If you are a U.S.-licenced Physician and choose to receive a reprint from Novartis Pharmaceuticals Corporation (NPC), the value of the reprint may be attributed to you and be posted on NPC’s publicly available website, which is updated quarterly. In addition, NPC will disclose that you received a transfer of value associated with a reprint to the federal government in order to meet the requirements of the Physician Payments Sunshine Act, a provision of the Affordable Care Act (ACA), often referred to as the Sunshine Act. Under the Sunshine Act, all transfers of value to U.S. licensed physicians, including the value of reprints, will be published annually on the Centers for Medicare & Medicaid Services (CMS) Open Payments website.

For additional information on the Sunshine Act please refer to the Novartis Website.

Privacy Policy

Data controller of personal information collected

Novartis Pharma AG, Lichtstrasse 35, CH-4056 Basel, Switzerland is processing information about you which constitutes “personal data” and Novartis AG considers the protection of your personal data and privacy a very important matter.

Novartis AG is responsible for the processing of your personal data as it decides why and how it is processed, thereby acting as the “controller”. 

In certain circumstances, when providing you the requested information, your personal information may be shared with our country-level Novartis affiliate companies as necessary to fulfil the purposes described below. Thus Novartis AG may exercise this responsibility jointly with other company(-ies) in the Novartis group, acting as “joint data controller(s)”.

In this Privacy Notice, “we” or “us” refers to Novartis Pharma AG.

Personal information collected

We collect the personal information you enter on this website, such as your name, country, e-mail address, phone number, institution,  postal address, profession, education degree ( eg PHD), preferred contact method and enquiry details(“Personal Information”). 

Purpose for collecting personal information and related use

We will not process your personal data if we do not have a proper justification foreseen in the law for that purpose. Therefore, we will only process your personal data if we have obtained your prior consent. 

We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data for the following purposes:

• Your personal information is being collected to provide you the requested medical information, for records keeping and reporting purposes to comply with industry codes and regulations, to create an aggregate report to report metrics and to understand the website usage and for any other purposes imposed by law and authorities.

Who has access to your personal data and to whom are they transferred?

We will not sell, share, or otherwise transfer your personal data to third parties other than those indicated in this Privacy Notice. In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data can be accessed by, or transferred to the following categories of recipients, on a need to know basis to achieve such purposes: 

• our personnel (including personnel, departments or other companies of the Novartis group);
• our suppliers and services providers that provide services and products to us;
• our IT systems providers, cloud service providers, database providers and consultants.

The above parties are obliged to protect the confidentiality and security of your personal data, in compliance with applicable law.

Your personal information is being shared with Bedrock Health, One Fleet, Ancells Road, Fleet, Hampshire, GU51 2UN, United Kingdom as the current data processor of Novartis, which provides this mobile application / Website. 

The personal data we collect from you may also be processed, accessed or stored in a country outside the country where Novartis is located , which may not offer the same level of protection of personal data. 

If we transfer your personal data to external companies in other jurisdictions, we will make sure to protect your personal data by (i) applying the level of protection required under the local data protection/privacy laws applicable to Novartis, (ii) acting in accordance with our policies and standards and, (iii) for Novartis located in the European Economic Area (i.e. the EU Member States plus Iceland, Liechtenstein and Norway, the "EEA"), unless otherwise specified, only transferring your personal data on the basis of standard contractual clauses approved by the European Commission or the Swiss Federal Data Protection and Information Commissioner respectively. 

For intra-group transfers of personal data the Novartis Group has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection relating to transfers of personal data outside the EEA and Switzerland. Read more about the Novartis Binding Corporate Rules by clicking here https://www.novartis.com/sites/www.novartis.com/files/bcr-individual-rights-2012.pdf. 

How do we protect your personal data?

We have implemented appropriate technical and organisational measures to provide an adequate level of security and confidentiality to your personal data. 

The purpose thereof is to protect it against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.

We may request you to confirm the personal data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your personal circumstances so we can ensure your personal data is kept up-to-date.

How long do we store your personal data?

We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements. 

Unless otherwise indicated the maximum retention period  is 24 months. When this period expires, your personal data is removed from our active systems.

What are your rights and how can you exercise them?

You may exercise the following rights under the conditions and within the limits set forth in the law:

• the right to access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating; 
• the right to request the erasure of your personal data or the restriction thereof to specific categories of processing; 
• the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal; 
• the right to request its portability, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.

If you have a question or want to exercise the above rights, you may send an email to global.privacy_office@novartis.com with a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity and shall not retain the scan after completion of the verification. When sending us such a scan, please make sure to redact your picture and national registry number or equivalent on the scan. 

If you are not satisfied with how we process your personal data, please address your request to our data protection officer at global.privacy_office@novartis.com, who will investigate your concern. 

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above. 

You can access the outlined here Privacy Policy at any time by following a link that will be sent to you via email.