4.1 Information that Mylan New Zealand May Collect.
The types of Personal Information Mylan New Zealand may collect include a Data Subject’s name, gender, date of birth, email address(es), residential, business and postal address(es), contact telephone numbers and facsimile numbers, health information (as defined in the Privacy Code) including allergies and prescription details and doctors details, website account user information and other information that may be relevant in our dealings with a Data Subject. More specifically, depending on the type of relationship we have with each Data Subject we may collect the following:
4.1.1 From a healthcare professional including doctor or pharmacist:
• name, profession, business address and other contact information
• any comments or suggestions regarding our products
• details gathered during calls made by our sales representatives to ensure we provide a personalised service
• statistical details regarding prescriptions given or filled
• details of samples you request from us
• (for pharmacists) financial information required for purchases of our products
• services (such as speaking engagements, consulting or advisory) you have provided to us and sponsored events you have attended and the payments you have received from us in connection with these services
4.1.2 From an individual consumer:
• name and contact details
• any Personal Information provided to us which is relevant to a query or complaint. This may include health information provided pursuant to the Data Subject’s express consent
4.1.3 From a job applicant:
• name and contact details
• qualifications and employment history
• log in details if you apply through our website
• health information (if a medical examination is required)
• the results of a criminal record check (if a criminal record check is required)
• whether the applicant is a New Zealand citizen or permanent resident and if not, their visa type
• whether the applicant holds a current drivers licence
4.1.4 From a member of a patient support program, including Epiclub:
• name and contact details
• website account user log in details;
• date of birth
• biometric information
• medical history and medication details (for example: allergies, and pending expiry of an EpiPen® Auto-Injector)
• Allergy & Anaphylaxis New Zealand membership
• role (e.g. patient, parent/carer, school or pharmacist)
4.1.5 From clinical trial participants:
• allergies, disease type or condition
• medical history
• test and trial results
• biometric and genetic information (including samples)
• name of doctor or treating physician
• family history
4.1.5 From participants of the Clozaril Patient Monitoring System:
• name, date of birth, sex, blood type
• blood test results
• medical history and medication details (including adverse event reports)
• other health information that may be required for regulatory compliance purposes
• name of doctor or treating physician
We generally collect Personal Information direct from the Data Subject, such as where the Data Subject contacts us, has a conversation with a sales representative, creates an account with us, uses one of our health applications, participates in a promotion or competition, or participates in a clinical trial. However, we may collect Personal Information from a third party where it is not reasonable or practical to collect the information from the Data Subject, or the Data Subject has consented to us obtaining the information from the third party, such as a doctor or pharmacist.
4.2 Anonymous Use.
When dealing with Mylan New Zealand, a Data Subject may choose not to identify himself or herself, to use a pseudonym, or may choose not to provide us with some or all of their Personal Information. However, in any of these situations, such elections may affect Mylan New Zealand’s ability to provide the products, services, information or assistance requested.
Where you elect to use a pseudonym or use a Mylan New Zealand website anonymously, we may subsequently contact you and require details of your true identity where we need them to fulfil any legal requirements.
4.3 Use and Disclosure of Personal Information.
We use Personal Information to:
• efficiently administer, manage and deliver our products and/or services including through our websites and patient monitoring systems;
• provide information about other products and/or services that may be of benefit to the Data Subject;
• respond to any queries or complaints;
• statistically analyse the distribution of our products;
• facilitate our business operations;
• comply with relevant legislation and regulations;
• conduct clinical trials, with the consent of participants; and
• conduct research in a de-identified manner relevant to public health and/or safety, to compile and analyse statistics relevant to public health, all in a manner permitted by New Zealand law, where the information you have provided is health information.
We may disclose a Data Subject’s Personal Information:
• to our agents, contractors or third party service providers that provide data processing, financial, legal, administrative or other services in connection with the operation of our business and the management of our patient monitoring systems, for example medical management service providers, mailing houses, software developers, IT maintenance providers and solicitors; or
• to another person or entity in connection with the sale or transfer of one of Mylan New Zealand's products or services (to enable continuity of supply of that product or service);
• to a third party if we determine that the disclosure is necessary in connection with our supply to you or your use of our products, services, your use of our website or with any purpose for which the relevant Personal Information was collected;
• where acting in good faith, we believe that the law requires or permits us to do so (e.g., to law enforcement agencies or government auditors, regulatory bodies and industry associations located in New Zealand or overseas); or
• with the Data Subject’s consent.
Without limiting the above, if you are, or are applying to become, a customer of Mylan New Zealand, we may use your Personal Information to check your creditworthiness and to recover any outstanding payments due by you from time to time. In order to do this, we may pass on your Personal Information to a credit reporting agency or a debt collection service provider. Personal Information that we pass on to a credit reporting agency may be made available by the credit reporting agency to other persons who use that credit reporting agency's services. We will, on request from you, inform you of any credit reporting agency to whom we may have disclosed your Personal Information and/or payment default information.
4.3.2 Overseas disclosures
Mylan New Zealand shares Personal Information with Mylan N.V. based in the Netherlands and UK and its affiliates. These affiliates include Mylan Inc., which serves as our corporate headquarters and is based in the United States and Alphapharm Pty Ltd and BGP Products Pty Ltd, which are based in Australia. Mylan New Zealand may also store Personal Information on third party servers based in the UK and Ireland. These countries may not offer the same level of privacy protection as in New Zealand. However, Mylan does take reasonable steps to ensure that Personal Information is transferred, stored and processed in a secure manner, and that the rights of Data Subjects are respected in a manner that is consistent with the New Zealand Information Privacy Principles and the Privacy Code.
4.3.3 Direct marketing and opting out
Subject to compliance with the Unsolicited Electronic Messages Act 2007, Mylan New Zealand may, after obtaining a Data Subject’s express prior consent, use information, including Personal Information, to communicate with a Data Subject to facilitate transmittal about its current or new products and services that Mylan New Zealand thinks may be useful or relevant to recipients (for example, via email, SMS or phone). The Personal Information provided by the Data Subject will be used in accordance with the purpose(s) agreed at the time the Data Subject opted in to receiving such communications. Mylan New Zealand does not rent, sell or share Personal Information about Data Subjects with other people or non-affiliated companies for their direct marketing purposes. Any Data Subject who does not wish to receive direct marketing from Mylan New Zealand after opting in to receive them may opt out of receiving such communications at any time by following the opt out instructions set out in the relevant communication or by contacting the Privacy Officer using the details set out in section 5 below.
4.4 Information Security
We take reasonable steps to protect your Personal Information from misuse, loss, unauthorised access, modification or disclosure.
Personal Information is stored securely whether in an electronic or physical form. For example, only staff needing access to the information are allowed access. Personal Information is stored in secured premises or in electronic databases requiring logins and passwords. Personal Information will be permanently de-identified or destroyed if it is no longer required for any purpose set out in Part 4.3 or for which we may otherwise use or disclose it, or when we are no longer required to keep it. Some information, particularly health information, must be kept for a number of years to comply with legal requirements, such as health records legislation.
4.5 Access and Correction
We take reasonable steps to ensure that all the Personal Information about you that we collect, hold, use or disclose, is relevant, accurate, complete, up to date and not misleading. Data Subjects must promptly notify us if there are any changes to their Personal Information.
Data Subjects can at any time request access to or correction of their Personal Information by contacting our Privacy Officer on the details in section 5 below. Mylan New Zealand will process such requests as soon as reasonably practicable, and in any case not later than 20 working days, and may require payment of reasonable charges incurred by us in complying with such requests. Data Subjects may also request to correct or delete Personal Information that they believe is irrelevant to the purposes set out in Part 4.3, inaccurate, incomplete or out of date.
Mylan New Zealand may need to verify a Data Subject’s identity before giving access to or correcting their Personal Information.
Mylan New Zealand will provide Data Subjects with access to their Personal Information unless an exception in the Privacy Act, Privacy Code, or other applicable legislation applies.
Mylan New Zealand will generally correct Personal Information on request or if we are otherwise satisfied the information is inaccurate, incomplete, out-of-date, irrelevant, or misleading. If we refuse to correct Personal Information, the Data Subject may ask us to record a statement with that Personal Information indicating what they believe is incorrect.
4.6 Questions or Complaints
Data Subjects wishing to make a complaint in relation to Mylan New Zealand’s handling of their Personal Information or access or request refusals, should contact our Privacy Officer using the details set out in section 5 below. Mylan New Zealand will need details about the nature of the complaint and will need to verify the Data Subject’s identity. We will investigate your complaint and respond within a reasonable period and within any timeframes required by law. We may need to request more information.
Data Subjects who are not satisfied with our response to a complaint can contact the Office of the New Zealand Privacy Commissioner at the details below:
Phone: 0800 803 909
Post: PO Box 10 094, The Terrace, Wellington 6143
Online form: www.privacy.org.nz/your-rights/complaint-form/