1. INTRODUCTION AND SUMMARY
Our Privacy Commitment
At Celgene Corporation, a Bristol-Myers Squibb Company (Celgene) we recognize the importance of, and are fully committed to protecting the privacy of, information related to all individuals with whom we interact – including patients, members of the public, employees, regulatory and healthcare professionals and business partners.
This policy is an overview of how Celgene Corporation and its worldwide affiliates process information about individuals, and illustrates Celgene’s commitment to ensuring that individuals can exercise choice and control over their information in accordance with local laws.
In addition to this General Privacy Notice, more information for Health Care Professionals can be found in the specialist Healthcare Professional Privacy Notice.
References to “Celgene”, “group”, “affiliates”, “we”, “us” and “our” are references to Celgene Corporation and its worldwide affiliates. A list of affiliates and the countries where they are located is available at Celgene’s Global Office Network.
2. INFORMATION CELGENE MAY PROCESS ABOUT YOU
Celgene may process information about you including, but not limited to:
- General information such as name, postal and/or email address, phone number, date of birth, and other information such as photographs and digital imagery, payment-related information, government issued identification in accordance with applicable law (e.g. driving license, passport, professional license number), agreements, your communications preferences; queries you make to Celgene;
- Professional information, such as your job title, educational information, professional qualifications, work experience, professional networks, programs and activities in which you participated;
- Health, biometric/genetic information related to identifiable or non-identifiable individuals, and only where necessary and strictly permitted under applicable law (including in relation to Celgene’s risk management and drug safety programs, or for accessibility purposes for visitors to Celgene sites); and
- Digital information generated from your use of Celgene’s websites and mobile applications, such as IP address, geo-localization, device ID and data transmitted via cookies.
3. SOURCES OF INFORMATION
In most cases, Celgene will collect information directly from you, although sometimes we will obtain information about you from public or third party information sources including (but not limited to):
- Celgene may collect information about Health Care Professionals from public or third party sources for marketing, and research purposes and to verify professional information (including but not limited to access to publicly accessible information, national registries or third party databases);
- Health Care Professionals or other third parties may provide patient information to Celgene where necessary under applicable drug safety and risk management laws;
- Celgene may collect information from your computer or other device you use when visiting Celgene’s website such as Internet Protocol (IP), domain name, Internet Service Provider (ISP), information about date and time of your request and other information provided by tracking technologies. Please see our Cookies notice below in Section 15
- Information may be shared within the Celgene group of companies, which includes our worldwide affiliates.
4. WHY CELGENE PROCESSES YOUR INFORMATION
Celgene will only process your information for purposes permitted by applicable laws, which may vary depending on where you live, and where Celgene operates. The purposes of the processing may include:
- Managing Celgene’s relationship with individuals or example, responding to questions and comments, inviting individuals to Celgene events, complying with regulatory obligations;
- For collaboration and research purposes, for example to enable Celgene to make more informed and objective decisions when identifying, engaging with healthcare professionals and key opinion leaders and managing the collaboration relationship with healthcare professionals;
- Recruitment, processing professional information to assess individuals for suitability for roles at Celgene;
- Market Research, processing information about individuals for lawful market research purposes. We collect information through surveys and interviews with patients and Healthcare Professionals to help us improve our products.
- Direct Marketing, we process information to provide marketing information to individuals in accordance with applicable local laws (you have choices about this – see “Your Rights” section of this Policy).
- Regulatory Reporting, processing information where necessary to comply with regulatory obligations in particular where they relate to drug safety and risk management obligations, and obligations related to spend transparency and similar requirements specific to the pharmaceutical sector.
- Any other purpose that is relevant in the relationship between Celgene and you
Celgene will process information for further purposes, where lawful to do so (such as for archiving, scientific or market research purposes) or when legally obliged to do so (such as reporting information for Celgene’s risk management and drug safety obligations).
Legal Basis of Processing
Celgene processes information based on one or more of the following:
- you have provided consent (in which cases, such consent can be withdrawn at any time);
- it is necessary to comply with contractual obligations with you;
- the processing is necessary for our compliance with a legal obligation;
- the processing is necessary to protect the vital interests of an individual;
- processing is in the public interest; or
- the processing is in Celgene’s legitimate interest, for example, Celgene processes information for scientific and statistical research purposes, information about Celgene visitors and supplier personnel, for scientific development, for the improvement of our products and services, to provide security measures to protect Celgene’s employees, contractors, patients, information and other assets and to prevent crime (such as fraud, financial crime and theft of intellectual and industry property and to ensure the integrity of its manufacturing and other operations).
Special Categories of Data
In addition to the above, where Celgene processes special categories of data about individuals in specified jurisdictions (including European Economic Area) – for example, information about individuals’ health, genetic, religious, ethnicity, religion, trade union membership, genetic and biometric data, sexual orientation or sex life) – it shall only do so in accordance with the obligations of the law.
Celgene relies on conditions including, but not limited to:
- where individuals provide explicit consent (such as patients consenting to appear in Celgene marketing materials);
- where required for rights and obligations related to employment;
- where required for vital interests of any individual;
- or processing is necessary for the purposes of provision of healthcare or occupational medicine, pursuant to a contract with a healthcare professional and;
- where processing is necessary for scientific research
5. WHERE CELGENE PROCESSES PERSONAL INFORMATION
Celgene has headquarters in the United States, with operations in Europe, Asia, South and North America. Information about you may be accessible to Celgene headquarters in United States, and to some Celgene affiliates, and selected vendors and partners, globally. Where Celgene processes information in countries that may not provide the same level of protection as your own country, Celgene will implement reasonable and appropriate legal and security measures to protect your information from unauthorized access, use or disclosure including, but not limited to, maintaining binding contracts that require appropriate protection of information about individuals.
For residents of European Economic Area (“EEA”) – whenever we transfer your information outside of the EEA or Switzerland, we will take necessary steps to ensure that adequate safeguards are put in place to protect your information. Such safeguards include the use of European Commission approved standard contractual clauses.
6. DISCLOSURE OF YOUR PERSONAL INFORMATION
Celgene discloses individual information where this is reasonably required to pursue its legitimate business aims and as required by law. Your information will be disclosed only in accordance with local applicable laws, and appropriate safeguards will be established, where possible, to protect your information. Celgene may disclose information to any member of our group of companies, which means Celgene affiliates, our ultimate holding company and its subsidiaries.
In order to conduct Celgene’s business, Celgene may also disclose information to third parties such as public/regulatory authorities/governmental bodies (government, including social and benefits departments), third parties that provide services to Celgene (such as but not limited to conducting audits, IT services, assisting in our clinical trials and studies), business partners and collaborators (such as external scientists), reviews and assist Celgene with health care compliance activities, if Celgene or substantially all of our assets are acquired by a third party, in which case personal information held by us about individuals will be included as transferred assets, or if Celgene is under a duty to disclose or share individuals’ information in order to comply with any legal or regulatory obligation or request.
Celgene may also disclose information to enforce any agreements it has with individuals; or to protect the rights, property or safety of Celgene employees, patients or others (e.g. visitors to Celgene premises).
7. AUTOMATED DECISION MAKING AND INDIVIDUALS’ RIGHTS
Celgene does not undertake decisions based solely on automated processing, including profiling, of individual unless we inform you otherwise.
8. INDIVIDUAL CHOICES: RIGHTS AND ACCESS TO INFORMATION
Access, Revision, Deletion
Under applicable privacy law, you may have a right to request a copy of information about you held by Celgene. You may also have the right to revise, correct, or delete such information. Your rights to such information may be subject to limited legal and regulatory restrictions. See “Exercising Individual Rights” below.
Objection to Processing and Additional Rights
Under applicable privacy law (e.g. European data privacy law), where Celgene relies on legitimate interest or public interest to process information, individuals can formally object to processing of their information.
In certain circumstances under applicable law, you may have the additional right to restrict aspects of the processing of your information or ask for a copy of your data to be provided to you, or a third party, in a digital format. See “Exercising Individual Rights” below.
Choices about Marketing
Under applicable privacy law (e.g. European data privacy law), you may have the right to object to information being used for the purposes of direct marketing and sending scientific information and newsletters. Where this right applies, please use the “opt-out” or “unsubscribe” functionality in communications, or, if you have registered online or through any of Celgene’s resources and have a user account, you can update your information and preferences here. See “Exercising Individual Rights” below.
Exercising Your Individual Rights
We provide you with certain choices regarding the use of your personal information. To exercise these choices, please complete the short form available here and your request will be forwarded to the most appropriate Celgene team. Depending on the applicable laws and the nature of the request, individuals may be required to provide additional information (as required to verify the identity of individuals).
Under the California Consumer Privacy Act 2018 (CCPA), California residents have specific rights regarding their personal information held by private companies.
California consumers can reference their detailed applicable rights under section “15. CALIFORNIA CONSUMER INFORMATION.”
Rights of European Individuals to Complain to Data Protection Authorities
In the event that any individual located in the EEA countries or Switzerland believes that Celgene has processed information in a manner that is unlawful or breaches his/her rights, or has infringed the “General Data Protection Regulation”, such individual has the right to complain directly to the applicable Data Protection Authority.
Without limiting any rights to complain directly to an authority, Celgene is committed to protecting personal information, and complaints may be made directly with Celgene here.
9. HOW LONG CELGENE RETAINS YOUR INFORMATION
Celgene aims to retain your information for no longer than is necessary for the specific business purpose or purposes for which it was collected. Information may be retained for a longer duration where applicable laws or regulations require, or allow Celgene to do so.
10. PROTECTION OF INFORMATION - SECURITY
Celgene uses appropriate technical and organizational measures to protect your information. We take reasonable steps to protect your information from loss, misuse, unauthorized access, disclosure, alteration or destruction.
11. APPLYING TO WORK AT CELGENE
Celgene processes information to identify applicants, and assess job applications and for other human resources processes necessary for evaluating and considering job applications. The information processed may include information such as your job title, education information, professional qualifications, work experience, publications and scientific activities, professional networks, programs and activities in which you participated.
In the course of an application, Celgene may process further information, such as government issued identification number, tax status, bank account details, details of any known disability/workplace accessibility needs, background information, travel and expenses, performance management, emergency contact details, compensation, hours of work, holidays and benefits related information.
12. INFORMATION FOR PATIENTS AND TRIAL PARTICIPANTS
Celgene processes the information of patients that use Celgene treatments and services, and clinical trial participants in trials linked to Celgene drugs. In addition, Celgene may have access to patient information through collaboration agreements with third parties (e.g. genetic data).
In certain circumstances and under applicable law, your name, identification number or any other information which allows your direct identification will be replaced by a code. For example, the coded study data will only be used for the purposes of the study and the follow-up of the safety and the effectiveness of the study medication. Only authorized members of the study doctor’s staff, Celgene’s personnel or the third parties which help Celgene with the conduct of the study will have access to the data. Celgene may transfer the coded study data outside your country in order to process or to submit them to competent authorities. See section 5 “Where Celgene Processes Your Information” for further information.
Under applicable law, Celgene will not have access to the names or contact details of patients and trial participants, and Celgene does not attempt to directly identify individuals. You should contact your Healthcare Provider, or the clinical trial site for trial participants, to learn more about how your information is processed. Celgene will process key-coded information about patients and trial patients – which may be one or more of, year of birth, initials or randomly selected unique identifier. Associated to this key coded data might be information relating to physical and psychological health, dietary information, ethnicity, sexual orientation, health and safety related information and other medical information. Information is collected from clinical trials and may include special categories of personal data.
Celgene may also share information collected during the study with scientists outside Celgene for further scientific research in the interest of public health. Celgene will, however, not provide information about your identity to these scientists.
In addition, we will process the information you voluntarily provide to us. For example, we will process information you provide to us when requesting information about our drugs to the extent necessary to answer your request. We will use this information in accordance with applicable laws.
For participants and other affected individuals below the age of 18, the information will be processed in accordance with applicable laws and not be processed without the previous authorization of the parent or legal guardian.
13. INFORMATION FOR HEALTH CARE PROFESSIONALS
Celgene processes information of Health Care Professionals such as contact information for corporate communications, contractual, financial and other information related to services provided and invitations to events and training activities, information concerning professional qualifications, information related to the handling requests from you and to managing some commercial activities.
Your personal data may be combined with other information we may already have about you and/or obtained through public means such as but not limited to scientific and medical publications, national registries and the Internet. To elect to have a review of this information please refer to the Contact Us Form.
For further information on how Celgene processes information of Health Care Professionals please see our Health Care Professional Privacy notice.
14. CALIFORNIA CONSUMER INFORMATION
You have the right to ask us to disclose to you any personal information we have collected about you in the last 12 months. In order to exercise this right, Celgene must first verify your identity to ensure it is a legitimate request, and then disclose to you:
- The categories of personal information we have collected about you;
- The types of sources used to collect personal information about you;
- The types of third parties with which we have shared any of your personal information (if applicable); and
- The purpose(s) of collecting your personal information.
You have the right to request that we delete the personal information we have collected from and about you. In order to exercise this right, Celgene must first verify your identity to ensure it is a legitimate request, we will then delete the relevant information unless an exemption applies.
You have the right to designate an authorized agent to act on your behalf to exercise your rights under the CCPA. In order to do so, Celgene must verify your identity, and your authorized agent must have written permission from you. We reserve the right to deny a request from an agent that does not submit proof that they are authorized to act on your behalf.
You have the right to be free from unlawful discrimination for exercising your rights under the CCPA.
Consumers with Disabilities
Celgene strives to accommodate all customers regardless of disabilities. If you need to receive the information contained in this document in a different format, please contact us using the contact information listed below.
Submitting a Request
To make a request please follow the link here to our online form or contact us at the phone number below in the “Contact Information” section of this Privacy Notice statement. As outlined above, Celgene will need to verify your identity before we provide access or delete your personal information and Celgene may be unable (e.g., due to legal requirements), or not obligated (e.g., due to applicable exemptions) to satisfy your request.
Information Celgene Collects
Personal data, or personal information, means any information about an identifiable individual. It does not include data where the individual is not capable of being identified from the data (anonymous data).
Celgene may collect personal information directly from you (in person, through online forms, and other interactions with Celgene employees, websites, and systems), or from other third parties.
Celgene does not “sell” personal information and has not “sold” personal information relating to California residents, including within the meaning of the CCPA within the past 12 months. For purposes of this Disclosure, “sell” or “sold” means the disclosure of personal information for monetary or other valuable consideration.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
|Personal Identifiers||First name, maiden name, last name, email address, postal address, telephone number, account name, Social security number, marital status, date of birth, gender, and other similar identifiers.|
|Personal Information Categories Listed in the California Customer Record Statute (CAL.CIV.CODE§1798.80 (e))||Name, signature, Social security number, physical characteristics or description, address, telephone number, insurance policy number, education, employment, employment history, bank account number or any other financial information, medical information or health insurance information. Some personal information in this category may overlap with other categories.|
|Characteristics of Protected Classifications Under California or Federal Law||Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (may include combinations of the following: gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).|
|Commercial Information||Records of personal property, products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies.|
|Biometric Information||Genetic, physiological, biological and behavioral characteristics including physical patterns, sleep, exercise or health data.|
|Internet or Electronic Data||Browsing history, search history, information regarding a consumer’s interaction with an internet Web site, application, or advertisement.|
|Geolocation Data||Physical location or movements.|
|Sensory Data||Audio, electronic, visual, thermal, olfactory, or similar information.|
|Professional Related Data||Work history, prior employer.|
|Education-Related Data||School or schools, and date of graduation.|
|Inferences||Drawn from any of the information identified in this table to understand consumer’s preferences related to the usage and delivery of Celgene products and services.|
How Celgene Uses Personal Information
The purposes for which Celgene uses personal information depends on the relationship or interaction with a specific California resident, and we only process your information for purposes permitted by applicable laws. Celgene may use personal information to operate, manage, and maintain our business, to provide products and services, and to accomplish business purposes and objectives.
- Managing Celgene’s relationship with individuals;
- For collaboration and research purposes;
- Direct Marketing; and
- Regulatory Reporting.
Sharing of Personal Information
In order to conduct Celgene’s business, Celgene may also disclose information to third parties including or in the instance that:
- Public/regulatory authorities/governmental bodies (government, including social and benefits departments);
- Third parties that provide services to Celgene (such as but not limited to conducting audits, IT services, assisting in our clinical trials and studies);
- Business partners and collaborators (such as external scientists) that review and assist Celgene with health care compliance activities;
- Celgene or substantially all our assets are acquired by a third party, in which case personal information held by us about individuals will be included as transferred assets; and
- Celgene is under a duty to disclose or share individuals’ information in order to comply with any legal or regulatory obligation or request.
Celgene web sites and mobile applications are not intended or designed for children under the age of 13. We do not collect personally identifiable information from any individual we know to be under the age of 13.
See section 12 “Information for Patients and Trial Participants” above for further information.
Celgene may use technology known as “cookies” and similar tracking technologies on our websites and other digital services, including geo-localization, on our websites and mobile applications. A cookie is a small data file that is placed on your device, which we use for the following purposes:
- Making your experience more efficient, faster and easier: by remembering your preferences, like preferred language, display and other settings, maintaining your session, and for authentication purposes. This helps us to provide you with a better user experience. These cookies are also referred to as Session-Id cookies, authentication cookies, and User Interface customization cookies.
- Gain useful knowledge about how the site is used: by collecting information about the number of visitors and other uses. This helps us improve our sites. These cookies are also referred to as analytics cookies. For this purpose, we use services such as Google analytics which means that Google and similar suppliers will also have access to this information (including your IP address and any other equipment identifiers such as the IMEI number and the MAC address).
- Provide easy access to our social media sites. This helps us to direct you and share with you our content within sites such as Facebook, Twitter, LinkedIn, Google Plus, YouTube or Pinterest. These ‘social media plug-ins’ may store cookies and similar technology on your computer or other device. This means that the social media sites may access this information (including your IP address), may identify that you interacted with the Celgene site.
Your web browser can be set to manage cookies and even to reject them. Do bear in mind that if you set your browser to automatically reject cookies, your user experience when visiting websites will not be the same: your preferences may not be remembered, some functionality may be lost and you may not be able to access certain areas or features of the sites.
Please note that Celgene does not currently respond to “Do Not Track” browser settings. Celgene continues to review new technologies and may adopt a standard once one is created.
For more information about cookies, types of cookies and how to manage cookies, including how to block them and delete them, please visit http://www.allaboutcookies.org
Celgene may update this policy from time to time by posting any revisions on www.celgene.com/celgene-privacy-policy/general-privacy-policy/. Where any material revisions are made, Celgene will directly notify individuals where and when legally required to do so, or may place a prominent notice on www.celgene.com/celgene-privacy-policy/
18. CONTACT US
(for residents of USA, Canada)
Chief Privacy Officer
86 Morris Avenue
Summit, NJ 07901
(for residents of the state of California, USA)
Use the link here to complete a request: https://www.celgene.com/privacy-policy/privacy-contact-us/california-data-subject-rights-request/
Toll-Free Number: 800-384-4907
You can contact the European Data Protection Officer or Celgene’s Chief Privacy Officer, by completing the Privacy Contact Us or by postal mail at:
(for residents of the European Economic Area/Switzerland, Asia, Middle East, Africa)
European Data Protection Officer
Route de Perreux, 1
Last Updated: December 2019