Privacy Notice for participation in the XTANDI™ & me patient support programme
Date: 15 December 2022
General information
Astellas Pharma Ltd (hereinafter “Astellas”, “we” or “us”) respects your right to privacy and treats your personal information in accordance with applicable laws and regulations, including the General Data Protection Regulation (“GDPR”) and the UK Data Privacy Act 2018 as amended and in force. This Privacy Notice explains who we are, how we collect and process personal information about you for the purposes of your participation in the patient support programme for Xtandi™ titled XTANDI™ & me, and how you can exercise your privacy rights. If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Privacy Notice.
What does Astellas do?
Astellas is a global pharmaceutical company whose ultimate parent company is headquartered in Tokyo, Japan. Our mission is to improve patients' lives in the following key areas: transplantation, urology, oncology and infections. For more information about Astellas, please see the "About" section of our Website at https://www.astellas.eu/about/about/.
What personal data does Astellas collect and why?
The type of information we will process for the purposes of your participation in the patient support programme are:
- Your name and surname;
- Your email address;
If you participate as a patient, we process the following additional information:
- Your NHS number;
- Information about your quality of your life, such as your physical, social, emotional and functional well-being and health in questionnaires that will be provided to you during the XTANDI™ & me patient support programme.
If we ask you to provide any other personal information not described above, then the personal information we will ask you to provide, and the reasons why we ask you to provide it, will be made clear to you at the point we collect your personal information.
In general, we will use the personal information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.
Who does Astellas share my personal data with?
We may disclose your personal information to the following categories of recipients:
- to third party services providers and partners, who provide data processing services to us, or who otherwise process personal information for purposes that are described in this Privacy Notice. In particular, we are partnering with Open Health which provides us with a digital platform for fulfilling this patient support programme. Your personal information will be collected and processed by Open Health so that you can access the digital platform, create an account and receive relevant materials in relation to the patient support programme.
- to the healthcare professional inviting a patient to the patient support programme for the purposes of managing their patients while they engage with the patient support programme.
- to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
- to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.
Legal basis for processing personal data
We collect and process your personal information including your health data for the purposes mentioned above based on your consent.
If you have questions or would like more information about the legal basis that we provide for collecting and using your personal data, please feel free to contact us using the contact details under the heading “Contact us” below.
How does Astellas protect my personal data?
We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.
Data retention
We will retain personal information we collect for the above purposes for 5 years.
When we do not have an ongoing, legal and business need to process your personal data, we will either delete or anonymise them or, if this is not possible (for example, if your personal data is stored in backup copies), store it securely and isolate it from all continued processing until it can be deleted. This occurs for example if you delete your user account or if we otherwise cease to provide the patient support programme. Your personal information in relation to your quality of life will be retained by Astellas in an anonymised format for an indefinite period after deletion of your account. You do however have the option to opt out of this, and this option appears as a checkbox in the ‘Your Details’ section of the platform.
Your data protection rights
You have the following data protection rights:
- If you wish to access, correct or update your account details you can edit this in the ‘Your Details’ section of the platform. If you wish to update your email address or telephone number you can do so at any time by contacting us using the process and the contact details provided under the “How to contact us” heading below.
- Your right to object to processing of your personal information, or to ask us to restrict processing of your personal information or to delete your personal information, or to request portability of your personal information, will be limited due to our legal obligations for on pharmacovigilance legislation. Astellas will not be able to erase or restrict processing of your data for legal reasons.
- Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. Again, you can do so at any time by contacting us using the process and the contact details provided under the “How to contact us” heading below.
- You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area are available here.)
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
Updates to this Privacy Notice
We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.
You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.
How to contact us
The data controller is Astellas Pharma Ltd., 300 Dashwood Lang Road, Bourne Business Park, Addlestone, United Kingdom, KT15 2NX, which is registered with the Information Commissioner’s Office (registration number ZA509457). The data processor is Open Health, C/O Legalinx Limited, Churchill House, Churchill Way, Cardiff, CF10 2HH, which is registered with the Information Commissioner’s Office (registration number ZA440914).
To exercise any of your privacy rights, please submit your query here.
If you have any questions or concerns about our use of your personal information, please contact our data protection officer using the following details: privacy@astellas.com.
MAT-UK-XTD-2022-00116 - Date of Preparation: Dec 2022