Privacy Policy
of NMD Pharma A/S

 

1. INTRODUCTION
NMD Pharma A/S, Palle Juul-Jensens Boulevard 82, 8200 Aarhus, Denmark, Business reg. no.: 36899069 (”NMD Pharma”) is the data controller for the processing of your personal data. Below, NMD Pharma has provided an overview of the processing activities in which personal data are processed, including among others the purpose thereof and the legal basis.

If you have any question to this privacy policy (“Privacy Policy”) or you wish to exercise your data subject rights pursuant to Chapter III of the General Data Protection Regulation (“GDPR”) and according to section 6 of this Privacy Policy, please contact NMD Pharma by email contact@nmdpharma.com or on telephone number +45 52 66 57 00.

2. CATEGORIES OF PERSONAL DATA, PURPOSE AND LEGAL BASIS
In order to conduct research that will deliver life-transforming therapies for people living with neuromuscular diseases, NMD Pharma processes personal data necessary for our research.

2.1 Participant in a clinical trial sponsored by NMD Pharma A/S.

As a participant in a clinical trial sponsored by NMD Pharma A/S, NMD Pharma processes personal data about you.

This may include ordinary personal data such as

  • gender,

  • date of birth, and

  • body weight and height,

  • but may also include special categories of personal data such as

  • your race,

  • your medical data including your medical history,

  • biological samples, and

  • information about your use of the trial medicine, the effect it has on you, and its potential side effects.

The purpose of the processing of your data is to provide valuable scientific and medical knowledge that may aid the development of drugs and therapies targeting patients with neuromuscular diseases. Additionally, NMD Pharma needs to process the abovementioned personal data about you in order for you to participate in the clinical study.

The processing of your personal data will be conducted in accordance with applicable local privacy regulations, including GDPR (where applicable). In general, NMD Pharma will retain your personal data for a minimum of 25 years. This is necessary for us to comply with legal obligations including notifications to the regulatory authorities; for example to ensure your safety. Your personal data will be processed in pseudonymous form. This means that your personal data will not be associated with your name. Your name and contact details will only be collected by the local study investigator and will never be transferred to us or any third parties.

To the extent permitted by the applicable laws and/or regulations, we will take all reasonable measures to protect the confidentiality of your personal data and your identity. Your personal data and your identity combined will never be made publicly available.

The specific details of the processing of your personal data including the legal basis for processing, planned transfers of personal data, and information about your rights (see section 6 below for your general rights when GDPR applies) are provided in the informed consent form and participant information material that you have received in connection with your participation. If you have lost the documents, you can retrieve a new set of documents by contacting the site or NMD Pharma A/S directly.

2.2 Contact person at business partners and other third parties

As a contact person at a business partner or another third party, NMD Pharma processes your personal data when you communicate with NMD Pharma, e.g., via emails in connection with NMD Pharma's existing contractual relation with the company you are employed with or in connection with the conclusion or termination of a contract. NMD Pharma processes ordinary personal data about you, including your name, email address, telephone number, position, etc.

The legal basis for such processing of your personal data is that the processing is necessary for the purposes of legitimate interests pursued by NMD Pharma and that it is NMD Pharma's assessment that our legitimate interests override your interests or fundamental rights and freedoms, cf. Art. 6(1)(f) of the GDPR. NMD Pharma's legitimate interests are fulfilment of our contractual obligations, maintaining and enhancing customer relationships, invoicing for the services your company provides to NMD Pharma and/or vice versa, communicating with you if you have any questions related to our services or vice versa, and for documentation purposes in the event you agree on matters relating to our services in writing via email.

In some cases, processing of personal data is necessary in order to comply with a legal obligation to which NMD Pharma is subject, for instance in relation to the obligation on the preservation of accounting records pursuant to the Danish Bookkeeping Act. In such case, the legal basis for the processing is Art. 6(1)(c) of the GDPR.

3. RECIPIENTS OF YOUR PERSONAL DATA
Certain recipients process personal data on behalf of NMD Pharma and may only process your personal data in accordance with documented instructions given by NMD Pharma and further terms and conditions stated in a data processor agreement entered with NMD Pharma. These data processors are not permitted to process your personal data for their own purposes. Additionally, some recipients are independent data controllers, or we may have a joint controllership with the recipient.

Examples of recipients your personal data may be disclosed to are biobanks, laboratories, statistics providers, hospitals, universities, contract research organizations, regulatory authorities, and external expert consultants provided that such disclosure is assessed to be legitimate and lawful.

4. TRANSFER OF YOUR PERSONAL DATA TO A THIRD COUNTRY (OUTSIDE OF EU/EEA)
NMD Pharma will in certain cases transfer your personal data to third countries outside of EU/EEA. NMD Pharma will ensure that transfer to third countries will be carried out in accordance with applicable data protection legislation so that an adequate level of protection is ensured.

If the personal data are transferred to recipients established in so-called "unsafe" third countries that are not approved by the EU Commission as ensuring an adequate level of protection, NMD Pharma ensures an adequate level of protection for instance by entering into the EU Commission's standard contractual clauses and - where necessary - by implementing additional safeguards. If you want a copy of our basis for transfers to third countries, please contact NMD Pharma by email contact@nmdpharma.com.

5. STORAGE OF YOUR PERSONAL DATA
NMD Pharma will only store your personal data as long as it is deemed necessary to fulfil the purposes for the processing of your personal data.

Pursuant to Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, NMD Pharma is subject to rules that require NMD Pharma to store your personal data for at least 25 years from the collection.

6. YOUR RIGHTS
NMD Pharma has implemented several measures to protect your personal data and ensure your rights. As a data subject, you can exercise the rights listed below. However, some of the rights only apply under certain circumstances.

The Danish Data Protection Agency has prepared guidelines regarding the data subjects’ rights. The guidelines can be accessed here. However, please note that the guidelines are only available in Danish.

6.1 Right of access
You have the right to request access to, including the disclosure of a copy of the personal data that NMD Pharma processes about you as well as the right to receive information on:

  • the purposes of the processing;

  • the categories of personal data concerned;

  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries and in that connection the necessary measures carried out prior to the transfer;

  • the envisaged storage period or the criteria used to determine that period;

  • the existence of the right to request rectification, erasure, restriction or objection against processing of your personal data, including especially processing of personal data in connection with direct marketing purposes;

  • the right to lodge a complaint with the Danish Data Protection Agency;

  • where your personal data are obtained from if the data are not collected from you; and

  • the existence of automated decision-making, including profiling, and as a minimum meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

6.2 Right to rectification
You have the right to have inaccurate personal data about yourself rectified as well as the right to request completion of incomplete personal data concerning you.

6.3 Right to erasure ("right to be forgotten")
Under certain circumstances you have the right to obtain from NMD Pharma the erasure of personal data, for instance if the processing is based on your explicit consent and you withdraw this consent.

6.4 Right to restriction of processing
You have the right to restrict NMD Pharma's processing of your personal data, for instance, in the event you dispute the accuracy of the personal data.

6.5 Right to data portability
When our processing of your personal data is carried out automatically and is based on your consent or a contract with you, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and the right to transmit those personal data to another data controller, if this is technically feasible.

6.6 Right to object
You have the right to object, on grounds relating to your particular situation, at any time to our processing of your personal data which is based on point (e) or (f) of Art. 6(1) of the GDPR. This applies at any time where personal data are processed for direct marketing purposes.

6.7 Right to not be subject to automated individual decision-making
You have the right not to be subject to a decision based solely on automatic processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

6.8 Right to withdraw a consent
If you have given us your consent to the processing of your personal data, you have the right to withdraw such consent at any time. However, the withdrawal of your consent will not affect the lawfulness of processing of your personal data based on consent before its withdrawal.

7. QUESTIONS OR COMPLAINTS
If you have any questions relating to this Privacy Policy, you wish to exercise your rights as mentioned above, or you disagree with the way NMD Pharma processes your personal data, you can contact NMD by using the contact information provided in section 1 of this Privacy Policy.

You can also file a complaint to the Danish Data Protection Agency, which is an independent public authority that is, inter alia, responsible for monitoring and enforcing the application of the GDPR. The Danish Data Protection Agency's contact information is available on its website: www.datatilsynet.dk.

8. AMENDMENTS TO THIS PRIVACY POLICY 
This Privacy Policy will be updated and modified periodically, as well as when necessary due to changes in applicable data protection legislation and practice and, thus, NMD recommends that you keep yourself updated of such changes.

Date of last change to this Privacy Policy: April 2023.