Data Privacy Notice on the Processing of Side Effects Reports, Medical Inquiries, and Technical Product Complaints
This Data Privacy Notice explains how Bayer AG, Kaiser-Wilhelm-Allee 1, 51373 Leverkusen, Germany, and its group companies, presently Bayer (Schweiz) AG and Berlis AG, both in CH-8045 Zurich (jointly “Bayer”), process personal data in order to handle information about adverse events (side effects), medical inquiries, and technical product complaints. Personal data is any information about an identified or identifiable natural person. Personal data is protected by applicable data privacy laws, for example, the Swiss Data Protection Act (SR 235.1) or the EU General Data Protection Regulation 2016/679 (“GDPR”).
See bayer.com/dppa for data privacy information for other processing purposes.
If you have questions about this Notice or the use of personal data by us, please contact us using the contact information provided in the end of this Notice.
Why do we process personal data?
Bayer develops and markets prescription drugs and medical devices and over-the-counter products such as drugs, dietary supplements, or cosmetics for human use (“health products”). During the development process and market launch of our health products, users may experience adverse events, questions may arise about our products, or it may be suspected that our health products have a technical defect. When we are contacted about these issues, we may have to process personal data.
We process personal data to record and manage side effects reports.
Bayer is legally required to monitor the safety of all Bayer health products developed or marketed in a country. The aim of these “pharmacovigilance” activities is to identify, assess, understand, and prevent the undesirable effects of drugs, including prescription drugs, over-the-counter drugs, and medical devices. This is how we protect public health and promote the high quality and safety standards of our health products. We can receive information about adverse events because it is reported to us or because we identify it if it is published, for example, on social media channels.
In the context of our pharmacovigilance obligations we may need to process safety-related information:
to investigate the adverse event;
to enter the adverse event into our global safety database;
to contact you for further information about the adverse event;
to compare the information about the adverse event with the information about other adverse events so that we can analyze the safety of a production batch, a Bayer health product, or an active ingredient as a whole; and
to provide binding reports to the competent national and/or regional regulatory authorities so that they can analyze the safety of a production batch, a Bayer health product, a generic drug, or an active ingredient.
Our pharmacovigilance activities may be supported by IT systems that use artificial intelligence. Whenever possible, we remove the identifying information beforehand. We use anonymized information about adverse events to continue to improve our systems and processes.
When we publish information about adverse events (e.g., case studies and summaries), we remove all identifying information to protect your identity.
We process personal data to respond to medical inquiries.
If you contact us with a question about Bayer’s health products, we may process your personal data:
to address your inquiry and provide a relevant response;
to enter your inquiry in our medical information database. This can comprise information that you exchange with our agents via online chat;
to contact you for follow-up questions and clarification;
to analyze the inquiry. This may be supported by an IT system, if applicable, which temporarily creates and analyzes an anonymized call log to provide the call agent with relevant information during the call;
to ensure the quality of our services. For this purpose, we may ask for your permission to record the call.
In some countries, we may offer medical information services via web-based or phone-based artificial intelligence (AI) bots. Interactions with AI bots are identified as such.
To answer your question, we have to take into account whether you are a medical professional or not.
If you are a medical professional with an established contact with Bayer, we may use your inquiry and your feedback on our medical information services to better prepare for our future contact with you. For this purpose, we may combine your medical inquiry with information from other online sources.
We process personal data to handle technical product complaints.
Bayer has introduced strict checks to ensure the quality of Bayer’s health products. Nevertheless, a product may occasionally have a certain defect or fall short of your quality expectations.
Your feedback or your questions about the quality of our health products help us improve our quality and control methods as well as our manufacturing processes. To address your feedback or your questions we may process personal data:
to handle your complaint and provide a relevant response;
to enter the data in our complaints management database;
to contact you for follow-up questions and clarification;
to analyze the product complaint;
to guarantee the quality of our services.
Which personal data do we process
Depending on the purpose, the processing of certain personal data is necessary. Processing comprises activities such as data collection, handling, analysis, transmission, storage, and deletion.
Our processing of side effects reports may comprise the following personal data:
Possible information about the individual reporting the adverse events:
contact information such as name, address, telephone/fax/cell phone/e-mail, or other contact information;
profession (this enables us to tailor the follow-up questions we ask you to your assumed level of medical knowledge);
relationship to the subject of the side effects report.
Possible information about the person suffering from the adverse event:
information that allows us to identify the case and prevent double reporting, such as name and/or initials (if provided);
demographic data such as date of birth, age group, sex, weight, or height;
medical information about the adverse event, such as:
details about the Bayer health product suspected of causing the adverse event, including dosage, reasons for use or changes in usual use;
information about concomitant medication, including dosage, duration of use, reasons for use or changes in usual use;
details about the adverse event, treatment provided, any potential long-term effects caused by the adverse event, and other medical information considered relevant, including documents such as laboratory reports, medication history, and patient history.
Information about health, ethnicity, religious beliefs, and sexual history.
Our processing of medical inquiries may comprise the following personal data:
Possible information about the individual making the medical inquiry:
contact information such as name, address, telephone/fax/cell phone, e-mail;
professional, if relevant for our response;
demographic data such as date of birth, age group, sex, weight, or height;
information provided in the context of the inquiry, such as health, ethnicity, or sexual history;
audio recording of our calls (based on your consent);
your opinion about our medical information services.
Our processing of technical product complaints may comprise the following personal data:
Possible information about the individual submitting the product complaint:
contact information such as name, address, telephone/fax/cell phone, or e-mail;
demographic data such as dates of birth;
information provided in the context of the complaint;
information about the purchase/origin of the product such as pharmacy, hospital, online;
information about caregivers who may have handled the product.
On what basis do we process your personal data?
Below, we explain the typical legal bases that apply when we process personal data to handle adverse events, medical inquiries, or technical product complaints. References to specific legal bases in this Notice are for illustrative purposes; depending on country-specific legislation, additional or alternative references may apply.
Processing to handle adverse events
The handling of adverse events is mandated by pharmacovigilance legislation and is intended to serve public interest in public health care, such as ensuring high quality and safety standards of health care and drugs or medical devices. The processing may also be in the legitimate interest of Bayer, for example, to further improve Bayer’s health products.
Processing to handle medical inquiries
Bayer processes your personal data to address your medical inquiries on the basis of our legitimate interest in addressing your inquiry and adhering to documentation and record-keeping obligations. Wherever possible and for purposes where it is legally required, we ask for your consent when you contact us.
Processing to handle technical product complaints
Our processing of your personal data in the context of a product complaint is based on the implied consent you provide by actively contacting us with the expectation of a response. It is then our legal obligation to process your personal data to respond to your complaint, manage the complaint sample request, and fulfill documentation and record-keeping requirements, including sharing the information you provide with the responsible legal manufacturer.
How long do we keep your personal data?
Bayer saves personal data for the period required to fulfill the purposes for which it was collected and to fulfill the statutory retention periods or other legal processing requirements.
Reporting side effects
We use and store personal data in accordance with the legal requirements for pharmacovigilance. We may be required to retain this information for the duration of the product lifecycle and for an additional period after the marketing of the respective drug or medical device.
Medical inquiries
After responding to your inquiry, we retain information about the inquiry to meet our documentation standards and comply with legal requirements, such as concerning liability matters. If you use the services of an AI bot, the stored data will include a complete transcript of your interaction. After the retention period expires, your personal data will be deleted or anonymized, provided this complies with local data protection requirements.
Our general retention period for personal data collected in the context of medical inquiries is 10 years.
If you consent to your call being recorded for quality purposes, the recording will be retained for up to one year.
Feedback on our medical information services from health care professionals with an established contact with Bayer is retained for 36 months.
Technical product complaints
After responding to your complaint, we retain information about it for record-keeping purposes and to comply with legal requirements for as long as required by applicable local laws.
Who do we share your personal data with?
To process personal data related to side effects, medical inquiries, or technical product complaints, we may share personal data with the following categories of recipients:
Companies of the Bayer Group, to process side effects information, medical inquiries, or technical complaints.
Service providers that support Bayer, on its behalf, in handling side effects, medical inquiries or technical complaints, such as call center operators, IT hosting providers or agencies that support the evaluation of individual cases. Among these, services from the following service providers are regularly engaged:
Accenture Services GmbH and international subsidiaries: evaluation of adverse events, IT hosting.
Capgemini Deutschland GmbH and international subsidiaries: IT services.
Conduent Commercial Solutions, LLC and international subsidiaries: call center for medical inquiries.
TATA Consultancy Services Deutschland GmbH and international subsidiaries: evaluation of adverse events, IT services.
TransPerfect Remote Interpreting, Inc.: language interpreting services.
Bayer’s marketing, distribution, or license partners with whom we are required to exchange safety information according to our pharmacovigilance obligations. Bayer has concluded data privacy agreements with these companies.
Supervisory authorities, if such transmission is legally required, e.g., with respect to (suspected) side effects.
Legal successors, in the event of a sale, assignment, or transfer of a particular Bayer health care product.
External lawyers, if necessary, to support legal decisions and pursue or defend legal claims.
Bayer has concluded data privacy agreements with all service providers that process personal data on Bayer’s behalf. The service providers are regularly monitored to ensure that they process personal data in accordance with data privacy agreements.
International transmission of personal data
Bayer may transmit personal data to countries other than those where the personal data was collected. In these other countries, a different (lower) data protection regime may apply than in the country of origin.
Personal data collected in the European Economic Area (EEA) may be transmitted to a country for which the European Commission has no recognized adequate level of data protection (referred to as “non-secure third countries”).
When transmitting personal data, Bayer ensures that this is done in accordance with applicable law. This may be done, for example, by concluding specific data protection agreements with the recipient or based on consent (examples not exhaustive).
For personal data collected in the EEA, Bayer usually agrees the “standard contractual clauses” with the recipients, which were issued by the Federal Data Protection and Information Commissioner (FDPIC) as appropriate safeguards. A copy of the standard contractual clauses can be provided on request. The transmission of personal data may also be based on other legal grounds, for example, if it is necessary for important reasons of public interest.
State disclosure in the case of disclosure of personal data abroad
Your personal data will be processed mainly in the country of the data controller and in other European countries where the Bayer Group has a subsidiary. In exceptional cases, your personal data may also be processed in countries outside the European Union, in particular in the USA.
What are your data privacy rights?
Applicable data protection laws ensure that individuals whose personal data we process have certain data privacy rights. These rights may comprise the following:
to request information about the personal data processed by Bayer;
to request the rectification of personal data if it is incorrect or incomplete;
to request the deletion of personal data, e.g., if it is no longer necessary for the purposes for which it was collected or processed or if there is no legal basis for its further processing;
to restrict processing, e.g. if the accuracy of the personal data is disputed or processing is unlawful;
to request the disclosure of personal data in a commonly readable format to the data subject or another controller, e.g., when the processing is based on consent;
to object to the processing of personal data as far as such processing is based on Bayer’s legitimate interest;
to withdraw consent to the processing of personal data, if such consent was given. Withdrawal of consent does not affect the lawfulness of the processing before the withdrawal of consent;
to file a complaint with a data privacy authority.
Contact
If you have any questions about data privacy, please use the provided contact form or reach out to our company data protection officer at the following address:
Data Privacy Officer of Bayer (Schweiz) AG
c/o Bayer Consumer Care AG
Peter Merian-Strasse 84
CH-4002 Basel
E-mail: privacy_ch@bayer.com
Bayer AG is designated as the representative in the European Union for our Swiss companies in accordance with Art. 27 GDPR. You can contact the representative at the following address:
Data Protection Officer
Bayer AG
51368 Leverkusen
E-mail: dp-representative@bayer.com
Amendment of Data Privacy Notice
We may update our Data Privacy Notice on the Processing of Side Effects Reports, Medical Inquiries, and Technical Product Complaints from time to time. Updates to our Data Privacy Notice will be published on our website. Any amendments become effective upon publication on our website. We therefore recommend that you regularly visit the site to keep yourself informed on possible updates.
Current version: DP-PVMIPTC-2409