As the data controller, the company Biocodex, whose registered office is established in France at 22 Rue des Aqueducs in Gentilly (94250) (hereinafter, “Biocodex”), undertakes to comply with the regulatory provisions applicable to the protection of personal data, in particular Regulation (EU) 2016/679 of April 27, 2016 – General Data Protection Regulation (hereinafter, the “GDPR”), on the processing that it implements on the website www.biocoreport.com (hereinafter, the “Website”).

Data protection policy

The user can navigate freely on the Website without having to explicitly provide personal information. Nevertheless, he/she may be required to provide data concerning him/herself, since the purpose of the Website is to allow him/her to ask a medical information question, to notify an adverse reaction or a quality complaint concerning the products marketed by Biocodex.

Each processing operation carried out on the Website limits the collection of personal data to what is strictly necessary and is accompanied by information detailing in particular:

• The purpose of the processing (the purposes) for which the personal data collected is intended;
• The legal basis of the processing;
• The source of the data (if not provided by the user of the Website);
• The mandatory or optional nature of the data collection;
• The categories of persons concerned;
• The recipients of the data;
• The duration of data retention;
• The possible existence of data transfers outside the European Union;
• The rights of the individual with respect to his/her data and how to exercise them.

Biocodex takes all necessary precautions to preserve the security of the Website user’s personal data and aims in particular to prevent them from being deformed or damaged, or from being accessed by unauthorized third parties.

In accordance with the GDPR, the user of the Website may exercise, on the data concerning him/her and by proving his/her identity, a right of access, rectification, deletion, portability, limitation, opposition, with the Data Protection Officer (DPO) of Biocodex (in English if French is not possible) at the email address dpo[at]biocodex.com (replace ‘’[at]’’ by ‘’@’’) or by postal mail: DPO BIOCODEX, 22 Rue des Aqueducs, 94250 GENTILLY, France; he/she also has the right to lodge a complaint with a supervisory authority (in France: CNIL, Service des Plaintes, 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 | www.cnil.fr).

NB) Insofar as the processing is based on compliance with a legal obligation, the persons concerned by the collection of data have neither the right to object, nor the right to the erasure of data, nor the right to data portability.

Website management

The purpose of this personal data processing is to manage the Website. It allows Biocodex:

• Management of online services set up to users;
• Technical administration and security management;
• Production of anonymous statistics on the use of the Website.

With reference to Article 6(1)(f) of the GDPR, the processing is necessary for the purposes of the legitimate interests pursued by Biocodex (to facilitate and simplify the notification procedures relating to the products it markets).

The categories of data processed are:

• Data relating to navigation on the Website (e.g. time stamps, IP addresses of users, technical data relating to the equipment and browser used by users, geolocation, cookies, etc.);
• Data relating to the management of online services;
• Data related to the management of technical services (e.g.: time-stamping and purpose of requests, follow-up, follow-up data, statistics);
• Anonymous statistics relating to the use of the Website.

Within the limits of their respective responsibilities and for what concerns them, are recipients of all or part of the data:

• Biocodex staff in charge of:
  • Management of the Website and online services (Pharmaceutical Affairs);
  • Technical administration of the Website and security (IT);
• The staff of the service providers concerned.

Data retention:

• The terms of retention of data relating to online services are detailed in each of the subsequent data processings corresponding to these services;
• Data relating to exchanges with service providers are kept for 5 years at the end of the contractual relationship;
• Except for legal obligations or particularly important risks, log data are kept for a maximum of 6 months;
• The data necessary for the production of statistics relating to the use of the Website are kept in a format that does not allow the identification of persons by their IP address, and include an identifier (relating to the cookie) kept for a maximum of 13 months (unless the person concerned objects).

The data collected during navigation, not necessary for the functioning of the Website (such as certain types of cookies), are optional. Unless otherwise indicated, the other data collected is mandatory.

Depending on the online service used, the data may be further processed for :

• Medical information;
• Health vigilance;
• Quality complaints.

‘’ Medical information’’ online service

The purpose of this personal data processing is to manage medical information requests. It allows Biocodex to ensure the traceability of responses to requests for information of a medical or pharmaceutical nature relating to the products it markets.

In reference to Article 6(1)(c) of the GDPR, the processing is necessary to comply with a legal obligation to which Biocodex is subject.

The categories of data processed are:

• Data relating to the identity and contact details of the applicant (surname, first name, postal address, email address, telephone/fax numbers) ;
• Information relating to the product concerned, the request and its processing, as well as any additional information useful for processing the request.

Within the limits of their respective attributions and for what concerns them, are recipients of all or part of the data:

• The applicant ;
• Biocodex staff in charge of medical information (Pharmaceutical Affairs);
• Biocodex staff in charge of vigilance or quality complaints (Pharmaceutical Affairs);
• Where applicable, the staff of the service providers concerned.

The data is kept for up to 10 years after the withdrawal of the product concerned from the market.

The contact details of the applicant, the name of the product concerned, the capacity of the applicant and the reason for the request must be collected. The absence of contact information does not allow the request to be processed.

The processing may lead to another processing related to vigilance or quality complaints on products.

‘’Health vigilance’’ online service

The purpose of this personal data processing is to manage health vigilance (pharmacovigilance, materialovigilance, nutrivigilance, etc.). It is covered by the CNIL RS-1 health standard, which governs the processing of personal data for the purpose of preventing, monitoring, evaluating and managing adverse health events. It allows Biocodex:

• The collection, recording, analysis, follow-up, documentation, transmission and storage of data relating to all adverse health events;
• Management of contacts with the person who reported the adverse health event or the health professional who can be asked for details of the reported adverse health event.

A declaration of compliance with the RS-1 health standard was made to the CNIL by Biocodex on 19/11/2020 (n° 2220113).

In reference to Article 6(1)(c) of the GDPR, the processing is necessary to comply with a legal obligation to which Biocodex is subject, in particular the health vigilance measures provided for in the Public Health Code.

The categories of data processed are, concerning the exposed person:

• Identification number (alphanumeric code);
• Personal data (age, year/date of birth, sex, weight, height, etc.);
• Health data (treatments administered, nature of adverse effects, personal or family history, etc.);
• Data related to the product concerned by the adverse health event;
• If applicable: professional life, tobacco/alcohol/drug consumption, lifestyle and behavior, ethnic origin;

The categories of data processed are, concerning the notifier or the health professional concerned;

• Identity (surname, first name), contact details (postal, telephone and electronic);
• If applicable: specialty of the health professional.

Within the limits of their respective attributions and for what concerns them, are recipients of all or part of the data:

• Biocodex staff in charge of medical information and health vigilance (Pharmaceutical Affairs);
• Biocodex personnel in charge of product quality complaints (Pharmaceutical Affairs);
• Subcontractors working on behalf of and under the responsibility of Biocodex;
• Other companies of the Biocodex group that participate in the operation or marketing of the product in question;
• Third parties whose product could be implicated;
• Health professionals concerned;
• National public bodies (regional health agencies, health agencies, etc.) or foreign bodies responsible for vigilance;
• Foreign national health authorities or agencies and international health authorities or agencies (European Medicines Agency, etc.).

Data may be transferred outside the European Union, if strictly necessary for the implementation of the vigilance system and in compliance with the provisions of article 6 of the reference framework relating to data recipients:

• Indirectly identifying data of exposed persons;
• Indirectly identifying data of notifiers.

The data are kept in the active database for the duration of the current use of the data. They are then kept in intermediate storage for the legal or regulatory period applicable to each health watch, or failing that, for up to 10 years from the date of withdrawal from the market of the product concerned. At the end of these periods, the data are deleted or archived in an anonymized form.

Concerning the exposed person, identifying information, health data and data relating to the product concerned by the adverse health event are necessary for processing. Data relating to professional life, tobacco/alcohol/drug consumption, lifestyle and behaviour, and ethnic origin are only processed if they are strictly necessary for the assessment of the adverse health event.

Concerning the notifier or the health professional interviewed, data relating to the identity and contact details of the person concerned are mandatory in order to document the case.

‘’Quality complaints’’ online service

The purpose of this personal data processing is to carry out the necessary actions following a report of a quality defect observed on a health product after it has been placed on the market. It allows Biocodex to:

• Process complaints:
  • Record the complaint in the quality complaint file;
  • Create a complaint file for quality control;
  • Organize the recall of the product concerned;
  • Carry out the necessary investigations;
  • Respond to the complainant;
• To carry out statistics on the improvement of the products.

With reference to Article 6(1)(c) of the GDPR, the processing is necessary to comply with a legal obligation to which Biocodex is subject and is in line with pharmaceutical and Good Manufacturing Practices (GMP).

Categories of personal data:

• Name of the organization (if applicable) ;
• Full name of the complainant (or contact person in the organization);
• Mailing address of organization or complainant;
• Email address and/or telephone number of the organization or complainant.

Within the limits of their respective responsibilities and for what concerns them, are recipients of all or part of the data:

• The persons in the Pharmaceutical Affairs and Quality departments, authorized to handle quality complaints;
• The pharmacist in charge or his/her representative
• Members of the Management;
• People from related departments (Shipping, Sales, Marketing, International, etc.);
• Health authorities (ANSM, FDA, etc.).

The data is kept in an active database for the duration of the current use of the data. They are then kept in intermediate storage for up to 10 years after the quality complaint has been processed. At the end of this period, the data is destroyed except for the database: it is archived in an anonymized form.

The personal data collected is necessary for the processing of complaints.

About cookies

Biocodex uses computer “cookies” on the Website, in particular those necessary for its proper functioning.

What is a computer “cookie”?

A computer “cookie” is a text file that may be deposited on a user’s terminal during navigation on a website. Cookies are an important tool that allows organizations to gain insight into the online activity of their users.

How it works: usually small and identified by a name, it is sent to the user’s browser by the website visited. The browser will keep it for a certain period of time, and will send it back to the website each time it is reconnected. In principle, cookies can be easily viewed and deleted.

In themselves, cookies are harmless because they do not contain executable code. They perform important functions for websites: they can be used to store a customer account ID, browsing preferences, track browsing for statistical or advertising purposes, etc.

However, cookies can store enough data to identify a user without his or her consent and, in some cases, can be used to create profiles of individuals. This is why it is necessary that the management of cookies be controlled within the framework of data protection.

Controlling the deposit of cookies

The user can prevent cookies from being deposited on his or her terminal or delete existing ones by setting his or her web browser accordingly. For instructions on how to manage cookies, you can refer to the help sections of your web browser.

NB) It should be noted that deactivating cookies in the web browser may lead to malfunctions on the Website and on other websites.

Cookies used on the Website

The cookies detailed below allow the Website to function optimally. They do not require the user’s consent:

NB) The Website does not use services offered by third parties, requiring cookies subject to the user’s consent