Pharmacovigilance Privacy Statement

This notice provides you with information on how Baxter entity (hereinafter "Baxter", "we", "our", or "us") registered as the Marketing Authorization Holder for the concerned medicinal product, together with its affiliates, successors, assignors and subcontractors as described in this Privacy Notice collects, stores, processes, uses and discloses your personal data for Adverse Event reporting and processing.

Types of Personal Information We Collect

This Statement only provides information on how Baxter collects, stores, processes, uses and discloses your personal data for Adverse Event reporting and processing, which includes but not limits to, your name (or patient’s name), contact information, medical history, drug history, medical assessments, laboratory data and other case related information.

For out-of-scope handling of personal data, or parts where this statement did not specify on how your personal data is collected, stored, processed, used and disclosed, please visit https://www.baxter.com.hk/policies-positions/global-privacy-policy.

Why we are collecting your personal data

Baxter will process your personal data for the following purposes:

1. collecting, detecting, assessing and preventing adverse events and monitoring of the safety of the medicinal products;
2. ensuring compliance to worldwide pharmacovigilance obligations, e.g. case follow-ups and reporting to regulatory authorities.

Baxter will process your personal data on the following basis:

1. if you are reporter of the adverse event concerning other person – on the basis that this is necessary to safeguard the safety of medicinal products;
2. if you are a patient reporting the adverse event or enquirer of the drug safety request – on the basis that it is necessary for reasons of your personal health or public interest in the area of public health.

The provision of your personal data is voluntary (unless you are a healthcare professional who is obliged to report adverse events), however if you do not provide your personal data we will not be able to address your query.

We will not use this information for any other purpose, unless we are legally obliged to do so (e.g. by regulatory authorities).

How long we keep your personal data

We will only retain your personal data for as long as we reasonably consider necessary for achieving the purposes set out above and as is required and/or permissible under applicable law.

After the retention period or when we reasonably consider it is no longer necessary to retain your personal data for achieving the purposes outlined in this Statement, we have the right to delete the personal data on our own, unless

1. it is legally forbidden by any law;
2. the data retention is necessary for public interest (including interest in the past).

With whom we may share your personal data

For the purposes outlined in this Statement, Baxter may transfer your personal data to other Baxter group companies and Baxter’s data processors acting on behalf of Baxter, such as providers of IT system administration and user support services and providers of adverse events processing services.

International Data Transfers

Some of the third parties referred to above may process your personal data outside of your country. The level of data protection in another country may not be equivalent to that in your country. However, we only transfer your personal data either to countries where the EU Commission has decided that they have an adequate level of data protection, or we take measures, for example, requirements in agreements, to ensure that all recipients provide an adequate level of data protection which comply with Cap. 486 The Personal Data (Privacy) Ordinance (the “Data Privacy Law”) of the laws of Hong Kong. We do this, for example, by entering into appropriate data transfer agreements. You can request information about such third parties as well as access copies of the agreements which Baxter entered with them by writing to [email protected]

Your rights

Under the premise of the Data Privacy Law, you have the right to:

• check whether we hold personal data about you, and if so for what purposes and what kind of personal data we hold about you, to access to your personal data and to request copies of that data,
• request rectification or erasure of your personal data that is inaccurate or processed for purposes not stated above,
• request us to restrict the processing of your personal data,
• in certain circumstances, object to the processing of your personal data (this will not affect the data processing that Baxter has already carried out based on previous consents),
• request information on the identities or categories of third parties to which your personal data are transferred,
• lodge a complaint with the data protection authority in your country.

Minors or Mentally Incapacitated Persons

We do not knowingly collect Personal Information from minors under the age of 18 and/or mentally incapacitated persons. If you are a minor under the age of 18 and/or mentally incapacitated person, please obtain the consent of parents or guardians before providing your personal information to us. If you think that we have collected Personal Information from a minor under the age of 18 and/or mentally incapacitated person, please contact us at [email protected].

Patient’s Personal Information

Please obtain the consent of the persons or their guardians before providing Personal Information concerning another person.

Data Controller

The controller responsible for processing your personal data is the entity registered as the Marketing Authorisation Holder for the concerned medicinal product, indicated in the patient information leaflet.

Please address your questions regarding your rights outlined in this Statement or the processing of our personal data with Baxter International Inc. or send an email to [email protected].