Privacy policy CRM
As at: 7 August 2025
Data protection information on the processing of personal data of members of a healthcare profession in the CRM system by Recordati AG
In accordance with applicable legal provisions for the protection of personal data, including the Federal Act on Data Protection (FADP), the associated Data Protection Ordinance (DPO), and, where applicable, the European Regulation (EU) 2016/679 (“GDPR“) as well as other applicable laws and provisions for the protection of personal data (collectively “Data Protection Laws“), Recordati AG (“Recordati“ or “Controller») provides you, in your capacity as a member of a healthcare profession (“HCP“ or “data subject“), with the following information regarding the processing of your personal data collected and processed by Recordati in the course of providing scientific information, marketing activities, and (online) event organization.
The personal data will be processed in accordance with the data protection laws and the applicable provisions of the relevant data protection authorities.
1. Who processes your personal data?
Person in charge
The data controller is Recordati AG, Uferstrasse 90, 4057 Basel, Switzerland. E-Mail: recordatichprivacy@recordati.com, Tel.: +41 61 205 61 00
Employee
All Recordati employees who have access to and can process the personal data of data subjects work under the direct supervision and according to the instructions of the controller in accordance with the applicable data protection laws.
2.Types of personal data processed
The personal data processed by the controller are:
- Personal and identification data (First and last name, date of birth, gender, tax number, job title of the person concerned, entry in the register of doctors);
- Contact details of the data subject (Telephone number, email address, address at which the data subject carries out their professional activities);
- Further information about the person of the HCP (such as interests, skills and approach in relation to (i) technological applications and platforms in the medical-scientific field, (ii) preferred therapeutic treatment methods and pathways, (iii) interest in digital communication channels, and (iv) interest in pharmaceutical products, which Recordati obtains in particular through discussions at events or conferences, or through HCP activities in the protected specialist area of Recordati websites, insofar as such information is available there and the HCP has registered and logged in there);
- Data concerning Recordati’s interaction with the data subject (such as featured products and/or discussed content, opening sent emails and digitally provided medical-scientific content, participation in webinars, etc.).
Personal data relating to HCPs is collected directly from the data subject or indirectly via employees or service providers used by Recordati for the digital organisation of promotional activities and medical-scientific information.
3. Purpose, legal basis for processing and duration of storage of personal data
Recordati processes the above-mentioned personal data of the data subject for the following purposes („Purposes”):
Purpose of processing
a) Conducting scientific information and promotional activities relating to medicines and products marketed by the Recordati Group, as well as related activities(such as the presentation of medicinal products, the recording of enquiries and the provision of samples, as well as activities relating to the planning of visits by sales representatives and the orientation, advice and monitoring of such activities) in doctors’ offices, hospitals and other establishments where healthcare professionals carry out their professional activities.
Legal basis
a) 6(1)(f) GDPR, where applicable (legitimate interest). Legitimate interest of the controller in planning, implementing and optimising (personalised) scientific information and advertising activities.
Retention period
a) Unless the data subject exercises their right to object, personal data will be stored for a period of five (5) years from the date of collection and storage in Recordati’s systems.
Purpose of processing
b) Carrying out profiling activities based on the needs, interests and professional characteristics of healthcare professionals in the fields of medicine & science, technology and/or research for (i) the analysis, internal organisation and planning of scientific information activities and (ii) the personalised provision of medical and scientific information about the medicines and products distributed by the Recordati Group.
If the controller does not have any personal data on the HCP or does not have sufficient data to enable personalised information to be provided, the HCP may nevertheless receive general medical and scientific information and content from the controller in accordance with sections 4(a) and (c).
Legal basis
b) 6(1)(f) GDPR, where applicable (legitimate interest). Legitimate interest of the controller in planning and carrying out targeted and personalised scientific information activities in the interest of healthcare professionals in order to improve their effectiveness in the interest of Recordati and the HCP.
Retention period
Unless the data subject exercises their right to object, personal data will be stored for a period of five (5) years from the date of collection and storage in Recordati’s systems.
Purpose of processing
c) Sending scientific and other information about medicines and products marketed by the Recordati Group by email or other digital or web-based means of communication (including sending invitations to participate in congresses, conferences or medical-scientific meetings, webinars and training events organised or sponsored by Recordati).
Legal basis
c) Article 6(1)(a) of the GDPR, where applicable. Express consent of the data subject.
Retention period
c) Personal data will be stored until the data subject exercises their right of withdrawal. The right of withdrawal may be exercised at any time by contacting the controller and/or the DPO, and in any case for a period of five (5) years from the date of the declaration of consent. Exercising the right of withdrawal does not affect the lawfulness of the previous processing of the data subject’s personal data.
Purpose of processing
d) Transfer of personal data to other companies in the Recordati Group where healthcare professionals work, for the purpose of fulfilling their independent medical, scientific and promotional information requirements regarding the medicines and products marketed by other Recordati companies.
The list of Recordati Group companies in each country is available on our website http://www.recordati.com or here.
Legal basis
d) 6(1)(a) GDPR, where applicable. Express consent of the data subject.
Retention period
d) Personal data will be stored until the data subject exercises their right of withdrawal. The right of withdrawal may be exercised at any time by contacting the controller and/or the DPO, and in any case for a period of five (5) years from the date of the declaration of consent. Exercising the right of withdrawal does not affect the lawfulness of the previous processing of the data subject’s personal data.
The provision of personal data processed for the above purposes is voluntary. In the event of exercising the rights to erasure, objection to processing or withdrawal of consent, Recordati may and will no longer carry out the activities described above in relation to the HCP.
After expiry of the above retention periods, the personal data of the HCP will be deleted, unless there are further legitimate interests of the controller and/or legal obligations that require their retention, possibly in reduced form.
The controller also expressly informs the HCP that, at the time of collection and each time information is sent for one of the above purposes, he/she has the option of: (i) withdraw any consent given at any time, whereby the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal; and/or (ii) object to the processing of their personal data on the basis of legitimate interest (for further details, see section 9).
If Recordati intends to use the personal data collected for purposes that are incompatible with the purposes for which the data was originally collected and for which, where necessary, consent was given, Recordati will inform the data subject in advance and, if necessary, obtain separate consent for processing for other/additional purposes.
4. Profiling
The controller informs the data subjects that, with regard to the purpose referred to in point 3(b) above (i.e. profiling activities), this activity is used exclusively to determine the professional and scientific profile of the HCP and their specific professional interests and needs on the basis of specific parameters specified by Recordati, in order to enable the optimisation of scientific information activities and the sending of relevant content in a precise and effective manner.
By creating profiles, Recordati aims to avoid sending mass medical-scientific communications and spam to HCPs and to implement a personalised communication system tailored to the needs, interests and professional characteristics of the individuals concerned. This form of communication by Recordati also indirectly benefits the HCP’s patients.
In connection with the profiling described here, Recordati expressly points out to HCPs that the profiling
- is not based on an automated decision-making process that has legal or similarly significant effects on the data subjects pursuant to Art. 21 FADP or, where applicable, Art. 22 GDPR;
- does not adversely affect the rights of the data subjects;
- has no long-term or even permanent effects on the data subjects, as the personal data used for profiling purposes is regularly updated by Recordati.
The profiling of the data subjects is based on the legitimate interests of the controller in the European Union and the European Economic Area (“EU/EEA”). The controller confirms that it has previously carried out an assessment in this regard to ensure that the rights and freedoms of the data subjects are not affected, that the legitimate expectations of the data subject with regard to the specific processing activity are taken into account and that the processing of personal data is proportionate (so-called “legitimate interest test”).
The persons concerned may request further information on the assessment of legitimate interests in accordance with the GDPR by contacting the controller or the data protection officer at the addresses provided below.
Data subjects have the right to object to the performance of profiling activities by Recordati at any time in accordance with the procedure set out in section 9.
5. Type of processing of personal data
The processing of personal data in accordance with Art. 5 lit. d FADP or, where applicable, Art. 4 para. 1 no. 2 GDPR for the above-mentioned purposes includes the collection, recording, organisation, retrieval, processing, deletion and destruction.
Personal data is processed on the basis of the principles of lawfulness, fairness, transparency, proportionality and minimisation. Processing is usually carried out electronically, but may also be carried out on paper. In both cases, processing is carried out using appropriate means that are adequate and state-of-the-art, ensuring security and confidentiality, minimising the risk of data loss and preventing unauthorised access and unlawful processing and dissemination.
6. Recipient
The controller informs the data subjects that their personal data may be disclosed or made available to other recipients or categories of recipients who are independent controllers in connection with the pursuit of the aforementioned purposes. These include, in particular, the competent authorities in accordance with national and/or European legal provisions or by official order.
The personal data of the data subjects may also be disclosed, if necessary, to carefully selected and appointed processors in accordance with Article 9 of the GDPR or, where applicable, in accordance with Article 28 of the GDPR, which may include, in particular:
- providers of customer relationship management (CRM) platforms and related technical support and maintenance services;
- communication agencies and/or event organisers; or
- other companies within the Recordati Group.
The complete list of recipients of your personal data (independent controllers or processors) is kept at the controller’s headquarters and can be viewed upon request by the data subject at the above address during normal business hours.
The personal data of the affected individuals will only be disclosed if there is a legal basis for doing so and only in accordance with the applicable data protection laws. Otherwise, the data will not be distributed further.
7. Transfer of data abroad
The data will only be processed within the EU/EEA.
Any transfer or transmission of personal data of data subjects to countries outside the EU/EEA shall only take place if there is an adequacy decision by the Federal Council of the Swiss Confederation or the European Commission or in accordance with the otherwise relevant conditions and guarantees of the applicable data protection laws, in particular Art. 16–18 of the Federal Act on Data Protection (FADP) or, where applicable, Articles 44–49 of the General Data Protection Regulation (GDPR).
8. Rights of data subjects
The controller expressly informs the data subjects that, in accordance with the statutory provisions, they have the right to withdraw their consent at any time, provided that they have given it. The lawfulness of the processing of personal data carried out until revocation is not affected by the revocation. The revocation can be exercised by contacting the controller using the contact details provided above. In addition, revocation is possible in the protected area of the controller’s website Recordati-Plus.co.uk, provided that such an area is available and the HCP has created an account there.
In addition, the controller expressly informs the data subjects that they have the following rights with regard to their personal data (collectively referred to as “rights”) and that they may exercise the following rights at any time:
a) the “right to information”, in particular the right to obtain confirmation from the controller as to whether or not personal data concerning the data subject are being processed, and if so, to receive this information in an intelligible form; b) the “right to rectification”, i.e. the right to request the rectification or, if desired, the completion of personal data concerning the data subject; c) the “right to erasure”, i.e. the right to request the erasure or conversion of existing personal data into an anonymous format under certain conditions regulated by data protection laws, e.g. if the personal data has been processed unlawfully or if the further processing of the personal data of the data subject is no longer necessary for the purposes for which the personal data was collected or subsequently processed; d) the “right to restriction of processing”, i.e. the right to request the controller to restrict processing in certain cases provided for in data protection laws; e) the “right to data portability”, i.e. the right to receive personal data in a structured, commonly used and machine-readable format (or to transmit it directly to another controller).
If the data subject exercises their above-mentioned rights against the controller, the controller will, where required, inform third party to whom the personal data of the data subject were transmitted as independent controllers about the possibility for the data subject to exercise their rights against them as well, in accordance with applicable data protection laws, unless providing such information is not possible or would involve a disproportionate effort for the controller.
It is expressly pointed out that, pursuant to Art. 30 FADP(wie beispielsweise Interessen, Fähigkeiten und Herangehensweise in Bezug auf (i) technologische Anwendungen und Plattformen im medizinisch-wissenschaftlichen Bereich, (ii) bevorzugte therapeutische Behandlungsmethoden und -wege, (iii) Interesse an digitalen Kommunikationskanälen und (iv) Interesse in Bezug auf pharmazeutische Produkte die Recordati insbesondere durch Gespräche im Rahmen von Veranstaltungen oder Kongressen, oder durch Aktivitäten des HCP im geschützten Fachbereich von Webseiten von Recordati erhält, soweit ein solcher dort verfügbar sind und der HCP sich dort registriert hat und eingeloggt ist); or, where applicable, Art. 21 GDPR, in the event of the exercise of the right to object, the controller shall refrain from any further processing of the personal data of the data subject, unless the controller can demonstrate compelling legitimate grounds for the further processing which override the interests, rights and freedoms of the data subject, or the further processing of the personal data of the data subject serves to establish, exercise or defence of legal claims.
The exercise of the above rights by the data subject is not subject to any formal restrictions and is free of charge for the data subject. If necessary, the controller may only require the data subject to prove their identity before taking further action in connection with the exercise of the above rights.
9. Right to lodge a complaint with the competent supervisory authority
The controller also informs the data subjects that, in accordance with the applicable data protection laws, they have the right to lodge a complaint with the competent supervisory authority if they believe that their personal data has been processed in a manner that violates the relevant data protection laws. Furthermore, the data subject may contact the competent supervisory authority if the controller delays, restricts or excludes the exercise of the above rights.
To make it easier for affected persons to contact the competent supervisory authorities: in Switzerland, the competent authority is the reporting form for affected persons.
10. Updating and revision
This privacy policy may be amended and/or supplemented by the controller at any time. The date of the most recent amendments is noted at the beginning of the privacy policy.