PRIVACY NOTICE FOR ADVERSE EVENTS, MEDICAL INQUIRIES, AND QUALITY REPORTING 

1. Purpose of This Notice 

This notice explains how DKSH Holding Ltd and its affiliates ("DKSH," "we," "us," or "our") collects and processes personal data when individuals report or submit information about: 

• Adverse Events (AEs) - to monitor the safety of medicinal products DKSH commercializes ("the Products"); 
• Medical Inquiries – to respond to requests for medical or scientific information regarding the products; and 
• Product Quality Issues - to assess and address product quality complaints, 

We are committed to monitoring the safety and quality of our Products and to complying with all applicable pharmacovigilance, medical information, and quality reporting obligations under the laws and regulations of the countries in which we operate. 

This notice applies to all reporters, including: 

• Patients reporting their own adverse events and/or product concerns; 
• Caregivers and other individuals reporting on behalf of a patient; 
• Healthcare professionals submitting reports in a clinical or professional capacity; and 
• Any individuals submitting a product quality report and/or medical inquiry. 

2. Name and details about the Data Controllers 

While DKSH Holding Ltd, with its registered office at Wiesenstrasse 8, Zurich, Switzerland is acting in its capacity as data controller for the processing activities related to the management of dksh.com main website, which is governed by Privacy Notice for Website. 

For the collection and initial intake of AEs, medical inquiries, and product quality reports submitted through our channels, DKSH Holding Ltd along with the relevant DKSH affiliate operating in your market act as joint controllers together with the applicable marketing authorization holder ("MAH"). 

Following intake, the MAH or the relevant DKSH Affiliate acts as the sole controller responsible for the assessment of the report, safety/quality evaluation, regulatory reporting, and retention of safety data, in accordance with its pharmacovigilance and quality obligations. 

3. Why We Collect Your Personal Data 

Depending on the nature of your report or inquiry, we collect your personal data for the following purposes: 

3.1 Adverse Event Reporting 

• To fulfil our legal and regulatory obligations under applicable pharmacovigilance requirements in the countries where we operate; 
• To fulfil contractual obligations, which may include reporting the adverse event to the product owner or marketing authorization holder; 
• Investigate and assess reported adverse events; 
• Submit mandatory safety reports to the relevant regulatory and health authorities; 
• Maintain safety records for public health purposes; and 
• Contact you for follow-up information if needed to complete the safety assessment. 

2.2 Medical Inquiries 

• Respond to your request for medical or scientific information; 
• Maintain records of inquiries and responses as required by applicable regulatory and quality standards; 
• Identify potential safety signals or product concerns that may require pharmacovigilance follow-up; and 
• Fulfil any regulatory documentation obligations applicable to medical information activities. 

2.3 Product Quality Issues

• Investigate the reported quality concern; 
• Take corrective and preventive actions, including product recalls where required; 
• Submit mandatory quality or safety reports to the relevant regulatory and health authorities; 
• Maintain records of complaints as required by applicable quality standards; 
• Notify the product owner, marketing authorization holder, or manufacturer, as appropriate; and 
• Contact you for follow-up information or to confirm the outcome of our investigation. 

3. Legal Basis for Processing 

We process your personal data on one or more of the following grounds, depending on the applicable laws of the country in which you are located: 

• Compliance with a legal obligation — where processing is required to meet our regulatory or statutory pharmacovigilance, quality, or medical information obligations; 
• Legitimate interests — where processing is necessary for our legitimate interests in maintaining product safety, quality, and regulatory compliance, and where those interests are not overridden by your rights and interests; 
• Consent — where required by the laws of your country, we will seek your consent before collecting or using your personal data, and you will have the right to withdraw that consent at any time without affecting the lawfulness of any prior processing; and 
• Public interest in the area of public health — where processing is necessary to protect public health, ensure product safety, or prevent harm to individuals or the public. 

Where processing is required by law or mandated by applicable pharmacovigilance regulations, your consent is generally not required.  

If personal data is not collected directly from the patient, we may not always be able to inform them individually, in accordance with applicable law, due to legal obligations and the need to protect public health. In all other cases, individuals whose data we collect will be informed through this notice or through a direct communication at the time of collection. 

4. What Personal Data We Collect 

We apply the principle of data minimization and collect only the personal data that is necessary for the purposes described in this notice. 

4.1 Adverse Event Reporting 

If You Are the Patient (Self-Reporter): 

• Your initials; 
• Contact details (e.g., email address, phone number); 
• Country/Location for Adverse Event Reporting; 
• Age and gender; 
• Product details; 
• If necessary, medical history and treatment details; 
• Description of the adverse event; and 
• If necessary, other health-related data relevant to the report. 

If You Are a Healthcare Professional, Caregiver, Friend/Relative or any other Individual Reporting on behalf of the Patient: 

• Your initials, contact details, and relationship to the patient; 
• Country/Location for Adverse Event Reporting; 
• The patient's initials, age, and gender; 
• Product details; 
• If necessary, medical history and treatment details; 
• Description of the adverse event; and 
• If necessary, other health-related data relevant to the report. 

4.2 Medical Inquiry 

• Your first name and last name; 
• Contact details (e.g., email address, phone number); 
• Country where you are located; 
• Details of the inquiry, including the product name, the medical or scientific question posed, and any relevant clinical context; and 
• Any health data incidentally disclosed in the course of the inquiry (e.g., a description of a patient case);  

4.3 Product Defects / Quality Complaints 

• Your name and contact details (e.g., email address, phone number); 
• Country where you are located; 
• Product name and batch number/lot number; 
• Description of the defect or quality concern, and any other information you provide to us in your message; 
• If necessary, images of the defect or quality concern in the products or any other information related to the report. 

We only collect the minimum data necessary to fulfil our obligations. 

5. How We Use Your Data 

5.1 Adverse Events 

Your data is used to: 

• Document and analyse the adverse event; 
• Fulfil contractual obligations to the product owner; 
• Maintain records in our safety database; 
• Contact you for follow-up information if needed; and 
• Submit reports to the relevant regulatory and health authorities. 

5.2 Medical Inquiries 

Your data is used to: 

• Route and respond to your inquiry through the appropriate medical affairs or medical information channel; 
• Generate and document an accurate and compliant medical response; 
• Maintain a record of the inquiry and response for regulatory and quality purposes; 
• Identify and escalate any potential safety signals contained within the inquiry for pharmacovigilance processing; and 
• Track patterns or trends in medical inquiries for product safety or labelling review purposes. 

5.3 Product Defects / Quality Complaints 

Your data is used to: 

• Acknowledge receipt of your complaint and initiate a formal investigation; 
• Trace and analyse the reported product or batch; 
• Coordinate corrective and preventive actions with the product owner, manufacturer, or regulatory authority; 
• Submit mandatory quality defect reports or field safety notices to health authorities; 
• Manage any potential recall or market withdrawal procedures; and 
• Contact you for follow-up information, to confirm investigation outcomes, or to facilitate return or replacement of the defective product where applicable. 

6. Data Sharing 

6.1 Recipients of Your Data 

In certain cases, we may be contractually or legally obligated to share your data with relevant third parties such the product owner or marketing authorization holder. This sharing is strictly limited to fulfilling the purposes described in this notice and is conducted under appropriate safeguards, including contractual protections, data minimization and pseudonymization where feasible. 

We may share your data with: 

• Regulatory and health authorities — where we are required by law to submit safety, quality, or pharmacovigilance reports; 
• Product owners or marketing authorization holders — where required by our contractual pharmacovigilance or quality agreements; 
• Manufacturers or contract manufacturers — for the purposes of quality investigation and corrective action; 
• Co-marketing or licensing partners — where required by applicable safety data sharing obligations; 
• Service providers supporting pharmacovigilance, medical information, or quality management activities — including safety database vendors and data processing partners; and 
• Courts, tribunals, or law enforcement bodies — where required by applicable law. 

6.2 International Data Transfers 

Where your data is transferred to recipients in countries other than your country of residence, we ensure that such transfers are protected by appropriate safeguards in accordance with the laws applicable in your jurisdiction. These safeguards may include contractual protections, data transfer mechanisms recognized by applicable law, or equivalent measures that ensure an adequate level of protection for your personal data. 

Certain recipients involved in pharmacovigilance activities may be located outside Switzerland. These recipients may include affiliated companies, marketing authorization holders, licensors, licensees, distributors, pharmacovigilance service providers and regulatory authorities located in Switzerland, the EEA, the United Kingdom and other jurisdictions where product safety activities are carried out.  

Some of these jurisdictions are recognized by Switzerland as providing an adequate level of data protection (e.g. the EU member states). Where this is not the case (e.g. an AE report filed in Thailand), we implement appropriate safeguards, including the Standard Contractual Clauses recognized under Swiss law and, where required, supplementary technical and organizational measures.  

7. Data Retention 

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy applicable legal, regulatory, and contractual obligations. 

• Adverse event records are retained for the minimum period prescribed by applicable pharmacovigilance regulations in the relevant jurisdiction, which is typically at least 10 years following the expiry of the product's marketing authorization, or longer where required by local law. 
• Medical inquiry records are retained for the period required by applicable regulatory guidelines and quality standards, and for as long as necessary to address any pharmacovigilance follow-up arising from the inquiry. 
• Product defect and quality complaint records are retained for the period prescribed by applicable quality regulations, which typically extends beyond the product's shelf life or expiry date, and at least for the period required by applicable law. 

Following the expiry of the applicable retention period, personal data will be securely deleted or anonymized, unless retention is required for the establishment, exercise, or defense of legal claims. 

9. Your Rights 

Depending on the laws applicable in your country, you may have some or all of the following rights in relation to your personal data: 

• Right of Access — to obtain a copy of the personal data we hold about you; 
• Right to Rectification — to request correction of inaccurate or incomplete personal data; 
• Right to Erasure — to request deletion of your personal data, subject to any legal obligations that require us to retain it; 
• Right to Restriction — to request that we limit the processing of your personal data under certain circumstances; 
• Right to Object — to object to processing carried out on the basis of legitimate interests; 
• Right to Data Portability — to receive your personal data in a structured, commonly used format, where applicable; 
• Right to Withdraw Consent — where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal; and 
• Right to Complain — to lodge a complaint with the relevant data protection or privacy authority in your country. 

Please note: Due to mandatory legal obligations in the area of pharmacovigilance, product quality, and public health, we may not be able to fulfil certain requests — in particular requests for erasure or objection — where processing is required by law or is necessary for reasons of public health. We will assess each request on its individual merits and respond within the timeframes required by applicable law. 

Where processing is carried out under joint controllership, DKSH Holding Ltd will act as your primary point of contact and will coordinate with the relevant DKSH Affiliate as necessary to respond within the timeframes required by applicable law. 

10. Contact Us 

If you have any questions about this notice, wish to exercise any of your rights, or have concerns about how we handle your personal data, please contact us at: 

DKSH Holding  Ltd. 
Wiesenstrasse 8 
8034 Zurich 
Switzerland 

Online communication channel for  privacy inquiries  or  dataprotection@dksh.com. 

You also have the right to contact the relevant data protection or privacy authority in your country if you believe your personal data has been processed in a manner that is inconsistent with applicable law.