Personal Data Protection Policy (GDPR)

PERSONAL DATA PROTECTION POLICY (V4, 11 March 2026)

1. PHARMASPECIFIC, DATA CONTROLLER

Pharmaspecific attaches importance to the protection of the personal data it processes as a data controller in the course of its activities.

This document sets out the personal data protection policy implemented by Pharmaspecific in the course of its activities under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).

The purpose of this personal data protection policy is to explain how Pharmaspecific complies with this regulation in managing its activities with its clients, clinical research participants and third-party companies, as well as in connection with the related legal and regulatory obligations. In particular, this Policy explains the nature of the data collected, the categories of data subjects, the purposes and legal bases of the processing carried out, the recipients of the data, the mechanisms governing data transfers outside the European Economic Area, the retention periods and the arrangements for data subjects to exercise their rights.

Data Protection Officer (DPO)
Pharmaspecific has appointed a Data Protection Officer (DPO), responsible for ensuring compliance with the applicable personal data protection regulations, advising the company on its obligations under the GDPR and acting as the point of contact for data subjects and supervisory authorities.

The DPO can be contacted at the following address: privacy@pharmaspecific.fr

2. PERSONAL DATA

In the course of our activities, we may collect, use and even transfer several types of personal data:

Civil status and identification data (name, date and place of birth, nationality, address/country of residence, passport and/or identity card number, photo, etc.)
Personal life (family situation, etc.)
Professional life (profession/position, employer, contact details, certifications/accreditations, telephone conversations/emails/chat, etc.)
Economic and financial information (income, etc.)
Technical information on the use of our services (IP address, connection logs, cookies, etc.)

Only data relevant to the purposes pursued are collected.

3. CATEGORIES OF DATA SUBJECTS

In the course of the services offered by Pharmaspecific, we may collect, use and transfer the personal data of the following categories of persons (non-exhaustive list): employees, subcontractors, clients, prospects, patients, physicians, etc.

4. PURPOSES OF PROCESSING

Pharmaspecific may process all or part of the data on the basis of legitimate interest:

to enable browsing on these websites and the management and traceability of the services ordered by the client: login and usage data for the websites and software, invoicing, order history, expense reports, etc.
to prevent and combat computer fraud (spamming, hacking, etc.): computer equipment used for browsing, IP address, password (hashed)
to improve browsing on this software and these websites: login and usage data
to conduct optional satisfaction surveys on these websites: email address
to conduct communication, marketing or sales campaigns (email): first name, last name, company, email address, order history
to improve the quality of the services provided: recording of telephone conversations

On the basis of legitimate interest, consent or a task carried out in the public interest (as chosen by the data controllers) :

Data of research participants or third-party companies (taxi, ambulance) in connection with the patient reimbursement service only: last name, first name, telephone number, address, email address, type of expense, supporting document, cost of expenses, bank details
Data of research participants in connection with clinical or observational studies: initials, pseudonymised health data protected in accordance with Deliberation No. 2018-153 of 3 May 2018 approving a reference methodology for the processing of personal data carried out in the context of health research with the consent of the data subject (MR-001) and repealing Deliberation No. 2016-262 of 21 July 2016.
Client data: last name, first name, email address, title, company.

For users of the website https://pharmaspecific.com, the data we collect will be kept for a maximum period of 3 years.

For users of the software https://remboursement.pharmaspecific.com, we collect the above data, which will be kept for a maximum period of 10 years.

We may have a legal obligation to collect certain Personal Information about you, or as a result of a contractual relationship between us. In such cases, failure to provide this information may prevent or delay the fulfilment of these obligations.

Pharmaspecific may also collect the following categories of Personal Information from third parties, on the basis of legitimate interest, such as online advertising agencies, lists of acquired companies, events or conferences, and purchased lists : last name, first name, address, email address, company name.

We may enhance or combine your personal information with data obtained from third parties for the same purposes as those for which we use the personal information you have knowingly provided to us.

Pharmaspecific does not sell your personal data to third-party companies.

5. LEGAL BASES FOR PROCESSING

In accordance with applicable regulations, the personal data processing carried out by Pharmaspecific is based on the following legal bases, depending on the purposes pursued:

Purpose of processing	Legal basis
Administrative and operational management of the services provided	Performance of a contract
Reimbursement of research participants’ expenses	Defined by the data controller. Please refer to the documentation received in connection with the research.
Compliance with regulatory obligations related to clinical research	Processing carried out as a processor on behalf of the sponsor, the data controller who determines the legal basis
Client and partner relationship management	Legitimate interest
Information system security and fraud prevention	Legitimate interest
Communication and marketing activities	Consent

Where processing is based on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

In accordance with the internal information classification policy, personal data are classified at a minimum as confidential data, requiring enhanced protection measures for access, retention and destruction.

6. RECIPIENTS OF THE DATA

The information recorded is reserved for the use of the department(s) concerned and may be communicated to service provider companies. The transfer of data to recipients located outside the European Union is intended for the entry, tracking and hosting of commercial follow-up data. Hosting takes place in countries with an adequate level of protection and in countries where transfers are governed by standard contractual clauses to ensure a sufficient level of protection of personal data. Nevertheless, Pharmaspecific remains free to choose its technical and commercial subcontractors, provided that they offer sufficient guarantees with regard to the requirements of the General Data Protection Regulation (GDPR : No. 2016-679).

Pharmaspecific undertakes to take all necessary precautions to preserve the security of the Information and in particular to ensure that it is not disclosed to unauthorised persons. However, if an incident affecting the integrity or confidentiality of the Client’s Information comes to the attention of Pharmaspecific, it must inform the Client as soon as possible and communicate the corrective measures taken. Furthermore, Pharmaspecific does not collect any “sensitive data” on its own behalf or, in connection with the patient expense reimbursement service, on behalf of the Client. However, solely in connection with services relating to the conduct of clinical research and acting as a processor, Pharmaspecific may process so-called sensitive data, such as data relating to participants’ health, which are transmitted to the Client only in pseudonymised form.

Users’ Personal Data may be processed by subsidiaries of Pharmaspecific and by subcontractors (service providers), exclusively for the purposes of this policy.

Within the limits of their respective responsibilities and for the purposes set out above, the main persons likely to have access to the data of Pharmaspecific’s Users are mainly the staff of our customer service department.

7. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

In order to deliver our services or meet our legal and regulatory obligations, we may need to transfer the personal data of Data Subjects to a country outside the European Economic Area. Appropriate measures are implemented to ensure a sufficient level of protection as required by the GDPR: countries whose legislation ensures adequate protection; safeguards ensuring this level of protection. These safeguards may be Standard Contractual Clauses for the protection of personal data adopted by the European Commission (i.e. a transfer contract between the controller and a recipient setting out the obligations of the controller and the recipient in the event of a transfer of personal data outside the European Union).

8. DATA RETENTION PERIOD

We keep the personal data of Data Subjects for as long as necessary to achieve the purpose pursued. We only keep these data for as long as we need them. This period depends on the reasons for which we use them, such as to provide you with our services, to pursue our legitimate interests, to comply with our legal and regulatory obligations or to establish, exercise or defend our legal rights. They may also be kept or archived for the statutory limitation periods.

9. RIGHT OF ACCESS, RECTIFICATION AND OBJECTION

In accordance with the European regulations in force :

Users of Pharmaspecific’s websites,
employees,
subcontractors,
clients, clinical research participants and representatives of third-party companies have the following rights:
– right of access (Article 15 GDPR) and rectification (Article 16 GDPR), updating or erasure of Users’ personal data (Article 17 GDPR), where such data are inaccurate, incomplete, ambiguous or out of date, or where their collection, use, disclosure or storage is prohibited
– right to withdraw consent at any time (Article 13-2c GDPR)
– right to rectification, which consists of amending data subjects’ data that are incorrect or incomplete and collected for use
– right to restriction of processing of Users’ data (Article 18 GDPR)
– right to object to the processing of Users’ data (Article 21 GDPR)
– right to portability of the data provided by Users, where such data are subject to automated processing based on their consent or on a contract (Article 20 GDPR)
– right to decide what happens to the data of Users after their death and to choose whether Pharmaspecific should communicate (or not) their data to a third party they have designated in advance

As soon as Pharmaspecific becomes aware of a User’s death, and in the absence of instructions from the User, Pharmaspecific undertakes to destroy the User’s data, unless its retention is necessary for evidential purposes or to comply with a legal obligation.

If Users wish to know how Pharmaspecific uses their Personal Data, to request its rectification or to object to its processing, they may contact Pharmaspecific in writing at the following address:

Data Protection Officer (DPO)
Pharmaspecific
Parc Descartes Nobel, 23 rue Nobel
77420 Champs-sur-Marne
or via privacy@pharmaspecific.fr

In this case, Users must indicate the Personal Data they would like Pharmaspecific to correct, update or delete, identifying themselves precisely with a copy of an identity document (identity card or passport).

Requests for deletion of Personal Data will be subject to the obligations imposed on Pharmaspecific’s websites by law, in particular regarding the retention or archiving of documents. Finally, Users of Pharmaspecific’s websites and services may lodge a complaint with the supervisory authorities, in particular the CNIL (https://www.cnil.fr/fr/plaintes).

10. HYPERLINKS, “COOKIES” AND INTERNET TAGS

Pharmaspecific’s websites contain a number of hyperlinks to other websites, set up with the permission of Pharmaspecific. However, Pharmaspecific is unable to check the content of the websites visited in this way and therefore accepts no liability in this respect.

Unless you decide to disable cookies, you agree that the website may use them. You may disable these cookies at any time, free of charge, using the deactivation options offered to you and set out below, bearing in mind that this may reduce or prevent access to all or part of the Services offered by the website.

“COOKIES”

A “cookie” is a small information file sent to the User’s browser and stored on the User’s device (e.g. computer, smartphone) (hereinafter “Cookies”). This file contains information such as the User’s domain name, the User’s Internet service provider, the User’s operating system, and the date and time of access. Cookies cannot in any way damage the User’s device.

Pharmaspecific may process information about the User’s visit to the Website, such as the pages viewed and the searches carried out. This information enables Pharmaspecific to improve the content of the Website and the User’s browsing.

Pharmaspecific implements a consent management mechanism in line with the CNIL guidelines, enabling Users to be clearly informed in advance of the placement of Cookies and to:

accept non-essential Cookies,
refuse non-essential Cookies,
change their choices at any time.

Cookies that are strictly necessary for the operation of the websites and applications and for the security of the services are placed without prior consent, in accordance with applicable regulations.
Non-essential Cookies (in particular audience measurement or social network Cookies) are only placed after the User’s explicit consent has been obtained.

Users may also configure their browser to limit or block the placement of Cookies. However, refusing or deleting certain Cookies may degrade the user experience or make certain features of the services unavailable.

Refusing non-essential cookies does not prevent access to the websites or services offered by Pharmaspecific.

However, certain optional features, such as content personalisation, remembering preferences or statistical analysis of visits, may be unavailable or limited if these cookies are refused.

Cookies that are strictly necessary for the operation of the website and the security of the services are not affected by this choice, in accordance with applicable regulations.

Pharmaspecific may use technical service providers to assist it in managing and analysing Cookies; these providers act in accordance with Pharmaspecific’s instructions and applicable regulatory requirements.

When Users interact with social network modules (such as Twitter/X, Facebook or LinkedIn), these platforms may place their own Cookies, only after the User’s explicit consent has been obtained, in accordance with their respective policies. Users may withdraw their consent at any time via the Cookie management module.

INTERNET TAGS

Pharmaspecific’s websites may occasionally use Internet tags (also known as “tags”, action tags, single-pixel GIFs, clear GIFs, invisible GIFs and one-to-one GIFs) and deploy them through a web analytics partner that may be located (and therefore store the corresponding information, including the User’s IP address) in a foreign country.

These tags are placed both in the online advertisements that allow Internet users to access the Website and on its various pages.

This technology enables Pharmaspecific’s websites to assess visitors’ responses to the Website and the effectiveness of its actions (for example, the number of times a page is opened and the information consulted), as well as the User’s use of the Website.

The external provider may collect information about visitors to the Website and other websites through these tags, compile reports on Website activity for Pharmaspecific’s websites, and provide other services relating to the use of the Website and the Internet.

11. Personal data security – Technical and organisational measures

Ensuring the security of the data entrusted to us is one of our most important responsibilities. To ensure the security and confidentiality of the personal data we collect and use, we have long had technical and organisational measures in place.

11.1 ORGANISATIONAL MEASURES

Every Pharmaspecific employee with access to personal data must take into account their obligations regarding the processing of personal data, and will have been informed of these obligations through an official company notice and regular training. The minimum information provided to all staff is as follows:

Duty of confidentiality and secrecy

Access to personal data by unauthorised persons must be prevented.

To this end, personal data must not be exposed to third parties (unattended computer screens, paper documents in areas accessible to the public, any media containing personal data, etc.).

When employees leave their workstation, they will systematically log out or lock their screen. Screens are set to lock after three minutes of inactivity. When employees travel, screen filters and anti-theft cables are used on computers.
Paper documents and electronic media containing personal data will be kept in a secure place (cabinets or restricted-access rooms) 24 hours a day. When the last employee leaves the workplace, they will ensure that the office is locked with a key and the security alarm activated.
Paper documents or electronic media (USB sticks, CDs, hard drives, etc.) containing personal data will not be discarded unless their destruction is guaranteed.

A document shredder is therefore available on Pharmaspecific’s premises. Pharmaspecific also uses a partner company to handle the destruction of media. A service contract has been signed with this company.
No information or personal data will be disclosed to third parties: particular attention will be paid to the non-disclosure of protected personal data during telephone consultations or by email, etc.
The duty of secrecy and confidentiality also applies when the employee is no longer bound by contract to the company.

Rights of personal data subjects

All employees will be informed of the procedures to be followed to handle data subjects’ rights, clearly defining the mechanisms through which these rights can be exercised (electronic means, reference to the Data Protection Officer if any, postal address, etc.), taking into account the following:

Personal data subjects may exercise their rights of access, rectification, erasure, objection and portability by email at privacy@pharmaspecific.fr, duly certifying their identity with a copy of an official identity document (ID card, passport or driving licence). The data controller must respond to data subjects without undue delay.

The right of access will be facilitated and a list of the personal data held by the data controller will be provided. The final purpose for which these data were collected, the identity of the recipients, the means of storage and the identity of the controller from whom rectification, erasure and objection to processing may be requested will also be communicated.

The right to rectification consists of amending data subjects’ data that are incorrect or incomplete and collected for use.

The right to erasure will delete data subjects’ data as soon as they express their disagreement or objection to consent to the processing of their data, and provided that no legal obligation prevents it.

The right to portability will allow data subjects to communicate their decision and inform the controller, where applicable, of the identity of the new controller with access to their personal data.

Pharmaspecific will inform all persons who so request about the exercise of their rights and the compliance conditions for respecting data subjects’ rights, as well as the form in which they may exercise them and the procedure to be followed.

Personal data breaches

In the event of a breach of personal data security (for example, theft of or inappropriate access to personal data, loss of removable devices containing personal data, etc.), the competent authority will be notified within a maximum of 72 hours once there is evidence of the breach, unless the data controller is able to demonstrate, in accordance with the principle of accountability, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification is not possible within 72 hours, it must be accompanied by the reasons for the delay, and information may be provided in phases without further undue delay.

Likewise, Pharmaspecific must notify the data subject of the personal data breach without delay where it is likely to result in a high risk to their rights and freedoms, so that they can take the necessary precautions. The communication must describe the nature of the personal data breach and provide recommendations so that the individual concerned can mitigate any potential adverse effects resulting from the breach. These communications to data subjects must be made as soon as reasonably possible and in close cooperation with the supervisory authority, following its advice or that of other competent authorities, such as the police. For example, the need to mitigate an immediate risk of harm would justify prompt communication with data subjects, whereas a longer period for communication may be justified by the need to implement appropriate measures to prevent continuing or similar personal data breaches.

The person designated for this purpose will prepare a report examining whether all appropriate technological protection has been applied and whether adequate organisational measures have been taken to establish immediately whether a personal data breach has occurred, in order to inform the supervisory authority and the data subject without delay. The report must ensure that notification has been made without undue delay, taking into account in particular the nature and seriousness of the personal data breach and its consequences and adverse effects for the data subject.

11.2 TECHNICAL MEASURES

Identification

Each Pharmaspecific user has a user profile created specifically for them, giving them access both to their computer and to shared resources (e.g. Microsoft Enterprise). Professional and personal use of the computer must be kept separate.
Different levels of user profiles have been created (with administrator rights for installing and configuring the system and users, and without privileges or administrator rights for accessing personal data, among others) to prevent undue access to personal data and to ensure that, in the event of a cyberattack, access privileges cannot be obtained or the operating system modified.
Access to personal data stored in electronic systems is protected by individual login credentials and passwords known only to duly authorised users.
Pharmaspecific uses a secure password manager to ensure that professional passwords are stored and managed securely.

Passwords, whether created by users or generated by the password manager, must meet the following minimum criteria to be considered strong passwords:
- a minimum length of 12 characters;
- at least one upper-case letter, one lower-case letter, one number and one special character;
- a unique password for each service, application or system, with no reuse across professional accounts;
- no personal information, single dictionary words or obvious sequences of characters.

Where different people access personal data, a specific user name and password will be available for each person with access to personal data (unambiguous identification).

All employees have a duty to keep their passwords confidential and to prevent them from being exposed to third parties.

Backup

The following describes the technical measures implemented to ensure the protection of personal data:

UPDATING COMPUTERS AND DEVICES: The devices and computers used to store and process personal data must be kept up to date as far as possible.

MALWARE: An antivirus system will be installed on computers and devices where personal data are processed automatically, in order to prevent the theft and destruction of information and personal data as far as possible. The antivirus system must be updated periodically.

FIREWALL: To prevent unauthorised remote access to personal data, an active firewall will be ensured on computers and devices where personal data are stored and/or processed.

DATA ENCRYPTION: Where personal data need to be taken outside Pharmaspecific’s offices, whether by physical or electronic means (for example, remote working on a laptop), the possibility of using an encryption method to ensure the confidentiality of personal data in the event of unauthorised access to the information must be considered.

BACKUP COPIES: Pharmaspecific performs automatic backups. This service is provided by OneDrive; files stored online on OneDrive are encrypted and kept on secure storage servers in several data centres, with no time limit, until the files are deleted by an authorised user.

It is also the responsibility of each employee to contribute to data security by complying with the rules and tools provided by the company in order to limit any risk of data loss or alteration.

In this respect, employees must in particular:

save and back up their work exclusively on professional servers or storage solutions authorised by the company, to which only authorised staff have access;
use professional email and storage tools in accordance with the internal rules in force;
protect their login credentials and change their passwords regularly;
apply the information security and confidentiality instructions defined by the company.

Pharmaspecific is responsible for implementing and maintaining appropriate technical measures to ensure the security and availability of data, including automatic and periodic backups of the professional data hosted on the systems and storage solutions it provides.

Guarantees from our suppliers and information for users

At Pharmaspecific, we are aware that the protection of personal data is not limited to the data within Pharmaspecific, but may in some cases extend to our suppliers. That is why we are committed to ensuring that they manage personal data in accordance with the GDPR.

In this context, Pharmaspecific enters into a specific data processing agreement with each supplier that manages or may have access to any type of personal data described in the GDPR.

In addition, when consent is given for the use of data, users are informed that third-party suppliers will have access to the personal data they have provided, and for what purpose.

The technical and organisational measures described above, as well as this personal data protection policy, are reviewed periodically to ensure that they remain appropriate in the light of regulatory, organisational and technological developments.

Contact Us