IQVIA (also referred to as “Company,” “we” or “our”) respects the relationships we have with our customers and respects the privacy of all individuals whose Personal Information may be processed by IQVIA in the performance of our services and our business operations. This Privacy Policy (“Policy”) explains how IQVIA collects, holds, uses and discloses Personal Information, including Personal Information of our personnel, consumers, healthcare professionals, patients, medical research subjects, clinical investigators, customers, suppliers, vendors, business partners and investors. IQVIA intends that this corporate privacy policy and our implementing standard practices and procedures will support timely compliance with all international privacy laws and regulations around the world.
This Policy supplements our EU-US Data Privacy Framework (DPF) Policy (available here). When appropriate, we rely on the DPF and the UK Extension to the DPF for data transfers from the EU and UK to the United States. We are awaiting an adequacy decision for data transfers from Switzerland to the United States made pursuant to the Swiss-US DPF. Accordingly, we currently rely on alternative data transfer mechanisms for these data transfers. In this policy, we refer to these alternative data transfer mechanisms and the DPF collectively as “appropriate data transfer mechanisms.”
To learn more about IQVIA’s privacy practices in relation to the information that we process through our online offerings, please review our Online Privacy Policy. If you are a California resident, you can review our California Privacy Addendum for additional rights that may apply to you. Additionally, if we process your “consumer health data” under Washington’s My Health My Data Act or a similar health privacy law in another jurisdiction, please review our Consumer Health Data Policy.
* * *
SCOPE: This Policy applies to all Personal Information of Individuals, either in electronic or paper format, received by IQVIA, including Personal Information of Company Personnel, job applicants, consumers, healthcare professionals, patients, medical research subjects, clinical investigators, customers, suppliers, vendors, business contacts and partners, government officials and investors. IQVIA endeavors to collect, use and disclose Personal Information in a manner consistent with the laws of countries in which it does business, and also has a tradition of upholding the highest ethical standards in its business practices.
DEFINITIONS: For purposes of this Policy, the following definitions shall apply:
“Sensitive Personal Information” means Personal Information that reveals or is processed to uniquely identify a person:
IQVIA will also treat as Sensitive Personal Information any information received from an employee or third party where that employee or third party treats and/or has identified the information as sensitive. Capitalized terms not defined above have the definitions set forth in the respective paragraphs of this Policy.
NOTICE OF DATA COLLECTION AND USE
Where IQVIA collects Personal Information directly from Individuals, it will explain the purposes for which it collects and uses Personal Information about the Individuals, the types of third parties to which IQVIA discloses that information, and the choices and means, if any, IQVIA offers Individuals for limiting the use and disclosure of Personal Information about them. Notice will be provided in clear and conspicuous language. This explanation will be provided as soon as practicable and, in any event, before IQVIA discloses the Personal Information or uses such information for a purpose materially different than that for which it was originally collected or processed.
IQVIA also will provide any additional information required by law for a specific context, product or service. In general, with exceptions and other lawful bases that may be relevant for any specific product or service notice, IQVIA processes personal data for its legitimate interests consistent with applicable law. Where an IQVIA entity receives Personal Information from another IQVIA entity or other entities, including when acting as a clinical research organization (CRO) processing Personal Information under the direction of a customer, it will use such information in accordance with the notices provided by such entities and the choices made by the Individuals to whom such Personal Information relates.
In circumstances in which IQVIA obtains personal data as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for providing appropriate notice to the Individuals and, when applicable, obtaining any requisite consent (unless this function has been delegated to IQVIA).
IQVIA may collect various categories of Personal Information (as elaborated on below) for the following purposes:
Please note that in certain jurisdictions (such as in Canada, the EU, and the UK), we implement additional protections (such as by obtaining consumer consent in relation to the use cases described above) to ensure that our data processing activities are in compliance with applicable law.
IQVIA may also use the Personal Information collected above to comply with our legal and regulatory obligations, policies and procedures, and for internal administrative purposes. We may also collect, use, and disclose Personal Information that we collect online for any purpose outlined in our Online Privacy Policy.
OTHER DISCLOSURES OF PERSONAL INFORMATION
In some cases, IQVIA may disclose Personal Information (i) if required to do so by law, court order or legal process, (ii) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, (iii) under the discovery process in litigation, (iv) to enforce IQVIA policies or contracts, (v) to collect amounts owed to IQVIA, (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity, or (vii) in the good faith belief that disclosure is otherwise necessary or advisable. IQVIA also may transfer Personal Information when a material event concerning its business operation(s), assets or shares, such as purchase, disposal, merger, joint venture or acquisition, is proposed or occurs. In such an event, IQVIA will endeavor to direct the transferee to use Personal Information in a manner that is consistent with this Policy. IQVIA will provide Individuals with reasonable mechanisms to exercise their choices to the extent required by applicable law.
ACCOUNTABILITY FOR ONWARD TRANSFER
In the performance of our services and business operations, Personal Information we collect or receive may be stored or transferred internationally throughout our worldwide organization and to our service providers or agents, including for hosting our databases or provision of data processing services, in accordance with applicable data privacy laws. Transfers to third parties are covered by the provisions in this Policy regarding notice and choice.
IQVIA may also share an Individual's Personal Information with Agents, including affiliates, in connection with services or business purposes that these individuals or entities perform for, or with, IQVIA. IQVIA may, for example, provide an Individual's Personal Information to Agents for hosting our databases, for data processing services, or to send to that Individual the information that he or she requested.
IQVIA may transfer Personal Information for specified, limited purposes to an Agent and will endeavor to obtain assurances that such Agent provides at least the same level of privacy protection as is required by appropriate data transfer mechanisms and this Policy and will notify IQVIA if it makes a determination that it can no longer meet this obligation.
Where IQVIA knows that any third party to whom it has provided Personal Information is using or disclosing Personal Information in a manner contrary to this Policy, IQVIA will take reasonable steps to prevent or stop the use or disclosure. With respect to such onward transfers to Agents, and to the extent IQVIA is responsible for the event, IQVIA shall remain liable should its Agents process Personal Information in a manner inconsistent with the appropriate data transfer mechanisms and this Policy.
In circumstances in which IQVIA obtains Personal Information as a service provider for its clients or affiliates, IQVIA’s clients or affiliates are responsible for protecting individual rights with respect to onward transfers.
SECURITY
IQVIA will endeavor to take reasonable and appropriate technical, administrative and physical safeguards designed to protect Personal Information in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the Personal Information IQVIA is processing, and regardless of whether such Personal Information is in electronic or tangible, hard copy form. We have a privacy incident response program designed to promptly respond to and escalate all privacy-related questions, complaints, and concerns, including any potential privacy or security incident.
DATA RETENTION
The information we collect may be archived or stored periodically by us according to backup processes and will only be retained for as long as is required for the purposes for which it was collected, as well as to provide our products and services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.
DATA INTEGRITY AND PURPOSE LIMITATION
IQVIA endeavors to use Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the Individual. IQVIA will take reasonable steps designed to ensure that only Personal Information that is relevant to its intended use, accurate, complete, current, and otherwise reliable in relation to the purposes for which the information was obtained is used by IQVIA for as long as IQVIA retains possession of such information. IQVIA’s Personnel have a responsibility to assist IQVIA in maintaining accurate, complete and current Personal Information. When acting as a CRO or in other situations where IQVIA acts on behalf of another entity, IQVIA endeavors only to process Personal Information that is relevant to the services it provides, and only for purposes compatible with those for which the Personal Information was collected; wherever possible, such Personal Information is non-identified. Where IQVIA processes Personal Information as a CRO or otherwise acts under the direction of its customers, IQVIA works with such customers so that the customers can provide a way for Individuals to correct or update their Personal Information to the extent required by law.
YOUR PRIVACY CHOICES
Depending on your jurisdiction, you may also have certain legal rights in relation to the processing of your Personal Information. These rights may include:
To exercise any of these rights, please fill out this webform or contact us by email at privacyofficer@iqvia.com with your name, physical address, email address, the email address associated with your interactions with IQVIA (if different), telephone number, and details about your interactions with IQVIA (including whether you are a patient or a health care professional). You may also designate an authorized agent to submit a request on your behalf. To designate an agent, please also send us a written and signed document by both you and the agent that authorizes the agent to act on your behalf. You may also use a power of attorney. Please note that we will still require you to provide sufficient information to allow us to reasonably verify that you are the person about whom we are receiving a request. We will respond to any request you submit in the time period required by applicable law and will allow you to appeal any decision we make in response to such request in accordance with applicable law. Appeals may be submitted to privacyofficer@iqvia.com.
Although IQVIA makes good faith efforts to provide individuals with access to their Personal Information, there may be circumstances in which IQVIA is unable to provide access, including, but not limited to: where the information contains legal privilege, would compromise others’ privacy or other legitimate rights, where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the case in question or where it is commercially proprietary. If IQVIA determines that access should be restricted in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries.
Depending on your jurisdiction, you may also have the right to lodge a complaint with your supervisory authority or challenge our decision with regard to any of your data protection rights. For example, for a list of EU supervisory authorities, please see this directory for contact details: https://edpb.europa.eu/about-edpb/board/members_en.
If you are a California user, you may also have additional rights available to you under the California Consumer Privacy Act. Please review our California Consumer Privacy Act Notice for additional details. If we process your “consumer health data” under Washington’s My Health My Data Act or a similar health privacy law in another jurisdiction, please review our Consumer Health Data Policy.
If you are an EU, Swiss, or UK resident, please review our EU-US DPF Policy that may provide you with additional information regarding your rights in relation to international data transfers.
RECOURSE, ENFORCEMENT AND LIABILITY
IQVIA encourages Individuals covered by this Policy to raise questions about the processing of Personal Information about them by contacting IQVIA through the contact information provided below. Any Personnel that IQVIA determines is in violation of this Policy will be subject to disciplinary action up to and including termination of employment, where applicable, in accordance with IQVIA’s disciplinary procedures.
Any questions or concerns regarding the use or disclosure of Personal Information should also be directed to IQVIA through the contact information given below. IQVIA will undertake reasonable efforts to investigate and attempt to resolve complaints and disputes regarding use and disclosure of Personal Information in accordance with the principles contained in this Policy.
In circumstances in which IQVIA obtained or maintains Personal Information as a CRO or other Service Provider, Individuals may submit complaints concerning the processing of their Personal Information to the relevant client, in accordance with the client’s dispute resolution process. IQVIA will participate in this process at the request of the client or the Individual. IQVIA will take steps to remedy any issues arising out of any potential failure to comply with this Policy and, where applicable, implement appropriate data transfer mechanisms.
CONTACT INFORMATION: Questions, comments, concerns or complaints regarding this Policy or IQVIA’s processing of Personal Information should be submitted to the IQVIA Chief Privacy Officer at PrivacyOfficer@IQVIA.com.
RESERVATION OF RIGHTS: IQVIA reserves the right to share an Individual’s Personal Information and contracts with Agents as required or authorized by law or regulation or in response to duly authorized information requests of government authorities.
CHANGES TO THE PRIVACY POLICY: This Policy may be reviewed and amended from time to time, without advance notice, to ensure that an appropriate level of protection for Personal Information is maintained. All amendments will be posted on this website. Please check back periodically for updates to this Policy.
IQVIA PRIVACY POLICY EFFECTIVE DATE: March 31, 2024
Translations