Privacy Notice
Welcome to the Otsuka Pharmaceutical Europe Ltd. (“Otsuka”, “we”, “us” and “our”) Privacy Notice (“Notice”) for the UK Rejoyn (“Application”) access code distribution website (“Website”). UK Rejoyn is a digital therapeutic intended for the treatment of depressive disorder episodes in adults. It is intended to be used alongside usual care provided by a healthcare professional. This Privacy Notice applies to healthcare professionals who request access codes for patients to access and use UK Rejoyn and patients who receive access codes to access UK Rejoyn (collectively, “you” and “your”) and explains how your personal data is processed and protected by Otsuka.
The Website is operated by Otsuka Pharmaceutical Europe Ltd., 2 Windsor Dials, Arthur Road, Windsor, SL4 1RS.
Otsuka is the data controller of your personal data and is registered with the UK Information Commissioner’s Office with registration number Z9584844.
This Notice explains how and why we use your personal data (e.g., when we provide you with access codes you have requested from us, when we provide you with access codes that have been requested on your behalf, or when you simply use our Website). In all cases, Otsuka understands and respects your privacy and acknowledges that information about an individual’s health and healthcare is confidential and sensitive.
In this Notice, when we talk about personal data, we mean any information that relates to an identified or identifiable person – in this case, you.
Your personal data will be processed in accordance with applicable legislation, including the UK Data Protection Act 2018 and the UK General Data Protection Regulation (“GDPR”). You should read this Notice, so you know what personal data we collect about you, what we do with it and how you can exercise your rights in connection with it. You should also read any other Notices that we give you, that might apply to our use of your personal data in specific circumstances from time to time.
If you have any questions about this Notice, you can contact Otsuka’s European Data Protection Office at Otsuka Pharmaceutical Europe Ltd., 2 Windsor Dials, Arthur Road, Windsor, SL4 1RS or by submitting your query here.
About the Application and Website
To begin using the Application, you will need to enter an access code provided to you by or on behalf of Otsuka. The access code is provided over email after a request for an access code is made via the Website, by you or on your behalf.
What personal data does Otsuka collect?
The personal data we process about you broadly falls into three main categories: (i) contact information, (ii) health information and (iii) usage information.
We collect your personal data from limited sources. The table below sets out the different types of personal data that we collect and the sources we collect it from:
| Category | Type of Personal Data | Collected from |
|---|---|---|
| Contact Information |
- Name
- Email Address - Organisation details (e.g., your place of work, practice, job title) |
- You
- Third parties (e.g., doctors) |
| Health Information | - Eligibility for UK Rejoyn |
- You
- Third parties (e.g., doctors) |
| Usage Information | - Your activity within the Website | - You |
Please note that if you do not provide us with your contact information, we will not be able to provide you with access to the Website, nor will we be able to interact with you. If you do not provide us with your health information (where applicable), we will not be able to provide you with an access code to enable access to the Application.
For what purpose does Otsuka process personal data and what is the legal basis?
We process the personal data listed above for the following purposes and legal bases. The table below sets out the purposes for which we process different categories of your personal data depending on who you are and the corresponding legal basis for that processing:
Healthcare Professionals
| Category of Personal Data | Purpose | Legal basis |
|---|---|---|
| Contact Information | To provide you with access to the Website. |
To perform a contract with you
Legitimate interests (it’s important that we can respond to your enquiries) |
| Contact Information | To be able to distribute access codes to patients enabling access to the Application. | To perform a contract with you |
| Contact Information | We may need the information you provide to comply with our regulatory monitoring and reporting obligations. | To comply with a legal obligation/td> |
| Contact Information | Compliance with our legal obligations where data related to safety or pharmacovigilance is concerned, including those related to adverse events, product complaints and patient safety. | To comply with a legal obligation |
| Usage Information | Monitoring and producing statistical information regarding the use of our Website and Application and analysing and improving their functionality. | Legitimate interests (we need to perform this limited routine monitoring to make sure our Website and Application work properly) |
Patients
| Category of Information | Purpose | Legal basis |
|---|---|---|
| Contact Information | To be able to distribute access codes allowing access to the Application. | To perform a contract with you |
| Health Information | To confirm your eligibility for access to the Application and provide you with access to the Application. | Explicit consent |
| Contact Information and Health Information | We may need the information you provide to comply with our regulatory monitoring and reporting obligations. | To comply with a legal obligation |
| Contact Information and Health Information | Compliance with our legal obligations where data related to safety or pharmacovigilance is concerned, including those related to adverse events, product complaints and patient safety. | To comply with a legal obligation |
| Usage Information | Monitoring and producing statistical information regarding the use of our Website and Application and analysing and improving their functionality. | Legitimate interests (we need to perform this limited routine monitoring to make sure our Website and Application work properly) |
Who does Otsuka share my personal data with?
We share your personal data with the following categories of recipients:
- group companies, third party service providers and partners who provide data processing services to us, or who otherwise process personal data for purposes that are described in this Notice or notified to you when we collect your personal data;
- competent law enforcement bodies, regulators, trade associations, government agencies, courts or other third parties where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
- potential buyers (and their agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes described in this Notice (on the basis of our legitimate interests in maintaining and optimizing our business operations);
- other persons where we have your consent to the disclosure.
How does Otsuka keep my personal data secure?
We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the categories of personal data processed.
International data transfers
We may transfer your personal data to other Otsuka group companies, service providers and partners located outside of the United Kingdom or the European Economic Area (“EEA”) (as appropriate), for example in the USA or Japan. Please note that countries outside of the United Kingdom or the EEA may not provide the same level of protection for your personal data. Where we transfer your personal data outside of the United Kingdom or the EEA, we ensure that appropriate safeguards are put in place and that all transfers of your personal data comply with applicable data protection laws.
The appropriate safeguards that Otsuka uses are the EU Standard Contractual Clauses (“SCCs”) and the UK Addendum to the SCCs. To find out more about how we safeguard your data in relation to data transfers outside the United Kingdom or the EEA, please contact us using the details in the ‘How to contact us?’ section below.
How long will your data be kept?
We will retain your personal data for no longer than is necessary for the purposes for which we are processing the data for. This will depend on a number of factors, including:
- any laws or regulations that we are required to follow;
- whether we are in a legal or other type of dispute with each other or any third party which requires the retention of certain data (e.g., when we are subject to a legal hold);
- the type of information we hold about you; and
- whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.
Your rights
You have a number of rights, which apply to our use of your personal data. The availability of these rights depends upon our legal basis for processing your personal data and may be subject to certain conditions and restrictions. In general, these rights are:
| Right | What does it mean? | |
|---|---|---|
| 1. | The right to be informed | You have the right to be provided with clear, transparent and easily understandable information about how your personal data is used and your rights over your personal data. This is provided in this Notice or through other avenues (such as when you contact us via telephone). |
| 2. | The right of access | You have the right to obtain access to your personal data (if an organisation is processing it), and information about the processing of your data. |
| 3. | The right to rectification | You are entitled to have your personal data corrected if it is inaccurate or incomplete. |
| 4. | The right to erasure | This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for an organisation to keep using it. This is not a general right to erasure; there are exceptions (for example, where you have withdrawn your consent to the processing of your personal data that we have relied on, and there is no other legal basis for the processing). |
| 5. | The right to restrict processing | You have the right to ‘block’ or suppress further use of your personal data in certain circumstances (for example, if you contest the accuracy of your personal data held by us and we are verifying the accuracy of your data). When processing is restricted, the relevant organisation can still store your personal data, but may not use it further. |
| 6. | The right to data portability | You have the right to receive your personal data in a structured, commonly used and machine- readable format and transmit the data to another controller, where we process the data based on your consent or performance of a contract. |
| 7. | The right to object | You have the right to object to the processing of your personal data, in certain circumstances such as when we rely on our legitimate interests. |
Where your personal data is processed on the basis of your consent, you have the right to withdraw your consent at any time. If exercised, this will not affect the lawfulness of processing prior to withdrawal.
You also have the right to complain to a data protection authority about our processing of your personal data. For more information, please contact your local data protection authority. Contact details for the UK data protection authority (the Information Commissioner’s Office) are available here. A list of data protection authorities in the EEA is available here.
How to contact us?
Should you have any questions in regards to the protection of your personal data or if you wish to exercise your legal rights, contact us either via email at privacy.rejoyn@otsuka-europe.com, or contact us by submitting a query.
