IQVIA (also referred to as “Company,” “we” or “our”) respects the relationships we have with our customers and respects the privacy of all individuals whose Personal Information may be processed by IQVIA in the performance of our services and our business operations. This Privacy Policy supplements our Privacy Shield policy (available here and discussed below), to apply around the world. This Policy explains how IQVIA collects, holds, uses and discloses Personal Information, including Personal Information of our personnel, consumers, healthcare professionals, patients, medical research subjects, clinical investigators, customers, suppliers, vendors, business partners and investors. IQVIA intends that this corporate privacy policy and our implementing standard practices and procedures will support timely compliance with all international privacy laws and regulations around the world.

To demonstrate our commitment to the protection of Personal Information, including Personal Information transferred out of the European Economic Area (“EEA”) and Switzerland for the performance of our services and business operations, we adhere to the Privacy Shield Principles and are certified to the EU-U.S. Privacy Shield Framework (“Privacy Shield”), as set forth by the U.S. Department of Commerce and the Federal Trade Commission. Further details of the Privacy Shield and the Privacy Shield Principles can be found on the website at https://www.privacyshield.gov. We also use standard contractual clauses and other mechanisms approved by the European Union and Switzerland, respectively, for transfers of Personal Information from the EEA and Switzerland.

Advisory: Please note that as of July 16, 2020, we no longer rely on the EU-U.S. or the Swiss-U.S. Privacy Shield to transfer data that originated in the EEA, Switzerland, or the UK to the U.S. We may continue to rely on alternative data transfer mechanisms deemed appropriate by the relevant authorities to transfer data collected from the EEA, Switzerland, and the UK to the U.S., such as standard contractual clauses.

SCOPE: This Policy applies to all Personal Information of Individuals, either in electronic or paper format, received by IQVIA, including Personal Information of Company Personnel, job applicants, consumers, healthcare professionals, patients, medical research subjects, clinical investigators, customers, suppliers, vendors, business contacts and partners, government officials and investors. IQVIA endeavors to collect, use and disclose Personal Information in a manner consistent with the laws of countries in which it does business, and also has a tradition of upholding the highest ethical standards in its business practices.

DEFINITIONS: For purposes of this Policy, the following definitions shall apply:

• "Agent” means any third party that uses Personal Information provided to it by IQVIA to perform tasks on behalf of and/or under the instructions of IQVIA or to which IQVIA discloses Personal Information for use on its behalf.
• “European Economic Area” (EEA) means for the purposes of this Policy the following thirty-one countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Ireland, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden (i.e. countries within the European Union) and Iceland, Liechtenstein, Norway and the United Kingdom.
• “Individual” means any natural person.
• “Personal Information” means any information or set of information about an identified or identifiable individual, including, but not limited to: (a) first name or initial and last name; (b) home or other physical address; (c) telephone number; (d) email address or online identifier associated with the individual; (e) Social Security number or other similar identifier; (f) employment, financial or health information; or (g) any other information relating to an individual that is combined with any of the above. The term “Personal Information” does not include non-identified information or information that is reported in the aggregate (provided that such aggregated information is not identifiable to a natural person).
• “Company Personnel” includes, but is not limited to, any employee (permanent or temporary), director, officer, contractor, worker, temporary worker, job applicant, retiree of IQVIA and any and all of their respective dependents.
• “Privacy Shield Principles” collectively means the seven (7) privacy principles, as well as the supplemental privacy principles and the associated guidance, details of which can be found at https://www.privacyshield.gov.
• “IQVIA” means any entity that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with IQVIA, Inc. For purposes of this definition, “control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of such entity, whether through the ownership of voting securities, by contract or otherwise.

“Sensitive Personal Information” means Personal Information that reveals or is processed to uniquely identify a person:

• All government-issued identification numbers (including US Social Security numbers, EU Social Security numbers, Canadian Social Insurance numbers, driver’s license numbers, and passport numbers);
• All financial account numbers (bank account numbers, credit card numbers, and other information if that information would permit access to a financial account);
• Individual medical records, biomedical specimens, and biometric information, including any information on any worker or consumer’s health, disability, disease or product interests;
• Reports of individual background checks;
• Data elements revealing race, ethnicity, national origin, political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data where processed to uniquely identify a person, any information that concerns medical or health conditions or sex life, or information relating to the commission of a criminal offense sex life or sexual orientation, and information relating to the commission of a criminal offense.
• Precise geolocation data related to workplace locations of healthcare professionals;
• Personal Information about individuals under the age of thirteen (13).

Capitalized terms not defined above have the definitions set forth in the respective paragraphs of this Policy.

NOTICE

Where IQVIA collects Personal Information directly from Individuals, it will explain the purposes for which it collects and uses Personal Information about the Individuals, the types of third parties to which IQVIA discloses that information, and the choices and means, if any, IQVIA offers Individuals options for limiting the use and disclosure of Personal Information about them. Notice will be provided in clear and conspicuous language. This explanation will be provided as soon as practicable and, in any event, before IQVIA discloses the Personal Information or uses such information for a purpose materially different than that for which it was originally collected or processed. IQVIA also will provide any additional information required by law for a specific context, product or service. In general, with exceptions and other lawful bases that may be relevant for any specific product or service notice, IQVIA processes personal data for its legitimate interests consistent with applicable law. Where an IQVIA entity receives Personal Information from another IQVIA entity or other entities, including when acting as a CRO processing Personal Information under the direction of a customer, it will use such information in accordance with the notices provided by such entities and the choices made by the Individuals to whom such Personal Information relates. In circumstances in which IQVIA obtains personal data as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for providing appropriate notice to the Individuals and, when applicable, obtaining any requisite consent (unless this function has been delegated to IQVIA).

• Research Studies-Related Information. For Individuals participating in research studies being managed by IQVIA as a CRO or in other situations where IQVIA is participating in research studies, including patients, their spouses/partners, care givers, and relatives, clinical investigators or other study personnel, and other consultants, contractors, managers, and agents (who are natural persons) of the study sponsor and its corporate affiliates, business partners and third-party service providers, Personal Information may be used in order to carry out the applicable studies and other study-related services and/or pharmacovigilance. This may include the transfer of such Personal Information to the applicable study sponsor, its corporate affiliates, business partners and third-party service providers performing services related to the study (e.g., study data management, clinical research monitoring services, safety monitoring, etc.).
• Human Resources-Related Information. For Individuals who are Personnel, we will process Personal Information to carry out and support our human resources functions and activities, including but not limited to (i) evaluation of qualifications for an employment position; (ii) provision of employment benefits; (iii) administration and management of employees, compensation, stock options, grants and purchase plans, bonuses, retirement, training, and career planning; (iv) utilizing employee skills and ongoing employee resource allocation; (v) communicating with employees or their emergency contacts; (vi) administration of the company's business including budgeting, manpower planning, and organizational design; (vii) authentication of the individual's identity when gaining access to computer system applications; (viii) Personal Information data changes; (ix) employment status changes; (x) travel and expense planning and reimbursement; and (xi) evaluation of employee performance and time management; and (xi) management of Personnel performance, and implementation, investigation and reporting on compliance and discipline procedures and matters. IQVIA may provide Personal Information to Agents to support IQVIA in performance of these human resources-related activities. Further information concerning how IQVIA collects, uses, shares and safeguards the Personal Information of Company Personnel is available to IQVIA Company Personnel in IQVIA’s internal privacy policy. In addition, for job applicants, Personal Information will be used for the evaluation of suitability of the applicant for a position. IQVIA may, under its discretion and with the consent of the candidate where required by law or otherwise obtained, perform such background checks as deemed appropriate to evaluate this suitability.
• Business Contacts. For Individuals who are business contacts of IQVIA, IQVIA may collect personal information concerning contact information for such business contacts. This information may be used for purposes consistent with the provision of information by these contacts, which may include marketing activities focused on sales of new products and services, requests to participate in market research that enhance IQVIA’s product offerings and other business activities.
• Health Care Professionals. IQVIA collects information about health care professionals directly from the health care professionals, from public sources and from business partners. We use this information in connection with various health care activities, including clinical trials, real world studies of patient treatment, health care outcomes analysis, market research activities, and other situations where primary intelligence from health care professionals is applicable.
• Customers and Program Participant Information. For Individuals sharing Personal Information with IQVIA in order to inquire about or otherwise make use of our services or purchase, receive or seek information, including about any health care products and services, opportunities to participate in clinical research, health care education and patient support programs which may be available through IQVIA, we will use such Personal Information in order to provide the requested information, products, and/or services. Such uses may include but is not limited to processing requested transactions, improving the quality of our services, sending communications about the products and services available through IQVIA, and enabling our business partners and Agents to perform certain activities on our behalf.
• Data Analytics Functions. In certain situations, IQVIA obtains and processes information about Individuals for various data analytics purposes. In most situations, this data has been anonymized or de-identified and is no longer Personal Information when it is obtained by IQVIA or whenever transferred. In some situations, IQVIA receives Personal Information from a customer or other data supplier for the purpose of such anonymization or de-identification. In other situations, the data that is obtained and processed by IQVIA is pseudonymous. This pseudonymous information may be used for research purposes, primarily in connection with academic partners, with academia, and may be transferred by IQVIA to the United States as part of these research-related activities. For all of these situations, IQVIA’s activities are consistent with the notice and choice provided by these customers or data suppliers to Individuals, and IQVIA’s use of this information is consistent with IQVIA’s obligation to provide services to these entities. In those situations, and where such information is transferred to the United States, IQVIA uses such information only in manners consistent with the Privacy Shield Principles and the manner in which this data was obtained.

IQVIA may also use the Personal Information collected above to comply with our legal and regulatory obligations, policies and procedures, and for internal administrative purposes.

CHOICE

IQVIA may offer Individuals the opportunity, where practical and appropriate, to choose whether their Personal Information is (a) to be disclosed to a non-Agent third party, or (b) to be used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized by the Individual.

IQVIA will not process Sensitive Personal Information about Individuals for purposes other than those for which the information was originally obtained or subsequently authorized by the Individual unless the Individual explicitly consents to the processing (“opt-in”), or as required or permitted, or where not prohibited by law or regulation.

In some cases, even if an Individual opts-out of disclosures of their Personal Information, IQVIA may still disclose such Personal Information (i) if required to do so by law, court order or legal process, (ii) in response to lawful requests by public authorities, including meet national security or law enforcement requirements, (iii) under the discovery process in litigation, (iv) to enforce IQVIA policies or contracts, (v) to collect amounts owed to IQVIA, (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity, or (vii) in the good faith believe that disclosure is otherwise necessary or advisable. IQVIA also may transfer Personal Information when a material event concerning its business operation(s), assets or shares, such as purchase, disposal, merger, joint venture or acquisition, is proposed or occurs. In such an event, IQVIA will endeavor to direct the transferee to use Personal Information in a manner that is consistent with this Policy. IQVIA will provide Individuals with reasonable mechanisms to exercise their choices to the extent required by applicable law.

ACCOUNTABILITY FOR ONWARD TRANSFER

In the performance of our services and business operations, Personal Information we collect or receive may be stored or transferred internationally throughout our worldwide organization and to our service providers or agents, including for hosting our databases or provision of data processing services, in accordance with applicable data privacy laws. Transfers to third parties are covered by the provisions in this Policy regarding notice and choice.

IQVIA may also share an Individual's Personal Information with Agents, including affiliates, in connection with services or business purposes that these individuals or entities perform for, or with, IQVIA. IQVIA may, for example, provide an Individual's Personal Information to Agents for hosting our databases, for data processing services, or to send to that Individual the information that he or she requested.

IQVIA does not sell or otherwise disclose Personal Information, except as described in this Policy or in a notice provided to Individuals at the time of collection, or as Individuals explicitly consent.

IQVIA may transfer Personal Information for specified, limited purposes, to an Agent and will endeavor to obtain assurances that such Agent provides at least the same level of privacy protection as is required by the Privacy Shield Principles (where applicable) and this Policy and will notify IQVIA if it makes a determination it can no longer meet this obligation.

Where IQVIA knows that any third party to whom it has provided Personal Information is using or disclosing Personal Information in a manner contrary to this Policy, IQVIA will take reasonable steps to prevent or stop the use or disclosure. With respect to such onward transfers to Agents, and to the extent IQVIA is responsible for the event, IQVIA shall remain liable should its Agents process Personal Information in a manner inconsistent with the Privacy Shield Principles (where applicable) and this Policy.

In circumstances in which IQVIA obtains Personal Information as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for protecting individual rights with respect to onward transfers.

SECURITY

IQVIA will endeavor to take reasonable and appropriate technical, administrative and physical safeguards designed to protect Personal Information in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the Personal Information IQVIA is processing, and regardless of whether such Personal Information is in electronic or tangible, hard copy form. We have a privacy incident response program designed to promptly respond to and escalate all privacy-related questions, complaints, concerns, including any potential privacy or security incident.

DATA RETENTION

The information we collect may be archived or stored periodically by us according to backup processes and will only be retained for as long as is required for the purposes for which it was collected, provide our products and services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

DATA INTEGRITY AND PURPOSE LIMITATION

IQVIA endeavors to use Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the Individual. IQVIA will take reasonable steps designed to ensure that only Personal Information that is relevant to its intended use, accurate, complete, current, and otherwise reliable in relation to the purposes for which the information was obtained is used by IQVIA for as long as IQVIA retains possession of such information. IQVIA’s Personnel have a responsibility to assist IQVIA in maintaining accurate, complete and current Personal Information. When acting as a CRO or in other situations where IQVIA acts on behalf of another entity, IQVIA endeavors only to process Personal Information that is relevant to the services it provides, and only for purposes compatible with those for which the Personal Information was collected; wherever possible, such Personal Information is non-identified. Where IQVIA processes Personal Information as a CRO or otherwise acts under the direction of its customers, IQVIA works with such customers so that the customers can provide a way for Individuals to correct or update their Personal Information to the extent required by law.

YOUR RIGHTS

Under laws in certain countries in which we operate, individuals have a right to access Personal Information about themselves, and to amend, correct or delete Personal Information that is inaccurate, incomplete or outdated. If you are an EU resident, you may have additional rights available to you with regards to your Personal Information, including the right to file a complaint with your local data protection authority, the right to object to your data being processed, and certain rights related to our use of any automated-decision making processes (to the extent applicable). IQVIA will, on request, provide an Individual with confirmation regarding whether IQVIA is processing Personal Information about them, consistent with applicable law. In addition, upon request of an Individual, IQVIA may take reasonable steps to comply with an individual rights request, except where the burden or expense of providing access would be disproportionate to the risks to that Individual’s privacy, where the rights of persons other than the Individual would be violated or where doing so is otherwise consistent with applicable law. Unless prohibited by applicable law, IQVIA reserves the right to charge a reasonable fee to cover costs for providing copies of Personal Information requested by Individuals. IQVIA, when acting as a CRO, has no direct relationship with medical research subjects participating in a clinical trial and any such Individuals who seek access, or who seek to correct, amend, or delete their inaccurate Personal Information should direct his or her query to the relevant study sponsor or investigator which has transferred such Personal Information to IQVIA for processing.

Also, in any other circumstances in which IQVIA maintains personal data as a service provider for its clients or affiliates, IQVIA ’s clients or affiliates are responsible for providing Individuals with access to their personal data and the right to correct, amend or delete the data where it is inaccurate. In these circumstances, Individuals should direct their questions to the appropriate IQVIA client or affiliate. If they do not receive a response, IQVIA will provide reasonable assistance in forwarding the Individual’s request.

Although IQVIA makes good faith efforts to provide Individuals with access to their Personal Information, there may be circumstances in which IQVIA is unable to provide access, including but not limited to: where the information contains legal privilege, would compromise others’ privacy or other legitimate rights, where the burden or expense of providing access would be disproportionate to the risks to the Individual’s privacy in the case in question or where it is commercially proprietary. If IQVIA determines that access should be restricted in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, IQVIA will take commercially reasonable steps to verify your identity before granting access to or making any changes to your Personal Information.

Where otherwise permitted by applicable law, you may send an e-mail to PrivacyOfficer@IQVIA.com or use any of the methods set out in this Policy to request access to, receive (port), seek rectification, or request erasure of Personal Information held about you by IQVIA. Such requests will be processed in line with local laws.

If you are a California user, you may also have additional rights available to you under the California Consumer Privacy Act. Please review our CCPA for additional details.

RECOURSE, ENFORCEMENT AND LIABILITY

IQVIA encourages Individuals covered by this Policy to raise questions about the processing of Personal Information about them by contacting IQVIA through the contact information provided below. Any Personnel that IQVIA determines is in violation of this Policy will be subject to disciplinary action up to and including termination of employment, where applicable, in accordance with IQVIA’s disciplinary procedures.

Any questions or concerns regarding the use or disclosure of Personal Information should also be directed to IQVIA through the contact information given below. IQVIA will undertake reasonable efforts to investigate and attempt to resolve complaints and disputes regarding use and disclosure of Personal Information in accordance with the principles contained in this Policy.

If you are an EU or Swiss citizen and feel that IQVIA is not abiding by the terms of this Policy, please contact IQVIA at the contact information provided below. If any request remains unresolved, you may contact the national data protection authority for your EU Member State.

In certain circumstances, IQVIA has agreed to cooperate with the American Arbitration Association (“AAA”) and with Judicial Arbitration and Mediation Services, Inc. (“JAMS”) with respect to complaints of Individuals that are not Personnel of the Company and with the local data protection authorities with respect to Personnel and human resources related information consistent with applicable law. For more information and to submit a complaint to AAA or JAMS, visit http://go.adr.org/privacyshield.html or https://www.jamsadr.com/file-an-eu-us-privacy-shield-claim. Such independent dispute resolution mechanisms are available to Individuals free of charge. If any request remains unresolved, Individuals may have a right to invoke binding arbitration under Privacy Shield. To verify any other IQVIA’s commitments on this regard, please review our Privacy Shield Policy. (However, please note that, as of July 16, 2020, we no longer rely on the EU-U.S. or the Swiss-U.S. Privacy Shield to transfer data that originated in the EEA, Switzerland, or the UK to the U.S.).

In circumstances in which IQVIA obtained or maintains Personal Information as a CRO or other Service Provider, Individuals may submit complaints concerning the processing of their Personal Information to the relevant client, in accordance with the client’s dispute resolution process. IQVIA will participate in this process at the request of the client or the Individual. IQVIA will take steps to remedy any issues arising out of potential failure to comply with this Policy and, where applicable, the Privacy Shield Principles.

CONTACT INFORMATION: Questions, comments, concerns or complaints regarding this Policy or IQVIA’s processing of Personal Information should be submitted to the IQVIA Chief Privacy Officer at PrivacyOfficer@IQVIA.com.

RESERVATION OF RIGHTS: IQVIA reserves the right to share an Individual’s Personal Information and contracts with Agents as required or authorized by law or regulation or in response to duly authorized information requests of government authorities.

CHANGES TO THE PRIVACY POLICY: This Policy may be reviewed and amended from time to time, without advance notice, to ensure that an appropriate level of protection for Personal Information is maintained. All amendments will be posted on this website. Please check back periodically for updates to this Policy.

IQVIA PRIVACY POLICY EFFECTIVE DATE: July 22, 2021

IQVIA PRIVACY POLICY – SOUTH AFRICAN ADDENDUM

This privacy notice applies in addition to the IQVIA General Privacy Policy available at https://www.iqvia.com/about-us/privacy/privacy-policy when the South African Protection of Personal Information Act, 2013 (“POPIA”) applies to the processing of your personal information.

IQVIA Solutions (Pty) Ltd (“IQVIA SA”, “we” or "us") is the entity responsible for collecting, storing or using your personal information (that is, the "responsible party" in terms of POPIA). If you have any questions, please contact us through the details set out in the "Contact Us" section below.

International transfers of personal information

If we transfer personal information to a recipient based in a jurisdiction outside the Republic of South Africa, we will ensure that we comply with the provisions of POPIA. We might, for example, rely on permitted transfer mechanisms such as relying on "binding corporate rules" or a transborder transfer agreement to which the recipient is a party. We may also rely on other transfer mechanisms or legal bases available to us.

Complaints

The Information Regulator is the competent authority to deal with complaints and claims that in relation to non-compliance with the personal information protection requirements under POPIA. The Information Regulator’s contact details are available at https://www.justice.gov.za/inforeg/contact.html