Privacy Policy

PRIVACY POLICY

This Privacy Policy describes how we process personal data to monitor drug safety (pharmacovigilance) and handle medical inquiries and product complaints. When we refer to ourselves as “we" or "us" or "VIVUS," we mean VIVUS B.V. Strawinskylaan 4117, Office #03-106, 1077 ZX Amsterdam and all of our group companies.

PURPOSES OF PROCESSING, CATEGORIES OF PERSONAL DATA, LEGAL BASIS

VIVUS has an obligation to monitor the safety of all pharmaceutical products that VIVUS develops and markets. This includes processing for the following purposes using the following categories of personal data.

1. Pharmacovigilance

We process personal data for safety reasons (Pharmacovigilance). Pharmacovigilance means activities aimed at detecting, evaluating, understanding and preventing adverse effects of pharmaceutical products, including prescription drugs. VIVUS is obliged under various laws to monitor and report adverse effects associated with VIVUS products in order to protect public health and ensure high standards of quality and safety.

For this purpose, we process personal data in order to investigate the adverse event, combine the information with information about other adverse events to analyze the safety of VIVUS products and provide reports to the relevant regulatory authorities for their analysis.

For Pharmacovigilance purposes we process the following categories of personal data:

• Data about the individual reporting an adverse event such as contact information (name, address, email etc.) or his/her occupation;
• Information about the individual that experienced an adverse event (depending on the information provided by the reporter) such initials, demographic information (age group, gender, weight, or height);
• Information received from reporter about the adverse event (including special categories of personal data, in particular health data) such as information about the VIVUS product and dosage, duration of use, changes to usual dosage or other circumstances, related treatment, other medications, actual or potential effects of adverse event reactions of the patient, suspected cause of the adverse event, including dosage, reasons for use, or changes in usual regimen including documents such as laboratory reports, medication histories, and medical histories; this data may include data about health

Processing for Pharmacovigilance purposes is done for reasons of public interest in the field of public health, such as ensuring high standards of quality and safety of medical products (Art. 6 (1) (c, e) and Art. 9 (2) (i) GDPR in conjunction with local legislation). The processing may also be in the legitimate interest of VIVUS to further improve VIVUS products (Art. 6 (1) (f) GDPR).

If personal data are transferred to health authorities in countries with a lower level of data protection than the European Economic Area (EEA), the legal basis is Art. 49 (1) (d) GDPR.

2. Medical Inquiries

We process personal data to respond to medical inquiries in connection with VIVUS products, record the inquiry for documentation purposes and future analysis as well to ensure the quality of our services and VIVUS products.

For this purpose, we process the personal data contained in the inquiries such as contact information of the person making the inquiry, the profession and, if applicable, information related to a specific case (treatment, weight, height, health data, dosage etc.).

As a rule, we will ask for your consent when contacting you (Art. 6 (1) (a) and 9 (2) (a) GDPR). In addition, it is our legitimate interest to record and analyze the inquiry for improvement of products/services as well as documentation and record-keeping requirements (Art. 6 (1) (f) GDPR).

How We Share Your Personal Data

VIVUS may share your personal data as follows:

1. Within Our Family of Companies

VIVUS LLC and its subsidiary companies may share your personal data amongst and between each other for the purposes set forth in this Privacy Policy.

2. With health authorities

We may share reports and our analysis of data about adverse events with health authorities worldwide (such as the FDA in the US or the EMA in the EU) to enhance public safety and comply with our legal obligations in those countries to report adverse events. If personal data are transferred to health authorities in countries with a lower level of data protection than the European Economic Area, the legal basis is Art. 49 (1) (d) GDPR.

3. With Providers

We may retain other companies and individuals to perform services on our behalf and we may collaborate with other companies and individuals with respect to particular products or services (collectively, “Providers”). Examples of Providers include IT hosting providers, or agencies that support the analysis of inquiries or reports about adverse events. Providers also include our co-promote partners for products and services that we jointly develop and/or market with other companies.

4. In Connection with Business Transfer

If we sell or transfer a business unit (such as a subsidiary) or an asset (such as a website) to another company (including in connection with any bankruptcy or similar proceedings), we will share your personal data with such company and will require such company to use and protect your personal data consistent with this Privacy Policy.

5. Sharing Personal Data outside of the EEA

We share your Personal Information with other recipient outside of the EEA under the following conditions:

• where the transfer is to a place that is regarded by the European Commission as providing adequate protection for your Personal Information; or
• where we have put in place appropriate safeguards to ensure that your Personal Information is protected (for example where both parties involved in the transfer have signed standard data protection clauses adopted by the European Commission or where the exporting company has committed to comply with privacy obligations set down under the EU-US Data Privacy Framework; or
• the above does not apply but we are still legally permitted to do so, for example if the transfer is necessary for the establishment, exercise or defence of legal claims or if we share with health authorities (Art. 49 (1) d) GDPR).

You can request further detail about the safeguards that we have in place in respect of transfers of Personal Information outside of the EEA by contacting us under the "Contact Us" section of this Privacy Policy.

Protection of Personal data

To help protect the privacy of personal data, we maintain physical, technical and administrative safeguards, such as locks, electrical surveillance systems, firewall, anti-malware and spam filtering systems, etc. We update and test our security technology on an ongoing basis. We restrict access to your personal data to those employees who need to know that information for performing their work. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of the personal data.

Retention of Personal Information

We will retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Because information relevant to pharmacovigilance is important for public health reasons, we retain personal data for pharmacovigilance purposes for at least 10 years after the product has been withdrawn from the last country in which the product was marketed.

Personal data of Children

Protecting the privacy of children is important. VIVUS does not intend to collect, process or use on our website any information relating to an individual whom we know to be under 18 years old without permission of the child’s parent or legal representative. Such legal representative has the right, upon request, to view the information provided by the child and/or to require that it be deleted. If your child has submitted personal information and you would like to request that such information be removed, please contact privacy@VIVUS.com

Your Rights

1. The right to be informed

You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we are providing you with the information in this Privacy Policy.

2. The right of access

You have the right to obtain a copy of your Personal Information (if we are processing it), and certain other information (similar to that provided in this Privacy Policy) about how it is used.

3. The right to rectification

You can ask us to take reasonable measures to correct your personal data if it is inaccurate or incomplete.

4. The right to erasure

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep using it or its use is unlawful. This is not a general right to erasure; there are exceptions, e.g., where we need to use your personal data in defence of a legal claim.

5. The right to restrict processing

You have rights to ‘block’ or suppress further use of your personal data when we are assessing a request for rectification or as an alternative to erasure. When processing is restricted, we can still store your personal data, but may not use it further. We keep lists of people who have asked for further use of their personal data to be ‘blocked’ to make sure the restriction is respected in future.

6. The right to data portability

You have rights to obtain and reuse certain personal data for your own purposes across different organisations.

7. The right to object

You have the right to object to processing based on Art. 6 (1) f) GDPR, on grounds relating to your particular situation, at any time insofar as that processing takes place for the purposes of legitimate interests pursued by us or by a third party. We will be allowed to continue to process your personal data if we can demonstrate “compelling legitimate grounds for the processing which override your interests, rights and freedoms” or we need this for the establishment, exercise or defence of legal claims.

VIVUS CONTACT INFORMATION:

VIVUS B.V.
Strawinskylaan 4117, Office #03-106,
1077 ZX Amsterdam
Data Protection Officer: privacy@VIVUS.com
Toll-Free Phone Number: 1-888-998-4887

Questions Regarding the Privacy Policy

If you have any questions about our Privacy Policy, or any concern about privacy at VIVUS Corporation, please contact us by e-mail at privacy@VIVUS.com.

We may update or revise this VIVUS Privacy Policy at any time. When we change the Privacy Policy in a material way, a notice will be posted on our website along with the updated Privacy Policy.