Privacy Policy

1. Data Protection at Parexel

Data protection is an important issue for us, Parexel International GmbH (hereinafter referred to as "we" or "Parexel"). As a service provider in the area of clinical pharmacology, it goes without saying that our activities comply with the regulations of the EU General Data Protection Regulation (GDPR) as well as other statutory data protection regulations, about which you can find more information, for example, at www.bfd.bund.de.

The purpose of this Privacy Policy is to inform you as a user of the compassionate use program portal https://myaccessprograms.parexel.com as well as interested doctors (hereinafter "you" or "the user") and the public about the legal basis by which, the method with which, the extent to which and the purpose for which we, as the processor on behalf of the initiator of the compassionate use program (the manufacturer of the drug), process personal data when you visit and use our compassionate use program portal, and the rights that you are entitled to as data subjects.

2. Contact Details for the Controller

The controller within the meaning of Art. 4 No. 7 GDPR and other national data protection laws of the member states is the initiator of the compassionate use program (the manufacturer of the drug). You can find the contact details for the controller in the contract you have concluded with them or, alternatively, you are welcome to request these details from us.

3. Contact Details for the Processor

The processor within the meaning of Art. 4 No. 8 GDPR and other national data protection laws of the member states is:

Parexel International GmbH

Klinikum Westend, Haus 31

Spandauer Damm 130

14050 Berlin, Germany

Email: cls-support@parexel.com

Website: https://myaccessprograms.parexel.com/

You can contact our data protection officer by email at EU_DPO@PAREXEL.comor via our postal address, marked for the attention of "The Data Protection Officer."

4. Important Information for Patients, Parents or Carers of a Patient

Compassionate use programs provide access to unauthorized medicines and are intended for patients with severe or life-threatening diseases, for whom there is no comparable or satisfactory alternative treatment, and who cannot enroll in a nearby clinical trial.

Inquiries received directly from patients or their caregivers cannot be answered via this website, since Parexel, as the processor, would be unable to assign such an inquiry to the personal data stored about you in this portal by your doctor. (This information is available only in a coded/pseudonymized format that does not allow Parexel to identify you directly).

If you are a patient, parent or carer of a patient and are looking for information about the availability of an unauthorized drug in your country, please discuss this with your doctor in order to contact the manufacturer of a potentially eligible drug.

If you are a participant in a compassionate use program and would like to obtain information about your personal data processed by Parexel, please contact your attending doctor. This is because:

• Only your attending doctor can enter the information about you required to carry out the compassionate use program via the portal in the compassionate use program database operated by Parexel in Germany.
• This information is processed only in a coded/pseudonymized format in the database used by the portal.
• This coded/pseudonymized information does not allow Parexel to identify you directly, which means that Parexel is unable to answer inquiries about the information entered by your attending doctor.

5. Scope of the Processing of Personal and Other Data

We collect and process your personal data as a data subject only as far as this is necessary in order to provide a functional portal and for the use of the functions of the compassionate use program database made available via this portal.

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, your address and communication details or your email address.

Processing means any operation or series of operations carried out with or without the aid of automated procedures relating to personal data, such as collection, recording, organization, arrangement, storage, modification or amendment, reading, querying, use, disclosure through communication, distribution or any other form of provision, comparison or interlinking, restriction, deletion or destruction.

The data subject is any identified or identifiable natural person whose personal data is processed by the controller or its processor.

With regard to the terminology used, we also refer to the definitions in Art. 4 GDPR. The terms used are to be understood to be gender-neutral.

The processing of personal data takes place exclusively on a legal basis and—if there is no such legal basis for the specific processing—with your consent as the data subject.

In some cases, we use external service providers to process your data. These providers have been carefully selected and commissioned by us, are bound by our instructions and are checked regularly.

a) Scope of the processing of personal data when visiting our portal to obtain information

If you use our website purely for information purposes, we will collect only the personal data that your browser transmits to our server. We collect the following data, which is technically necessary for us to display our website to you as a visitor, and to ensure its stability and security:

• Your (pseudonymized) IP address
• The date and time of your request
• Access status/HTTP status code
• The volume of data transferred in each case
• Web page from which the request originates
• The browser you use
• Your operating system
• The language and version of your browser software
• The device you are using (PC, tablet or smartphone)
• Your screen resolution
• The duration of your visit to our website

The legal basis for the processing is Art. 6 para. 1 sentence 1(f) GDPR. Our legitimate interest is derived from the data collection purposes listed above. In no case will we use the collected data for the purpose of drawing conclusions about you as a person.

This data will not be stored together with any other personal data pertaining to you.

b) Scope of the processing of doctors' personal data when contacting us

If you contact us in your capacity as a doctor via the email address provided on our website, your email address and the personal data you provide will be stored and processed for the purposes of responding to your inquiry.

The legal basis of the processing is Art. 6 para. 1 sentence 1(f) GDPR. Our legitimate interest lies in the processing of the inquiry or message that you sent to us in your capacity as a doctor.

The personal data collected by us in connection with the contact will be automatically deleted after completion of the inquiry or message that you sent to us in your capacity as a doctor, unless the personal data was collected in connection with your participation in a compassionate use program. In this case, the retention period is limited to the termination of the contractual relationship to participate in a compassionate use program and, if applicable, to any legal retention and deletion periods.

This data will not be stored together with any other personal data pertaining to you.

c) Scope of processing when registering for a compassionate use program

If you register for a compassionate use program, we collect the following personal and non-personal data:

• From you in your capacity as a participating doctor
  • Your first and last name
  • Your street and house number
  • Your city and postal code
  • Your telephone/cell number
  • Your email address
  • Your IP address
  • The date and time of your request

• Patient-related information that you provide to Parexel in your capacity as a participating doctor:
  • Patient number
  • Year of birth
  • Sex

We collect the personal data that you provide to us to initiate your contractual participation in a compassionate use program on behalf of the initiator of the compassionate use program (the manufacturer of the drug), to contact you in the event of any queries and discuss further details of participation with you. The legal basis for the processing of data for the aforementioned purposes is Art. 6 para. 1 sentence 1(b) GDPR.

6. Disclosure of Personal Data

Your data will not be transmitted to third parties for purposes other than those listed below. We will share your data with third parties only if:

• You have given your explicit consent for us to do so pursuant to Art. 6 para. 1 sentence 1(a) GDPR.
• This is necessary for the processing of contractual relationships with you pursuant to Art. 6 para. 1(b) GDPR.
• There is a legal obligation to pass on data pursuant to Art. 6 para. 1(c) GDPR.
• Pursuant to Art. 6 para. 1 sentence 1(f) GDPR, the disclosure is necessary for the establishment, exercise or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.

In such cases, however, the amount of data transmitted is limited to the minimum required. Data will be transmitted to third countries only if Parexel has been commissioned to do so by the initiator of the compassionate use program (the manufacturer of the medicinal product).

7. Your Rights as a Participating Doctor

At your request pursuant to Art. 15 GDPR, we will be happy to inform you whether and what personal data is stored pertaining to you as a participating doctor, including, but not limited to, the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of an automated decision-making process including profiling.

As a participating doctor, you also have the right pursuant to Art. 16 GDPR to have any incorrect personal data corrected or any incomplete data completed.

Furthermore, as a participating doctor, you have the right pursuant to Art. 18 GDPR to request that we restrict the processing of your data, provided the legal requirements for this are met.

As a participating doctor, you have the right pursuant to Art. 20 GDPR to receive the personal data pertaining to you in a structured, commonly used and machine-readable format or to request that your personal data be transferred to another controller.

In addition, as a participating doctor, you have the right pursuant to Art. 17 GDPR to be "forgotten". This means that you can ask us to delete your personal data, provided the legal requirements for this are met.

Irrespective of this, we will automatically delete your personal data and the information you provided about your participating patients if the purpose of the data collection has ceased to apply or if the data processing was carried out illegally.

As a participating doctor, you also have the right pursuant to Art. 21 GDPR to object at any time to the processing of your personal data, provided that a right of objection is provided for by law. In the event of an effective withdrawal, your personal data will also be automatically deleted by us.

If you wish to exercise your right of withdrawal or objection, please send an email to cls-support@parexel.com.

In the event of violations of the data protection regulations, you are entitled to make a complaint to the competent supervisory authority pursuant to Art. 77 GDPR. The data protection authority responsible for us is:

The Berlin-based Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin, Germany. (https://www.datenschutz-berlin.de/buergerinnen-und-buerger/ihre-beschwerde-bei-uns/)

8. Use of Cookies

We use cookies on our website. These are small text files that your browser creates automatically and that are stored on your device when you visit our website.

When you visit the website for the first time, we will inform you that we use cookies. If you continue with your visit to the website, you agree to the use of cookies.

A cookie stores information that results in connection with the specific device used. However, this does not mean that we will immediately learn of your identity.

The use of cookies is primarily intended to make the use of our website a more pleasant experience for you. For example, we use session cookies to recognize that you have already visited individual subpages of our website. These session cookies are automatically deleted when you leave our website. We also use temporary cookies, which are stored on your device for a specified period of time, to optimize the user experience. If you visit our website again to take advantage of our services, the cookies will automatically recognize that you have visited the site previously and remember the entries and settings that you made so that you do not have to re-enter these details.

9. Deletion of Data and Storage Period

Personal data pertaining to you as a data subject will generally be deleted or blocked as soon as the purpose for data storage no longer applies.

Your personal data may be stored beyond this if this has been provided for by the European or national legislator in EU directives, laws or other regulations to which the controller is subject.

The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless it is necessary to continue to store the data for the purposes of concluding or fulfilling a contract.

If you would like your data to be deleted, please send an email to cls-support@parexel.com. In this case, the personal data will be completely and permanently deleted. If data has to be retained for legal reasons, it will be restricted in terms of processing until it is finally deleted and thus blocked. The data will then no longer be available for further use.

10. Data Security

Our website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries or applications to join a compassionate use program, that you send to us as the website operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the padlock symbol in your browser line.

If SSL or TLS encryption is enabled, the data that you send to us cannot be read by third parties.

11. Changes to our Privacy Policy

We reserve the right to amend this Privacy Policy from time to time to ensure that it is consistent with current legal requirements or to incorporate changes to our services in the Privacy Policy. In this case, the current Privacy Policy will then apply to your next visit and use of our website.

Last updated: 15-Dec-2021

Version 1.0