Data Privacy Statement For Pharmacovigilance

This Data Privacy Statement for Pharmacovigilance (the “Statement”) contains important information on how AJ Vaccines A/S (“AJ Vaccines”, “we”, “us”) processes personal data (i.e., any data relating to an identified or identifiable natural person) to monitor the safety of our products (pharmacovigilance) and handle medical enquiries.

Pursuant to applicable privacy laws, AJ Vaccines is considered as data controller of personal data that we receive in relation to side effects of our products.

1. PURPOSE OF PROCESSING PERSONAL DATA

AJ Vaccines manufactures vaccines and other medicinal products (the “AJ Vaccines’ Products”). As a pharmaceutical company, AJ Vaccines is obliged to monitor the safety of our medicinal products worldwide. This is performed through pharmacovigilance. Pharmacovigilance means activities that aim to identify, collect, evaluate, understand and prevent side effects of medicinal products.

We process personal data for safety reasons. Processing in this regard includes activities such as collecting, handling, analyzing, transferring, and storing data. AJ Vaccines monitors and reports such side effects related to AJ Vaccines’ Products in order to safeguard the public health and ensure high standards of quality. A side effect means an unfavourable, untoward or unintended event following the use of our products, whether or not considered associated with the administration of the product.

To comply with our pharmacovigilance obligations and in the interest of protecting patient safety, we might collect and process personal data from individuals who experience and/or report a side effect. The personal data is processed to:

· evaluate side effects

· contact individuals who have reported side effects

· collate with information from other reported side effects, to investigate the safety of the batch from which the side effect originates

· mandatory reporting of side effects to national and/or regional regulatory authorities.

Moreover, we process personal data to answer medical enquiries. In case we are contacted with a question relating to AJ Vaccines’ Products, the Personal Data is processed to:

· answer the enquiry

· contact the reporter for follow-up questions and clarification purposes

· ensure the quality of our answers

We have implemented technical and organizational measures to safeguard all Personal Data that we process, including safeguards and procedures designed to restrict access to Personal Data to those employees who need it to perform their job responsibilities.

2. LEGAL BASIS FOR PROCESSING PERSONAL DATA

AJ Vaccines processes personal data collected for pharmacovigilance to comply with its obligations to monitor and report side effects and to process medical enquiries.

3. HOW WE COLLECT PERSONAL DATA

Any personal data which we process is provided to us either directly by patients, private individuals, healthcare professionals or through literature reporting a side effect or via a third party e.g., pharmacies, regulatory agencies, distributors, market research agencies, etc.

4. CATEGORIES OF PERSONAL DATA

Depending on the purpose, we need to process specific personal data. However, we will only collect the data necessary to fulfilling our obligations.

We will process personal data about:

1) the individual experiencing side effect from use of our Products, and/or

2) the individual reporting the side effect.

For safety purposes, the personal data we process about the individual experiencing a side effect includes, but is not limited to:

· Information allowing to identify the relevant case to prevent double reporting, such as name and/or initials

· Demographic data such as date of birth, age group, gender, weight, or height

· Medical information concerning the side effect, such as:

Details of the relevant AJ Vaccines Product suspected to cause the adverse side effect, including dosage, reasons for application, or changes to the usual regimen
Details of concomitant medication, including dosage, application duration, reasons for application, or changes to the usual regimen
Details of the side effect, the treatment in that regard, potential long-term effects the side effect has caused, or and other medical information considered relevant including documents like lab reports and medication histories

· Information about health, or ethnic origin.

The personal data we process about the individual reporting a side effect includes, but is not limited to:

· Contact information such as name, address, phone/mobile phone/email/ or other contact information

· Profession (this allows to determine the follow-up questions you are asked depending on your assumed level of medical knowledge)

· Relationship with the subject of the report.

To handle medical enquiries, we will process personal data relating to the person submitting the medical enquiry, which may include:

· Contact information such as name, address, phone/mobile phone/email/ or other contact information

· Profession such as health care professional

· Information as being provided as part of the enquiry or complaint

5. RETENTION OF PERSONAL DATA

AJ Vaccines retains personal data for the period required to fulfil the purposes for which the data have been collected and to meet legal retentions periods or other legal processing requirements.

Side effects and safety information for AJ Vaccines’ Products, which may include personal data and related correspondences, are retained at least for the duration of the product life cycle and for an additional period, which depends on local regulations, after the relevant product.

6. TRANSFER OF PERSONAL DATA

Any and all personal data received by AJ Vaccines as part of reporting of a side effect will be processed internally at AJ Vaccines by specialised pharmacovigilance employees.

As part of our processing of personal data for safety reasons or medical enquiries, AJ Vaccines may transfer personal data to the following categories of recipients:

· The safety database service provider

· AJ Vaccines’ co-distributors, or license partners, where pharmacovigilance obligations for an AJ Vaccine Product require the exchange of safety information. Personal data originating from the EEA are not transferred outside the EEA or to any countries not accessed as providing adequate protection according to the GDPR legislation by the European Commission.

· AJ Vaccines is obliged by law to report an adverse side effect to regulatory authorities, such as the European Medicines Agency through the EudraVigilance database, and other national or regional regulatory authorities. This is done by only tranferring the minimum required information for a side effect case and by anomising the data, e.g. omitting names and contact information.

AJ Vaccines may also disclose personal data:

(i) to any third party that acquires, or is interested in acquiring, all or part of AJ Vaccines’ assets or shares, or that succeeds AJ Vaccines in carrying on all or a part of its business, whether by merger, acquisition, reorganization or otherwise; or

(ii) as required or permitted by law, including to comply with a writ of summons or similar legal process or government request, or when AJ Vaccines believes in good faith that

disclosure is legally required or AJ Vaccines has a legitimate interest in making a disclosure, such as where necessary to protect AJ Vaccines’ rights and property.

Information about an adverse side effect may also be published in case studies. In such events, any personal data will be removed from the publication to ensure complete anonymity.

AJ Vaccines has agreed data privacy contracts with all service providers processing personal data on AJ Vaccines’ behalf. Service providers are regularly monitored to ensure that they handle personal data according to the data privacy contracts and safeguards specified therein.

7. PRIVACY RIGHTS

Pursuant to applicable privacy regulation, the individuals whose personal data we are processing have certain rights under applicable privacy and data protection laws. Generally, these rights include the right to:

• get access to the individual’s personal data, and to get a copy of the data we hold about the individual

• have us rectify any information we hold about the individual that is incorrect

• have us transfer the data we hold about the individual to another party

• have us restrict processing the individual personal data – unless this will conflict with our legal obligations

• have us delete the individual’s personal data – please note that we cannot delete any (relevant) information which was provided to us in relation to the reporting of an adverse side effect

• Complain to the national data protection authority.

Please be aware that there may be limitations to these rights if they interfere with our pharmacovigilance obligations. For security reasons, an individual who wishes to enforce its rights will be required to provide adequate identification before we are able to act.

Please see contact details below if you wish to exercise any of these rights.

8. CONTACT

For any query regarding privacy matters related to AJ Vaccines’ handling of adverse side effects, including any questions or comments to this Statement, or any request to exercise a right as described in section 7 hereof, should be sent to:

AJ Vaccines A/S

Artillerivej 5

DK-2300 Copenhagen

Denmark,

att. Pharmacovigilance & Safety

or by email to: drugsafety@ajvaccines.com