Privacy Policy - Bristol Myers Squibb
General Privacy Notice
Click here to download or print a copy of this BMS general privacy notice.
If you are a healthcare professional, participant to a BMS clinical study or research project or an BMS employee, you can access our other notices here: HCP Privacy Notice | Research Participants Privacy Notice | Employee privacy notice
Our Commitment |
At Bristol Myers Squibb (BMS), your privacy matters to us. For us, data privacy goes beyond mere compliance with the law. BMS aims to collect, use, and share information that we obtain about you in a manner consistent with our company values, including high ethical standards, integrity, inclusion, fairness, and transparency. We have a dedicated internal team that reviews how BMS accesses, collects, uses, shares, stores, transfers, deletes and protects information about you. To safeguard your data, BMS employs reasonable and appropriate security measures. When upholding your rights as a data subject, you can contact us to respond to any questions you might have that are not answered in this Notice at eudpo@bms.com or as described below.
1. WHO WE ARE |
We are Bristol Myers Squibb Pharmaceuticals Limited (BMS), a company member of the Bristol Myers Squibb Company group. In addition to this Notice, our details (name, address, etc.) may have been given to you separately at the time of the collection of information about you, for example, in a form, an app or website notice, or in an e-mail, containing a link to this Notice. Together with our worldwide affiliates and other entities that are part of the BMS group which have a relationship with you, we are the controllers of your Personal Information. We refer to these entities as “BMS”, “we”, “us” or “our”. You can access the main locations of our entities and facilities, markets where we distribute our products and the countries where we operate on www.bms.com.
2. INTRODUCTION – HOW THIS NOTICE APPLIES TO YOU |
This general privacy notice (“Notice”) is a global Notice. It describes how Bristol Myers Squibb may Use information about you (“Personal Data” or “Personal Information”) when you interact with our company, in connection with your use of BMS websites, mobile applications, devices and platforms, when we communicate with you and in the context of our business activities. It also informs you about your privacy rights and the measures and processes we put in place to protect your data.
This Notice applies whether you are a patient, member of the public, visitor, shareholder or investor, member of a regulatory body or authority, supplier or business partner, job applicant, or any other individual with whom we engage or who is involved in our business activities. If you are an employee, please click here or use the link on the footer of our website on https://www.bms.com/gb.
In this Notice, we refer to you as “you” or “your”. We use the term “Processing” or “Use” when we refer to the access, collection, recording, organisation, structuring, retrieval, disclosure, storage, transfer, deletion or otherwise use of your Personal Information.
Compliance with applicable laws
When Using your Personal Information in the context of our activities, we will do so in compliance with relevant data privacy and data protection laws, which includes regulatory and national law requirements that may apply to such Use and, where applicable, giving you the specific rights that apply in the country where you reside (altogether “Applicable Data Protection Law”).
3. HOW WE USE YOUR INFORMATION ONLINE |
We may collect your Personal Information online when you use BMS or third-party operated websites and other online resources, including mobile applications, other digital means or platforms. This may also happen through collaborations that we have in place with third parties or companies that host websites for us or with whom we have partnerships for our products, services, or activities. Below, we give you additional information about how we use your information online.
You may interact with BMS or our partners’ websites and platforms that relate to BMS products and services, job application, patient recruitment, disease awareness, scientific research, alliance websites, or applications used in the context of patient support or management programs.
We enter into arrangements for those collaborations to require an appropriate protection of your Personal Information. Some areas of our websites and platforms may require you to submit information in order for BMS to respond to your request, permit you to access specific areas or participate in a particular activity. When visiting our websites, please also read our Legal Notice and if you are visiting our website for safety reasons, the Pharmacovigilance Notice.
We have identified examples where we Use your Personal Information online in the table below.
Online Information that we may collect when you use our sites |
|
---|---|
Contact information |
If you communicate with us through the "contact us" link on our sites, we may ask you for your Personal Information, such as your name, telephone number, professional information and e-mail address so that we can verify your identity, or respond to your questions and comments. |
Website features |
Our site offers various features, which we may change from time to time. We may ask you to submit certain Personal Information so we can communicate with you about these features and manage them properly. |
Contacting Medical Information or reporting an adverse event |
If you contact our medical information team (medinfo) or report an adverse event in relation to a BMS product, the information you provide (including your name, contact details, professional information and your questions) will be documented and retained on our databases for purposes of dealing with your enquiry and to comply with the law. |
Connections and authentication |
Some areas of our websites and platforms can be restricted. It may require you to log in with usernames, passwords and other authentication mechanisms that belong to you, that you create or that we provide you. When using such features, this may automatically allow us to access certain of your account credentials or other personal user account details to verify your identity or that you have a valid license to practice as a professional. |
Other uses of information |
We may Use the Personal Information you provide through BMS website or platforms for our internal purposes. These purposes include administration of the site, data analytics, compliance with our legal obligations or our internal policies and procedures. |
Cookies and similar tracking technologies |
When connecting to our various websites, applications, and other digital platforms, we may use cookies and other similar technologies that may allow us or third parties to collect Personal Information about you. Depending on the country where you reside, you may opt-in or opt-out from options or technologies that we use and display. Please read our section on cookies below for more information. |
Links to other third-party websites
As a convenience to users, our sites contain links to other third-party websites that may offer additional information, such as educational or professional materials, services and contacts. This Notice does not apply to your use of those other websites. Before using the linked websites, please review their privacy notices to understand how they use and protect your Personal Information.
4. WHAT INFORMATION WE MAY PROCESS ABOUT YOU |
The information that we Process about you may include various categories of Personal Data depending on your interactions with BMS, third parties with whom we collaborate, or external sources that provide us with your Personal Data. We have outlined below the main categories of Personal Information and, where applicable categories of sensitive Personal Information that we may collect about you.
Examples of general categories of Personal Information |
|
---|---|
Contact information |
Full name, personal or professional postal and/or email address, phone number and other contact details. |
Identification information |
Full name, initials, date of birth, photographs, or government-issued identification, such as driving licence, passport, professional licence number, or government ID number. |
Financial information |
Payment-related information, such as your bank address or account details and number, tax-related information for business purposes, or other information about you, your relatives, connections, your suppliers or third parties for example to verify the absence of conflicts of interest or to comply with anti-bribery laws. |
Professional information |
Job title, CVs and resume, educational information, professional qualifications, position, work experience, background checks, professional networks, programs, publications and activities, referrals and, other relevant professional information where needed. |
Categorization and classification data |
In some cases, we may classify, organise, rank, rate or create profiles relating to our audiences (for example, via our customer relationship management system or other similar tools). When doing so, those activities are conducted with human intervention by BMS staff or authorised third-party employees to capture:
You can read more about this activity in section 10 below. |
Sentiment analysis and analytics, social media and data from publicly available sources |
We may obtain information from publicly available sources, third-party service providers specialized in social media listening, or from the Internet to understand how the general public or influencers perceive our brand, products and activities. This may include collecting information about:
When conducting such activity, we do not make individual decisions on users unless we inform you otherwise. We have agreements in place with third parties to protect and limit information Used for this purpose to aggregate reports. If we need to specifically identify you, we will use reasonable efforts to inform you about our Use of your Personal Information. You can read more about this activity in section 10 below. |
Data from social media activities and monitoring
|
BMS uses social media channels to share important news about our research and commercial activities, programs, and initiatives to improve the life of patients. You may connect using your login details on such platforms or visit publicly available pages. When monitoring our channels, we may receive aggregate information or access Personal Information about you, such as your username, profile, and what you say, like or comment on our channel. When monitoring our channels, BMS may also receive information about potential adverse events about someone using a BMS product. If we identify or receive safety information about patients, we may be required to notify competent authorities about pharmacovigilance cases. You should consider carefully what information about yourself and others (such as colleagues, friends, customers, or patients) you choose to share when you use social media. If you need to report any concern about our products, we encourage you to contact us via our contact forms on our official BMS sites. Because the information you may share becomes public and often cannot be permanently erased on those platforms, we recommend that you do not report sensitive information, including health information through BMS social media platforms. We may provide additional notice and choices to you about how BMS may Use Personal Information on social media platforms, our websites and other online resources that we utilize. |
Information technology-related data |
The information we may collect might originate from your use of BMS’s sites, websites, mobile applications, and other connected devices (such as medical devices and Apps) and includes:
|
In some situations, we may collect sensitive Personal Information about you. When doing so, we apply stronger safeguards to protect your privacy. Depending upon the country in which you reside and the particular context for the collection of such Personal Information, this may include the following information:
Examples of special categories of data / sensitive Personal Information |
||
---|---|---|
General types of sensitive Personal Information |
|
|
Health information |
We may collect data relating to your health in limited contexts, which includes:
|
5. WHERE DO WE GET YOUR INFORMATION FROM |
In most cases, BMS will collect information directly from you, although sometimes we will obtain information from public or third-party information sources or from use of web-based, devices or other technologies which automatically generate such information. We have outlined below the main ways BMS collects and Processes Personal Data when interacting directly or indirectly with you.
We may collect information from you directly:
Such as when:
- we interact with you in the course of our activities or when you participate in a BMS activity, event or program (such as diversity and inclusion, ambassador or patient support programs);
- we collect information in the context of a specific treatment, such as for personalized medicines, using medical devices or digital platforms or applications;
- we engage service providers, business partners or institutions for services, collaborations or operations;
- you sign up to receive our communications to become a member of our databases or when registering to receive our press releases, e-mail alerts, marketing communications or more information about our activities;
- you share information with us through our various contact points, such as through our company products, commercial, clinical or alliance websites, mobile applications, contact forms, call centers, career application websites, during offices or manufacturing site visits, or for product inquiries;
- we collect information about you from your computer or other devices you use when visiting BMS’s website or mobile applications, or other products, our offices and facilities; or
- you share medical information with us relating to adverse events, pharmacovigilance or incidents involving devices or applications. These disclosures can be communicated in-person or remotely, including by calling us, or via our websites and other digital channels or means of communication.
We may collect Information about you indirectly:
Such as when:
- we receive information about you through a healthcare professional where necessary for pharmacovigilance, incident management, risk management, investigation, or litigation purposes;
- we obtain information that is accessible from public registries, databases, or other third-party sources, such as service providers, agencies or private organisations;
- you have made information about you publicly available on the Internet, including websites, social media platforms, scientific reviews, articles and publications and other sources, in which case we may either inform you, anonymize the data or get your prior consent;
- necessary to verify your credentials, professional information (such as by accessing publicly accessible information, national registries or third-party databases) or your identity for compliance, security or ID verification purposes;
- you make public posts on social media platforms that we follow (for example, so that we can understand public opinions); or
- conducting pharmacovigilance monitoring activities, or in the context of incidents or other post-market surveillance obligations.
We may also collect information about you automatically, such as for security and systems monitoring (e.g. through video (CCTV) recording) and building access control logs when you visit our offices or in other contexts made apparent to you at the time.
6. DATA MINIMIZATION |
Where permitted and feasible, and to protect your right to privacy, BMS will take reasonable steps to remove or anonymize information that may directly or indirectly identify you, and restrict to the minimum the amount of Personal Information that BMS Uses, submits or transfers to third parties, courts, or governmental bodies.
7. FOR WHAT PURPOSES DOES BMS PROCESS YOUR INFORMATION |
This is a global Notice. BMS Processes your information in the context of our regular activities, and in accordance with the purposes as set out in this Notice, a separate notice, or when Applicable Data Protection Laws either permit or require us to do so. These purposes may vary depending on where you live and where BMS operates. Where the laws of a country restrict or prohibit certain activities described in this Notice, we will comply with such requirements. This may include refraining or not Using your Information for those purposes restricted or prohibited in that country.
Below, we list some of the main, but not all, of our purposes for which we may Use Personal Information about you.
Main purposes for which BMS may Use your Personal Information |
|
---|---|
Contracting purposes |
We may Use Personal Information about you, your staff and third parties with whom you collaborate in the context of the services that you provide to us. Such Personal Information may include:
This includes obtaining Personal Information before, during and after we enter into a contract with your, your organisation and your staff. |
Collaboration and research purposes |
We may Use Personal Information about you when we partner with other organisations, including private or public alliances, institutions, regional or local discussions, or life science industry groups associations and consortiums. |
Patient advocacy and support programs |
When we exchange, interact or establish partnerships with service providers, local, regional or global patient advocacy associations or organisations, or other life sciences companies, including in the context of patient-related support or management programs. |
Providing innovative products, such as devices or personalized medicine |
As we develop and manufacture innovative therapies, we may Use Personal Information, which may include sensitive Personal Information about you when providing:
In this context, we may keep Personal Information, including health information, about you for manufacturing, quality or safety purposes. |
Managing BMS’s relationship with you |
For example, when we:
|
Commercial and marketing activities |
When conducting our business operations, we may interact with you in person or digitally or to improve our brand and products, such as through the following activities:
|
|
|
|
|
In the context of clinical operations, studies and programs |
BMS Uses limited Personal Information before, during and after we place a pharmaceutical product or a medical device on the market. This includes during our sponsored clinical trials and studies, such as for drug safety (pharmacovigilance), or incident or post-market surveillance monitoring (materiovigilance), or when interacting with authorities, regulatory agencies and bodies. We may also conduct real-world evidence activities in compliance with regulatory requirements. |
Job application |
When we Process professional information to assess individual's suitability for roles at BMS or collaboration purposes, such as when you apply on our career websites, through a job offer posted online or through agencies with whom we have partnerships. You can read more information in section 14 “Applying to work at BMS”. |
Patient recruitment activities and websites |
When we conduct in-person and activities to inform the general public, healthcare professionals and patients about our diseases, upcoming medicines and treatments or studies that may enable individuals to apply to such clinical trials or studies that we conduct. |
Regulatory and compliance |
When we Process information to comply with regulatory obligations particularly where they relate to drug safety and risk management obligations, and obligations related to spend-transparency and similar requirements specific to the pharmaceutical sector. |
Investigations, prosecutions or defence of legal claims |
For example, we may have to keep, preserve Personal Information about you in order to protect our rights, or for the protection of third-party rights. In certain situations, we may have to submit or transfer such information third parties, courts, or governmental bodies including outside your country of residence. Where permitted and feasible, and to protect your right to privacy, BMS will take reasonable steps to remove or anonymize information that may directly or indirectly identify you and restrict to the minimum the amount of Personal Information that BMS submits or transfers to third parties, courts, or governmental bodies. |
Other purposes: BMS will Process your Personal Information for other purposes, where permitted or when required such as reporting information for BMS’s risk management and drug safety obligations. |
8. HOW BMS JUSTIFIES USING YOUR INFORMATION |
In this section, we describe our legal justifications (commonly referred to as “legal basis”) for the Use of your Personal Information related to each of our main Processing activities. We will use the legal basis that is most appropriate for the purpose and circumstances related to such Processing. Below, we have explained which legal bases we may choose or have to use when Using your Personal Information.
There may be times where we must use your consent to Process your Personal Information. We may also decide to ask your permission to Process your Personal Data, such as in the context of voluntary initiatives or activities.
In the following table, you can read more details about what legal basis or combination of legal bases we use when Processing your Personal Information.
Our legal bases |
Examples of activities that we conduct with your Personal Information |
---|---|
We may use our legitimate business interest or private interest to Process your Personal Information for |
|
When we rely on our contractual relationship with you |
when Using Personal Information about you, your staff, suppliers and third parties with whom you collaborate, for example to:
|
To comply with applicable laws |
We may Use your Personal Information, including keeping or sharing it with authorities as required or when allowed by Applicable Data Protection Laws, such as to:
|
We use the public interest |
when the law of your country enables us to rely on it, in particular in situations that will be of significant public interest, such as for:
|
We may use your Vital interests |
In limited situations, BMS may have to collect information, which includes the use of sensitive Personal Data about you to protect your life or against incidents or other threats. |
Other legal exceptions |
In some instances, the law of your country may allow BMS to use a legal exception. This may apply, for example, when Using your health data to conduct research projects or to ensure high standards of quality and safety of health care and of medicinal products or medical devices. |
With your consent |
We may use your prior permission when the law of your country requires us to do so, for example to Use your Personal Information, disclose it, transfer it to, or share it with, third parties, including outside your country of residence. In other instances, we may require your prior consent:
|
9. WITH WHOM DO WE SHARE YOUR INFORMATION |
As a multinational company operating worldwide, your Personal Information may be shared with, or accessed by, parties located outside your country of residence. If you are located outside of the United States, BMS may share your Personal Information with parties located in countries that provide less protection than in your country, which includes the United States. We may also Process and share your Personal Information with some of our affiliates and other members of the BMS group including selected and approved third parties (vendors and business partners) that help us operate worldwide. When doing so, we implement appropriate measures to prevent unauthorised access or Use of your Personal Information.
Below you can find more information about how BMS shares your Personal Information within its group of entities and with third parties.
Sharing your Personal Information within the BMS group
Often, we share your Personal Information within the BMS group of companies (“BMS Group”). This may include the Bristol Myers Squibb Company headquarters in the United States and all of its current and future subsidiaries, branch offices, affiliates, entities and other companies that are part of, owned or controlled by, the BMS Group. When exchanging information internally, we rely on appropriate arrangements and mechanisms to cover any transfer of your Personal Information within our corporate structure, such as binding corporate rules (BCRs), contractual arrangements approved by authorities or based on consent.
Sharing your Personal Information with third parties
To conduct our business, we share with, or disclose Personal Information to, third parties, such as:
- Third-party service providers for the purpose of outsourcing specific business activities to request external support and resources. This may include companies that provide information technology services, clinical trials and studies support, marketing or market research services, events, meeting and planning services, or services related to talent acquisition or consultancy;
- business partners such as external scientists and healthcare professionals to review and assist us with healthcare compliance activities and institutions and other organisations with whom we collaborate to support our clinical or commercial activities (such as for clinical studies, patient support programs, and so on);
- Regulatory and health authorities including governmental bodies (such as the FDA, EMA, NHS), data protection authorities, tax authorities, or courts in case of disputes, when permitted or required by Applicable Data Protection Law; and
- third parties to whom BMS is legally obligated to provide such information, such as other parties in litigation or legal disputes, guardians, conservators, or individuals with powers of attorney.
When engaging with third parties, we enter into agreements with them for the Processing of Personal Data so that such Processing is carried out in accordance with our instructions, in a confidential, secure, and transparent manner in order to protect your privacy rights. When it is not possible to enter into an agreement with a third party, such as when engaging, reporting or interacting with regulatory or health authorities or courts, and when legally possible, we will use our best efforts to implement appropriate security measures and controls (such as pseudonymisation) to protect your Personal Information.
If you are in the European Economic Area (“EEA”), Switzerland and the United Kingdom
Whenever we transfer your Personal Information within the EEA, Switzerland or to countries that are deemed “adequate”, such countries are deemed to offer the same level of protection as given by the law of your country. When accessing your Personal Data from, or transferring it, outside of the EEA or Switzerland to countries that may not provide the same level of protection as your own country, we will use appropriate safeguards to protect your right to privacy. For example, such safeguards may consist of using Standard Contractual Clauses (to exchange information with third parties outside of the EEA, Switzerland and the United Kingdom), Binding Corporate Rules (for data transfer within the BMS group of companies) as approved by the European Commission or the competent authority, data transfer agreements or your consent. |
If you are outside the EEA, Switzerland and the United Kingdom
Where possible, we will allow access to or the transfer of your Personal Information outside your country of residence:
|
10. AUTOMATED DECISION-MAKING AND INDIVIDUALS’ RIGHTS |
Unless permitted by law, BMS does not make decisions based solely on automated Processing (including profiling) of individual data unless we inform you otherwise prior to the Processing. We may use algorithms that will enable us to use automated decision-making, including to create profiles. This means that when we use certain technologies, software or algorithms, which may allow us to create profiles, tiering, further understand trends and statistics or use other advanced technologies or automated processing, someone will be involved to validate decisions resulting from such use.
As the use of such technologies evolves, we may use algorithms without a person involved in the decision. In this case, if this activity requires us to Process your Personal Information that is not anonymized, we will comply with any applicable legal requirements, such as to draw this to your attention and provide you with information about the logic involved in the decision, as well as the significance and the envisaged consequences for you of such Use of your Personal Information. Depending on your country of residence, you will have the right to ask that such decision is taken by an individual.
11. WHAT ARE MY RIGHTS AND HOW TO EXERCISE THEM |
You have a number of rights related to the Personal Data that we Process about you (this will depend on the jurisdiction where you reside and the legal basis that we use). Most often, exercising your right is free of charge. We may also have to clarify your request and explain if we can comply with it or if this is restricted in your situation. You can always contact BMS at eudpo@bms.com to find out more about your rights and how best to exercise them.
Below we have listed individual rights that may apply depending on your jurisdiction.
You may have the right to:
- receive a copy of your Personal Data we hold about you;
- correct your Personal Data we hold about you;
- where applicable, receive a machine-readable copy of your Personal Data (portability);
- ask us to delete your Personal Data or restrict how it is used;
- where applicable, object to Processing of your Personal Data for certain purposes, such as when we use it for marketing purposes (opt-out); and
- where you have provided us with your consent to Use your Personal Data, you can withdraw your consent at any time without affecting BMS’ Use of such information before your withdrawal of consent.
Exceptions to your rights
There may be exceptions to your privacy rights described in this Notice. This depends on the country where you reside, why we are Processing your Personal Data and if your request may impair the rights of others. If we cannot comply with your request to exercise your privacy rights, for example when we keep your information for regulatory purposes or for the investigation, prosecution, or defence of a legal claim, we will explain this to you when you contact us.
Example
If you ask BMS to stop sending you marketing communications by e-mail, we may keep your e-mail address and other contact details in case we conduct other activities with you, such as when we have a contract with you or if we have a legal or a regulatory obligation to keep your contact details.How to contact us
If you have any questions about how we Use your Personal Information, please contact our Data Protection Office at eudpo@bms.com.
Note: We may need to request specific information from you to help us confirm your identity. If your request is complex or if you have made a large number of requests, it may take us longer to respond to you, but we will keep you informed of any delays. You will not have to pay a fee to obtain a copy of your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
Lodging a complaint with the Information Commissioner's Office
In some countries, you may have the right to lodge a complaint to the relevant data protection or competent authority if you believe that we Process your Personal Information unlawfully or are violating your rights. For example, in the United Kingdom, if you feel that we have been unable to resolve your information rights concern, you have the right to raise the matter with the Information Commissioner's Office by using their live chat service or calling their helpline on 0303 123 1113.
12. HOW LONG WE RETAIN YOUR INFORMATION |
We aim not to retain your Personal Information for longer than necessary for the specific business purposes for which it was collected. After that, unless we are required to continue to maintain the information by law, we may anonymize, restrict, block or delete it.
In certain cases, BMS may retain your Personal Information for a longer period for the purpose that we have and, in a manner, or a format, that may require BMS to keep certain identifiers. In such case, we may archive it and apply appropriate measures which may consist of blocking, preventing, obfuscating, pseudonymizing, key-coding, or restricting any further access and Use of Personal Information about you. When retaining and storing information about you in our systems, we have put in place data retention schedules in accordance with our company policy and in compliance with Applicable Data Protection Laws.
When assessing the appropriate retention period, we take into account the quantity, nature and sensitivity of Personal Data, the potential risk of harm in the event of unauthorised use or disclosure, the purposes of the Processing and whether or not these purposes can be achieved by other means, as well as applicable legal obligations.
13. HOW DO WE PROTECT YOUR INFORMATION |
We implement appropriate technical and organisational controls to protect your Personal Information that we hold to prevent unauthorised Processing, loss of data, disclosure, use, alteration, or destruction. Where appropriate, we use encryption, pseudonymisation (such as key coding), de-identification and other technologies that can assist us in securing the information about you, including measures to restore access to your information. We also require our service providers to comply with reasonable and recognized data privacy and security requirements.
We conduct tests and reviews of our technologies and processes, including a review of our business partners and vendors, so that our security controls remain effective. Also, we may further anonymize your Personal Information when it is no longer needed for the purpose for which BMS originally collected such Information.
14. APPLYING TO WORK AT BMS |
BMS may Process your Personal Data to evaluate your application to work at BMS. When applying for an opportunity at BMS, we may collect and Process Personal Information about you directly or indirectly from our official websites, third parties or when you make this information publicly available or accessible by third parties for recruitment purposes. You can consult our career opportunities on this page: https://careers.bms.com/gb. Below, you can find more information about how BMS Processes your Personal Information when you apply to work for us.
To consider your application we may collect:
- your professional experience, such as job title, education information, professional qualifications, work experience, publications, and professional networks, programs and activities in which you participated;
- your contact details, such as your e-mail address, full name, date of birth and other information necessary to submit your application;
- information gathered from agencies, such as information from recruitment agencies, reference providers, and (where permitted by law) background screening providers;
- publicly available information from a company website, internet searches or social media platforms such as LinkedIn or other social media platforms, and publicly available profile information (such as your experience, skills, and interests);
- information that you allow us to access, for example, if you choose to simplify your login Process to the job platform to allow direct access once you have signed in to your third party social media user account, (such as Gmail or Yahoo!), or if you want to upload information to the platform (such as from LinkedIn) instead of manually completing an application; and
- other information that you submit to us, that we obtain indirectly or that we access when looking for new hires or career opportunities.
As your job application proceeds
We may ask you to share additional Personal Information with us, such as:
- official information, such as government issued identification number or tax status;
- financial information, such as bank account details;
- special categories of Personal Data / sensitive Personal Data, including (where it is permitted, necessary or required for your application) information about your health, marital status, trade union membership religion, criminal records, or credit worthiness data; or
- other information necessary for your interview or providing you with a job offer, such as details of any known disability or workplace accessibility needs, background information, travel and expenses, performance management, emergency contact details, compensation, hours of work, holidays and benefits-related information.
Where do we Use your Personal Information for job application
As a multinational organisation, our affiliates transfer information globally. When you upload information to a job search platform, you provide it to all our affiliates, each of which may Process it for its own recruitment purposes. This is the case even where you respond to a job posting that mentions a particular BMS affiliate. Accordingly, we may transfer globally information about you (for example, if you are in the European Economic Area ("EEA"), your information may be transferred outside the EEA; if you are in Australia, your information may be transferred outside Australia).
We will not keep your Personal Information for longer than needed to consider your application. However, we may ask your permission to keep some information about you for a longer period (for example your CV or resume, work experience, cover letters and so on) to consider your eligibility for further job opportunities.
15. WHAT INFORMATION DO WE COLLECT ABOUT OUR PATIENTS |
BMS Processes Personal Information about patients that use our treatments and in the context of our clinical research activities. We may also Use patient Personal Information in connection with certain activities, such as through our services, patient websites, collaborations or consortium agreements with third parties (for example genetic data), during events interviews, for advocacy related activities, or for clinical trials, studies or research projects linked to our products (for example to recruit you through our websites or business partners).
Note, this section, together with this Notice, does not apply to participants to clinical trials.
This Notice applies to how BMS may Use Personal Information about you when you participate in non-clinical activities. You can read our specific Patient privacy notice if you are involved in a research project, clinical trial or in a study. Below, you will find out more information about Personal Data that we collect about patients in contexts other than clinical studies or research projects.
Patients participating in non-clinical research activities with BMS
In the context of non-clinical research activities, BMS generally does not collect patient data, except in certain occasions, such as where we have reporting obligations to authorities, when we engage directly with you, via third parties, when you contact us, when accessing websites or other platforms, or if you agree to share such information with us. In some instances, we may have interactions with you or access information about you outside of our clinical research activities. This may happen when:
- accessing our personalized medicines, other innovative therapies or devices;
- BMS collaborates with patient organisations;
- we recruit you for our clinical studies;
- inviting you to our events;
- we propose patient support programs; or
- when conducting surveys, market research, interviews or propose ambassador programs.
When doing so, BMS will either collect information that does not allow us to identify you or use technical measures to limit the risk of identification. For example, we may use measures that could include:
- replacing your information such as name, identification number or any other information with a code (key-coded study data);
- using a third party provider who will only share your Personal Information in an aggregate manner with BMS;
- anonymizing your Personal Information after its collection; or
- requesting your prior consent.
If BMS accesses Personal Information about you that is sensitive, we will protect it adequately. For more information about our Use of sensitive data, please refer to section 4.
16. CHILDREN |
BMS websites and mobile applications are not intended or designed for children under the age of 13. Depending on the country where you reside, you may not use this website under the age of 16 or 18. We do not collect information from any individual we know to be under the age of 13 (or older if your country is more restrictive). Please refer to our Research Participants Privacy Notice for further information relating to non-adults participation to our studies.
17. COOKIES AND TRACKING TECHNOLOGIES |
Depending on the country where you reside, you may manage your preferences on cookies and similar tracking technologies through the use of consent management tools that are available on our websites. This section applies to cookies and similar tracking technologies and we explain what our use of cookies and similar tracking technologies means to you and how to disable tracking (such as using opt-in or opt-out preferences). When we collect information that may enable us to identify you, the other sections of this Notice will apply.
You can set your cookie preferences by clicking here.
What are cookies?
A cookie is a small piece of data that a website asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Such cookies when set by us are called first-party cookies. We may also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting (for example, those used by social media, instant messaging, CRM or marketing platforms, or advertising companies). For more information about cookies, types of cookies and how to manage cookies, including how to block them and delete them, please visit http://www.allaboutcookies.org.
Below, we list the main categories of cookies and similar tracking technologies that we may use when you connect to our websites, use our web-based platforms, applications, devices, or when you interact with us electronically or when you receive electronic communications from us (“Online Use”). You can learn more about the purposes for which BMS may use such technologies for your Online Use.
What categories of cookies may BMS use?
We generally use certain types of cookies during your session on our website (“session cookies”). To improve your experience or remember your preferences or choices, we may use cookies that will remain on your device unless you remove them (“persistent cookies”). When using cookies on our websites and other digital services, such technology may include:
Categories of cookies and tracking technologies that BMS may use |
|
---|---|
Strictly necessary cookies (“required”) |
Those cookies and tracking technologies enable our websites to operate and to improve the security of our website for your Online use, such as when you have to authenticate or use login functionalities to access restricted parts of our websites (such as using patient or physician login or page selection to restricted pages or areas of a website or application). |
Performance cookies |
Those cookies may allow BMS to:
|
Social media cookies |
On certain BMS websites, we may use social media plugins for you to share interesting content or to connect to certain accounts to share your Personal Information with us. Such platforms may access your history of navigation and collect information about your browsing journey under their own terms. You can access more information when connecting to our sites. |
Analytics cookies |
These cookies enable us to better know the use of our websites, establish statistics on their uses and visits (e.g. information on each visited page, how long a user navigates on a specific page, how long it takes to download a specific page, what are the users’ actions on each page (click, selection, etc.). |
Other tracking technologies |
When using third-party software or websites, mobile applications, devices, web-based platforms or through other Online use, the technology may involve certain built-in tracking technologies. This may include:
|
Why do we use cookies on our website?
In addition to the explanation provided in this Notice and the section above, we use cookies or similar tracking technologies in various instances, such as for the following purposes:
- Making your experience more efficient, faster and easier: by remembering your preferences, like preferred language, display and other settings, maintaining your session, and for authentication purposes. This helps us to provide you with a better user experience. These cookies are also referred to as Session-Id cookies, authentication cookies, and User Interface customization cookies.
- Gain useful knowledge about how the site is used: by collecting information about the number of visitors and other uses. This helps us improve our sites. These cookies are also referred to as analytics cookies. For this purpose, we use services such as Google Analytics which means that Google and similar suppliers will also have access to this information (including your IP address and any other equipment identifiers such as the IMEI number and the MAC address).
- Provide easy access to our websites. This helps us to direct you, share with you our content within sites such as Facebook, Twitter, LinkedIn, YouTube or Pinterest or allow you to share content that is of your interest. To the extent we use such technology, these ‘social media plug-ins’ may store cookies and similar technology on your computer or other device. This means that the social media sites may access this information (including your IP address), may identify that you interacted with the BMS site.
- Improve our marketing communications to you. Certain cookies, such as web beacons or tracking pixels, may be used by third party systems, such as customer relationship management systems or other service providers who help us manage e-mail campaigns. Those trackers enable us to better understand the success of our communications and the relevance of the content that we share with you. This may allow us to reduce the number of e-mails that we send you and provide you with content, scientific information, or initiatives that are more tailored to your interests.
How can you object or refuse cookies?
Subject to the law of your country, in particular in the European Union, we will either inform you, ask your prior permission (opt-in) before placing tracking technologies on your device, or provide you with a right to object (opt-out) for the purposes that we describe in this section. Your web browser, e-mail software (such as Microsoft outlook, or Google Gmail) and other clients that you use can be set to manage cookies and similar trackers and even reject them by default. Do bear in mind that if you set your browser to automatically reject cookies, your user experience when visiting websites will not be the same: your preferences may not be remembered, some functionality may be lost and you may not be able to access certain areas or features of the sites.
For more details on the cookies that we use, you can read our cookie table below or, where applicable, on the website that you use by accessing the relevant cookie notice.
18. CHANGES TO THIS PRIVACY NOTICE |
BMS may update this notice from time to time by posting any revisions on this website. Where any material revisions are made, BMS may place a prominent notice on this website and when legally required to do so, will directly notify you.
19. CONTACT US |
If you have questions about this Notice, or want to obtain more information about our privacy practices, please contact our Data Protection Officer at eudpo@bms.com or contact us by postal mail at:
Contact |
Name of the affiliate |
---|---|
To contact BMS |
Bristol Myers Squibb Pharmaceuticals Limited ARC Uxbridge, Sanderson Road |
European Data Protection Officer |
Data Protection Officer eudpo@bms.com |
UK Data Protection Representative |
Bristol-Myers Squibb Pharmaceuticals Limited ARC Uxbridge, Sanderson Road |
Healthcare Professionals Privacy Notice
Click here to download or print a copy of this BMS Healthcare Professionals Privacy Notice.
If you are a participant to a BMS clinical study or research project, you can access our Research Participants Privacy Notice or here: https://www.bms.com/gb/privacy-policy.html#studypatient.
Our Commitment |
At Bristol Myers Squibb (BMS), your privacy matters to us. For us, data privacy goes beyond mere compliance with the law. BMS aims to collect, use, and share information that we obtain about you in a manner consistent with our company values, including high ethical standards, integrity, inclusion, fairness, and transparency. We have a dedicated internal team that reviews how BMS accesses, collects, uses, shares, stores, transfers, deletes and protects information about you. To safeguard your data, BMS employs reasonable and appropriate security measures. When upholding your rights as a data subject, you can contact us to respond to any questions you might have that are not answered in this Notice at eudpo@bms.com or as described below.
1. WHO WE ARE |
We are Bristol Myers Squibb Pharmaceuticals Limited (BMS), a company member of the Bristol Myers Squibb Company group. In addition to this Notice, our details (name, address, etc.) may have been given to you separately at the time of the collection of information about you, for example, in a form, a notice on an app or a website, or in an e-mail, containing a link to this Notice. Together with our worldwide affiliates and other entities that are part of the BMS group which have a relationship with you, we are the controllers of your Personal Information. We refer to these entities as “BMS”, “we”, “us” or “our”.
You can access the main locations of our entities, facilities, our markets where we distribute our products and the countries where we operate on www.bms.com or at the following addresses.
2. INTRODUCTION – HOW THIS NOTICE APPLIES TO YOU |
This privacy notice (“Notice”) describes how Bristol Myers Squibb uses information about you (“Personal Data” or “Personal Information”) as a healthcare professionals, medical professional, personnel and staff of healthcare institutions (such as statisticians, pharmacists, representatives of hospitals, clinicals, universities), government authorities, non-profit organisations, key opinion leaders or influencers, with whom we interact (altogether “HCPs”, “you”, “your”). This Notice applies when you interact with our company, and in the context of our business activities. It also informs you about the measures and processes that we put in place to protect your data. We use the term “Processing” or “Use” when we refer to the access, collection, recording, organisation, structuring, retrieval, disclosure, storage, transfer, deletion or otherwise use of your Personal Information.
Compliance with applicable laws
When Using your Personal Information in the context of our activities, we will do so in compliance with relevant data privacy and data protection laws, which includes regulatory and national law requirements that may apply to such Use and, where applicable, giving you the specific rights that apply in the country where you reside (altogether “Applicable Data Protection Law”).
3. HOW WE USE YOUR INFORMATION ONLINE |
We may collect your Personal Information online when you use BMS or third-party operated websites and other online resources, including mobile applications, other digital means or platforms. This may also happen through collaborations that we have in place with third parties or companies that host websites for us or with whom we have partnerships for our products, services, or activities. Below, we give you additional information about how we use your information online.
You may interact with BMS or our partners’ websites and platforms that relate to BMS products and services, job application, patient recruitment, disease awareness, scientific research, alliance websites, or applications used in the context of patient support or management programs.
We enter into arrangements for those collaborations to require an appropriate protection of your Personal Information. Some areas of our websites and platforms may require you to submit information in order for BMS to respond to your request, permit you to access specific areas or participate in a particular activity. When visiting our websites, please also read our Legal Notice and if you are visiting our website for safety reasons, the Pharmacovigilance Notice.
We have identified examples where we Use your Personal Information online in the table below.
Online Information that we may collect when you use our sites |
|
---|---|
Contact information |
If you communicate with us through the "contact us" link on our sites, we may ask you for your Personal Information, such as your name, telephone number, professional information and e-mail address so that we can verify your identity, or respond to your questions and comments. |
Website features |
Our site offers various features, which we may change from time to time. We may ask you to submit certain Personal Information so we can communicate with you about these features and manage them properly. |
Contacting Medical Information or reporting an adverse event |
If you contact our medical information team (medinfo) or report an adverse event in relation to a BMS product, the information you provide (including your name, contact details, professional information and your questions) will be documented and retained on our databases for purposes of dealing with your enquiry and to comply with the law. |
Connections and authentication |
Some areas of our websites and platforms can be restricted. It may require you to log in with usernames, passwords and other authentication mechanisms that belong to you, that you create or that we provide you. When using such features, this may automatically allow us to access certain of your account credentials or other personal user account details to verify your identity or that you have a valid licence to practice as a professional. |
Other uses of information |
We may Use the Personal Information you provide through BMS website or platforms for our internal purposes. These purposes include administration of the site, data analytics, compliance with our legal obligations or our internal policies and procedures. |
Cookies and similar tracking technologies |
When connecting to our various websites, applications, and other digital platforms, we may use cookies and other similar technologies that may allow us or third parties to collect Personal Information about you. Depending on the country where you reside, you may opt-in or opt-out from options or technologies that we use and display. Please read our cookie section below for more information. |
Links to other third-party websites
As a convenience to users, our sites contain links to other third-party websites that may offer additional information, such as educational or professional materials, services and contacts. This Notice does not apply to your use of those other websites. Before using the linked websites, please review their privacy notices to understand how they use and protect your Personal Information.
4. WHAT INFORMATION WE MAY PROCESS ABOUT YOU |
We interact with you as an HCP and Use information about you during our activities, such as to conduct clinical trials, for collaborations or commercial activities, for scientific projects, to understand the market or improve our medicines and products. When doing so we may Process various categories of Personal Information depending on your interactions with BMS or third parties with whom we collaborate, or external sources from where we obtain your Personal Data. We have outlined below the main categories of Personal Information about you that we may Use.
Examples of general categories of Personal Information |
|
---|---|
Contact information |
Full name, postal and/or email address, phone number and other contact details about you, your organisation, or staff. Example: We may use your contact details, in particular when you interact or work with us, when we communicate with you or share news, materials or invite you to participate in our activities. |
Identification information |
Full name, initials, date of birth, photographs, or government-issued identification, such as driving licence, passport, professional licence number, or government ID number. Example: To provide you with information on our products or diseases, we may verify your license to practice in your specialisation area (for example through our internal platforms or third party services. |
Financial information |
Payment-related information, such as your bank address or account details and number, tax-related information for business purposes, or other information about you, your relatives, connections, your suppliers or third parties. Example: We Use such data to verify the absence of conflicts of interest, conduct due diligence, to comply with anti-bribery laws, for billing purposes when you collaborate with us, participate in advisory boards or render services to us. |
Your professional and background information |
Such information may include for example your:
Examples: We use such information to engage or work with you when BMS evaluates the feasibility of a clinical study in a healthcare organisation where you work or with whom you collaborate, when we use your publications, organise or invite you to expert panels and advisory boards or when we get your data from databases or other available sources. |
Spend transparency information |
Such information may include:
Depending on the country where you reside, BMS Uses and discloses such information based on your consent, transparency codes, the law or our legitimate interest to conduct our regular business activities. This information is generally made publicly available on our official BMS websites. |
Categorization and classification data |
In some cases, we may Use your Personal Information in order to classify, organise, rank or otherwise create profiles relating to you as a healthcare professional, key opinion leader or as an influencer. This activity may include collecting data about:
Example: We may process such information via certain software, our customer relationship management system (CRM) or other analytics tools. You can read more about this activity in section 10 below. |
Publicly available data or data accessible from databases
|
We may obtain information about you from publicly available sources, public or private registries, or databases. When obtaining such information, we may Use your professional contact, identification information and other professional and background information for pharmacovigilance reporting purposes and, for example, to create categories or classifications based on your area of specialization, assess if your site is qualified for a clinical study, to personalize your e-mails and provide relevant scientific or interact with you in the most efficient and relevant manner. |
Media data and your image rights |
We may Use media content, that may include Personal Information about you, such as your pictures, photographs, audio or video recordings. Example: Such content may originate from events, programs, interviews or other initiatives that we organise. |
Information technology-related data | When using the internet, websites, devices or platforms, we may collect data, including metadata, that originates from your use of BMS’s sites, websites, mobile applications, social media channels and other connected devices (such as medical devices and Apps). This may include:
To read more about our Use of such information, read our cookie section. |
Special category / sensitive Personal Data (if permitted or required by law) | In limited circumstances, we may collect data concerning your health or sensitive Personal Information about you, such as:
|
Other categories of Personal Data | For more categories of Personal Data that we may collect about you, you can read our general privacy notice. |
5. WHERE DO WE GET YOUR INFORMATION FROM |
In many cases, BMS will collect Personal Information directly from you (such as when we collaborate with you) although sometimes we will obtain information about you indirectly from public or third-party information sources, databases or third-party providers. We have outlined below the main ways BMS collects and Processes Personal Data when interacting directly or indirectly with you.
We may collect information about you directly:
Such as when:
- we conduct clinical trials, studies, research projects;
- we enable early access programs to patients or when you request us to provide patients with a BMS product at an early stage, or for compassionate use;
- we provide innovative products or devices to patients, such as cell therapies or personalized medicines;
- you use or visit about offices and facilities;
- you connect to or use our websites, applications, devices or other digital platforms in the context of clinical or commercial activities;
- you contact us through our different means of communication (email, call centers, medical information), such as to obtain information about BMS products, diseases or treatments;
- you notify, or report medical information to, BMS that may relate to adverse events or incidents, in the context of pharmacovigilance or risk management programs via other similar channels (via pharmacovigilance or risk management touch points), which may include incidents or other post-market surveillance obligation;
- we exchange or when you request, information before entering into a contract with you, and thereafter during the term of such arrangement;
- we conduct due diligence, assessments, or when we evaluate your institutions’ eligibility to conduct a clinical study and thereafter if we select your institution;
- you interact with our BMS representatives in the course of our activities and interactions with you;
- you subscribe to our newsletters or want to remain informed about our activities or collaboration opportunities or where the law requires it, you agree to receive promotional materials; or
- we conduct in-person or remote visits or exchange information with you about our products and activities.
We may collect Information about you indirectly:
- when obtaining it from, or when you make your Personal Information available on, the website of your institution or your office, the Internet, social media, and other digital platforms;
- when we access public or private registries, or publication databases, journals, societies, editorial board websites, national registries, professional directories and third-party HCP databases;
- when conducting pharmacovigilance and risk management monitoring activities; or
- when we need to verify or obtain verification from third parties about your professional status, medical licence, such as by accessing publicly accessible information, national registries or third-party databases.
6. DATA MINIMIZATION |
Where permitted and feasible, and to protect your right to privacy, BMS will take reasonable steps to remove or anonymize information that may directly or indirectly identify you, and restrict to the minimum the amount of Personal Information that BMS Uses, submits or transfers to third parties, courts, or governmental bodies.
7. FOR WHAT PURPOSES DOES BMS PROCESS YOUR INFORMATION |
This is a global Notice. BMS Processes your information in the context of our regular activities, and in accordance with the purposes as set out in this Notice, a separate notice, or when Applicable Data Protection Laws either permit or require us to do so. These purposes may vary depending on where you live and where BMS operates. Where the laws of a country restrict or prohibit certain activities described in this Notice, we will comply with such requirements. This may include refraining or not Using your Information for those purposes restricted or prohibited in that country. Below, we list some of the main, but not all, of our purposes for which we may Use Personal Information about you.
Main purposes for which BMS Uses your Personal Information |
|
---|---|
For collaborations and research purposes |
We Use your Personal Information in that context for example:
|
To manage our relationship with you as an HCP |
|
In the context of events and congresses | We Use your Personal Data for events and congresses, in particular:
When conducting these activities, we comply with applicable codes of conducts, laws and regulations that may prohibit certain types of promotional activities. |
To support and improve our products and medicines or how you deliver healthcare | Those activities may include when we:
These activities allow us to better understand how to improve the safety and quality of our products, the way you provide healthcare to your patients. |
Using your data in the context of our clinical operations | Our clinical activities may include:
|
Marketing, commercial and interest-based communications | We conduct this activity when BMS or other third parties engage with you remotely or via digital means, in-person or through newsletters on:
When sending such communication to you, we may personalize such content to your professional area and interests. You can read more in our cookies section. |
Categorization and classification purposes | Categorisation and classification enable us to engage with you, invite you to speak to ad-boards or propose collaborations with us. This may include:
You can read more information in our section 10 below. |
We comply with legal, industry best practices and ethical obligations or codes of conducts | Using Personal Information about you when we:
|
Achieve strategic and research purposes
|
For example, when we engage with Key Opinion Leaders or influencers to enable us to make more informed and objective decisions or in the context of scientific research. |
Communicate with you in the context of our business operations
|
For example, communications, with the individuals, entities, and institutions in the context of our business activities, including to provide training courses and awareness about our products. |
Conduct security, fraud or crime detection and prevention programs
|
For example, to ensure security and confidentiality of your data, ensuring a safe environment at our events, facilities, or networks. |
Investigations, prosecutions, or defence of legal claims
|
When keeping and preserving information about you in order to protect our rights, or for the protection of third-party rights. In certain situations, we may have to submit or transfer such information to third parties, courts, or governmental bodies. Where permitted and feasible, and to protect your right to privacy, BMS will take reasonable steps to remove or anonymize information that may directly or indirectly identify you, and restrict to the minimum the amount of Personal Information that BMS submits or transfers to third parties, courts, or governmental bodies. |
Any other purpose that is relevant in the relationship between Bristol Myers Squibb and HCPs. |
8. HOW BMS JUSTIFIES USING YOUR INFORMATION |
In this section, we describe our legal justifications (commonly referred to as “legal basis”) for the Use of your Personal Information related to each of our main Processing activities. We will use the legal basis that is most appropriate for the purpose and circumstances related to such Processing. Below, we have explained which legal bases we may choose or must use when Processing your Personal Information.
There may be times where we must use your consent to Process your Personal Information. We may also decide to ask your permission to Process your Personal Data, such as in the context of voluntary initiatives or activities.
In the following table, you can read more details about what legal basis or combination of legal bases we use when Processing your Personal Information.
Our legal bases |
Examples of activities that we conduct with your Personal Information |
---|---|
We use our legitimate business or private interest |
In the context of our clinical and commercial activities, and depending on the law of your country of residence, we may rely on this legal basis:
|
Based on the contractual relationship with you |
We Use and keep your Personal Information for example:
|
To comply with applicable laws |
We may Use your Personal Information, including keeping or sharing it with authorities when permitted or as required or when allowed by Applicable Data Protection Laws, such as:
|
With your consent |
We may use your prior permission when the law of your country requires us to do so, for example to Use your Personal Information, disclose it, transfer it to, or share it with, third parties, including outside your country of residence. In other instances, we may require your prior consent, or provide you with a right to object for example when:
|
9. WITH WHOM DO WE SHARE YOUR INFORMATION |
As a multinational company operating worldwide, your Personal Information may be shared with, or accessed by, parties located outside your country of residence. If you are located outside of the United States, BMS may share your Personal Information with parties located in countries that provide less protection than in your country, which includes the United States. We may also Process and share your Personal Information with some of our affiliates and other members of the BMS group including selected and approved third parties (vendors and business partners) that help us operate worldwide. When doing so, we implement appropriate measures to prevent unauthorised access or Use of your Personal Information.
Below you can find more information about how BMS shares your Personal Information within its group of entities and with third parties.
Sharing your Personal Information within the BMS group
Often, we share your Personal Information within the BMS group of companies (“BMS Group”). This may include the Bristol Myers Squibb Company headquarters in the United States and all of its current and future subsidiaries, branch offices, affiliates, entities and other companies that are part of, owned or controlled by, the BMS Group. When exchanging information internally, we rely on appropriate arrangements and mechanisms to cover any transfer of your Personal Information within our corporate structure, such as binding corporate rules (BCRs), contractual arrangements approved by authorities or based on consent.
Sharing your Personal Information with third parties
To conduct our business, we share with, or disclose Personal Information to, third parties, such as:
- Third-party service providers for the purpose of outsourcing specific business activities to request external support and resources. This may include companies that provide information technology services, clinical trials and studies support, marketing or market research services, events, meeting and planning services, or services related to talent acquisition or consultancy;
- business partners such as external scientists and healthcare professionals to review and assist us with healthcare compliance activities and institutions and other organisations with whom we collaborate to support our clinical or commercial activities (such as for clinical studies, patient support programs, and so on);
- Regulatory and health authorities including governmental bodies (such as the FDA, EMA, NHS), data protection authorities, tax authorities, or courts in case of disputes, when permitted or required by Applicable Data Protection Law; and
- third parties to whom BMS is legally obligated to provide such information, such as other parties in litigation or legal disputes, guardians, conservators, or individuals with powers of attorney.
When engaging with third parties, we enter into agreements with them for the Processing of Personal Data so that such Processing is carried out in accordance with our instructions, in a confidential, secure, and transparent manner in order to protect your privacy rights. When it is not possible to enter into an agreement with a third party, such as when engaging, reporting or interacting with regulatory or health authorities or courts, and when legally possible, we will use our best efforts to implement appropriate security measures and controls (such as pseudonymisation) to protect your Personal Information.
If you are in the European Economic Area (“EEA”), Switzerland and the United Kingdom
Whenever we transfer your Personal Information within the EEA, Switzerland or to countries that are deemed “adequate”, such countries are deemed to offer the same level of protection as given by the law of your country. When accessing your Personal Data from, or transferring it, outside of the EEA or Switzerland to countries that may not provide the same level of protection as your own country, we will use appropriate safeguards to protect your right to privacy. For example, such safeguards may consist of using Standard Contractual Clauses (to exchange information with third parties outside of the EEA, Switzerland and the United Kingdom), Binding Corporate Rules (for data transfer within the BMS group of companies) as approved by the European Commission or the competent authority, data transfer agreements or your consent. |
If you are outside the EEA, Switzerland and the United Kingdom
Where possible, we will allow access to or the transfer of your Personal Information outside your country of residence:
|
10. CLASSIFICATION, AUTOMATED DECISION-MAKING AND INDIVIDUALS’ RIGHTS |
BMS may combine your Personal Data with other information we may already have about you or obtained through public means such as scientific and medical publications, national registries, software, databases, or the Internet. We may also carry out internal assessments, evaluations, categorization, classification, raking or ratings of your activities, and/or your site’s performance, including analytics (where applicable). Below, we provide you with additional information about how we categorize or classify your Personal Data.
We use an algorithm to tier HCPs according to your research activity (including publications) and skills (such as years of experience and qualifications). Applicable rates for speaking and event participation are set according to the tiering of HCPs.
Unless permitted by law, BMS does not make decisions based solely on automated Processing (including profiling) of individual data unless we inform you otherwise prior to the Processing. This means that when we use certain technologies, software, or algorithms, which may allow us to create profiles, tiering or further understand trends and statistics, someone will be involved to validate decisions resulting from such use.
As the use of such technologies evolves, we may use algorithms without a person involved in the decision. In this case, if this activity requires us to Process your Personal Information that is not anonymized, we will comply with any applicable legal requirements, such as to draw this to your attention and provide you with information about the logic involved in the decision, as well as the significance and the envisaged consequences for you of such Use of your Personal Information. Depending on your country of residence, you will have the right to ask that such decision is taken by an individual.
11. WHAT ARE MY RIGHTS AND HOW TO EXERCISE THEM |
You have a number of rights related to the Personal Data that we Process about you (this will depend on the jurisdiction where you reside and the legal basis that we use). Most often, exercising your right is free of charge. We may also have to clarify your request and explain if we can comply with it or if this is restricted in your situation. You can always contact BMS at eudpo@bms.com to find out more about your rights and how best to exercise them.
Below we have listed individual rights that may apply depending on your jurisdiction.
You may have the right to:
- receive a copy of your Personal Data we hold about you;
- correct your Personal Data we hold about you;
- where applicable, receive a machine-readable copy of your Personal Data (portability);
- ask us to delete your Personal Data or restrict how it is used;
- where applicable, object to Processing of your Personal Data for certain purposes, such as when we use it for marketing purposes (opt-out); and
- where you have provided us with your consent to Use your Personal Data, you can withdraw your consent at any time without affecting BMS’ Use of such information before your withdrawal of consent.
Exceptions to your rights
There may be exceptions to your privacy rights described in this Notice. This depends on the country where you reside, why we are Processing your Personal Data and if your request may impair the rights of others. If we cannot comply with your request to exercise your privacy rights, for example when we keep your information for regulatory purposes or for the investigation, prosecution, or defence of a legal claim, we will explain this to you when you contact us.
Example
If you ask BMS to stop sending you marketing communications by e-mail, we may keep your e-mail address and other contact details in case we conduct other activities with you, such as when we have a contract with you or if we have a legal or a regulatory obligation to keep your contact details.How to contact us
If you have any questions about how we Use your Personal Information, please contact our Data Protection Office at eudpo@bms.com.
Note: We may need to request specific information from you to help us confirm your identity. If your request is complex or if you have made a large number of requests, it may take us longer to respond to you, but we will keep you informed of any delays. You will not have to pay a fee to obtain a copy of your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
Lodging a complaint with the Information Commissioner's Office
In some countries, you may have the right to lodge a complaint to the relevant data protection or competent authority if you believe that we Process your Personal Information unlawfully or are violating your rights. For example, in the United Kingdom, if you feel that we have been unable to resolve your information rights concern, you have the right to raise the matter with the Information Commissioner's Office by using their live chat service or calling their helpline on 0303 123 1113.
12. HOW LONG WE RETAIN YOUR INFORMATION |
We aim not to retain your Personal Information for longer than necessary for the specific business purposes for which it was collected. After that, unless we are required to continue to maintain the information by law, we may anonymize, restrict, block or delete it.
In certain cases, BMS may retain your Personal Information for a longer period for the purpose that we have and, in a manner, or a format, that may require BMS to keep certain identifiers. In such case, we may archive it and apply appropriate measures which may consist of blocking, preventing, obfuscating, pseudonymizing, key-coding, or restricting any further access and Use of Personal Information about you. When retaining and storing information about you in our systems, we have put in place data retention schedules in accordance with our company policy and in compliance with Applicable Data Protection Laws.
When assessing the appropriate retention period, we take into account the quantity, nature and sensitivity of Personal Data, the potential risk of harm in the event of unauthorised use or disclosure, the purposes of the Processing and whether or not these purposes can be achieved by other means, as well as applicable legal obligations.
13. HOW DO WE PROTECT INFORMATION ABOUT YOU |
We implement appropriate technical and organisational controls to protect your Personal Information that we hold to prevent unauthorised Processing, loss of data, disclosure, use, alteration, or destruction. Where appropriate, we use encryption, pseudonymisation (such as key coding), de-identification and other technologies that can assist us in securing the information about you, including measures to restore access to your information. We also require our service providers to comply with reasonable and recognized data privacy and security requirements.
We conduct tests and reviews of our technologies and processes, including a review of our business partners and vendors, so that our security controls remain effective. Also, we may further anonymize your Personal Information when it is no longer needed for the purpose for which BMS originally collected such Information.
14. COOKIES AND TRACKING TECHNOLOGIES |
Depending on the country where you reside, you may manage your preferences on cookies and similar tracking technologies through the use of consent management tools that are available on our websites. This section applies to cookies and similar tracking technologies and we explain what our use of cookies and similar tracking technologies means to you and how to disable tracking (such as using opt-in or opt-out preferences). When we collect information that may enable us to identify you, the other sections of this Notice will apply.
You can set your cookie preferences by clicking here.
What are cookies?
A cookie is a small piece of data that a website asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Such cookies when set by us are called first-party cookies. We may also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting (for example, those used by social media, instant messaging, CRM or marketing platforms, or advertising companies). For more information about cookies, types of cookies and how to manage cookies, including how to block them and delete them, please visit http://www.allaboutcookies.org.
Below, we list the main categories of cookies and similar tracking technologies that we may use when you connect to our websites, use our web-based platforms, applications, devices, or when you interact with us electronically or when you receive electronic communications from us (“Online Use”). You can learn more about the purposes for which BMS may use such technologies for your Online Use.
What categories of cookies may BMS use?
We generally use certain types of cookies during your session on our website (“session cookies”). To improve your experience or remember your preferences or choices, we may use cookies that will remain on your device unless you remove them (“persistent cookies”). When using cookies on our websites and other digital services, such technology may include:
Categories of cookies and tracking technologies that BMS may use |
|
---|---|
Strictly necessary cookies (“required”) |
Those cookies and tracking technologies enable our websites to operate and to improve the security of our website for your Online use, such as when you have to authenticate or use login functionalities to access restricted part of our websites (such as using patient or physician login or page selection to restricted pages or areas of a website or application). |
Performance cookies |
Those cookies may allow BMS to:
|
Social media cookies |
On certain BMS websites, we may use social media plugins for you to share interesting content or to connect to certain accounts to share your Personal Information with us. Such platforms may access your history of navigation and collect information about your browsing journey under their own terms. You can access more information when connecting to our sites. |
Analytics cookies |
These cookies enable us to better know the use of our websites, establish statistics on their uses and visits (e.g. information on each visited page, how long a user navigates on a specific page, how long it takes to download a specific page, what are the users’ actions on each page (click, selection, etc.). |
Other tracking technologies |
When using third-party software or websites, mobile applications, devices, web-based platforms or through other Online use, the technology may involve certain built-in tracking technologies. This may include:
|
Why do we use cookies on our website?
In addition to the explanation provided in this Notice and the section above, we use cookies or similar tracking technologies in various instances, such as for the following purposes:
- Making your experience more efficient, faster and easier: by remembering your preferences, like preferred language, display and other settings, maintaining your session, and for authentication purposes. This helps us to provide you with a better user experience. These cookies are also referred to as Session-Id cookies, authentication cookies, and User Interface customization cookies.
- Gain useful knowledge about how the site is used: by collecting information about the number of visitors and other uses. This helps us improve our sites. These cookies are also referred to as analytics cookies. For this purpose, we use services such as Google Analytics which means that Google and similar suppliers will also have access to this information (including your IP address and any other equipment identifiers such as the IMEI number and the MAC address).
- Provide easy access to our websites. This helps us to direct you, share with you our content within sites such as Facebook, Twitter, LinkedIn, YouTube or Pinterest or allow you to share content that is of your interest. To the extent we use such technology, these ‘social media plug-ins’ may store cookies and similar technology on your computer or other device. This means that the social media sites may access this information (including your IP address), may identify that you interacted with the BMS site.
- Improve our marketing communications to you. Certain cookies, such as web beacons or tracking pixels, may be used by third party systems, such as customer relationship management systems or other service providers who help us manage e-mail campaigns. Those trackers enable us to better understand the success of our communications and the relevance of the content that we share with you. This may allow us to reduce the number of e-mails that we send you and provide you with content, scientific information, or initiatives that are more tailored to your interests.
How can you object or refuse cookies?
Subject to the law of your country, in particular in the European Union, we will either inform you, ask your prior permission (opt-in) before placing tracking technologies on your device, or provide you with a right to object (opt-out) for the purposes that we describe in this section. Your web browser, e-mail software (such as Microsoft outlook, or Google Gmail) and other clients that you use can be set to manage cookies and similar trackers and even reject them by default. Do bear in mind that if you set your browser to automatically reject cookies, your user experience when visiting websites will not be the same: your preferences may not be remembered, some functionality may be lost and you may not be able to access certain areas or features of the sites.
For more details on the cookies that we use, you can read our cookie table below or, where applicable, on the website that you use by accessing the relevant cookie notice.
15. CHANGES TO THIS PRIVACY NOTICE |
BMS may update this notice from time to time by posting any revisions on this website. Where any material revisions are made, BMS may place a prominent notice on this website and when legally required to do so, will directly notify you.
16. CONTACT US |
If you have questions about this Notice, or want to obtain more information about our privacy practices, please contact our Data Protection Officer at eudpo@bms.com or contact us by postal mail at:
Contact |
Name of the affiliate |
---|---|
To contact BMS |
Bristol Myers Squibb Pharmaceuticals Limited ARC Uxbridge, Sanderson Road |
European Data Protection Officer |
Data Protection Officer eudpo@bms.com |
UK Data Protection Representative |
Bristol-Myers Squibb Pharmaceuticals Limited ARC Uxbridge, Sanderson Road |
Research Participants Privacy Notice
This notice outlines specific information on the processing of personal information about data subjects whose data is processed by Bristol Myers Squibb in the context of clinical trials, observational studies as well as other research projects.
1. INTRODUCTION AND SUMMARY |
Our Commitment
At BMS we recognize the importance of, and are fully committed to protecting your privacy as a patient or any other participant (“Research Participant”) in BMS sponsored clinical trials, observational studies and other scientific research projects (including projects using already available data at BMS or third parties for other research purposes, and projects where additional data is derived from available human biosamples such as blood samples) (altogether “Research Projects”).
Scope of this Research Participants Privacy Notice
This Notice applies in relation to a Research Project. In other cases, please refer to the BMS General Privacy Notice
This Notice includes general information about what, why and how your data is processed, as well as your data privacy rights. This information complements any information you may have already received in the context of your participation into a Research Project (e.g. via an Informed Consent Form, a separate Privacy Notice or a GDPR patient letter). If you have any questions, please contact your usual Research Project point of contact (e.g. Study doctor).
References to “BMS”, “group”, “affiliates”, “we”, “us” and “our” are references to the relevant BMS entity sponsoring the Research Project and its worldwide affiliates.
2. INFORMATION WE MAY PROCESS ABOUT YOU |
Your personal data is in principle collected by a third party (e.g. hospital, clinic) (“Study Site”). The type of information and specific data collected is determined based on the needs for the Research Project. It may include:
General categories of Personal Information |
|
---|---|
Contact information |
|
Demographic information |
|
Health-related information |
|
Key-coded data |
|
BMS protects your personal information with a key-code
Unless otherwise required in the context of a Research Project (e.g. for your safety in the context of a drug or medicinal product supply chain), all above information about you is transferred to BMS by the Study Site in such manner that BMS cannot directly identify you or its service providers. All direct identifiers, such as name, surname, passport number, are replaced by a unique code assigned to you for the Research Project. Only the Study Site keeps the link between your Research Participant code and your identity, for the duration determined under applicable law.
3. SOURCES OF INFORMATION AND RESPONSIBILITIES |
In principle, we will not collect information directly from you, we will obtain information about you from the Study Sites, third party vendors and service providers acting on our behalf or from publicly accessible sources (such as websites, social media and other digital platforms, publication databases, journals, societies, editorial board websites, national registries, professional directories and third party healthcare professionals databases).
Under applicable law, BMS will be considered “data controller” in the context of the Research Project in relation to the study data which the Study Site transfers to BMS or BMS’ service providers for the Research Project. Typically, such data will be coded before being transferred to BMS. BMS will ensure that such data is processed in accordance with applicable law. The Study Site remains data controller of the data it holds about you that is processed for other purposes (e.g. medical care).
4. WHY WE PROCESS YOUR INFORMATION |
Your inclusion in the Research Project requires the processing of your personal data.
We will only process information for purposes permitted by applicable law, which may vary depending on where you live and where we operate.
Below, we list the main purposes for which we may process information about you and our legal bases.
Main purposes for which BMS Uses your Personal Information |
|
---|---|
Achieve strategic and research purposes |
For example, for reaching the primary and secondary objectives of the Research Project, to support the development of and authorization to be placed on the market of any drug, medicinal product or any disease-related product, and to monitor its safety. |
Comply with legal, regulatory, industry best practices and ethical obligations |
For example, complying with applicable laws, regulations and requests from governmental agencies, requirements for the authorization to introduce a drug or medicinal product in the market, e.g. complying with pharmacovigilance data capture and reporting obligations; and complying with industry standards and our policies. |
Conduct our business operations |
For example, responding to questions and comments, managing our collaboration and payments. |
Any other purpose that is relevant for BMS to sponsor and conduct Research Projects |
We will process information for further purposes, where lawful to do so (such as for archiving, scientific or market research purposes) or when legally obliged to do so (such as reporting information for BMS’ risk management and drug safety obligations).
5. HOW DO WE JUSTIFY PROCESSING YOUR INFORMATION |
Legal Bases for Processing your Personal Information
We may process information based on one or more of the following legal bases:
- You have provided consent (in such cases, consent can be withdrawn at any time);
- It is necessary to comply with our contractual obligations with you;
- Where required for vital interests of any individudal;
- The processing is necessary for our compliance with a statutory or legal obligation;
- in certain circumstances the processing information is necessary for BMS’ or a third party’s legitimate interest – for example, we process information for scientific and statistical research purposes, for drug safety and risk management purposes;
- where we process special categories of your personal data – for example, information related to your health – we shall only do so in accordance with applicable law.
The processing of information for scientific research purposes is considered to be compatible with the initial purposes for which information was initially collected.
6. WHERE WE PROCESS YOUR INFORMATION |
We have headquarters in the United States, with worldwide operations. Your information may be accessible to our headquarters in the United States, and to some of our affiliates, and selected vendors and partners, globally. Where we process information in countries that may not provide the same level of protection as in your own country, we will implement reasonable and appropriate legal and security measures to protect your information from unauthorized access, use or disclosure including, but not limited to, maintaining binding contracts that require appropriate protection of your information.
For residents of EEA: whenever we transfer your information outside of the EEA, Switzerland and any other country benefiting from an adequacy decision from the European Commission, we will take necessary steps to ensure that adequate safeguards are put in place to protect your information. Such safeguards include the use of European Commission approved standard contractual clauses.
To the extent BMS is based outside the EEA, it will appoint, where required by applicable law, a representative within the EEA. Its contact details are made available to you through the Research Project information you received or from your Research Project usual contact point.
7. DISCLOSURE OF YOUR PERSONAL INFORMATION |
In the context of the Research Project, there will be disclosure of your personal data maintained by the Study Site (e.g. your medical records), where required under applicable law, to:
- Study monitors and auditors, who may work for BMS or its authorized agents, who check that the Research Project is being performed correctly and that the information collected about you is accurate;
- National and international regulatory authorities such as Ethics Committees, Health authorities and other competent authorities (for example, inspectors or other officials of the health authority in your country, the European Medicines Agency, the United States Food and Drug Administration).
Those persons will have the obligation to keep your records and your information confidential.
We may also disclose the study data where this is reasonably required to pursue our legitimate business aims and as required by law. Information will be disclosed only in accordance with applicable laws, and appropriate safeguards will be established, where possible, to protect your information. We may disclose your information to third party companies and other entities, for activities related to the Research Project (e.g. data storage, data analysis). You may ask your Research Project contact point for a list of the recipients of your data. Your contact point will liaise with us.
If BMS or substantially all of our assets are acquired by a third party, personal information held by us about you will be included as transferred assets.
We may also disclose information to enforce any rights we have or to protect our rights or the rights, property or safety of our employees, patients or others.
8. INDIVIDUAL CHOICES: RIGHTS AND ACCESS TO INFORMATION |
Access, Revision and Deletion
Under applicable privacy law, you may have a right to request a copy of your information held by us. You may also have the right to revise, correct, or delete such information. Your rights to this information may be subject to limited legal and regulatory restrictions. Please refer to the “Contact Us” section of this privacy notice.
Objection to Processing and Additional Rights
Under applicable privacy law, where we rely on legitimate interests or public interest to process your information, you can formally object to processing of your information for these purposes.
In certain circumstances, you have the additional rights to restrict aspects of the processing of your information or ask for a copy of your data to be provided to you, or a third party, in a digital format.
Please refer to the “Contact Us” section of this privacy notice.
Lodging a Complaint with Data Protection Authorities
You may have the right to lodge a complaint directly with the relevant data protection authority or supervisory authority if you believe that we have processed information in a manner that is unlawful or breaches your rights under applicable data privacy law.
Without limiting any rights to complain directly to an authority, we are committed to protecting personal information, and complaints may be made directly with the Study Site that will liaise with us, please refer to the “Contact Us” section of this privacy notice.
9. HOW LONG WE RETAIN YOUR INFORMATION AND WITHDRAWAL FROM A RESEARCH PROJECT |
We aim to retain your information for no longer than necessary for the purposes for which it was collected or obtained. For example, in the context of a clinical trial, legal retention periods may go up to minimum of 25 years. Information may be retained for a longer duration where applicable laws or regulations require, or allow us to do so, for example for conducting further research purposes.
If your participation in the Research Project stops for any reason, data collected prior to your withdrawal may still be processed along with other data collected as part of the Research Project. Normally no new information will be collected for the study database unless you specifically consent to that as part of participating to a follow-up study, except where this is required by law (e.g. law may require that any side-effects you may suffer are documented). To complete the study findings, your long term health status may also be ascertained from publicly available records (unless you have objected to this to your study contact point).
10. PROTECTION OF INFORMATION - SECURITY |
We use appropriate technical and organizational measures to protect information. When handling the information of Research Participants, we take reasonable steps to protect it from loss, misuse, unauthorized access, disclosure, alteration or destruction.
11. CHANGES TO PRIVACY NOTICE |
We may update this notice from time to time by posting any revisions on https://www.bms.com/gb/privacy-policy.html. Where any material revisions are made, we may directly notify individuals when legally required to do so, or may place a prominent notice. Please regularly refer to this page for updates.
12. CONTACT US |
If you have any questions about how your data is used or wish to exercise any of your data privacy rights or have a complaint related to the processing of your personal information, please liaise with your usual Research Project contact point (e.g. Study doctor). This contact will direct your requests to BMS, if needed, by using your Research Participant identification code. It is recommended using this approach so that your request is dealt with in the most confidential way and your identity is not revealed to us. In addition, should you contact us directly, we are likely not in a position to identify you from the data we hold (since we do not have access to the Research Participants’ identity but only their identification code). If you feel that your contact point is unable to address your query, you can also contact BMS via our Data Protection Officer or at this address https://www.bms.com/gb/about-us/contact-us.html.
Contact |
Name of the affiliate |
---|---|
For Research Participants in the European Economic Area, United Kingdom and Switzerland, you can contact our Data Protection Officer: |
Bristol Myers Squibb Data Protection Officer |
For Research Participants in the USA, Canada, Asia, North Africa or other regions, please contact dpo@bms.com or by post at: |
Bristol Myers Squibb P.O. Box 640 |
Data Protection Representative |
Bristol-Myers Squibb Pharmaceuticals Limited ARC Uxbridge, Sanderson Road |
NO-GB-2300026
Date of preparation: March 2023