EEA HCP Privacy Notice

EEA HCP PRIVACY NOTICE

INTRODUCTION

This EEA Privacy Notice for Health Care Professionals (“HCP Privacy Notice” or “Privacy Notice”) describes the Personal Data that the European Economic Area (“EEA”) Pfizer companies named in the Contact Us section below (hereinafter, “Pfizer”, “us” or “we”) collect about you as a healthcare professional (“HCP” or “you”) when we interact with you; how we use that data; how we protect it; and the choices you may make with respect to your Personal Data. We encourage you to review this HCP Privacy Notice and click on the available links or select “Learn More” if you want additional details on a particular topic.

If you are interacting with us online, please also see the privacy notice posted on the website or application that you are using.

PERSONAL DATA

“Personal Data” is data that identifies you as an individual or relates to an identifiable individual. We will collect Personal Data when we meet with you, when you participate in our programs, activities, industry events, trade shows, or in connection with your inquiries and communications with us. We also collect Personal Data from data companies providing information services in the healthcare sector, publicly accessible sources of professional information, and joint marketing partners.

More information

Personal Data that we may collect includes:

Name;
Contact information (postal address, telephone numbers, email address, fax number)
Your preferred language;
Professional photograph, as well as your image and voice for both online and recorded and transcripts of your meeting contributions;
Your interests (such as in health care topics about which you request information from us);
Professional biography including data related to your education, licensures, specialties, workplace, professional affiliations (e.g., memberships in medical societies or HCP networks), publications, credentials, and other professional achievements;
Data related to your interest in the content we display in the context of our scientific information activity, your use of our products, your interactions with us, your preferred method of communications with us, and services for those you care for;
Financial and banking data that you provide to us to pay you for services and provide reimbursement for professional fees, travel, accommodation and out of pocket expenses;
National ID number, passport number, tax identification number, as applicable and authorized;
Travel preferences and possible special needs.

We may receive Personal Data from third parties that have collected it in compliance with applicable data protection laws to confirm contact or financial details or to better understand your interests.

When you are asked to provide Personal Data, you may decline. But if you choose not to provide data that is necessary for us to provide requested services or perform our contractual obligations, we may not be able to provide you those services or perform those contractual obligations.

If you provide or permit us to collect any Personal Data relating to another person, including adverse event data, you are telling us that you have the authority to share that data and to permit us to use the data as described in this Privacy Notice.

HOW WE USE PERSONAL DATA

We use Personal Data in order to:

Interact and engage with you when we have a contractual relationship, on the basis of our legitimate interest or your consent.
More information
Operating our business includes:
- Complying with our regulatory monitoring and reporting obligations, including those related to adverse events, product complaints and product safety.
- Verifying your eligibility to access certain products, services and data that may be provided only to licensed HCPs or otherwise conducting background checks to ensure we are not precluded from working with you.
- Conducting training and ensuring quality control.
- Detecting, preventing, or investigating misconduct.
- Complying with anti-corruption and transparency obligations.
- Analysing your preferences, including through Artificial Intelligence (“AI”) tools, in order to improve our interactions with you, i.e., to deliver you the content, products and offers (via our Site, emails or digital tools) that we believe will be relevant to your professional interests.
- Analysing or predicting your preferences, including through AI tools, in order to identify aggregated trends to develop, improve or modify our products, services and business activities.
- Analysing, including through AI tools, your professional interests and area of expertise on the basis of our legitimate interest to optimize our internal resources allocation in the context of the scientific information activity, as well as to improve the quality of the interactions with you.
- Analysing your professional interests, including through AI tools, your interest in the content we share or display in the context of our scientific information activity, on the basis of our legitimate interest to improve our communication materials, streamline our internal workflow and to improve the quality of the visits to you.
- Exercising and protecting our rights, privacy, safety or property, and/or those of our affiliates, you or others.
Operate our business to comply with our legal obligations, for statistical purposes or to meet our legitimate interests in maintaining our business.
More information
Operating our business includes:
- Complying with our regulatory monitoring and reporting obligations, including those related to adverse events, product complaints and product safety.
- Verifying your eligibility to access certain products, services and data that may be provided only to licensed HCPs or otherwise conducting background checks to ensure we are not precluded from working with you.
- Conducting training and ensuring quality control.
- Detecting, preventing, or investigating misconduct.
- Complying with anti-corruption and transparency obligations.
- Analysing your preferences, including through Artificial Intelligence (“AI”) tools, in order to improve our interactions with you, i.e., to deliver you the content, products and offers (via our Site, emails or digital tools) that we believe will be relevant to your professional interests.
- Analysing or predicting your preferences, including through AI tools, in order to identify aggregated trends to develop, improve or modify our products, services and business activities.
- Analysing, including through AI tools, your professional interests and area of expertise on the basis of our legitimate interest to optimize our internal resources allocation in the context of the scientific information activity, as well as to improve the quality of the interactions with you.
- Analysing your professional interests, including through AI tools, your interest in the content we share or display in the context of our scientific information activity, on the basis of our legitimate interest to improve our communication materials, streamline our internal workflow and to improve the quality of the visits to you.
- Exercising and protecting our rights, privacy, safety or property, and/or those of our affiliates, you or others.

Provide you with marketing and promotional communications on scientific/health materials (by digital means or otherwise), which may be personalized to your professional area and interests when we have your consent.

Email communications will contain tracking pixels (also known as web beacons or clear GIFs) — small transparent images that, when an email is opened, automatically send a request to our server and allow the collection of the following data: (i) confirmation that the email was opened; (ii) your IP address; (iii) device type and email client used; (iv) read time and number of re-openings; and (v) technical identifiers associated with the specific email send (message ID, timestamp).

Pixel tags enable Pfizer, among other things, to measure the success of our marketing campaigns, to know whether you received our communications and if you were able to open them. This information may be used to create profiles of your activities for professional purposes so that Pfizer can offer you targeted offers and information (online or face-to-face) that match your profile or the profiles of people with similar interests. This is part of our goal to improve and develop our professional relationships.

Please note that unless otherwise indicated, by ‘legitimate interest’ we mean our interest in conducting and managing our business to enable us to provide you the best products and services, to provide you the information you are requesting from us, or to improve our internal organization and efficiently allocate our resources.

When we process Personal Data to meet our legitimate interests, we ensure that our legitimate interests are not overridden by your interests, fundamental rights and freedoms. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your Personal Data for our legitimate interests. We do not process your Personal Data on the basis of our legitimate interest where our interests are overridden by the impact on you (unless we have your consent or another legal basis under Regulation (EU) 2016/679).

You can obtain further information about how we assess our legitimate interests against any potential impact on you by contacting us as indicated under Section “Contact Us” below.

HOW WE DISCLOSE PERSONAL DATA

We disclose Personal Data as follows:

To other Pfizer companies (visit here for a list of our companies) for the purposes described in this Privacy Notice.
To our third-party service providers, to provide services such as data analysis, data technology and related infrastructure provision such as but not limited to applications that allow us to organize and stream online conferences, customer service, auditing and other services.
To specialized companies providing information services in the healthcare sector to ensure your data remains up to date and accurate.
To other companies with which we collaborate regarding joint development, distribution and/or marketing of particular products or services.
To comply with a regulatory requirement, judicial proceeding, court order, government request, or legal process served on us.
To take legal action or otherwise protect the safety, rights, or property of our customers, the public, Pfizer and our affiliates.
To prepare, complete and implement any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).To companies that were formerly wholly or partly included in the Pfizer group to whom we provide services during a transition period following separation.

USE OF ARTIFICIAL INTELLIGENCE TOOLS

Pfizer uses artificial intelligence (“AI”) and machine learning tools – both proprietary internal tools and third-party AI platforms– in connection with the processing of your Personal Data for:

Professional segmentation: AI tools assist in categorising HCPs based on professional specialty, scientific interests, prescribing patterns, and interaction history, to optimise scientific information activity.
Personalisation of communications: AI tools personalise the content, format, and timing of email communications and scientific materials on the basis of your professional profile and your consent.
Predictive analysis of scientific interests: AI models analyse patterns in your interactions with Pfizer (content consulted, events attended, topics requested) to improve the relevance of future interactions and internal resource allocation.

All AI outputs are reviewed by a qualified Pfizer employee before any action is taken that may materially affect you. No decision producing legal or similarly significant effects is made solely on the basis of automated processing. Additional safeguards include: (i) data minimisation; (ii) purpose limitation (AI outputs not repurposed without a separate legal basis); (iii) vendor governance ; (iv) cross-border transfer safeguards (Standard Contractual Clauses or equivalent mechanisms under Chapter V GDPR); and (v) EU AI Act compliance monitoring (Regulation (EU) 2024/1689; this Notice will be updated as applicable obligations arise).

AI tools are used exclusively as decision-support tools (human-in-the-loop) and do not produce automated decisions within the meaning of Article 22 GDPR.

The legal basis for AI-assisted processing is Pfizer's legitimate interest pursuant to Article 6(1)(f) GDPR for segmentation and analytics purposes, and your consent pursuant to Article 6(1)(a) GDPR where AI is used in connection with personalised promotional communications.

DISCLOSURES OF TRANSFER OF VALUE

A Pfizer company in the country of your professional practice will make public disclosures of the transfers of value that you receive from any Pfizer company according to the EFPIA Transparency Code of Conduct and/or applicable local law (such as payment of professional fees, travel, accommodations and out of pocket expenses).

More information

Unless otherwise required by law, we will disclose your identity, city and country of professional practice and the date, nature and amount of value that you receive from Pfizer. Your ID or social security number will only be published if required by local law. These disclosures will be published on our websites and/or EFPIA local pharmaceutical industry association websites. When legally required, disclosure will also occur on relevant government websites. The data, once published, will be available for 3 years (unless another legal period applies in your country). We disclose this data pursuant to consent, law or legitimate interests. The publication of this data serves multiple legitimate interests of society, including patients, health care systems, the pharmaceutical industry, and to you as an HCP by:

Instilling public confidence in the integrity and independence of HCPs.
Helping safeguard public health by promoting HCP accountability to patients for decisions about their treatment.
Demonstrating a commitment to continual education of HCPs which helps provide better care to patients.

INDIVIDUAL RIGHTS

You have the right to exercise your rights as data subject, in accordance with Regulation (EU) 2016/679.

If you would like to request to access, correct, update, suppress, restrict, object or delete Personal Data that you have provided to us, withdraw a consent or if you would like to request to receive an electronic copy of such Personal Data for purposes of transmitting it to another company, you may contact us as indicated in the Contact Us section. In particular, you have the right to object at any time to the processing of your Personal Data we process on the basis of our legitimate interest, subject to our right to demonstrate the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject. We will respond to your request consistent with applicable data protection law.

In your request, please tell us what Personal Data you would like to have changed, whether you would like to have it suppressed from our database, or otherwise let us know what limitations you would like to put on our use of it. For your protection, we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable, and in accordance with applicable data protection law.

Please note that we may need to retain certain Personal Data for regulatory and recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion.

DATA SECURITY

We seek to use reasonable organizational, technical and administrative measures to protect your Personal Data. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure.

RETENTION PERIOD

We will retain your Personal Data for the time strictly necessary in light of the purpose(s) for which it was obtained and as outlined in this Privacy Notice. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; or (iii) whether retention is advisable in light of our legal position (such as in regard to the enforcement of the Site Terms of Use, applicable statutes of limitations, litigation or regulatory investigations).

CROSS BORDER TRANSFERS

The data we collect through the Site may be stored and processed in any country where we have facilities or in which we engage service providers, including in the U.S. and where our affiliates operate.

Some non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures, such as by ensuring that the recipient is bound by EU Standard Contractual Clauses, to protect your Personal Data.

To obtain a copy of these measures please visit here.

UPDATES

From time to time, we will update this Privacy Notice. Any changes will become effective when we post the revised Privacy Notice on the Site. This Privacy Notice was last updated as of the “Last Updated” date shown above. We will notify you of substantial changes occurred in this Privacy Notice.

CONTACT US

The data controller responsible for the processing of your Personal Data under this Privacy Notice is Pfizer S.L.U. with its registered office in Avenida de Europa 20b, Alcobendas, Madrid, 28108.

If you have questions about this Privacy Notice, please contact us at privacidad@pfizer.com.

If you would like to request to exercise any individual rights, please contact us at www.pfizer.com/individualrightsgdpr, or write to the following address: privacidad@pfizer.com

You may also contact our data protection officer responsible for your country or region, if applicable, at privacy.officer@pfizer.com. To find their contact information, visit DPO.Pfizer.com.

LODGING A COMPLAINT WITH A REGULATOR

You may lodge a complaint with a data protection authority competent for your country or region or place of alleged infringement. Please click visit herefor contact information for such authorities.