1. INTRODUCTION AND SUMMARY

Our Privacy Commitment

At Celgene we recognize the importance of, and are fully committed to protecting the privacy of, information related to all individuals with whom we interact – including patients, members of the public, employees, regulatory and healthcare professionals and business partners.

About this General Privacy Policy

This policy is an overview of how Celgene Corporation and its worldwide affiliates process information about individuals, and illustrates Celgene’s commitment to ensuring that individuals can exercise choice and control over their information in accordance with local laws.

Scope of this General Privacy Policy

This policy is specifically intended to provide information for our website and mobile application users, Celgene shareholders, members of the public who interact with Celgene, patients that use Celgene products, and individuals with whom we do business (including, but not limited to, staff at regulatory authorities, personnel of suppliers and partners and visitors to Celgene offices). This Policy also provides information to individuals who may be considered for employment by Celgene (“Applying to Work at Celgene” in Section 11 below) and provides information to patients that take part in clinical trials related to Celgene drugs (“Information for Patients and Trial Participants” in Section 12 below] about how to discover more about specific privacy practices. Information about use of cookies and similar technology by Celgene on digital services can be found in Section 15 Cookies below.

In addition to this General Privacy Notice, more information for Health Care Professionals can be found in the specialist Healthcare Professional Privacy Notice.

References to “Celgene”, “group”, “affiliates”, “we”, “us” and “our” are references to Celgene Corporation and its worldwide affiliates. A list of affiliates and the countries where they are located is available at Celgene’s Global Office Network.

2. INFORMATION CELGENE MAY PROCESS ABOUT YOU

Celgene may process information about you including, but not limited to:

  • General information such as name, postal and/or email address, phone number, date of birth, and other information such as photographs and digital imagery, payment-related information, government issued identification in accordance with applicable law (e.g. driving license, passport, professional license number), agreements, your communications preferences; queries you make to Celgene;
  • Professional information, such as your job title, educational information, professional qualifications, work experience, professional networks, programs and activities in which you participated;
  • Health, biometric/genetic information related to identifiable or non-identifiable individuals, and only where necessary and strictly permitted under applicable law (including in relation to Celgene’s risk management and drug safety programs, or for accessibility purposes for visitors to Celgene sites); and
  • Digital information generated from your use of Celgene’s websites and mobile applications, such as IP address, geo-localization, device ID and data transmitted via cookies.

3. SOURCES OF INFORMATION

In most cases, Celgene will collect information directly from you, although sometimes we will obtain information about you from public or third party information sources including (but not limited to):

  • Celgene may collect information about Health Care Professionals from public or third party sources for marketing, and research purposes and to verify professional information (including but not limited to access to publicly accessible information, national registries or third party databases);
  • Health Care Professionals or other third parties may provide patient information to Celgene where necessary under applicable drug safety and risk management laws;
  • Celgene may collect information from your computer or other device you use when visiting Celgene’s website such as Internet Protocol (IP), domain name, Internet Service Provider (ISP), information about date and time of your request and other information provided by tracking technologies. Please see our Cookies notice below in Section 15
  • Information may be shared within the Celgene group of companies, which includes our worldwide affiliates.

4. WHY CELGENE PROCESSES YOUR INFORMATION

Celgene will only process your information for purposes permitted by applicable laws, which may vary depending on where you live, and where Celgene operates. The purposes of the processing may include:

  • Managing Celgene’s relationship with individuals or example, responding to questions and comments, inviting individuals to Celgene events, complying with regulatory obligations;
  • For collaboration and research purposes, for example to enable Celgene to make more informed and objective decisions when identifying, engaging with healthcare professionals and key opinion leaders and managing the collaboration relationship with healthcare professionals;
  • Recruitment, processing professional information to assess individuals for suitability for roles at Celgene;
  • Market Research, processing information about individuals for lawful market research purposes. We collect information through surveys and interviews with patients and Healthcare Professionals to help us improve our products.
  • Direct Marketing, we process information to provide marketing information to individuals in accordance with applicable local laws (you have choices about this – see “Your Rights” section of this Policy).
  • Regulatory Reporting, processing information where necessary to comply with regulatory obligations in particular where they relate to drug safety and risk management obligations, and obligations related to spend transparency and similar requirements specific to the pharmaceutical sector.
  • Any other purpose that is relevant in the relationship between Celgene and you

Celgene will process information for further purposes, where lawful to do so (such as for archiving, scientific or market research purposes) or when legally obliged to do so (such as reporting information for Celgene’s risk management and drug safety obligations).

Legal Basis of Processing

Celgene processes information based on one or more of the following:

  • you have provided consent (in which cases, such consent can be withdrawn at any time);
  • it is necessary to comply with contractual obligations with you;
  • the processing is necessary for our compliance with a legal obligation;
  • the processing is necessary to protect the vital interests of an individual;
  • processing is in the public interest; or
  • the processing is in Celgene’s legitimate interest, for example, Celgene processes information for scientific and statistical research purposes, information about Celgene visitors and supplier personnel, for scientific development, for the improvement of our products and services, to provide security measures to protect Celgene’s employees, contractors, patients, information and other assets and to prevent crime (such as fraud, financial crime and theft of intellectual and industry property and to ensure the integrity of its manufacturing and other operations).

Special Categories of Data

In addition to the above, where Celgene processes special categories of data about individuals in specified jurisdictions (including European Economic Area) – for example, information about individuals’ health, genetic, religious, ethnicity, religion, trade union membership, genetic and biometric data, sexual orientation or sex life) – it shall only do so in accordance with the obligations of the law.

Celgene relies on conditions including, but not limited to:

  • where individuals provide explicit consent (such as patients consenting to appear in Celgene marketing materials);
  • where required for rights and obligations related to employment;
  • where required for vital interests of any individual;
  • or processing is necessary for the purposes of provision of healthcare or occupational medicine, pursuant to a contract with a healthcare professional and;
  • where processing is necessary for scientific research

5. WHERE CELGENE PROCESSES PERSONAL INFORMATION

Celgene has headquarters in the United States, with operations in Europe, Asia, South and North America. Information about you may be accessible to Celgene headquarters in United States, and to some Celgene affiliates, and selected vendors and partners, globally. Where Celgene processes information in countries that may not provide the same level of protection as your own country, Celgene will implement reasonable and appropriate legal and security measures to protect your information from unauthorized access, use or disclosure including, but not limited to, maintaining binding contracts that require appropriate protection of information about individuals.

For residents of European Economic Area (“EEA”) – whenever we transfer your information outside of the EEA or Switzerland, we will take necessary steps to ensure that adequate safeguards are put in place to protect your information. Such safeguards include the use of European Commission approved standard contractual clauses.

6. DISCLOSURE OF YOUR PERSONAL INFORMATION

Celgene discloses individual information where this is reasonably required to pursue its legitimate business aims and as required by law. Your information will be disclosed only in accordance with local applicable laws, and appropriate safeguards will be established, where possible, to protect your information. Celgene may disclose information to any member of our group of companies, which means Celgene affiliates, our ultimate holding company and its subsidiaries.

In order to conduct Celgene’s business, Celgene may also disclose information to third parties such as public/regulatory authorities/governmental bodies (government, including social and benefits departments), third parties that provide services to Celgene (such as but not limited to conducting audits, IT services, assisting in our clinical trials and studies), business partners and collaborators (such as external scientists), reviews and assist Celgene with health care compliance activities, if Celgene or substantially all of our assets are acquired by a third party, in which case personal information held by us about individuals will be included as transferred assets, or if Celgene is under a duty to disclose or share individuals’ information in order to comply with any legal or regulatory obligation or request.

Celgene may also disclose information to enforce any agreements it has with individuals; or to protect the rights, property or safety of Celgene employees, patients or others (e.g. visitors to Celgene premises).

7. AUTOMATED DECISION MAKING AND INDIVIDUALS’ RIGHTS

Celgene does not undertake decisions based solely on automated processing, including profiling, of individual unless we inform you otherwise.

8. INDIVIDUAL CHOICES: RIGHTS AND ACCESS TO INFORMATION

Access, Revision, Deletion

Under applicable privacy law (e.g. European data privacy law), you may have a right to request a copy of information about you held by Celgene. You may also have the right to revise, correct, or delete such information. Your rights to such information may be subject to limited legal and regulatory restrictions.  See “Exercising Individual Rights” below.

Choices about Marketing

You may have the right to object to information being used for the purposes of direct marketing and sending scientific information and newsletters. Where this right applies, please use the “opt-out” or “unsubscribe” functionality in communications, or, if you have registered online or through any of Celgene’s resources and have a user account, you can update your information and preferences here. See “Exercising Individual Rights” below.

Objection to Processing and Additional Rights

Under applicable privacy law (e.g. European data privacy law), where Celgene relies on legitimate interests or public interest to process information, and where Celgene conducts direct marketing, individuals can formally object to processing of their information for these purposes (in addition to the “Choices about Marketing” set out above). Individuals should clearly state “objection to processing” when contacting Celgene to exercise this right to objection.

In certain circumstances, you have the additional rights to restrict aspects of the processing of your information or ask for a copy of your data to be provided to you, or a third party, in a digital format.

See “Exercising Individual Rights” below.

Exercising Your Individual Rights

To exercise your individual rights please complete the short form available here and your request will be forwarded to the most appropriate Celgene team. Depending on the applicable laws and the nature of the request, individuals may be required to provide some additional information (including as required to verify the identity of individuals).

Rights of European Individuals to Complain to Data Protection Authorities

In the event that any individual located in the EEA countries or Switzerland believes that Celgene has processed information in a manner that is unlawful or breaches his/her rights, or has infringed the “General Data Protection Regulation”, such individual has the right to complain directly to the applicable Data Protection Authority.

Without limiting any rights to complain directly to an authority, Celgene is committed to protecting personal information, and complaints may be made directly with Celgene here.

9. HOW LONG CELGENE RETAINS YOUR INFORMATION

Celgene aims to retain your information for no longer than is necessary for the specific business purpose or purposes for which it was collected. Information may be retained for a longer duration where applicable laws or regulations require, or allow Celgene to do so.

10. PROTECTION OF INFORMATION – SECURITY

Celgene uses appropriate technical and organizational measures to protect your information. We take reasonable steps to protect your information from loss, misuse, unauthorized access, disclosure, alteration or destruction.

11. APPLYING TO WORK AT CELGENE

Celgene processes information to identify applicants, and assess job applications and for other human resources processes necessary for evaluating and considering job applications. The information processed may include information such as your job title, education information, professional qualifications, work experience, publications and scientific activities, professional networks, programs and activities in which you participated.

In the course of an application, Celgene may process further information, such as government issued identification number, tax status, bank account details, details of any known disability/workplace accessibility needs, background information, travel and expenses, performance management, emergency contact details, compensation, hours of work, holidays and benefits related information.

12. INFORMATION FOR PATIENTS AND TRIAL PARTICIPANTS

Celgene processes the information of patients that use Celgene treatments and services, and clinical trial participants in trials linked to Celgene drugs. In addition, Celgene may have access to patient information through collaboration agreements with third parties (e.g. genetic data).  Your name, identification number or any other information which allows your direct identification will be replaced by a code. The coded study data will only be used for the purposes of the study and the follow-up of the safety and the effectiveness of the study medication. Only authorized members of the study doctor’s staff, Celgene’s personnel or the third parties which help Celgene with the conduct of the study will have access to the data. Celgene may transfer the coded study data outside your country (e.g. to the United States) in order to process or to submit them to competent authorities. See section 5 “Where Celgene Processes Your Information” for further information.

Celgene will not have access to the names or contact details of patients and trial participants, and Celgene does not attempt to directly identify individuals. You should contact your Healthcare Provider, or the clinical trial site for trial participants, to learn more about how your information is processed. Celgene will process key-coded information about patients and trial patients – which may be one or more of, year of birth, initials or randomly selected unique identifier. Associated to this key coded data might be information relating to physical and psychological health, dietary information, ethnicity, sexual orientation, health and safety related information and other medical information. Information is collected from clinical trials and may include special categories of personal data.

Celgene may also share information collected during the study with scientists outside Celgene for further scientific research in the interest of public health. Celgene will, however, not provide information about your identity to these scientists.

In addition, we will process the information you voluntarily provide to us. For example, we will process information you provide to us when requesting information about our drugs to the extent necessary to answer your request. We will use this information in accordance with applicable laws.

For participants and other affected individuals below the age of 18, the information will be processed in accordance with applicable laws and not be processed without the previous authorization of the parent or legal guardian.

13. INFORMATION FOR HEALTH CARE PROFESSIONALS

Celgene processes information of Health Care Professionals such as contact information for corporate communications, contractual, financial and other information related to services provided and invitations to events and training activities, information concerning professional qualifications, information related to the handling requests from you and to managing some commercial activities.

Your personal data may be combined with other information we may already have about you and/or obtained through public means such as but not limited to scientific and medical publications, national registries and the Internet. To elect to have a review of this information please refer to the Contact Us Form.

For further information on how Celgene processes information of Health Care Professionals please see our Health Care Professional Privacy notice.

14. CHILDREN

Celgene web sites and mobile applications are not intended or designed for children under the age of 13. We do not collect personally identifiable information from any individual we know to be under the age of 13.

See section 12 “Information for Patients and Trial Participants” above for further information.

15. USE OF COOKIES/DO NOT TRACK

Celgene may use technology known as “cookies” and similar tracking technologies on our websites and other digital services, including geo-localization, on our websites and mobile applications. A cookie is a small data file that is placed on your device, which we use for the following purposes:

  • Making your experience more efficient, faster and easier: by remembering your preferences, like preferred language, display and other settings, maintaining your session, and for authentication purposes. This helps us to provide you with a better user experience. These cookies are also referred to as Session-Id cookies, authentication cookies, and User Interface customization cookies.
  • Gain useful knowledge about how the site is used: by collecting information about the number of visitors and other uses. This helps us improve our sites. These cookies are also referred to as analytics cookies. For this purpose, we use services such as Google analytics which means that Google and similar suppliers will also have access to this information (including your IP address and any other equipment identifiers such as the IMEI number and the MAC address).
  • Provide easy access to our social media sites. This helps us to direct you and share with you our content within sites such as Facebook, Twitter, LinkedIn, Google Plus, YouTube or Pinterest. These ‘social media plug-ins’ may store cookies and similar technology on your computer or other device. This means that the social media sites may access this information (including your IP address), may identify that you interacted with the Celgene site.

Your web browser can be set to manage cookies and even to reject them. Do bear in mind that if you set your browser to automatically reject cookies, your user experience when visiting websites will not be the same: your preferences may not be remembered, some functionality may be lost and you may not be able to access certain areas or features of the sites.

Please note that Celgene does not currently respond to “Do Not Track” browser settings. Celgene continues to review new technologies and may adopt a standard once one is created.

For more information about cookies, types of cookies and how to manage cookies, including how to block them and delete them, please visit http://www.allaboutcookies.org

16. CHANGES TO THIS PRIVACY POLICY

Celgene may update this policy from time to time by posting any revisions on www.celgene.com/celgene-privacy-policy/general-privacy-policy/. Where any material revisions are made, Celgene will directly notify individuals where and when legally required to do so, or may place a prominent notice on www.celgene.com/celgene-privacy-policy/

17. CONTACT US

If you have questions about this Privacy Policy, or to obtain more information about Celgene’s privacy practices, please contact us.

You can contact the European Data Protection Officer or Celgene’s Chief Privacy Officer, by completing the Privacy Contact Us or by postal mail at:

(for residents of the European Economic Area/Switzerland, Asia, Middle East, Africa)
European Data Protection Officer
Route de Perreux, 1
2017 Boudry
Switzerland

(for residents of USA, Canada)
Chief Privacy Officer
86 Morris Avenue
Summit, NJ 07901
United States

Last Updated: May 2018