Below you will find some of the more essential policies for safeguarding the privacy of your data when interacting with Sobi.
This privacy notice applies to personal information collected by Swedish Orphan Biovitrum AB (“Sobi”) during an interaction between you and Sobi. The interaction with Sobi may take place in different ways, e.g., via a Sobi controlled webpage or thru a physical meeting with a Sobi representative. Please read this privacy notice carefully and feel free to contact us if you have any questions.
This privacy notice explains what personal information may be collected and processed about you and how Sobi may use that information. It also includes a description of your rights related to Sobi’s use of your personal information.
This privacy notice applies to personal information collected when you interact with global Sobi entities, including Swedish Orphan Biovitrum AB. For country-specific privacy notices please visit the relevant local site.
Swedish Orphan Biovitrum AB (publ) (“Sobi”), with registered offices at SE-112 76 Stockholm, Sweden, e-mail address firstname.lastname@example.org, is responsible for the processing of your personal information in scope of this notice as it decides why and how it is processed, thereby acting as the “data controller” of such personal information.
Legal basis for processing
Sobi may process your personal data based on Sobi’s legitimate interest, when necessary to provide services, respond to questions you may have submitted, or to maintain websites and other services. Collection and use of personal information may in some situations require Sobi to ask for, and obtain consent, before personal information is collected and used. If the consent concerns a child under the age of 16 (or such other lower age determined by the local laws where you live), consent must be given by an authorized person with parental responsibility for the child.
How we may collect personal information
The personal information collected by Sobi may be information you voluntarily disclose, such as e.g., information provided in contact forms or in registration pages on websites. Sobi may also collect certain personal information that does not directly identify you, but which makes identification possible through the combination of other information or identifiers such as your company name and position.
When you interact with Sobi, we may also collect and use personal information which you do not yourself disclose, such as computer or device serial numbers and IP addresses, as part of being able to provide services.
How we will use your personal data
By providing your personal information to us, you agree that, where it is permitted by local law, we may use the information:
- to respond to your questions or requests for information
- to provide you with information that you have requested
- to improve our level of service
- to comply with local laws, for example reporting adverse event information
- to consider your application for employment
- for our own administrative and quality assurance purposes
- for other purposes that may be detailed on the website or mobile application or otherwise agreed between Sobi and you
We will only use the personal information collected from you for the purposes for which it is collected. Personal information collected for purposes other than marketing will not be used for marketing. When legally required, Sobi ensures that consent is obtained prior to sending marketing information.
In the course of our activities and for the same purposes as those listed in this privacy notice, your personal information can be accessed by, or transferred to the following categories of recipients on a need to know basis to achieve such purposes:
- our personnel (including personnel, departments or consultants),
- our independent agents or brokers (if any),
- our other suppliers and services providers that provide services and products to us,
- our IT systems providers, cloud service providers, database providers and consultants,
- any third party to whom we assign or novate any of our rights or obligations, and
- our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.
Sobi is responsible for any processing by such third parties and will ensure that such contractors have entered into written agreements allowing Sobi to comply with our obligations under this privacy notice and applicable laws. Your personal information will not be disclosed to any other third parties unless you have explicitly given your consent to such disclosure or if it is required by law.
Transfer of data outside the EEA
The personal information collected by Sobi may be made accessible or transferred to to the recipients listed above. Such recipients may be located in other countries, including countries outside the European Economic Area (“EEA”). The level of legal protection for personal data is not the same in all countries and may not provide the same level of protection as the data protection laws in the EEA or of the country in which you live. In case of such transfer, Sobi will take reasonable efforts and security measures in an effort to keep your information secure, and Sobi is responsible to ensure that the transfer takes place by means of Standard Contractual Clauses or EU Model Clauses or another method in accordance with applicable law. You may contact us by using this webform if you have any questions about the methods we use to safeguard any personal information transferred outside the EEA.
Security of personal information
We take reasonable steps to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration or destruction by using security precautions that provide for industry standard protection. However, no data stored or transmitted over the Internet can be guaranteed to be completely secure. As a result, to the extent permitted under applicable law, we make no warranty, express or implied, concerning the security or integrity of any personal information.
Retention and erasure of personal information
We will retain your information only for the period necessary to fulfil the purposes outlined in this privacy notice or the period to which you have consented unless a longer retention period is required by law.
Information regarding your rights
Whenever we process your personal information, we take reasonable steps to keep your personal information accurate and up-to-date for the purposes for which it is collected. We will provide you with the ability to exercise the following rights under the conditions and within the limits set forth in the applicable law:
- the right to be informed about what personal information we have about you and how we process your it,
- the right to access your personal information processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating,
- the right to request the erasure of your personal information or the restriction thereof to specific categories of processing,
- the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal,
- the right to object, in whole or in part, to the processing of your personal information. With certain exceptions, this includes the right to object to direct marketing,
- the right to request a data portability, i.e., that the personal information you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations, and
- the right to object to automated decision-making including profiling resulting in a significant or legal effect, i.e., you can request a human intervention in any automated decision-making process related to processing of your data resulting in a significant or legal effect, and where such processing is not based on your consent, authorized by law or necessary for the performance of a contract.
If you have any questions, requests or complaints about how we process your personal information, please contact us by using this online webform.
If you have any comments or complaints regarding the way your personal data is being handled, you have the right to contact the supervisory authority in Sweden (Swedish: Integritetsskyddsmyndigheten, see this LINK) or in the country where you live, to lodge a complaint.
Links to other websites
Websites operated by Sobi contains links to a number of sites that we believe may offer useful information for our website visitors. This privacy notice and the obligations under it do not apply to such websites (unless the other website is owned by Sobi and directly links to this policy). We suggest contacting those websites directly for information on their personal data protection, security, data and collection policies. Sobi cannot be held liable for any actions by or content provided by such third-party websites.
Changes to this privacy notice
We may update this privacy notice from time to time. In case of material changes to this notice (meaning any changes that materially affect your rights), a temporary notice will be published on our websites.
Sobi is committed to responsible and ethical sharing of data from clinical studies and supports the continuous efforts of the European Medicines Agency (EMA), the European Commission and the Food and Drug Administration (FDA) to further increase the transparency of data from clinical studies. As a pioneer in rare diseases, Sobi also advocates sharing of data from studies while protecting individual patient integrity and compliance with applicable legislation.
Public disclosure of clinical study information
Sobi follows the policy to register and disclose information for all Sobi-sponsored clinical studies (both interventional and non-interventional) on the publically available website www.ClinicalTrials.gov and other public domains as applicable to local laws and regulations. Study registration is completed before recruitment of the first study participant.
Public disclosure of clinical study results
Sobi follows EMA and FDA regulations and/or other applicable local laws and regulations for public posting of clinical study results. At a minimum, results of all interventional studies of approved and available medicinal products, regardless of study outcome, will be posted on ClinicalTrials.gov and/or other domains as applicable within 12 months (6 months for paediatric studies) of study completion.
Moreover, as per Good Publication Practice 3 (GPP3) Sobi intends to make the results from all Sobi-sponsored studies (both interventional and non-interventional studies) publically available to the scientific community, ideally in peer-reviewed journals, regardless of outcome.
Sharing of anonymised clinical study data with qualified researchers
Sobi commits to sharing clinical study data on participant level and summary data for medicines and indications approved by EMA and/or FDA. Data access will be granted in response to qualified research requests. All requests are evaluated by a cross functional panel of experts within Sobi. A decision on sharing will be based on the following:
- The scientific merit of the proposal – i.e. the proposal should be scientifically sound, ethical, and have the potential to contribute to the advancement of public health.
- The feasibility of the research proposal – i.e. the requesting research team must be scientifically qualified and have the resources to conduct the proposed project.
- Maintenance of personal integrity – i.e. Sobi will not consider sharing individual data if there is a risk of re-identification of individuals despite a proper anonymisation. Moreover, the patients’ informed consent will always be respected. Sobi reserves the right to reject the proposal if the anonymisation process will render unusable data.
- Publication of results – the applicants should commit to submit their findings to a peer-reviewed scientific journal, alternatively to present the results at a congress (poster or similar), regardless of the research outcome.
Data sharing requests
To request access to clinical study data, please complete the data sharing request form and send together with any additional attachments to email@example.com. Only duly completed data sharing request forms will be considered.
If you are a patient we may also be provided with information about you by a third party reporting an adverse event that affected you, such as e.g. healthcare professionals or relatives to you.
Information we collect and why we collect it
The purpose for processing the personal data about you provided through the Sobi Patient Safety reporting channels is to enable Sobi Drug Safety to maintain its pharmacovigilance system as required by applicable pharmacovigilance legislation (e.g. by the European Medicines Agency [EMA]and the US. Food and Drug Administration [FDA]). Pharmacovigilance means the science and activities relating to the detection, assessment, understanding and prevention of adverse reactions and other medicine-related problems. A pharmacovigilance system, including safety databases, is used to fulfil Sobi’s legally binding obligations in relation to pharmacovigilance and to monitor the safety of medicinal products and detect any change in their risk-benefit balance.
Information we collect about patients (subject of the report)
We collect personal data about you when you, or a third party, provide us with information about you in relation to an adverse event that affected you. Where you are reporting the adverse event yourself, please also refer to the Reporters section below.
The personal data that we may collect about you when you are the subject of an adverse event report is:
- name or initials;
- age and date of birth;
- weight and height;
- details of the product causing the reaction, including the dosage you have been taking or were prescribed, the reason you have been taking or were prescribed the product and any subsequent change to your usual regimen;
- details of other medicines or remedies you are taking or were taking at the time of the reaction, including the dosage you have been taking or were prescribed, the period of time you were taking that medicine, the reason you have been taking that medicine and any subsequent change to your regimen;
- details of the adverse event you suffered, the treatment you received for that event, and any long‐term effects the event has caused to your health; and
- other medical history considered relevant by the reporter, including documents such as lab reports, medication history and patient history.
Some of this information may be considered by law to be “sensitive personal data” about you. This includes any information that tells us about your:
- religion; and
- sexual life
This information is only processed where relevant and necessary to document your adverse event properly and for the purpose of meeting our pharmacovigilance requirements. These requirements exist to allow us and competent pharmacovigilance authorities to diagnose, manage and prevent such adverse events from occurring in the future.
Information we collect about reporters
- Sobi is legally required to ensure that adverse events are traceable and available for follow-up. As a result, we must keep information about reporters to allow us to contact you once we have received the report. The personal data that we may collect about you when you report an adverse event is your:
- contact details (which may include your address, e‐mail address, phone number or fax number);
- profession (this information may determine the questions you are asked about an adverse event, depending on your assumed level of medical knowledge); and
- relationship with the subject of the report.
Legal basis for processing
The legal basis for processing of the personal data is compliance with Sobi’s legal obligations based on binding law (EU General Data Protection Regulation Article 6.1.c).
How we share your Personal Data
Also, personal data may be disclosed to a third party such as a health authority if we are required to do so because of an applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.
Sobi will not disclose the collected data for commercial purposes.
Transfers of Personal Data outside the EEA
Retention of Personal Data
Sobi is required to store all information including the personal data regarding safety of medicinal products for at least ten years after the end of the expiration of the marketing authorisation or longer if required by local legislation.
Information regarding your rights
You have the right to view the personal information that we hold about you. You may contact Sobi to inquire whether our register contains your personal data. Subject to legal exceptions, after you have supplied sufficient search criteria, Sobi will search for your data in Sobi’s register. If data that can be identified as your personal data is found, you will be given copy of it, or you will be given a notice that the register contains no data which can be identified as your personal data.
You may also request Sobi to complete or correct any inaccurate personal data held about you, or to correct or delete any data that is erroneous, unnecessary or incomplete or to request Sobi to restrict the processing of personal data. You can make such a request by contacting us at firstname.lastname@example.org or via the contact information provided below.
If you have any comments or complaints regarding the way your personal data is being handled, you have the right to contact the supervisory authority in Sweden (Swedish: Datainspektionen, see this link) or in the country where you live, to lodge a complaint.
Sobi takes precautions to ensure that personal data collected for pharmacovigilance purposes is protected and that the processing is in accordance with applicable data protection rules including encrypted transfer of personal data when feasible.
The database used for processing safety data is validated, or tested as appropriate, to ensure that any changes to data can be identified and access to these systems is restricted to named individuals.
Any hard copies of documents is stored in a secure and robust area such as fire proof cupboards or archives to which access is limited.
Swedish Orphan Biovitrum AB
SE-112 76 Stockholm
Data Protection Officer
Swedish Orphan Biovitrum AB
Data Protection Officer: Max Tullberg
112 76 Stockholm