This Data Processing Agreement (the "Agreement") forms an integral part of the Terms of Use between the Subscriber and the Provider. It sets out the parties' respective obligations regarding the personal data that the Provider processes on behalf of the Subscriber through the PEC platform.
1. Parties, roles and scope
The "Subscriber" is the pharmaceutical company that subscribes to the PEC platform to run Patient Support Programs. It acts as the Data Controller for the personal data it enters into the platform or that is collected on its behalf. The "Provider" is the operator of the platform and acts as the Data Processor on behalf of the Subscriber.
This Agreement applies to all personal data processed by the Provider on behalf of the Subscriber in the course of providing the service ("Subscriber Data"). It does not apply to the personal data of platform users that the Provider processes for its own account-management and security purposes, which is governed by the Privacy Policy.
2. Subject matter and duration
- Subject matter: hosting, storing and processing Subscriber Data so that the Subscriber can run Patient Support Programs through the platform.
- Nature: collection, recording, organization, storage, consultation, modification, retrieval, transmission over the network, backup and erasure, by automated means.
- Purpose: enabling the Subscriber to manage programs per country, patient journeys, enrollment, electronic consent, activities, adverse-event (pharmacovigilance) reporting, dispensations, the care network, reports and the audit log.
- Duration: for the term of the Subscriber's subscription and until the data is returned or deleted in accordance with Section 11.
3. Data subjects and data
Categories of data subjects:
- patients enrolled in Patient Support Programs;
- caregivers and relatives of patients;
- healthcare professionals and healthcare facilities in the care network;
- the Subscriber's staff and team members who use the platform.
Categories of personal data:
- identity and contact data, including the national ID number, which is stored as a keyed hash;
- program enrollment data and electronic consent records;
- data relating to activities, dispensations and follow-up;
- adverse-event report data;
- professional data of healthcare professionals and account data of the Subscriber's staff.
Special categories of data: the processing includes health data, such as diagnosis, treatment and adverse events. The Subscriber acknowledges that it is responsible for ensuring a valid legal basis for this processing and for obtaining any required consent from data subjects.
4. Documented instructions
The Provider processes Subscriber Data only on the documented instructions of the Subscriber, including this Agreement, the Terms of Use and the settings the Subscriber configures in the platform, unless required to do otherwise by applicable law; in that case the Provider informs the Subscriber of that legal requirement before processing, unless the law prohibits it.
Patient data is used solely to provide the service to the Subscriber. In particular, the Provider undertakes:
- not to use Subscriber Data for any analytics or purposes for its own benefit;
- not to sell, rent or otherwise monetize Subscriber Data;
- not to share or disclose it to any third party except as provided in this Agreement;
- not to use it to train any artificial intelligence or machine learning models.
The Provider immediately informs the Subscriber if, in its opinion, an instruction infringes applicable data protection law.
5. Confidentiality of personnel
The Provider ensures that only authorized personnel whose duties require it have access to Subscriber Data, that they are bound by a contractual or statutory duty of confidentiality, and that they receive appropriate data protection training. The duty of confidentiality continues after their engagement with the Provider ends.
6. Security measures
The Provider implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in particular given the nature of health data, including:
- strict isolation between Subscribers, so that each company's data is confined to its own workspace;
- encryption in transit (HTTPS) and encryption at rest for sensitive fields;
- separation of patient identifying data (PII) from clinical data, with national ID numbers stored as a keyed hash;
- two-factor authentication and session management;
- role-based access control and application of the principle of least privilege;
- a full audit log of changes;
- regular backups and restoration testing;
- rate limiting and malware scanning of uploaded files;
- vulnerability management, including timely updating of components and application of security patches.
The Provider may update these measures provided that the overall level of protection is not reduced.
7. Sub-processors
The Subscriber authorizes the Provider to engage the following sub-processors:
- [hosting provider]: infrastructure and data storage.
- [email provider]: delivery of transactional emails.
The Provider enters into a written contract with each sub-processor imposing data protection obligations no less protective than those in this Agreement, and remains liable to the Subscriber for the performance of the sub-processors' obligations.
The Provider notifies the Subscriber in advance of any addition or replacement of a sub-processor. The Subscriber may object to the change on reasonable data protection grounds within a reasonable period after the notice. If no solution can be found, the Subscriber may terminate the affected service.
8. Personal data breaches
The Provider notifies the Subscriber of any personal data breach affecting Subscriber Data without undue delay and at the latest within 72 hours of becoming aware of it. The notification includes, to the extent available:
- a description of the nature of the breach, including the categories and approximate number of data subjects and records concerned;
- the name and contact details of the contact point from whom more information can be obtained;
- a description of the likely consequences of the breach;
- a description of the measures taken or proposed to address the breach and mitigate its effects.
Where it is not possible to provide all the information at the same time, it may be provided in phases without undue further delay. The Provider cooperates with the Subscriber to enable it to meet its obligations to notify authorities and data subjects.
9. Data location and transfers
Subscriber Data is stored in [country of hosting]. The Provider will not transfer it outside that country without prior notice to the Subscriber and appropriate safeguards in accordance with applicable law.
10. Assistance to the Subscriber
Taking into account the nature of the processing and the information available to it, the Provider provides reasonable assistance to the Subscriber with:
- responding to requests from data subjects exercising their rights, including through the platform's features. If the Provider receives a request directly, it forwards it to the Subscriber and does not respond itself;
- carrying out data protection impact assessments (DPIAs) and prior consultations where required;
- cooperating with competent supervisory and regulatory authorities.
11. Return and deletion of data
At the end of the subscription, the Provider enables the Subscriber to export its data in a structured, commonly used format. The Provider then deletes Subscriber Data, including existing copies, within thirty (30) days, and provides written certification of deletion upon the Subscriber's request. This excludes data that applicable law requires the Provider to retain, which remains protected under this Agreement and is processed only for the purpose requiring its retention. Backups are deleted in accordance with their normal rotation cycle.
12. Audit rights
The Provider makes available to the Subscriber all information necessary to demonstrate compliance with this Agreement, including relevant security documentation. The Subscriber, or an independent auditor it appoints who is bound by confidentiality, may also conduct an audit under the following conditions:
- reasonable prior written notice of at least thirty (30) days;
- no more than once per year, unless a personal data breach has occurred or a supervisory authority requires it;
- the audit is conducted during normal business hours without disrupting the service or compromising the confidentiality of other Subscribers' data;
- the Subscriber bears the costs of the audit unless it reveals a material breach.
13. Liability and precedence
Each party's liability under this Agreement is subject to the terms and limitations set out in the Terms of Use, unless applicable law provides otherwise. In the event of any conflict between this Agreement and the Terms of Use regarding data protection, this Agreement prevails.
14. Duration
This Agreement takes effect on the date the Terms of Use are accepted, remains in force for the term of the subscription, and continues thereafter for as long as the Provider holds any Subscriber Data. Obligations which by their nature are intended to survive, such as confidentiality and deletion, survive the termination of this Agreement.