The data collected about you
For the purposes of providing the Programme, Ashfield will collect and process personal data relating to patients and their referring healthcare professional (if provided) such as: (i) basic identification and contact data supplied as part of patient registration or otherwise in connection with the provision of the Programme; (ii) health data such as information about the patient’s health and any other medical information that may be provided or collected for the purposes of providing the Programme (including data collected as part of questionnaires conducted over the phone during the coaching calls); (iii) usage data relating to the uptake and use of the Programme; and (iv) safety data reported during the Programme as detailed further below. Phone calls with Ashfield are also recorded for training and monitoring purposes – your agreement to this will be sought on each call. However, Ashfield may not be able to proceed with the call if you do not agree to this.
How your data is used
Your personal data will only be used for the purposes described below. We have also identified the legal grounds we rely on to use your data in this manner.
|Purpose||Type of data||Legal ground for processing|
To provide the Programme, which may include contacting you by telephone to obtain your feedback on the Programme
To administer and monitor the uptake and performance of the Programme
|To comply with legal obligations to monitor the safety of Sanofi’s medicines||
How your data is shared
Other than as described below, Ashfield will not share your personal data with Sanofi or any other third parties, unless: (i) you have granted specific permission to do so; (ii) when this is required by law; or (iii) in response to a court order or request from a regulator, government body or law enforcement agency.
Ashfield may share your personal data with the following parties, but only for the purposes described in the table above:
- its group companies involved in the provision of the Programme;
- certain external service providers who assist Ashfield in providing the Programme, such as IT service providers;
- where patients agree, with their referring healthcare professional for the purpose of providing information on their progress through the Programme; and
- if you (or any other person) report that you (or someone else) have experienced a side effect while taking a Sanofi product, Ashfield may share this safety-related information along with any relevant personal data, which will be in a pseudonymised form (see below for more information on what this means) unless you agree otherwise (referred to as “Safety Data”), to the product safety monitoring team at Sanofi. Sanofi will use this Safety Data for the sole purpose of evaluating the safety of its products, which may include: (i) contacting the patient, their GP or their referring healthcare professional to discuss the data; (ii) sharing the data with Sanofi’s contractors who assist Sanofi in evaluating the safety of its products; and/or (iii) sharing the data with national and international health authorities and regulatory bodies (in an anonymised form wherever practical).
So that Sanofi can administer and monitor the uptake and performance of the Programme, Ashfield will also provide Sanofi with reports containing pseudonymised data relating to patients (“Performance Reports”). Where data has been pseudonymised, it means that Sanofi will not be able to identify you directly from the data/reports as information that identifies you (such as names, dates of birth etc.) will be removed or replaced with a reference number. Sanofi may share data from Performance Reports with its group companies and/or external third parties.
How your data is stored
If Ashfield ceases providing the Programme on behalf of Sanofi, Ashfield may, on agreement with the NHS: (i) transfer your personal data to a new provider appointed by Sanofi; and/or (ii) continue to hold your personal data in its databases until the Programme is fully transferred and operational. If such a transfer does not take place within 12 months, Ashfield will delete your personal data as soon as reasonably possible unless required by law to retain it for longer. In case a transfer should occur, Sanofi will ensure that the new provider (i.e. a company who takes over from Ashfield) will be bound and operate according to the same strict standards for data protection as applied to Ashfield.
If you have any questions about this Privacy Statement or our data protection practices, including to exercise your rights under data protections laws (including to request access to your personal data), please contact Ashfield using the following details:
Post: Quality Department, Ashfield House, Resolution Road, Ashby de la Zouch, Leicestershire, LE65 1HW