This Data Privacy Framework Policy (“Policy”) applies to IQVIA Inc. and its U.S. operating subsidiaries (including those entities listed in Exhibit A) (collectively referred to as “IQVIA,” “Company,” “we” or “our”) when Personal Information is received from or about Individuals in the European Economic Area (EEA), United Kingdom (UK), or Switzerland in any format including electronic, paper or verbal. IQVIA respects the relationships we have with our customers and respects the privacy of all Individuals whose Personal Information (see Definitions) may be processed by IQVIA in the performance of our services and our business operations.
To demonstrate our commitment to the protection of Personal Information, including Personal Information transferred out of the EEA, UK, and Switzerland for the performance of our services and business operations in the United States, IQVIA complies with the EU-U.S. Data Privacy Framework (“DPF”), the UK extension to the DPF (“UK Extension”), and the Swiss-U.S. Data Privacy Framework (“Swiss DPF”), respectively, as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the EEA, UK, and Switzerland to the United States.
IQVIA has certified with the Department of Commerce that it adheres to the DPF Principles. If there is any conflict between the terms in this Policy and the DPF Principles, the DPF Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/s/. We also use standard contractual clauses and other mechanisms approved by the European Union for certain transfers of Personal Information to the United States from the EEA, UK, and Switzerland.
This Policy supplements IQVIA’s General Privacy Policy and Online Privacy Policy (collectively, they comprise IQVIA’s “Privacy Policies”).
Advisory: Please note that we are awaiting an adequacy decision for data transfers from Switzerland made pursuant to the DPF. Once that adequacy decision becomes approved, we will also rely on the Swiss DPF for data transfers from Switzerland. We currently rely on alternative data transfer mechanisms, such as standard contractual clauses, for such data transfers.
SCOPE: This Policy applies to all Personal Information of Individuals received by IQVIA in the U.S. from the EEA, UK, or Switzerland, including Personal Information of consumers, healthcare professionals, patients, medical research subjects, clinical investigators, customers, suppliers, vendors, job applicants, business contacts and partners, investors, and government officials. Further information concerning how IQVIA collects, uses, shares and safeguards the Personal Information of Company Personnel is available in IQVIA’s internal privacy policies (and they are made available to Individuals to whom they pertain). This Policy will help you understand how IQVIA collects, uses, shares and safeguards Individuals’ Personal Information, and how, in certain circumstances, you can elect whether or not to allow your Personal Information to be used or shared. IQVIA endeavors to collect, use and disclose Personal Information in a manner consistent with the laws of countries in which it does business, and also has a tradition of upholding the highest ethical standards in its business practices.
Adherence to the DPF Principles may be limited (i) to the extent required or allowed by applicable law, rule or regulation; (ii) to the extent necessary to respond to lawful requests by public authorities, including to meet national security, law enforcement, legal or governmental requirements; and/or (iii) to protect the health or safety of an Individual. Also, this Policy may not apply or may be limited when Personal Information is collected or processed by the following:
DEFINITIONS: For purposes of this Policy, the following definitions shall apply:
Capitalized terms not defined above have the definitions set forth in the respective paragraphs of this Policy.
Where IQVIA collects Personal Information directly from Individuals, it will explain the purposes for which it collects and uses Personal Information about the Individuals, the types of third parties to which IQVIA discloses that information, and the choices and means, if any, IQVIA offers Individuals for limiting the use and disclosure of Personal Information about them. Notice will be provided in clear and conspicuous language. This explanation will be provided as soon as practicable and, in any event, before IQVIA discloses the Personal Information or uses such information for a purpose materially different than that for which it was originally collected or processed. Where IQVIA receives Personal Information from its subsidiaries, affiliates or other entities, including when acting as a Contract Research Organization (CRO) processing Personal Information under the direction of a customer, it will use such information in accordance with the notices provided by such entities and the choices made by the Individuals to whom such Personal Information relates.
In circumstances in which IQVIA obtains personal data as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for providing appropriate notice to the Individuals whose personal data are transferred to the U.S. and obtaining any requisite consent (unless this function has been delegated to IQVIA).
IQVIA may also use the Personal Information collected above to comply with our legal and regulatory obligations, policies and procedures, and for internal administrative purposes.
IQVIA will offer Individuals the opportunity, where practical and appropriate, to choose (optout) whether their Personal Information is (a) to be disclosed to a non‐agent third party, or (b) to be used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized by the Individual.
IQVIA will not process Sensitive Personal Information about Individuals for purposes other than those for which the information was originally obtained or subsequently authorized by the Individual unless the Individual explicitly consents to the processing (“opt‐in”), or as required or permitted, or where not prohibited by law or regulation.
In some cases, even if an Individual opts‐out of disclosures of their Personal Information, IQVIA may still disclose such Personal Information (i) if we are required to do so by law, court order or legal process; (ii) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; (iii) under the discovery process in litigation; (iv) to enforce IQVIA policies or contracts; (v) to collect amounts owed to IQVIA; (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; or (vii) in the good faith belief that disclosure is otherwise necessary or advisable. IQVIA also may transfer Personal Information when a material event concerning its business operation(s), assets or shares, such as purchase, disposal, merger, joint venture or acquisition, is proposed or occurs. In such an event, IQVIA will endeavor to direct the transferee to use Personal Information in a manner that is consistent with this Policy. IQVIA will provide Individuals with reasonable mechanisms to exercise their choices to the extent required by applicable law.
In most situations, transfers to third parties are covered by the provisions in this Policy regarding notice and choice.
IQVIA does not sell or otherwise disclose Individuals’ Personal Information, except as described in our Privacy Policies or in a notice provided to Individuals at the time of collection, or as Individuals explicitly consent. IQVIA may share Individuals’ Personal Information with our service providers, consultants and affiliates for our and our affiliates’ internal business purposes or to provide Individuals with a requested service.
IQVIA will endeavor to only transfer Personal Information to a third party/Agent where such third party/Agent has given assurances that it provides at least the same level of privacy protection as required by the DPF Principles and this Policy and will notify IQVIA if it makes a determination it can no longer meet this obligation. IQVIA may, for example, provide an Individual's Personal Information to Agents to host our databases, for data processing services, or to send to that Individual the information that he or she requested. Where IQVIA has knowledge that an Agent is using or disclosing Personal Information in a manner contrary to the DPF Principles and/or this Policy, IQVIA will take reasonable steps to prevent or stop the use or disclosure. With respect to onward transfers to Agents, DPF requires that, to the extent it is responsible for the event, IQVIA shall remain liable should its Agents Process Personal Information in a manner inconsistent with the DPF Principles, and IQVIA accepts and shall follow this principle.
Where IQVIA knows that any third party to whom it has provided Personal Information is using or disclosing Personal Information in a manner contrary to this Policy and/or the DPF Principles, IQVIA will take reasonable steps to prevent or stop the use or disclosure. With respect to such onward transfers to Agents, and to the extent IQVIA is responsible for the event, IQVIA shall remain liable should its Agents process Personal Information in a manner inconsistent with the DPF Principles and this Policy.
In circumstances in which IQVIA obtains personal data as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for protecting individual rights with respect to onward transfers. IQVIA has potential liability in cases of onward transfer to third parties of data of EU individuals received pursuant to the DPF Principles.
IQVIA will endeavor to take reasonable and appropriate technical, administrative and physical precautions designed to protect Personal Information in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the Personal Information IQVIA is processing, and regardless of whether such Personal Information is in electronic or tangible, hard copy form.
IQVIA endeavors to use Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the Individual. IQVIA will take reasonable steps designed to ensure that only Personal Information that is relevant to its intended use, accurate, complete, current, and otherwise reliable in relation to the purposes for which the information was obtained is used by IQVIA for as long as IQVIA retains possession of such information. IQVIA’s Personnel have a responsibility to assist IQVIA in maintaining accurate, complete and current Personal Information. When acting as a CRO or in other situations where IQVIA acts on behalf of another entity, IQVIA endeavors only to process Personal Information that is relevant to the services it provides, and only for purposes compatible with those for which the Personal Information was collected. Where IQVIA processes Personal Information as a CRO or otherwise acts under the direction of its customers, IQVIA works with such customers so that the customers can provide a way for Individuals to correct or update their Personal Information.
IQVIA will, on request, provide an Individual with confirmation regarding whether IQVIA is processing Personal Information about them. In addition, upon request of an Individual, IQVIA will take reasonable steps to correct, amend, or delete their Personal Information that is found to be inaccurate, incomplete or processed in a manner non‐compliant with this Policy or the DPF Principles, except where the burden or expense of providing access would be disproportionate to the risks to that Individual’s privacy, where the rights of persons other than the Individual would be violated or where doing so is otherwise consistent with DPF Principles. Unless prohibited by applicable law, IQVIA reserves the right to charge a reasonable fee to cover costs for providing copies of Personal Information requested by Individuals.
In circumstances in which IQVIA maintains personal data as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for providing Individuals with access to their personal data and the right to correct, amend or delete the data where it is inaccurate. In these circumstances, Individuals should direct their questions to the appropriate IQVIA client or affiliate. If they do not receive a response, IQVIA will provide reasonable assistance in forwarding the Individual’s request.
IQVIA encourages Individuals covered by this Policy to raise questions about the processing of Personal Information about them by contacting IQVIA through the contact information provided below. Any Personnel that IQVIA determines is in violation of the DPF Principles and/or this Policy will be subject to disciplinary action up to and including termination of employment, where applicable, in accordance with IQVIA’s disciplinary procedures.
In accordance with the DPF Principles, IQVIA commits to resolve complaints about Individuals’ collection or use of your Personal Information. Any Individuals with inquiries or complaints regarding this Policy or the use or disclosure of Personal Information in accordance with the DPF Principles should first contact IQVIA using the contact information given below. IQVIA will investigate and attempt to resolve complaints and disputes regarding use and disclosure of Personal Information in accordance with the DPF Principles outlined in this Policy. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, IQVIA commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.
In addition, IQVIA has further committed to cooperate with the panel established by the EU data protection authorities (“DPAs”) and comply with the advice given by the panel with respect to unresolved DPF complaints related to Individuals’ human resources data transferred from the EEA in the context of the employment relationship. IQVIA also commits to cooperate with the Swiss Federal Data Protection and Information Commissioner (FDPIC) and the UK’s Information Commissioner’s Office (ICO) and to comply with the advice given by such authorities with regard to human resources data transferred from Switzerland and the UK in the context of the employment relationship. If you do not receive timely acknowledgement of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact your DPA for more information or to file a complaint. The services of DPAs (including the FDPIC and the ICO) are provided at no cost to Individuals. If any request remains unresolved, Individuals may, under certain circumstances, have a right to invoke binding arbitration under DPF. For additional information, see https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction. The Federal Trade Commission has jurisdiction over IQVIA’s compliance with the DPF Principles.
Under certain limited conditions, if your complaint is not resolved through these channels, it may be possible for Individuals to invoke binding arbitration before the EU-U.S. DPF Panel to be created by the U.S. Department of Commerce and the European Commission. For additional information, please visit .
In circumstances in which IQVIA obtained or maintains Personal Information as a CRO or other Service Provider, Individuals may submit complaints concerning the processing of their Personal Information to the relevant client, in accordance with the client’s dispute resolution process. IQVIA will participate in this process at the request of the client or the Individual. IQVIA will take steps to remedy any issues arising out of potential failure to comply with the DPF Principles.
CONTACT INFORMATION: Questions, comments, concerns or complaints regarding this Policy or IQVIA's processing of Personal Information should be submitted to IQVIA by clicking here.
RESERVATION OF RIGHTS: IQVIA reserves the right to share an Individual’s Personal Information and contracts with Agents as required or authorized by law or regulation or in response to duly authorized information requests of government authorities.
CHANGES TO THE POLICY: This Policy may be reviewed and amended from time to time, without advance notice, to ensure that an appropriate level of protection for Personal Information is maintained. All amendments will be posted on this website. Please check back periodically for updates to this Policy.
POLICY - EFFECTIVE DATE: September 9, 2024