This policy explains how Mylan New Zealand Limited and BGP Products trading as Mylan EPD and any other affiliates of Mylan New Zealand Limited trading in New Zealand (referred to in this policy as “Mylan New Zealand”, “we”, “our” or “us”) handles the Personal Information that we collect and hold about individuals (who are described in this policy as Data Subjects). It details the types of Personal Information we may collect, how we may use and disclose it, how we store it, and how a Data Subject may seek access to, and correction of it. In addition to this policy Mylan New Zealand will, on occasions, provide Data Subjects with specific statements about how we use and disclose particular information that we collect from the Data Subject (including through our website) and seek consent if necessary.
Mylan New Zealand is bound by the Privacy Act 1993 (“Privacy Act”) (including the Privacy Principals in that Act), the Health Information Privacy Code 1994 (“Privacy Code”), and other relevant health legislation. Mylan New Zealand researches, develops and manufactures generic medicines and other medical products and distributes them throughout New Zealand. Mylan New Zealand is a wholly-owned, indirect subsidiary of Mylan N.V. In the course of our business and activities, we collect, process, transmit, disclose and store Personal Information about different types of people.
At Mylan New Zealand your privacy is important to us. We are committed to ensuring that Personal Information we hold about you is held securely and that your privacy is protected.
Data Subject. Means any patient, customer, healthcare provider, or individual (except for employees of Mylan New Zealand and other Mylan group companies) about whom Mylan New Zealand collects, transmits, discloses, processes, or stores Personal Information that is identifiable or may be identifiable to the individual.
Personal Information. Means any information or opinion about a Data Subject, or about a Data Subject who is reasonably identifiable to us, whether it is true or not, or whether it is recorded in material form or not.
Privacy Officer. Means the person whose details are available at section 5 of this policy below and who can be contacted in relation to any enquiries, complaints or access and correction requests in connection with this policy.
4.1 Information that Mylan New Zealand May Collect. The types of Personal Information Mylan New Zealand may collect include a Data Subject’s name, gender, date of birth, email address(es), residential, business and postal address(es), contact telephone numbers and facsimile numbers, health information including allergies and prescription details and doctors details, website account user information and other information that may be relevant in our dealings with a Data Subject. More specifically, depending on the type of relationship we have with each Data Subject we may collect the following:
4.1.1 From a healthcare professional including doctor or pharmacist:
4.1.2 From an individual consumer:
- name, profession, business address and other contact information
- any comments or suggestions regarding our products
- details gathered during calls made by our sales representatives to ensure we provide a personalised service
- statistical details regarding prescriptions given or filled
- details of samples you request from us
- (for pharmacists) financial information required for purchases of our products
- services (such as speaking engagements, consulting or advisory) you have provided to us and sponsored events you have attended and the payments you have received from us in connect with these services
4.1.3 From a job applicant:
- name and contact details
- any Personal Information provided to us which is relevant to a query or complaint. This may include health information provided pursuant to the Data Subject's express consent
4.1.4 From a member of a patient support program, including Epiclub:
- name and contact details
- qualifications and employment history
- log in details if you apply through our website
- health information (if a medical examination is required)
- the results of a criminal record check (if a criminal record check is required)
- whether the applicant is a New Zealand citizen or permanent resident and if not, their visa type
- whether the applicant holds a current drivers licence
4.1.5 From clinical trial participants:
- name and contact details
- website account user log in details;
- date of birth
- biometric information
- medical history and medication details (for example: allergies, and pending expiry of an EpiPen® Auto-Injector)
- Allergy & Anaphylaxis New Zealand membership
- role (e.g. patient, parent/carer, school or pharmacist)
- allergies, disease type or condition
- medical history
- test and trial results
- biometric and genetic information (including samples)
- name of doctor or treating physician
- family history
We generally collect Personal Information direct from the Data Subject, such as where the Data Subject contacts us, has a conversation with a sales representative, creates an account with us, uses one of our health applications, participates in a promotion or competition, or participates in a clinical trial. However, we may collect Personal Information from a third party where it is not reasonable or practical to collect the information from the Data Subject, or the Data Subject has consented to us obtaining the information from the third party, such as a doctor or pharmacist.
4.2 Anonymous Use.
When dealing with Mylan New Zealand, a Data Subject may choose not to identify himself or herself, to use a pseudonym, or may choose not to provide us with some or all of their Personal Information. However, in any of these situations, such elections may affect Mylan New Zealand’s ability to provide the products, services, information or assistance requested.
Where you elect to use a pseudonym or use a Mylan New Zealand website anonymously, we may subsequently contact you and require details of your true identity where we need them to fulfill any legal requirements.
4.3 Use and Disclosure of Personal Information.
We use Personal Information to:
- efficiently administer, manage and deliver our products and/or services including through our websites;
- provide information about other products and/or services that may be of benefit;
- respond to any queries or complaints;
- statistically analyse the distribution of our products;
- facilitate our business operations;
- comply with relevant legislation and regulations;
- conduct clinical trials, with consent of participants; and
- conduct research in a de-identified manner relevant to public health and/or safety, to compile and analyse statistics relevant to public health, all in a manner permitted by New Zealand law, where the information you have provided is health information.
We may disclose a Data Subject’s Personal Information:
- to our agents, contractors or third party service providers that provide financial, legal, administrative or other services in connection with the operation of our business, for example mailing houses, software developers, IT maintenance providers and solicitors, or together with the sale or transfer of one of Mylan New Zealand's products or services to another person or entity (to enable continuity of supply of that product or service);
- to a third party if we determine that the disclosure is necessary in connection with our supply to you or your use of our products, services, your use of our website or with any purpose for which the relevant personal data was collected;
- where acting in good faith, we believe that the law requires or permits us to do so (e.g., to law enforcement agencies or government auditors regulatory bodies and industry associations located in New Zealand or overseas); or
- with the Data Subject’s consent.
Without limiting the above, if you are, or are applying to become, a customer of Mylan New Zealand, we may use your Personal Information to check your creditworthiness and to recover any outstanding payments due by you from time to time. In order to do this, we may pass on your Personal Information to a credit reporting agency or a debt collection service provider. Personal Information that we pass on to a credit reporting agency may be made available by the credit reporting agency to other persons who use that credit reporting agency's services. We will, on request from you, inform you of any credit reporting agency to whom we may have disclosed your Personal Information and/or payment default information.
4.3.2 Overseas disclosures
Mylan New Zealand shares Personal Information with Mylan N.V. based in the Netherlands and UK and its affiliates. These affiliates include Mylan Inc., which serves as our corporate headquarters and is based in the United States and Alphapharm Pty Ltd and BGP Products Pty Ltd, which are based in Australia. Other companies are in countries which may not take steps to ensure that the Personal Information that we disclose to those countries is handled in accordance with New Zealand privacy laws. However, Mylan does take steps to ensure that Personal Information is transferred, stored and processed in a secure manner, and that the rights of Data Subjects are respected in a manner that is consistent with New Zealand Privacy Principles.
4.3.3 Direct marketing and opting out
Subject to the Unsolicited Electronic Messages Act 2007, Mylan New Zealand may, after obtaining express prior consent, use information, including Personal Information (for example, email, SMS or phone), to communicate with a Data Subject to facilitate transmittal about its current or new products and services it thinks may be useful or relevant to recipients. The Personal Information provided by the Data Subject will be used in accordance with the purpose(s) agreed at the time the Data Subject opted in to receiving such communications. Mylan New Zealand does not rent, sell or share Personal Information about Data Subjects with other people or nonaffiliated companies for their direct marketing purposes. Any Data Subject who does not wish to receive direct marketing from Mylan New Zealand after opting in to receive them may opt out of receiving such communications at any time by following the opt out instructions set out in the relevant communication or by contacting the Privacy Officer using the details set out in section 5 below.
4.4 Information Security
We take reasonable steps to protect your Personal Information from misuse, loss, unauthorised access, modification or disclosure.
Personal Information is stored securely whether in an electronic or physical form. For example, only staff needing access to the information are allowed access. Personal Information is stored in secured premises or in electronic databases requiring logins and passwords. Personal Information will be permanently de-identified or destroyed if it is no longer required for any purpose set out in Part 4.3 or for which we may otherwise use or disclose it, or when we are no longer required to keep it. Some information, particularly health information, must be kept for a number of years to comply with legal requirements, such as health records legislation.
4.5 Access and Correction
We try to ensure that all the Personal Information about you that we collect, hold, use or disclose, is relevant, accurate, complete and current. Data Subjects must promptly notify us if there are any changes to their Personal Information.
Data Subjects can at any time request access to or correction of their Personal Information by contacting our Privacy Officer on the details in section 5 below. Mylan New Zealand will process such requests within a reasonable time and may require payment of reasonable charges incurred by us in complying with such requests. Data Subjects may also ask to correct or delete Personal Information that they believe is irrelevant to the purposes set out in Part 4.3, inaccurate, incomplete or out of date.
Mylan New Zealand may need to verify a Data Subject’s identity before giving access to or correcting their Personal Information. We will respond to such requests in a reasonable time.
Mylan New Zealand will provide Data Subjects with access to their Personal Information unless an exception in the Privacy Act, Privacy Code, or other applicable legislation applies.
Mylan New Zealand will generally correct Personal Information on request or if we are otherwise satisfied the information is inaccurate, incomplete, out-of-date, irrelevant, or misleading. If we refuse to correct Personal Information, the Data Subject may ask us to record a statement with that Personal Information indicating what they believe is incorrect.
4.6 Questions or Complaints
Data Subjects wishing to make a complaint in relation to the handling of their Personal Information or access or request refusals, should contact our Privacy Officer on the details in section 5 below. Mylan New Zealand will need details about the nature of the complaint and will need to verify the Data Subject’s identity. We will investigate your complaint and respond within a reasonable period and within any timeframes required by law. We may need to request more information.
Data Subjects who are not satisfied with our response to a complaint can contact the Office of the New Zealand Privacy Commissioner on the details below:
Phone: 0800 803 909
Post: PO Box 10 094, The Terrace, Wellington 6143
Online form: www.privacy.org.nz/your-rights/complaint-form/
5.0 CONTACT DETAILS
C/ General Counsel Australia and New Zealand
PO Box R1462
Royal Exchange Post Office
Tel 02 9298 3999
Fax 02 9566 4686
6.0 CHANGES TO THIS POLICY
Last updated: December 2016