Privacy Notice (Patient)
This Privacy Notice explains how your personal data is processed when you use the Hypoparathyroidism Patient Experience Scale (“HPES”) questionnaire digital platform (hereinafter the “Platform”) and what your rights are in relation to Ascendis Pharma collecting, processing, and retaining your personal data.
Data controller
References in this privacy policy to “Ascendis Pharma”, “We”, “Us” or “Our” mean Ascendis Pharma A/S (a company registered in Denmark). We control the ways your personal data is collected and the purposes for which your personal data is used. We are responsible for the protection of your privacy rights when processing your personal data.
Please note that even though Ascendis Pharma is a data controller, we will not access to your personal data, and we will only receive reports including symptom/well-being scores on an aggregate level and only where the aggregate is five (5) or more patients in a country. This ensures your privacy is protected.
Contact us
If you have any questions or concerns about our use of your personal information or would like to exercise any of your rights — including object to the processing of your personal information in the way that we describe in this notice – please contact us. Our contact details can be found below:
Ascendis Pharma A/S
Tuborg Boulevard 12
2900 Hellerup
Denmark
Tel: +45 70 22 22 44
Email: DataPrivacy@ascendispharma.com
www.ascendispharma.com
Please note that, in order to protect your privacy, we can provide only general guidance on how to navigate the system and exercise your rights. We will not be able to access your personal data directly.
What personal data is collected and processed?
The data collected via the Platform includes your first and last name, year of birth, contact details (email address and/or phone number if provided by you or your treating physician), answers to the HPES questions, scoring of the answers, patient ID, clinic ID and the country of treatment.
Why do we need your personal data?
We process your personal data to create and administer your account, providing you with access to the Platform so that you can complete the questionnaire, and your responses can be appropriately scored.
In particular:
First and last name: to create your patient profile and for communication purposes.
Contact details (email and/or phone number): to send you notifications related to the questionnaire.
Answers to questionnaire questions: to generate scores that reflect your symptoms due to hypoparathyroidism and the impact of the condition on your daily functioning and well-being.
Scoring of your answers: to help your treating physician better understand your condition, monitor its progression, and engage in structured discussions with you regarding your condition.
Patient ID and clinic ID: to ensure unique identification within the system.
Country of treatment: to enable statistical analysis and to ensure discretion of data.
What are our sources of data and legal basis for processing?
We collect data directly from you, from your treating physician, and information the Platform generates, such as patient and clinic IDs.
The processing of your Personal Data for the purposes stated above is based on the following legal bases (see Articles 6 and 9 of the GDPR):
your consent (Article 6(1)(a);
your explicit consent (Article 9(2)(a).
Who will receive your personal data?
We will share your data with the following categories of recipients:
Authorized healthcare professionals directly involved in your care will have access to your personal data.
Vendors providing service, support and maintenance will have access to your data only to the extent strictly necessary for the operation of the Platform.
We require all third parties processing personal information on our behalf (data processors) to enter into a data processing agreement including having appropriate technical and organizational security measures in place to protect your personal information, in line with applicable data protection legislation. We further require that they do not share your personal information with any third parties without our written consent, that they keep the information secure, retain it only for the period we instruct, and that they do not use it for any other purposes than those specified.
International transfers
Your personal data may be transferred outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place. This means that when transferring personal information to non-EEA countries We will either rely on the EU Commission's decision that the receiving country offers an adequate level of data protection or base the transfer on a standard agreement made by the EU Commission known as Standard Contractual Clauses (SCC). When relying on SCCs for transfers to non-EEA countries, we conduct transfer impact assessments and implement supplementary measures, such as encryption and pseudonymization, where required, to ensure compliance with EU data protection standards. Further details as well as a copy of our Standard Contractual Clauses can be provided on request (see Contact Us section above).
Automated processing
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.
For how long do we keep your personal data?
Your personal data held by us or our representatives will be retained for as long as you use the Platform and will be deleted after fourteen (14) consecutive months of inactivity, upon withdrawal of your consent, or when it is no longer necessary to meet our legal and/or regulatory obligations.
Your rights
You can at any time request a copy of the data we hold about you, which you can transfer to another party, if needed. You have the right to correct inaccurate or incomplete data about you, to object to our processing of your personal data or to request the deletion of your data. You can withdraw your consent at any time either by deleting your account via the link at the bottom of each email from the Platform, or by asking your treating physician to delete your profile. This does not affect processing that took place before withdrawal. If you believe that your rights under the GDPR have been violated, you have the right to lodge a complaint with the relevant data protection authority. Contact details for authorities in the EEA countries are available here.
To exercise any of your rights as described in this notice please send an email to:
DataPrivacy@ascendispharma.com
Updates to this Privacy Notice
We reserve the right to update this Privacy Notice from time to time in response to changing legal, technical, or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes. The applicable Privacy Notice will at all times be available on the Platform.