse event or product complaint with information about other adverse events and product complaints received by Biogen to support safety and quality monitoring of the product; and
• report to competent regulatory authorities.

As our safety and quality reporting obligations require us to review patterns across reports received from every country where we market our products, the analysis is performed by an international group of highly qualified safety physicians and quality personnel. Information provided as part of an adverse event or product complaint report is shared within Biogen on a worldwide basis through Biogen’s Global Safety Database. This database is hosted at Biogen’s headquarters in the United States (Biogen Inc.). Biogen’s international headquarters, Biogen International GmbH in Switzerland, may also require access. Biogen also engages service providers to assist it in the administration of its safety and product complaint reporting activities (such as IT service providers). Biogen is also obliged to transfer adverse event and product complaint data to national regulatory authorities for their databases and to the European Medicine Agency’s EudraVigilance database.

Such transfers may include transfers outside of your country to countries which do not implement an adequate level of protection for your personal data under your national data protection law. Personal data collected for safety and product complaint reporting may be transferred to a third party in the event that one of our products is sold, assigned or transferred. We may also share personal data with other pharmaceutical companies who are our co-marketing, co-distribution or other licence partners, where safety and product complaint reporting obligations for a product require such exchange of safety and quality information. Biogen takes appropriate steps to ensure personal data is adequately protected if transferred across national boundaries. Biogen : (i) has EU-approved Standard Contractual Clauses in place where necessary to provide an adequate level of data protection; or (ii) where this is not practical (for example, because of a transfer to a governmental authority), makes the transfer on the basis that the transfer is necessary to safeguard an overriding public interest in the context of public health.

The countries to which we will transfer personal data include the USA, countries of the European Economic Area and countries where Biogen has an affiliate (a list of which you can find here)

Because patient safety is paramount, we retain all the information we collect as a result of an adverse event report for at least 10 years after the date of expiry of the marketing authorisation of the product and for product complaints at least 10 years after closing the investigation. This is to ensure that we can continuously monitor the safety and quality of our products over time.

You may contact Biogen at any time if you would like to access your personal data or require information about the personal data that we hold about you. You may request restriction of the processing of your personal data and you may also request the correction of it. Please note that you do not have a right of objection, a right to erasure or the right to data portability, as we process and store personal data to perform our legal obligations under safety and quality reporting laws.

Under data protection laws, a "controller" is the legal entity that is responsible for protecting your personal data and helping you to exercise your data protection rights. Biogen is the controller of your personal data. If, at any time, you have questions or concerns about this Privacy Notice or the processing of your personal data, or would like to exercise your rights as outlined above, you can contact Biogen’s Data Protection Officer at privacy@biogen.com.