Processing of personal data

We get personal data from the following sources:

• Universities
• Hospitals and clinics
• Research organisations
• Suppliers and Partners we collaborate with
• Research institutions and practitioners as part of a Novo Nordisk sponsored study
• Public and private databases
• Medical devices, apps and eDevices 

We process personal data about you for the purpose of carrying out scientific research and to:

• Generate new knowledge and insights
• Identifying unmet medical needs e.g. Epidemiological research
• Plan how to do future studies, e.g. inclusion and exclusion criteria optimisation
• Cross-study analyses of same disease or efficacy
• Assessment of laboratory measurements to understand trends
• Verify trends in demographics of subjects enrolled in trials, e.g. across trials to improve understanding of geographic and ethnic differences
• Optimize access to medicines
• Reuse of regulatory submission packages and other obligations to authorities
• Use as control arm supplement, e.g. use of clinical data from an arm of one study as an arm in another study to reduce the needed enrolment of placebo subjects
• Tool or analytical method development to advance research
• Enhance safety signal interpretation, e.g. build models from in vitro/ vivo/ clinical trial data to predict safety
• Develop disease modelling capabilities/biomarker development/development of assays or spectra
• Develop statistical programming models, e.g. to enhance precision power
• Develop of Algorithms and Artificial intelligence, e.g. for health apps/medical eDevice development
• Health economics outcomes
• Data sharing for research purposes, e.g. fulfil request to share coded data and lab samples from a clinical trial with an external researcher or scientist
• Research partnership
• On-market (real world data) research

For the purposes described in section 2, we will only process pseudonymized personal data. This means that we will not be able to directly identify you based on the data available. The pseudonymized personal data may include:

• Information about health
• Demographic data such as age, gender and nationality
• Information about race or ethnic origin
• Information about religious beliefs
• Information about sex life and sexual orientation
• Information about use of a Novo Nordisk product or service, hereunder preferences
• Biosamples that you have donated for use in R&D activities (e.g. blood, skin, hair, liquids, primary cells, stem cells, urine, tissues) and genetic data. 

Our processing of your personal data requires a legal basis.

Depending on the data, we will process your personal data because it is necessary for our legitimate interests in being able to conduct scientific research within the core areas in which we operate (see: https://www.novonordisk.com/science-and-technology/research-technologies.html)

To get insights on how our products and services are used, in order to further develop and improve them and make them available to patients across the globe we process personal data in accordance with GDPR art. 6(1)(f), GDPR art. 9(2)(j) and/or section 10 of the Danish data protection act. In each such case we have assessed that our legitimate purpose is not overwritten by your interests.   

In some cases, the pseudonymized personal data we process about you will be based on your consent, which you have provided to the source from which we obtained your data, e.g. by the consent you have provided to our partners or research institutions or as part of a Novo Nordisk sponsored research study, cf. GDPR art. 6(1)(a) and GDPR art. 9(2)(a). In such a case Novo Nordisk ensures that any further use of your data for research purposes will be compatible with the original purpose for collecting the data.

We may share your pseudonymized personal data with:

• Suppliers and suppliers that assist our company (e.g. consultants, IT service providers, law firms, and Contract Research Organisations (CROs)
• Hospitals and clinics
• Public authorities if needed
• Other Novo Nordisk entities (e.g. Novo Nordisk entities in other countries)
• In collaboration with other pharmaceutical or tech companies but only for research purposes
• External researchers who are investigating the same or related disease area or drug product

For the purposes described above in section 2, we may transfer your personal data to countries outside the European Economic Area (EEA).

We use one of the following safeguards, as required by law, to protect your personal data in case of such transfer:

• The transfer is to a Novo Nordisk entity covered by Novo Nordisk’s Binding Corporate Rules, available at: https://www.novonordisk.com/about-novo-nordisk/corporategovernance/personal-data-protection.html.
• The destination countries are deemed by the EU Commission to have an adequate level of protection of personal data
• We have entered into Standard Contractual Clauses for the Transfer of Personal Data to Third Countries. You can get a copy of the Clauses by contacting us as described in section Who we are.

We will keep your pseudonymized personal data as long as relevant for the intended use for which it was collected and in accordance with Novo Nordisk A/S’ data retention and deletion procedures.

Examples:

• Data related to technical complaints will be kept for 12 years
• HBS will be kept as long as we are allowed, depending on the arrangement we have with our external parties. Sometimes it is for 3 years, but it can also go up to 15 years,
  
• Pharmacovigilance data and regulatory documents relating to individual authorised medicinal products will be stored for as long as the marketing authorisation exists and for at least a further 10 years after the marketing authorisation has ceased to exist
  

In general, you have the following rights:

• You can get information of what identifiable personal data we have about you
• You can get a copy of your personal data in a structured, commonly used and machine-readable format
• You can get an update or correction to your personal data
• You may request to have your personal data deleted or destroyed
• You may request us stop or limit processing of your personal data
• Where the personal data is collected on the basis of your consent you may withdraw your consent
• You can submit a complaint about how we process your personal data to a Data Protection Authority

Under applicable law, limits on these rights exist when data is processed purely for scientific purposes. This means that in such circumstances, the above rights on insight into the data, right to correction or destroy of data and right to stop processing are limited.

Contact us as described in section “Who we are” with questions or requests relating to these rights.