PV DATA PRIVACY

Swixx Biopharma Privacy Notice – Pharmacovigilance

Definitions used in this Privacy Notice

“Adverse event” means an unwanted, unintended, or harmful event in relation to the use of a Swixx Biopharma product. With respect to medical devices, it also includes “incidents” and for cosmetics “serious undesirable effects”, but for ease of reading, only the term “adverse event” will be used in this notice.

“Personal Data” means information in any format that can be used, directly or indirectly, alone or in combination with any other information, to identify a person.

“Swixx Biopharma” means Swixx Biopharma SA., having its principal office at Neuhofstrasse 5A, CH-6340 Baar, Switzerland or its Affiliate(s) (or both), also referred to in this Privacy Notice as “we”, “us” and “our”.

Swixx Biopharma and your privacy

Ensuring patients’ safety is extremely important to us and we take the safe use of all our products seriously. We need to be able to get in touch with people who contact us about our products in order to follow-up and obtain further information, give answers to requests or to send requested material. This Privacy Notice describes how we collect and use Personal Data to help us fulfil our duty to monitor the safety of all products including medicines we market or have in clinical development (also known as our pharmacovigilance obligations) and to ensure the quality and safety of all our products.

The notice is also applicable to cosmetic products, food supplements and medical devices since the international (including European) regulations on such products require similar safety and quality monitoring. However, to facilitate the reading only reference to drug safety is made.

Scope of this Privacy Notice

This Privacy Notice applies to information we collect from or about you online, by phone, fax, e-mail or post, or as part of the adverse event or quality reporting regulations applicable to us. We may also collect this information about you through specific forms submitted by you to us.

If you are a patient, we may also be provided with information about you by a third party reporting an adverse event that affected you. Such third parties may include medical professionals, lawyers, relatives, or other members of the public.

Legal basis for processing your personal data

Swixx Biopharma is under a legal obligation to collect specific data for reasons of public interest in the area of public health (EU GDPR Art. 6(1) and 9.2(i)). In accordance with law, pharmaceutical companies, as marketing authorization holders of products, must retain all product-related documents for at least the time period of the marketing authorization is valid, plus 10 years following its expiry. Therefore, personal information related to the safety of our products will be retained for this time period.

Patients (subject of report)

We collect personal data about you when you or a third party provides us with information in relation to an adverse event that affected you or someone else. In case you are reporting the adverse event yourself, please also refer to the Reporters section.

Pharmacovigilance laws require us to take “detailed records” of every adverse event passed to us to allow the event to be evaluated and collated with other adverse events recorded about that product.

The personal data that we will maybe have to collect some personal data from you like:

• name or initials;
• age and date of birth;
• gender;
• weight and height;
• details of the product causing the reaction, including the dosage you have been taking or were prescribed, the reason you have been taking or were prescribed the product and any subsequent change to your usual regimen;
• details of other medicines or remedies you are taking or were taking at the time of the reaction, including the dosage you have been taking or were prescribed, the period of time you were taking that medicine, the reason you have been taking that medicine and any subsequent change to your regimen;
• details of the adverse reaction you suffered, the treatment you received for that reaction, and any long- term effects the reaction has caused to your health; and
• other medical history considered relevant by the reporter, including documents such as lab reports, medication histories and patient histories.

Some of these information are considered by law to be “sensitive personal data”, like for e.g. health, ethnicity religion and sexual orientation but such information is only processed where relevant and necessary to document your reaction properly and for the purpose of meeting our pharmacovigilance, safety, and any other legal requirements. These requirements exist to allow us and competent authorities (such as the European Medicines Agency) to evaluate adverse events and make efforts to prevent similar events from happening in the future.

By properly reporting of side effects, you can help provide more information on the safety of medicines.

Reporters

We collect information about you when you provide us with information in relation to an adverse event you report.

Pharmacovigilance laws require us to ensure that adverse events are traceable and available for follow-up. As a result, we must keep sufficient information about reporters to allow us to contact you once we have received the report. The personal data that we may collect about you when you report an adverse event is your:

• name;
• contact details (which may include your address, e-mail address, phone number or fax number);
• profession (this information may determine the questions you are asked about an adverse event, depending on your assumed level of medical knowledge); and
• relationship with the subject of the report.

In case you are also the subject of a report, this information may be combined with the information you provide in relation to your reaction.

How we use and share Personal Data

As part of meeting our pharmacovigilance obligations, we may use and share Personal Data to:

• investigate the adverse event;
• contact you for further information about the adverse event you reported;
• collate the information about the adverse event with information about other adverse events received by Swixx Biopharma to analyze the safety of a batch, product, or active ingredient as a whole; and
• provide mandatory reports to national and/or regional authorities so that they can analyze the safety of a batch, product, active ingredient as a whole alongside reports from other sources.

Personal Data collected from you in accordance with this Privacy Notice may also be transferred to a third party in the event of a sale, assignment, transfer, or acquisition of the company or a specific product or therapeutic area, in which case we would require the buyer, assignee or transferee to treat that personal data in accordance with applicable data protection laws.

We may also share Personal Data with other pharmaceutical companies who are our partners, where pharmacovigilance obligations for a product require such exchange of safety information. List of such external recipients can be found at www.swixxbiopharma.com/en/partnering/)

We share information with national and/or regional authorities, such as the European Medicines Agency in accordance with pharmacovigilance laws. We are unable to control their use of any information we share, however note that in these circumstances, we do not share any information that directly identifies any individual (such as names or contact information), but we only share pseudonymized information.

Your rights

As patient safety is very important, we retain all the information we gather about you as a result of an adverse event report to ensure that we can properly assess the safety of our products over time.

For Europe: You may be entitled under applicable law to ask Swixx Biopharma for a copy of your information, to correct it, erase or restrict its processing, or to ask us to transfer some of this information to other organizations. You may also have rights to object to some processing. These rights may be limited in some situations – for example, where we can demonstrate we have a legal requirement to process or keep your personal data. You may exercise these rights by contacting Swixx Biopharma EU Data Protection Officer at data@swixxbiopharma.com

Please note that for legal reasons, we cannot delete information that has been collected as part of an adverse event report unless it is inaccurate. Also, we may require you to provide proper identification before we comply with any request to access or correct Personal Data.

We hope that we can satisfy any queries you may have about the way in which we process your personal data. If you have any concerns about how we process your Personal Data, you can get in touch with Swixx Biopharma Data Protection Office: for Europe, please contact us at data@swixxbiopharma.com

Security

Swixx Biopharma takes measures to secure Personal Data from accidental loss and from unauthorized access, use, alteration, or disclosure. Additionally, we take further information security measures including access controls, stringent physical security and robust information collection, storage & processing practices.

Contact Information

If, at any time, you have questions or concerns about this Privacy Notice, please send an e-mail data@swixxbiopharma.com