Privacy Policy – Medical Vigilance

Privacy Notice – Pharmacovigilance System

Art. 13 EU Regulation 679 of April 27, 2016

Pursuant to Article 13 of European Regulation 2016/679 (GDPR), concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, ABOCA S.p.A. Società Agricola (hereinafter “ABOCA”), with registered office at Loc. Aboca 20, Sansepolcro (AR) – 52037, Arezzo, Italy, as Data Controller, is required to provide users of the website www.aboca.com with certain information regarding the processing of their personal data.

Data Controller:
ABOCA S.p.A. Società Agricola, Loc. Aboca 20, 52037 Sansepolcro (AR), Italy.

Data Protection Officer (DPO):
Avv. Giuseppe Serafini, Foro di Perugia
Email: [email protected]

Key Definitions to Aid Reading of this Notice

Vigilance: The set of activities aimed at identifying, evaluating, understanding, and preventing adverse effects or any other problems related to the use of medical devices, dietary supplements, and cosmetics. Its primary objective is to ensure that products are used safely, maintaining a favorable benefit/risk ratio for the population.

Medical Device: Any instrument, apparatus, appliance, software, implant, reagent, material, or other article, intended by the manufacturer to be used on humans, alone or in combination, for one or more of the following specific medical purposes:

• diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of diseases;

• diagnosis, monitoring, treatment, alleviation, or compensation of an injury or disability;

• study, replacement, or modification of anatomy or of a physiological or pathological process or state;

• providing information through in vitro examination of samples derived from the human body, including donated blood and tissues;

• and which does not achieve its principal intended action in or on the human body by pharmacological, immunological, or metabolic means, although its function may be assisted by such means.

Dietary Supplement: Food products intended to supplement the normal diet, providing a concentrated source of nutrients or other substances with a nutritional or physiological effect, either single-ingredient or multi-ingredient, in dosage forms, i.e., forms for commercial distribution such as capsules, tablets, pills, powders in sachets, liquids in vials, dropper bottles, and other similar forms, intended to be consumed in small unit quantities.

Cosmetic Product: Any substance or mixture intended to be applied to the external surfaces of the human body (epidermis, hair system and hair, nails, lips, external genital organs) or to the teeth and mucous membranes of the oral cavity for the exclusive or primary purpose of cleaning, perfuming, altering appearance, protecting, maintaining in good condition, or correcting body odors.

Food Business Operator: A natural or legal person responsible for ensuring compliance with food law requirements within the food business under their control.

Responsible Person: A natural or legal person designated as the “responsible person” within the EU, ensuring compliance with the relevant obligations set out in the cosmetics regulation.

Manufacturer: A natural or legal person who manufactures a cosmetic product, or has it designed or manufactured, and markets it under their name or trademark.

Adverse Effect: Any adverse reaction to human health resulting from the normal or reasonably foreseeable use of an Aboca product.

Personal Data: Information that identifies a natural person.

Reporter: A person who communicates health data concerning themselves or third parties.

Scope of Application

Ensuring patient safety is an absolute priority for Aboca. Therefore, we take the safe use of all our products (medical devices, supplements, and cosmetics) very seriously.

It is essential to be able to contact individuals who report safety information about our products (reporters), in order to collect further details, respond to requests, and provide the necessary materials.

This notice explains how we collect and use personal data received to fulfill our Vigilance obligations and ensure the safety of all our products.

The notice concerns the collection and use of personal data to ensure the safety of Aboca products.

Recording and analyzing reports, as well as the systematic and accurate collection of data, is not only a technical requirement but also an essential pillar to ensure that Vigilance can proactively protect public health and promote safe and responsible use of products.

Data are used to:

• Obtain the necessary information for reports;

• Respond to user requests;

• Monitor the safety and quality of products.

Nature of Data and Provision

We may collect the following information relating to the data subject:

• initials;
• gender;
• date of birth;
• age;
• ethnic origin;
• dosage;
• product name;
• batch/lot;
• reason for use;
• start and end date of the reaction;
• detailed description of the adverse effect;
• whether they are continuing to use the product;
• detailed information on other products (medications, medical devices, dietary supplements, cosmetics) they are using or were using at the time of the adverse effect or information request, including dosage taken or prescribed;
• outcome of the reaction to date (ongoing, resolved, improved, etc.);
• personal and family medical history (allergies, other conditions, etc.);
• any tests or investigations (if performed).

We may collect the following data regarding the reporter, if different from the patient/subject of the request:

• name and contact information (which may include address, email, phone number, or fax number);
• relationship to the person for whom the report was submitted.

Providing data is not mandatory but is essential to process a report of an adverse event related to the use of an Aboca product.

Failure to provide data will prevent the handling of the report.

Purposes and Legal Basis of Processing

The personal data collected may be used for the following purposes:

• Investigating adverse events;
• Contacting the reporter for further information;
• Analyzing Vigilance reports;
• Transmitting information to Competent Authorities;
• Asserting or defending a legal right.

The processing operations, detailed below, are based on laws governing your right to personal data protection and your right to privacy, namely:

• fulfillment of contractual obligations undertaken by ABOCA in your favor at the time of purchase or use of the products (Art. 6(b) GDPR);
• fulfillment of legal obligations or orders to which the Data Controller is subject by law or authority order (Art. 6(c) GDPR);
• public interest purposes pursuant to Art. 9(i) GDPR and Art. 83 EU Regulation 745 of April 5, 2017, regarding medical devices;
• processing necessary to ascertain, exercise, or defend a legal right in judicial proceedings, or whenever judicial authorities exercise their jurisdictional functions (Art. 9(f) GDPR).

Recipients

Your data may be communicated to data processors providing services on behalf of Aboca, within the limits of Art. 28 GDPR, to internal staff responsible for managing reports, and, where applicable, to regulatory authorities for compliance with legal obligations.

Data Retention Period

In accordance with the law, as a manufacturer, Food Business Operator, or Responsible Person for medical devices, dietary supplements, and cosmetics, we retain all product-related documents and personal data collected for Vigilance purposes for the duration of the marketing authorization, plus an additional 10 years after its expiry; however, the retention period may be extended if necessary, on a case-by-case basis, to assert or defend a legal right.

Security Measures

We adopt appropriate measures to protect personal data from accidental loss, unauthorized access, use, alteration, or disclosure, through encryption tools and designated data processors under Art. 28 GDPR.

Additionally, we implement further information security measures, including access controls, strict physical security, and sound practices for the collection, storage, and processing of information.

International Transfers

If data need to be transferred to entities outside the EU, the relevant instruments for legitimate data transfer, such as EU adequacy decisions, standard contractual clauses issued by the European Commission (GDPR Articles 45, 46), or applicable derogations (GDPR Article 49), will be applied as necessary.

Rights of Data Subjects

In relation to the above-described processing, you may exercise your rights as a data subject under the GDPR at any time. In general, you may:

• access your personal data, obtain evidence of the purposes pursued by the Controller, the categories of data processed, recipients, retention periods, the existence of automated decision-making, including profiling, and, in such cases, the logic used and potential consequences for the data subject;
• obtain the correction of inaccurate personal data without delay;
• obtain, where applicable, the deletion of your data;
• obtain restriction of processing where applicable;
• object to processing, where permitted, based on applicable laws;
• where applicable, obtain portability of data provided to the Controller, in a structured, commonly used, machine-readable format, or request transmission of such data to another Controller, if feasible;
• lodge a complaint with the relevant Data Protection Authority in your country, if deemed appropriate.