PRIVACY NOTICE PROVIDED IN ACCORDANCE WITH ART 14.1-14.4 REGULATION (EU) 2016/679

How we process your data

Menarini Group companies may engage in collaboration and partnerships with research entities, such as universities, as well as with other pharmaceutical companies (“Partners”). This is the case, for example, when a Partner grants a Licence to Menarini to develop and/or commercialise a product or compound originally developed by the Partner. This also happens when a research entity has carried out a study on a product or study compound which Menarini owns or has in-licenced from other companies.

When this happens, Partners may disclose to Menarini information collected in the course of clinical trials, with the aim of enabling Menarini to assess the clinical trial’s results, as well as to develop and commercialise the product/compound on which the clinical trial focused, including producing the documentation required by the authorities to allow the product/compound’s commercialisation or assess its safety, in line with legal and regulatory requirements. Such information will not include the patients’ names and surnames, but only pseudonymised data, i.e., data where identifiable patient information, such as name and surname, has been replaced with a code (eg. AA0001). The code is assigned to patients by the study doctor at the hospital or research centre (“Centre”) where patients are enrolled, in accordance with the criteria set out in the protocol of the clinical trial in which you have participated and with sector best practices.

Thus, if you have participated in a trial sponsored by a Partner of a Menarini Group Company, Menarini may have access to your pseudonymised personal data, and the Menarini Group company that receives the data acts in the capacity as “independent data controller” of your personal data. At the end of this document is a list with the studies whose data were disclosed to Menarini by Partners, as explained above in this document, along with the Partner’s name.

Your personal data have originally been collected by the Partner on the basis of your consent (or other legitimate grounds depending on the country), and you were provided with all the relevant information via the Patient Information Sheet, Informed Consent Form and the Partner’s dedicated study website, where you were made aware of the fact that your data could be sent to other entities, such as Menarini.

Your medical records, which contain identifying information about you, including your name and surname, have been stored only at the Centre, under its sole and exclusive control, and Menarini has no access to it. In fact, the Centre may allow only the following entities to access your full medical records, where identifying information about you is contained: the Partner’s authorised representatives only for the purposes of ensuring your medical information has been appropriately reported on the trial documentation, in line with the applicable laws, the protocol and the Good Clinical Practices. - Health authorities, in particular the European Medicines Agency and the US Food and Drug Administration, or equivalent authorities in the EU or non-EU countries, to perform audits, as prescribed by the law; Courts/other adjudicating bodies and/or other public authorities, in the cases prescribed by the law and other exceptional cases.

The list where the Patient ID is associated with your identification data (“Control List”) is kept at the Centre where you were enrolled - neither the Partner nor Menarini may access to it after the trial has concluded and monitoring/source data verification activities have been finalised (unless the Partner is the hospital, university or research centre where you were enrolled, in which case the Partner may keep the Control List and hold your trial records but will always keep these separate and secure). In addition, outside of monitoring cases, the Centre is prohibited (under both privacy laws and the GCPs, i.e. the rules that govern clinical trials) from providing information about patients that is not necessary for the study - thus, it cannot disclose your identity. When the retention time provided by the law for the retention of clinical study documents has elapsed, the Centre will normally destroy the study documentation, including the Control List. At that point, the Centre becomes also unable to match patient identity with the corresponding patient code.

In any case, please be informed that while the possibility to single out your identity by combining your coded data with other available data cannot be completely ruled out, such possibility is extremely unlikely in practice, because neither the Partner nor Menarini will attempt to re-identify you.

We may use your coded data to register new medicines and compounds, to assess the data and analyse them to confirm the study results, to conduct further analysis requested by Health authorities and, in certain cases, also to perform further medical and scientific research purposes. These may include, for example: clinical studies pertaining to your pathology/medical condition(s)or similar conditions; studies which compare the data of this Study with those from other sources to identify the factors involved in a disease.

The legal basis for the processing may be, depending on the case, your consent that you provided to the Partner, pursuant to art 6.1a GDPR and 9.2.a of GDPR; compliance with a legal obligation and the public interest to ensure high standards of quality and safety of health care and of medicinal products or medical devices, pursuant to article 6.1.c. and 9.2.i of GDPR (e.g. in case further analysis is requested by the authorities, and in case the data is necessary to monitor the safety of the product, in line with the applicable laws on pharmacovigilance) or the legitimate interest to pursue scientific research pursuant to article 6.1.f and 9.2.j of GDPR.

Your data will be processed electronically and/or manually by Menarini and may be forwarded to

• other companies belonging to the Menarini Group;
• other licensors-licensees (or potential licensors/licensees/business partners)
• third parties acting on behalf of the Licensee, including experts/providers that support the analyses and store the data.
• Medical Regulatory Authorities, (e.g. the the European Medicines Agency, the U.S. Food and Drug Administration). These latter entities and the Sponsor may inspect the study files for scientific research, pharmacovigilance, and safety purposes: this may require matching your personal code with your own data and identity. Moreover, your data can be disclosed in an aggregate or pseudonymised form in scientific publications (steps will be taken to ensure you are not recognisable).

Please be informed that your pseudonymised data may be transferred to countries that might not ensure standards of personal data protection equivalent to those existing in the European Union, due to the lack of adequate local laws. When this happens, the Licensee will ensure the transferred data are afforded an adequate level of protection, in line with EU Law, by selecting non-EU data recipients that commit to respect EU data protection by concluding contractual clauses approved by the EU Commission, aimed at protecting your data. In the case of transfer to the US, Menarini will, where necessary, take additional measures in addition to approved contractual clauses to ensure data protection. Nevertheless, you should be informed that if Menarini or another company has registered or markets the products/compounds in non-EU countries, your data may have to be submitted to the Authorities in charge of monitoring the safety and reliability of medicines in those countries. In these cases, it may not be possible to ensure your data will be processed in line with EU law, so you may be unable, for example, to exercise your right to access or amend your data processed by said non-EU authorities – transferred data will, however, be “coded” to protect your identity.

Your rights

The GDPR affords the data subjects the rights under articles 15 to 22 of Regulation (EU) 2016/679, namely: knowing whether or not any data referring to you is being processed by Menarini; access your data; verify the data’s content, origin, exactness, location (including, where applicable, the Third Countries where the data might be); obtain a copy of the data including their transmission to another entity indicated by you; ask that the data are supplemented, updated, amended; in the circumstances set forth by the law, ask that the processing of data is restricted, that Data are anonymised or frozen; oppose to the processing of your data for legitimate reasons. You have the right to lodge a complaint with your local supervisory authority.

In your case, you may be unable to exercise these right because we are not in a position to identify you, unless you provide us information that enable your identification (as said, we just have pseudonymised, or “coded”, data about you). We therefore recommend you should liaise with the Centre where you were enrolled, which will in turn interact with the Partner and with Menarini, so that they can ensure your request is fulfilled while ensuring that full confidentiality is maintained about your identity also vis-à vis the Partner and Menarini.

If you need further information on how we process data, you may reach the Menarini’s Data Protection Officer at dpo@menarini.com

*****

List of Studies where Partners disclosed study data to Menarini: