Inflectra^® Treatment Decision Aid

Inflectra Treatment Decision Aid PRIVACY POLICY

Last update: March 2021

Inflectra Treatment Decision Aid (ITDA)^® is a web-based tool managed and administered by Mind Digital Group on behalf of Pfizer Limited for use by gastroenterology physicians (Physicians or End Users) in the United Kingdom who may be sole practitioners, healthcare professionals working in partnerships, incorporated bodies or other types of practice (Clinics) to aid the decision making in relation to treatment of patients with Crohn’s Disease or Ulcerative Colitis. Under English, EU and Swiss privacy laws Pfizer Limited located at Walton Oaks, Dorking Road, Tadworth, Surrey, KT20 7NS, UK, will be a data controller in respect of the End User data.

Pfizer Limited and other relevant Pfizer affiliates are jointly referred to in this Privacy Policy as ‘Pfizer’.

In order for Pfizer to discharge its responsibilities under English, EU and Swiss privacy laws, this Privacy Policy sets out how information that is submitted in connection with the use of ITDA will be treated.

(1) PERSONAL DATA

ITDA may store and otherwise process the following kinds of data as submitted by End Users:

• Email address
• Password
• Employment Address e.g. Hospital/Clinic Name
• Name
• Surname
• No patient identifiable data will be processed when using the ITDA tool.

(2) COOKIES

The ITDA tool employs cookies. A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to the web browser and stored by the browser on your hard drive. The identifier is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

ITDA only stores anonymous and privacy compliant cookies. Cookies are not linkable to the End User data.

The cookies stored by ITDA are session cookies:

Named for example:

"SESSc81e2429a611c7853e44eba4be44e134" with a value like "Ur9rDZxy3v981Pa9a9xwzEvHfaSf7I_24ZKnCXNR36o", so fully anonymous and compliant with privacy rules. Session cookies will be deleted from your computer when you close your browser.

Most browsers automatically accept cookies but you can usually change your browser to prevent cookies being stored. For further information on cookies and how to switch them off, visit www.allaboutcookies.org. If you are using a smartphone, set your preferences through the “Settings” app of your smartphone and/or the browser(s) app(s). There are also software products available that can manage cookies for you.

PLEASE NOTE, IF YOU TURN COOKIES OFF, THIS WILL LIMIT THE SERVICE WE ARE ABLE TO PROVIDE AND MAY AFFECT YOUR USER EXPERIENCE.

(3) USE OF PERSONAL DATA

Pfizer Limited will be the data controller of all End User data submitted and used in the ITDA tool to enable the End User’s intended use of ITDA.

No patient identifiable data will be processed when using the ITDA tool.

The use of the ITDA tool by the End User is based on Pfizer’s contractual relationship with the End User (governed, among others, by the ITDA Terms of Use). Once registered, the End User data is necessary for ITDA to perform as intended. Furthermore, based on its legitimate interests Pfizer may use the End User data for the following purposes:

• (a) for the registration and administration of End User accounts and providing the ITDA access to authorised End Users;
• (b) to track and assess use of ITDA by de-identified data;
• (c) to send notifications of application outages or updates (including suspensions of End User accounts and withdrawal of ITDA);
• (d) to respond to requests for support; and
• (e) to record details of which End User account has been used to create, view and update any End User data.

In addition, Pfizer will receive only the following de-identified information:

• The number of End Users using ITDA in each Clinic.

(4) DATA SECURITY

ITDA and the service providers mentioned below employ security technology, including firewalls, to safeguard information and have procedures in place aimed at ensuring the confidentiality, integrity, availability and resilience of the systems used to host, maintain and support this information.

The ITDA will be hosted on a website which will implement Sitelock. Sitelock protects the website from all types of DDoS attacks. It also secures websites from automated and human targeted attacks, prevent scrapers, block backdoor access and sort out bot traffic. It will be sourced from the following provider: https://www.sitelock.com/

All End User data (except for email addresses) are encrypted using Secure Sockets Layer (SSL) once the End User has keyed it into the ITDA application and clicked ‘save’. SSL is a standard security protocol for establishing encrypted links between a web server and a browser in an online communication. The usage of SSL technology ensures that all data transmitted between the web server and browser remains encrypted. This can be purchased through the server/ hosting provider.

All information relating to the patient is encrypted using SSL once the End User has keyed it into the ITDA application and clicked ‘save’.

(5) USE OF SERVICE PROVIDERS

Pfizer will use third party service providers to:

• provide the ITDA tool and service, including hosting of ITDA (including its supporting databases)
• to provide maintenance and support services; and
• to act as a technical support function

(6) POLICY AMENDMENTS

Privacy laws and practice are continually developing and Pfizer aims to meet high standards. Our policies and procedures are, therefore, under continual review. We may, from time to time, update this Privacy Policy and suggest you check this page periodically to review our latest version.We may also notify End Users of changes to our Privacy Policy by email.

(7) THIRD PARTY WEBSITES

Where the website contains links to other websites or services that are owned or controlled by third parties, neither Pfizer nor any of its service providers are responsible for the privacy policies or practices of those third party websites or services. The Clinic and/or its End Users should check that the policies and practices are acceptable to them before use.

(8) INDIVIDUAL RIGHTS AND DATA RETENTION

If you would like to request to review, correct, update, suppress, restrict or delete Personal Data that you have provided to us through ITDA, or if you would like to request to receive an electronic copy of such Personal Data for purposes of transmitting it to another company, you may contact us as indicated in the Contact Us section below. We will respond to your request consistent with applicable law.

In your request, please tell us what Personal Data you would like to have changed, whether you would like to have it suppressed from our database, or otherwise let us know what limitations you would like to put on our use of it. For your protection, we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.

Please note that we may need to retain certain Personal Data for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion.

(9) CONTACT US

The company responsible for collection, use, and disclosure of your Personal Data under this Privacy Policy is

Pfizer Limited, Walton Oaks, Dorking Road, Tadworth, Surrey, KT20 7NS, UK

If you have questions about this Privacy Policy, or if you would like to request to exercise any individual rights, please contact us at dataprotectionuk@pfizer.com, or write to the following address:

Pfizer Limited, Walton Oaks, Dorking Road, Tadworth, Surrey, KT20 7NS, UK

You may also contact our data protection officer responsible for your country or region, if applicable. To find their contact information, visit DPO.Pfizer.com.

(10) LODGING A COMPLAINT WITH REGULATOR

The End User also has the right to lodge a complaint to data protection authority in his/her jurisdiction (http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080) if his/her rights have been breached.