Data Privacy Statement for Handling of Adverse Events, Medical Inquiries, and Product Technical Complaints
1. Responsible Party
The party responsible for the processing of your personal data on our website is
C4 health GmbH
Wildstr. 20
89522 Heidenheim a. d. Brenz
Germany
Phone: +49 7321 757 8170
Fax: + 49 7321 757 8171
Email: info@c4health.com
Web: www.c4health.com
HRB Ulm 735245, St.Nr. 64002/24399, Ust. ID. DE312589905
Managing Directors: Tanja Reischl-Stenske, Christian Stenske
For questions concerning data privacy, please contact:
Datenschutzbeauftragter
C4 health GmbH
Wildstr. 20
89522 Heidenheim a.d. Brenz
Email: privacy@c4health.com
2. Types of personal data we collect
Depending on the nature and purpose of an inquiry, we collect only the personal data and other information necessary to process and respond to it.
2.1 Processing of reports on adverse events
When processing adverse event reports, the following personal data may be processed:
On the patient:
- Case identification information (e.g., initials)
- Demographic data (e.g., date of birth or age group, sex, weight, height)
- Medical information about the adverse event, in particular:
- Details regarding the indication for treatment, including dosage, reasons for use, or deviations from standard practice
- Details about the event, including its symptoms, treatment, and potential long-term effects on the patient’s health; relevant documentation such as laboratory reports and medication history, if applicable
- Details regarding concomitant medications and treatments, including dosage, duration of use, reasons for use, or changes to standard use
- Information about the patient's health and medical history, ethnic background, and sex life.
On the reporting or inquiring person:
- Contact information (e.g., name, address, phone number, email)
- If applicable, occupation, job title, field of expertise, department (to enable follow-up questions based on the level of knowledge)
- If applicable, relationship to the person affected by the report
2.2 Processing of medical inquiries
When processing medical inquiries, the following personal data may be collected about the person making the inquiry:
- Contact information (e.g., name, address, phone number, email)
- Occupation, if relevant to our response
- If relevant, data about the patient (e.g., initials, date of birth or age group, gender, weight, or height)
- If relevant, information about the patient provided in connection with the inquiry, such as health or ethnic origin
- Audio recordings of our calls, provided that consent to recording was given
2.3 Processing of product technical complaints
When processing product technical complaints, the following personal data may be collected about the person making the inquiry:
- Contact information (e.g., name, address, phone number, email)
- Information provided in connection with the complaint
- Information about the purchase/source of the product (e.g., pharmacy, hospital, internet)
- Information about caregivers who may have handled the product
3. Purpose of the collection, use, and disclosure of your data
Regardless of the nature of your enquiry, your data will be processed solely for the purposes set out below. For reports of adverse effects, the data is anonymised for the purposes of reporting adverse reactions to the authorities, as required by law. For other medical inquiries, your data is pseudonymised and stored on our system, applying the appropriate security measures. Your personal data will not be disclosed for any other purpose.
3.1 For reports of adverse events
We are legally obliged to monitor the safety of all our products that we develop or market in a country. This includes the collection and processing of reports concerning adverse events of our products.
This usually involves the processing of personal data. Such processing is necessary in order:
- to investigate and document the adverse event.
- to contact you in case we have any further questions.
- to cross-reference the information received with other adverse event reports.
- to provide binding reports to the relevant regulatory authorities.
3.2 For medical inquiries
If you contact us with medical questions about our products, we may process your personal data in order to:
- to process your inquiry and provide an appropriate response.
- to document your inquiry appropriately.
- to contact you regarding follow-up questions or to clarify any issues.
- to ensure the quality of our services. To this end, we may ask for your permission to record the call.
3.3 For product technical complaints
- to process your complaint and analyse feedback.
- to document your complaint accordingly.
- to contact you if we have any follow-up questions.
- to ensure the quality of our services. To this end, we may ask for your permission to record the call.
4. Legal basis for processing of personal data
The handling of adverse events is required by pharmacovigilance legislation. The processing of personal data for this purpose is carried out in accordance with our legal obligations and for reasons of public interest in the area of public health (Art. 6(1)(c) and (e) and Art. 9(2)(i) of the GDPR) in conjunction with pharmacovigilance legislation and local data protection laws, in particular the Medicinal Products Act (AMG).
In addition, the processing of personal data collected in connection with medical enquiries or technical product complaints is also carried out on the basis of Article 6(1)(a) of the GDPR (provided you have given your consent to the processing) and Article 6(1)(f) of the GDPR (to safeguard our legitimate interests).
5. Data recipients
In order to process your enquiries, the personal data we collect may need to be shared. Both internally and externally, such data is only shared with authorised individuals and partners with whom we have, where necessary, entered into the required Data Processing Agreements.
6. Deletion of data
We delete personal data once the purpose for which it was stored or processed no longer applies, or restrict its processing where statutory retention obligations apply (e.g. under commercial and tax law).
There are also specific regulations under pharmaceutical law governing the reporting of adverse events. These require records to be retained for 10 years after the expiry of the marketing authorisation for the product in question, or for 30 years after the expiry date of the medicinal product, whichever retention period is longer.
7. Your rights
Under current data protection laws, you have certain rights in relation to the processing of your personal data, in particular:
- In accordance with the applicable legal provisions, you have the right to access, rectify and erase your stored personal data at any time.
- You have the right to request the restriction of the processing of your personal data.
- You may withdraw your consent to the processing of your personal data at any time . The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.
object to the processing of your personal data on grounds relating to your particular situation. - You have the right to transfer data that we process automatically on the basis of your consent or in fulfilment of a contract, either to yourself or to a third party, in a commonly used, machine-readable format (where technically possible).
- You also have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information, who can be contacted at: www.baden-wuerttemberg.datenschutz.de.