Privacy Notice

1.1 Purpose

As a healthcare company, Camurus Pty Ltd (Camurus) recognises the importance of privacy and is committed to the management and handling of Personal Information and Sensitive Information in an open and transparent way. Camurus is required to comply with the Australian Privacy Act 1988 (Cth) (Privacy Act) and this policy creates a framework to ensure that any Personal Information Camurus holds is collected, used, stored and disclosed in accordance with the Australian Privacy Principles in the Privacy Act.

Your Personal Information is held securely in accordance with this Privacy Policy and privacy laws and is treated with respect and care. You have the right to contact us to access or correct your Personal Information. We encourage you to contact us if you have questions or concerns about your privacy or how your Personal Information is handled by Camurus.

1.2 Scope

This Privacy Policy documents the handling of Personal Information by and on behalf of Camurus, both within and outside of Australia.

This policy does not apply to the handling of Personal Information about Camurus employees.

1.3 Regulatory Environment

As a healthcare company which deals with Personal Information and Sensitive Information, Camurus has an obligation to respect the privacy of individuals and to follow the Australian privacy laws, which include:

  • the Privacy Act 1988 (Cth) (as amended from time to time);
  • the National Privacy Principles contained in Schedule 3 to the Privacy Act or where applicable, theAustralian Privacy Principles contained in Schedule 1 of the Privacy Act;
  • all other applicable laws that require a person to observe privacy or confidentiality obligations inrespect of Personal Information.

Please notify Camurus in writing if you are currently, or in the future become, a resident of the European Union, so that Camurus can assess whether any Personal Information it holds falls within the scope of the GDPR.

2.1 Personal Information Collected and Held by Camurus

Camurus may collect and hold information about individuals who may be customers, members of the general public, job applicants, business contacts, healthcare professionals and others.

The information Camurus typically collects and holds is detailed below.

2.2 Members of the Public

  • Information obtained when you access Camurus’ websites
  • Information you provide when calling Camurus’ medical affairs line or reporting an adverse event,including name/Initials, occupation, home/work address, telephone number, email address, gender, date of birth, age or age range, pregnancy, medication, medical history including drug of dependence, doctor’s details, details of adverse event
  • Information from any patient support programmes which Camurus runs, including de-identified details (your initials and date of birth), age or age range, medication, medical history including drugof dependence, doctor’s details

2.3 Healthcare Professionals

  • Your name, business address, business telephone number(s) and email address
  • Professional details, including provider number
  • Practice specialty including areas of interest
  • Membership of professional associations
  • Practice and/or business information including, where applicable, interest in Camurus products
  • Information relating to your patients, following Adverse Event reporting, product complaints orMedical Information line enquiries, including patient drug of dependence
  • Information relating your participation in Camurus sponsored or supported clinical trials,conferences or other educational events
  • Information from public domain websites
  • Information obtained when you access Camurus’ websites
  • Information and all notes obtained during telephone sales calls, including date and duration of thecall, call outcome, follow-up required
  • Information about patients obtained when reporting adverse events required for reporting toregulatory authorities and for safety data reporting by Camurus’ global pharmacovigilance function
  • Frequent flyer numbers, passport details and next of kin details, when Camurus sponsors orarranges your travel to educational events or for business relating to Camurus

2.4 Business Contacts

  • Your name, business address, business telephone number(s) and email address
  • Dealings with Camurus in respect of general business relationships
  • Work, professional and employment references, reports and assessments
  • Information from public domain websites
  • Information obtained when you access Camurus’ websites

2.5 Job Applicants

The types of Personal Information Camurus collects from job applicants, including for both employment and contract positions, may include:

  • Employment history
  • Qualifications
  • Residential address
  • Date of birth
  • Opinions about suitability for employment from referees and previous employers
  • Taxation and banking details
  • Information from public domain and social media websites
  • Information obtained when you access Camurus’ websites
  • Driver’s licence/passport details
  • Superannuation fund details
  • Next of kin
  • Psychometric testing results
  • Records of Medicines Australia course or code of conduct training completion

Job applicants have the right to not disclose Personal Information, however Camurus may not be able to assess a candidate’s suitability for employment when it does not receive all necessary information. Camurus will only disclose the Personal Information of job applicants to third parties with the consent of the job applicant, or as otherwise permitted in limited circumstances by law.

Once a position has been filled, all applications received by Camurus are filed and kept in Camurus’ human resources files. However, the following information, if previously collected, will not be retained for applicants who do not commence employment or a contract position with Camurus: bank account details,driver’s licence/passport, Tax File Number, superannuation fund details, next of kin.

3.1 How Will Camurus Collect Your Personal Information

Wherever possible, Camurus will collect Personal Information about you directly from you. Nevertheless, on some occasions Camurus may collect your Personal Information from other sources, such as:

  • Third party agents or data providers
  • Public domain websites on the Internet
  • Electronic communications such as articles and information pieces in which you feature such as ahealth information site or a medical professional site
  • Publicly available directories and listings such as telephone directories
  • Newspapers, magazines, professional journals and the electronic media
  • The date, time and domain from which you access Camurus’ website
  • Personal interactions and/or communications with Camurus employees and/or contractors
  • Databases purchased from an external provider
  • Healthcare professionals
  • Carers

Personal information about you which Camurus collects and holds may vary depending on your particular interaction with Camurus and will be for a legitimate business purpose. Camurus will not collect Sensitive Information about you, such as information about your health or ethnicity without your consent.

3.2 Collection of Your Personal Information Through Camurus’ Websites

Websites managed by or on behalf of Camurus provide for direct input of Personal Information under some circumstances. In addition, Camurus’ websites make use of ‘cookies’ which are small text files that arestored in the visitor’s local browser cache. This enables recognition of the visitor’s browser to optimise the website and simplify its use. Most browsers are set up to accept these cookies automatically, however you can deactivate the storing of cookies or adjust your browser to inform you before the cookie is stored on your computer. Data collected via cookies will not be used to determine the personal identity of the website visitor.

Camurus expects to increasingly makes use of web analytics, including analysis by third party serviceproviders, which may use IP addresses. While this may in some circumstances be ‘Personal Information’ neither Camurus nor the service providers have any interest in an individual’s browser activities and will not use the information to take any action targeted to individuals without having obtained that person’sconsent.

3.3 How Will Camurus Hold and Use Your Personal Information

Customer Relationship Management (CRM) Software

  • Information relating to healthcare professionals and third parties with which Camurus conducts business will be held on Camurus’ secure customer relationship management (CRM) software platform. This information will be accessed and used in the ordinary course of conducting business and for continuous and improved relationship management, including but not limited to communicating with you, order processing and fulfilment, accounting, responding to enquiries or complaints.
  • Sales data and call activity will be entered into databases run by 3rd party providers such as IQVIA and Prospection. Camurus may also provide those providers with your updated contact or other professional information, consistent with the use of such databases by other pharmaceutical companies.
  • Information relating to third parties with which Camurus conducts business will be used to facilitate the provision of products and services to Camurus.

Healthcare Professionals

In addition to the uses of Personal Information specified in the CRM section, Camurus may use your information as follows:

  • To provide you with information relevant to your practice
  • To involve you in conferences and provide training and support relevant in Camurus’ products and therapy areas relevant to your practice
  • To assess your suitability for and involvement in advisory boards
  • To otherwise satisfy our legal and regulatory obligations
  • To report adverse events to regulatory authorities and for safety data reporting by Camurus’ global pharmacovigilance function.

Personal Health Information

  • Camurus will collect and record personal health information obtained from calls to Camurus’ medical affairs line when you or your carer report an adverse event related to a Camurus medication.
  • Your personal health information will be anonymised and included in reports to regulatory agencies and in Camurus records.

Other Use and Disclosure

Camurus may disclose information about you in the course of any of the uses described above, including to related businesses and third-party service providers for routine business purposes such as order delivery, marketing, hosting, data processing and validation, data storage or archiving, printing and mailing. Camurus will use only reputable service providers and will ensure that it enters into appropriate contractual provisions with service providers to safeguard your privacy.

Camurus will otherwise only disclose Personal Information about you to a third party where required by law.

3.4 Overseas Recipients

Camurus may transfer your Personal Information to affiliated Camurus companies and service providers located outside of Australia. Under these circumstances, your Personal Information will always be stored in a secure manner which is at least as robust as the practices followed by Camurus in Australia.

  • Your Personal Information may be aggregated with data from other Camurus sources and stored or processed on computers or web-based database systems located outside Australia where data protection laws may differ from ours. Camurus’ IT servers, databases and cloud-based data centres are located globally.
  • Your Personal Information may be stored, maintained and processed on computers or web-based database systems at Camurus which may be accessed by and shared with any affiliate within the global Camurus Group (Camurus Affiliates) and with third-parties working with Camurus Affiliates. Our overseas related corporate bodies are located in the European Union, amongst others.
  • Some of our overseas service providers, including our IT service providers, are located globally including in the European Union. Where Camurus uses external service providers located in countries outside of Australia, Camurus takes reasonable steps, including by contract provisions, to ensure that these service providers do not breach the Australian privacy laws.
  • We may disclose your Personal Information to regulatory authorities overseas, such as the European Medicines Agency, ethics committees, or otherwise as required by law.

4.1 Data Security

Camurus uses technical and organisational security precautions to protect your data from misuse, interference or loss and from unauthorised access, modification or disclosure.

Camurus’ security procedures are continuously revised based on new technological developments to ensure that any Personal Information that is provided to Camurus by you through Camurus’ systems will beprotected against possible misuse by third parties.

In the event of an actual or suspected data breach, Camurus will follow the procedures outlined in its Mandatory Data Breach Response Plan, including

  • containing the data breach
  • conducting a risk assessment to assess the severity rating of a suspected or known data breach
  • assessing whether an Eligible Data Breach has occurred.

If an Eligible Data Breach has occurred, Camurus may report the data breach to third parties such as:

  • Camurus’ financial services provider
  • police or law enforcement bodies
  • the Australian Securities & Investments Commission (ASIC)
  • the Australian Taxation Office (ATO)
  • the Australian Transaction Reports and Analysis Centre (AUSTRAC)
  • the Australian Cyber Security Centre (ACSC)
  • the Australian Digital Health Agency (ADHA)
  • the Department of Health
  • State or Territory Privacy and Information Commissioners
  • Australian Health Practitioner Regulation Agency
  • professional associations and regulatory bodies
  • insurance providers.

Camurus will contact you if you have been personally impacted by an Eligible Data Breach.

4.2 Data Retention

Camurus will delete from its records Personal Information which is no longer required.

If Camurus is required to retain Personal Information (e.g. Adverse Event records), then wherever practicable, it will be held in a de-identified form.

4.3 Data Access and Correction

You may request access to Personal Information Camurus holds about you at any time. If you believe your Personal Information is inaccurate, out of date, incomplete, irrelevant or misleading, you may request to have it corrected.

Requests to access or correct Personal Information should be sent to the Privacy Officer. Please provide as much detail as possible to assist in the location of information Camurus may be holding about you, such as your name, contact details, any former name(s), and if possible the context, for example, your relationship with Camurus. Please specify if you are seeking access to specific Personal Information.

Camurus will respond to your request within 30 days of receipt or within any further time notified to you in writing.

4.4 Deletion of Data

You may notify Camurus at any time if you do not wish Camurus to retain your Personal Information. Camurus will comply with all such requests wherever practicable and lawful.

5.1 European General Data Protection Regulation (GDPR)

Camurus’ parent company and many of Camurus’ affiliates are subject to the GDPR. Although many of theprivacy principles of the GDPR are similar to the Act and other Australian privacy laws, there are some differences. If you are a European resident, Camurus may be subject to GDPR in relation to Personal Information it holds about you. Accordingly, we request that you notify us if you are a European resident when you transfer your Personal Information to us or if you are aware that we are collecting your Personal Information. Your Personal Information will still be subjected to the same information security standards as are applied to all Personal Information held by Camurus and its global affiliates. However, we may manage your Personal Information in a different manner to take account of data portability entitlements and other GDPR-specific requirements.

6.1 Complaints

All complaints regarding your Personal Informational should be made in writing to Camurus’ Privacy Officer.

Camurus will respond to your complaint within 30 days of receipt of your correspondence or within any further time notified to you in writing.

If you are not satisfied with the outcome of the response you receive, we can refer you to the Office of the Australian Information Commissioner (as applicable) for further investigation.

6.2 Privacy Officer contact information

All requests relating to access, correction or deletion of Personal Information, or any other information relating to Camurus’ Privacy Policy should be made in writing to:

The Privacy Officer

Camurus Pty Ltd
Hyde Park Hub
223 Liverpool St
Darlinghurst, NSW, 2010
Australia

Email: [email protected]
Phone: 1800 142038

7.1 Definitions Privacy Officer contact information

TermDefinition
CamurusCamurus Pty Ltd
Confidential InformationInformation that is not known to, or readily accessible by, the public and disclosure of that information would cause harm to or disadvantage a person or organisation. Access and disclosure of Confidential Information must be controlled and will only be given to persons who require access to perform their duties.
Data BreachAn incident, in which Personal Information or Confidential Information is lost or subjected to unauthorised access, modification, disclosure, or other misuse or interference.
Eligible Data BreachA Data Breach which has caused serious harm to an individual requiring notification under the Notifiable Data Breaches Scheme under the Privacy Act.
GDPRGeneral Data Protection Regulation, the equivalent to the Australian Privacy Act in the European Union, which took effect in May 2018 and has been enacted individually in member countries.
Personal InformationAny information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act.
Privacy ActPrivacy Act 1988 (Cth).
Sensitive InformationPersonal Information categorised as Sensitive Information under the Privacy Act, including but not limited to health records.