This Privacy Policy explains how the personal data of PEC platform users is collected, used, retained and protected. It applies to employees of subscribing pharmaceutical companies and members of their teams. Please read it carefully.
1. Who we are and scope
PEC is a software-as-a-service platform that enables pharmaceutical companies (each a "Subscriber") to run Patient Support Programs, including programs per country, patient journeys, enrollment, electronic consent, activities, adverse-event (pharmacovigilance) reporting, dispensations, care network, reports and audit log. In this policy, "we", "us" or the "Provider" means the operator of the platform.
This policy covers only the personal data of the platform's users themselves. Data about patients, caregivers and healthcare professionals entered into the platform by a Subscriber is processed by us on behalf of and on the instructions of the Subscriber, as a data processor, under the Data Processing Agreement concluded with that Subscriber, which is the data controller for that data. To exercise any right relating to patient data, please contact the pharmaceutical company concerned directly.
2. Data we collect
We collect the following categories of data, and only to the extent necessary:
- Identity and contact data: name, work email address, telephone number and job title.
- Organization data: the name of the Subscriber, country, and the role and permissions assigned to the user within the workspace.
- Account and security data: sign-in and sign-out records, IP address, device and browser type, active sessions, security events (such as failed sign-in attempts and password changes) and the data required for two-factor authentication.
- Usage data: actions recorded in the audit log, such as the creation, modification or deletion of records, with their date and author.
We never store passwords in plain text; they are kept only in hashed form.
3. Purposes and legal bases
- Providing the service: creating and managing accounts and enabling users to use the platform, on the basis of the performance of the contract with the Subscriber and our legitimate interest in delivering a sound service.
- Security and fraud prevention: identity verification, two-factor authentication, rate limiting, malware scanning of uploaded files and detection of suspicious activity, on the basis of our and the Subscriber's legitimate interest in protecting the platform and its data.
- Support: answering requests and resolving incidents, on the basis of the performance of the contract and our legitimate interest.
- Legal obligations: complying with applicable law and responding to lawful requests from competent authorities.
- Service communications: sending necessary account messages, such as password resets, security alerts and notices of changes to the terms, on the basis of the performance of the contract.
We do not use your data for advertising, and we do not make decisions about you based solely on automated processing.
4. Retention periods
- Account data: for as long as the account is active, then for a defined period after its closure or the end of the Subscriber's subscription, not exceeding what is necessary to wind down the contractual relationship and meet legal obligations.
- Security and sign-in logs: twelve (12) months as a general rule.
- Audit log: for the period set by the Subscriber or required by applicable law, as it forms part of the Subscriber's regulatory records.
When the retention period expires, the data is deleted or irreversibly anonymized.
5. Who we share it with
We never sell or rent your personal data. We share it only with the following recipients, and only to the extent necessary:
- Hosting provider: to operate the platform and store data.
- Email delivery provider: to send service messages.
- Professional advisers: such as lawyers and auditors, who are bound by a duty of confidentiality.
- Competent authorities: where disclosure is required by law or by court order.
Authorized administrators of the Subscriber can also see the data of users in their workspace, within the limits of their permissions.
6. International transfers
We aim to store data within a defined geographic location. Where personal data must be transferred to another country, this will take place only with appropriate safeguards in accordance with applicable law, such as standard contractual clauses or adequacy decisions issued by the competent authorities.
7. Security
We apply appropriate technical and organizational measures to protect data, including:
- strict isolation between Subscribers, so that each company's data is confined to its own workspace;
- two-factor authentication and role-based permissions;
- a full audit log of changes;
- encryption in transit (HTTPS) and encryption at rest for sensitive fields;
- regular backups, rate limiting and malware scanning of uploaded files;
- session management, allowing you to sign out your sessions on other devices.
No system can guarantee absolute security, however. Please notify us immediately of any suspicious use of your account.
8. Your rights
Subject to applicable law, you have the right to:
- access your data and obtain a copy of it;
- rectify inaccurate or incomplete data;
- request the deletion of your data;
- request the restriction of processing;
- object to processing based on legitimate interest;
- receive your data in a structured, commonly used format (portability);
- withdraw your consent at any time where processing is based on it, without affecting the lawfulness of prior processing;
- lodge a complaint with the competent data protection supervisory authority.
To exercise these rights, please write to us at the email address shown at the bottom of this page. We may ask you to verify your identity before acting on the request, and we will respond within the period required by law. Where your account belongs to a Subscriber, we may refer your request to that Subscriber where appropriate.
9. Cookies
We use only the cookies and local storage that are strictly necessary for the platform to work:
- Session cookie: to keep you signed in.
- CSRF protection cookie: to secure forms against cross-site request forgery.
- Language preference: to display the platform in the language you selected.
- Theme preference: stored in your browser to display the light or dark theme.
We use no advertising trackers and no third-party analytics tools for marketing purposes.
10. Changes to this policy
We may amend this policy from time to time. Any change will be published on this page with an updated date, and for material changes we will notify users by appropriate means before they take effect.
11. Contact us
For any question about this policy or the processing of your personal data, please contact us at the email address shown at the bottom of this page.