PRIVACY NOTICE FOR HCP

We take your data protection rights and our legal obligations seriously. Your personal data (as defined below) will be treated in a secure and confidential manner and only as set out below or otherwise notified to you in writing.

Bausch Health Trading DWC LLC respects your privacy and is committed to protecting your personal data. This privacy policy will tell you about how we look after and use your personal data provided to us, and your privacy rights under data protection regulations, including the General Data Protection Regulation (“GDPR”; and data protection law made under GDPR), as well as the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 dated 09/02/1443H (corresponding to 16/09/2021G), and how those regulations protect you.

Information that Bausch Health Trading DWC LLC as the Data Controller (hereafter: “Bausch + Lomb” or “Data Controller”) may have about you, may either be directly provided by you, by our business partners (i.e. the legal entity for whom you work), by third parties (e.g. external vendors or medical agencies), or be obtained through trusted publicly available sources.

We may collect various types of personal data about you, including:

• your general and identification information (e.g. name, first name, last name, or postal address, fixed and/or mobile phone number, website);
• your function (e.g. title, position, name of company, as well as, for healthcare professionals, first specialty, second specialty,);
• information regarding your utilization, responses and/or preferences including in terms of types of messages discussed, channels of communication and frequency;
• data you provide to us, for example when you fill in forms or during events you attend, or when you answer questions during a conversation or in a survey;
• data which relate to our products and services; and
• information about the scientific and medical activities/interactions you have with us, including potential future interactions.

 

Purposes and Legal Basis

Bausch + Lomb will only process your personal data if:

• the processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request;
• the processing is necessary to comply with our legal or regulatory obligations; or
• the processing is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.

Please note that, when processing your personal data on this last basis, we always seek to maintain a balance between our legitimate interests and your privacy.

Examples of such ‘legitimate interests’ are data processing activities performed:

• to develop a proximity and trustful professional relationship with healthcare professionals;
• to provide knowledge to the healthcare professionals about Bausch + Lomb medicines and scientific developments;
• to offer our products and services to our customers;
• to prevent fraud or criminal activity, misuses of our products or services as well as the security of our IT systems, architecture and networks;
• to meet our corporate and social responsibility objectives.

 

Purposes of the Processing

We process the personal data we may have about you for the following purposes:

• manage our relationship with you (e.g. through our databases);
• collecting and evaluating of experiences with our products, advertising and promotion in terms of medicines and medical device regulations;
• provide you with appropriate, adequate and updated information about diseases, drugs as well as our products and services;
• improve the quality of our interactions and services by adapting our offering to your specific needs;
• answer your requests and provide you with efficient support;
• preserve the company’s economic interests and ensure compliance and reporting (such as complying with our policies and local legal requirements, tax deductions, managing alleged cases of misconduct or fraud; conducting audits and defending litigation);
• any other purposes imposed by law and authorities.

Access to Personal Data and Transfer

In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data may be accessed by or transferred to the following categories of recipients, on a need-to-know basis to achieve such purposes:

• our personnel (including personnel, departments or other companies of the Bausch + Lomb group);
• our suppliers and services providers that provide services and products to us;
• our IT systems providers, cloud service providers, database providers and consultants;
• our business partners who offer products or services jointly with us or with our subsidiaries or affiliates;
• any third party to whom we assign any of our rights or obligations.

The above third parties are contractually obliged to protect the confidentiality and security of your personal data, in compliance with applicable law.

Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.

The personal data we collect from you may also be processed, accessed or stored in a country outside the country where Bausch + Lomb is located, which may not offer the same level of protection of personal data.

Where personal data is transferred across borders, Bausch + Lomb will ensure that such transfers are carried out strictly in accordance with applicable data protection laws and regulatory requirements.

Where required, we will implement appropriate safeguards prior to any such transfer, which may include entering into standard contractual clauses, adopting intra-group data transfer agreements, relying on adequacy decisions, or obtaining necessary regulatory approvals or authorizations.

Protecting Your Personal Data

We have implemented appropriate technical and organizational measures to provide an adequate level of security and confidentiality to your personal data in accordance with applicable data protection laws, including the PDPL and National Cybersecurity Authority (NCA) guidance.

Data Retention

We will only retain personal data we may have about you for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

We will retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected and/or to comply with applicable legal or regulatory requirements. The applicable retention obligations may vary depending on your country of residence.

Data Subjects’ Rights

Subject to applicable law, you may have certain rights in relation to your Personal Information, which may be exercised under the conditions and within the limits set out in the applicable regulations. These rights may include, where available:

• the right to access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
• the right to request the erasure of your personal data or the restriction thereof to specific categories of processing;
• the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
• the right to object, in whole or in part, to the processing of your personal data;
• the right to object to a channel of communication used for direct marketing purposes; and
• the right to request its portability, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.

The availability and scope of these rights may vary depending on your country of residence.

If you have a question or want to exercise the above rights, you may send an email to dpo@bausch.com. Subject to applicable law, You may also have the right to lodge a complaint with a competent data protection authority or regulator in your jurisdiction if you believe that your personal data has been processed in a manner that does not comply with applicable laws. You also have a right to oppose our collection and use of your personal information as explained in this form. If you wish to do so, please contact us at: dpo@bausch.com.