Introduction

This privacy notice describes the types of personal data that Medtronic collects for the purposes of pharmacovigilance-related activities, medical information enquiries and product complaints handling related to Medtronic BioPharma products, how we use the data, what data protection rights you may have and how you can contact us to exercise these rights. This privacy notice does not apply to situations where we have notified you that an alternative privacy notice applies. We recognize that data protection is an ongoing responsibility, so we may update this privacy notice from time to time.

The Medtronic company responsible for processing personal data in context of the activities described in this privacy notice is Medtronic BioPharma B.V., having its registered address at Earl Bakkenstraat 10, Heerlen 6422 PJ, The Netherlands (“Medtronic” or “we”).

The type of information that Medtronic collects from you will depend on whether you are an individual making a medical enquiry, reporting an adverse event or a product complaint or an individual affected by a product complaint or experiencing an adverse event (“you”) and the type of processing activity:

  • Pharmacovigilance activities and product complaints.
    We collect personal data of the reporting individual, such as the name, contact details, and affiliations/profession.
    We may collect personal data of the individual experiencing an adverse event, such as demographic data, product-related information, data related to the health and medical history of that individual, and any additional data strictly necessary for processing the adverse event for pharmacovigilance purposes or to evaluate, classify and assess the adverse event or product complaint.

  • Medical Information enquiries.
    We collect personal data of the individual making a medical enquiry, such as the name, contact details and affiliation/profession.

Purposes and lawful bases for processing

Pharmacovigilance

Medtronic may process personal data provided in relation to adverse events or other activities related to pharmacovigilance, including for the detection, assessment, understanding and prevention of adverse effects or any other medicine-related problem.

We collect and process your personal data for these purposes in order to comply with our legal pharmacovigilance obligations. We may also be required to report the data to regulatory authorities.

Medical Information enquiries

Medtronic may process personal data provided in relation to a medical enquiry to answer the enquiry, follow up on such requests and maintain the information in a medical information database for reference. Where required by law (such as for pharmacovigilance and drug safety), we may also be required to report the data to regulatory authorities. Your data will not be used for any other purposes.

For such purposes, we collect and process your data to respond to your enquiries based on our legitimate interests and, if you are a patient, on the basis of your (explicit) consent. If you are not a patient, your consent, if obtained by ticking a consent box, will not be regarded as consent to the processing of your personal data as another legal basis, namely legitimate interests, is more appropriate and therefore applicable.

If the medical information enquiry requires the reporting of an adverse event or other activities related to pharmacovigilance, your data may be processed to comply with our legal pharmacovigilance obligations for these purposes.

If your medical enquiry consists of a product complaint, your data may be processed to comply with our legal obligations in the context of drug safety.

Product Complaints

Medtronic may process personal data provided in relation to a product complaint, including for the evaluation, classification and assessment of the product complaint, to follow up on such requests and to record the information in a product complaints database.

We collect and process your data for these purposes in order to comply with our legal obligations. We may also be required to report the data to regulatory authorities.

Recipients of your personal data

We may share the data you provided to us with companies and affiliates of Medtronic group, business partners and third-party service providers, insofar as required for the purposes identified above.

In the event that you engage directly with third-party service providers outside the scope of the activities covered by this privacy notice (e.g. by interacting with their website or availing to additional services from them), the privacy notice of these third parties will apply to any resulting processing of your personal data.  To the extent any linked online services or third-party features are not owned or controlled by us, Medtronic is not responsible for these third parties’ information practices. 

Medtronic is also obliged to report certain pharmacovigilance and relevant product information to regulatory and health authorities worldwide. The reports shared with such regulatory authorities contain details about the incident but will only contain limited personal data about:

  • Individual affected by an adverse event or product complaint. Information as provided to Medtronic, including age or date/year of birth (where permitted by regulations) and gender. Note that patient name will never be provided to regulatory authorities.
  • Reporting individuals. Information as provided to Medtronic, to allow the regulatory authority to follow up with the reporting individual, including name, contact details and affiliation/profession.

We may transfer the personal data we collect about you to recipients in countries other than the country in which the information was originally collected. Those countries may not have the same data protection laws as the country in which you initially provided the information.

When we transfer your personal data to recipients in other countries, we will comply with applicable legal requirements providing adequate protection for the transfer of personal data, including by implementing appropriate safeguards based on the European Commission’s Standard Contractual Clauses or one of the other transfer mechanisms foreseen under applicable data protection laws. Subject to applicable law, you may obtain a copy of these safeguards by contacting us as indicated in the How to Contact Us section below.

Data retention

Your personal data will only be retained by Medtronic for so long as necessary and relevant to fulfil the purposes set out herein and comply with legal requirements in context of pharmacovigilance and drug safety. For more information on the retention of your personal data, please contact us as indicated in the How to Contact Us section below.

Security of your personal data

We are committed to protecting the security and confidentiality of your personal data. We use technical and organizational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized access or disclosure. Where required, Medtronic has entered into binding agreements with its third-party service providers which includes appropriate safeguards to ensure that your personal data is used only for the purposes agreed in our contract with them and is kept safe in accordance with applicable data protection laws and regulations.

Your rights

To the extent provided by applicable law, you have the following rights: 

  • to request access to your personal data processed for the purposes identified in this privacy notice. Your request should contain a detailed, accurate description of the personal data you want access to; 
  • to ask us to correct information about yourself you think is inaccurate or incomplete. Please be informed that we can ask you to demonstrate that the personal data you want to correct is indeed erroneous;
  • to object, based on your particular situation, to any use or processing of your personal data which we have based on our legitimate interests;
  • to receive, in a structured, commonly used and machine-readable format, your personal data you have provided to us based on your consent, and to have this information transmitted to another company, where it is technically feasible.;
  • to restrict our use of your personal data if and when (a) you contest the accuracy of the information, (b) the processing is illegitimate and you request the restriction of its use instead of its deletion (c) your personal information is no longer needed for the purposes which are outlined above, but you need it in judicial proceedings;
  • to ask for the deletion of your personal data that is being processed or retained by us, but only when this personal data is no longer necessary in light of the purposes explained above and there is no legal or regulatory obligation which obliges us to keep it.

How to contact us

If you wish to exercise any of your rights or if you have any questions regarding the processing of your personal data described above, please contact us or Medtronic’s Data Protection Officer at rs.privacyeurope@medtronic.com.  When there are reasonable doubts regarding your identity, you might be asked to provide additional information to help us verify your identity. If you are not satisfied by our response or if you consider your privacy rights have been breached, you may have the right to lodge a complaint with a data protection authority.