THEDERMA SHANGHAI CO., LTD. (hereinafter referred to as "the Company," "we," "us," or "our") is committed to protecting personal information and complies with applicable laws and regulations to safeguard the security of the personal information we process.
We have therefore adopted this Healthcare Professional Privacy Policy (hereinafter referred to as "this Privacy Policy"), which applies uniformly to the processing of the personal information of healthcare professionals (hereinafter referred to as "you" or "HCP") carried out by the Company within Mainland China.
This Privacy Policy is intended to explain how we process (including but not limited to collecting, using, storing, providing, and deleting) your personal information, and how we protect your rights in relation to that information, including your rights of access, copying, correction, and deletion, as set out in Section IX.
Provisions of this Privacy Policy that may materially affect your rights and interests are marked in bold typeface. Please read them carefully.
By clicking "I Agree" or otherwise confirming your acceptance of this Privacy Policy, you acknowledge and agree that we process your personal information within the scope permitted by law and as set out in this Privacy Policy. Where we process your sensitive personal information, provide your personal information to a third party, or transfer your personal information outside the territory of the People's Republic of China, we will obtain your separate consent in addition to your acceptance of this Privacy Policy, unless consent is not required under Applicable Laws and Regulations.
This Privacy Policy is not applicable to minors. If you are under the age of 18, please do not accept or sign this Privacy Policy or provide us with any personal information.
I. Definitions
1.1 Applicable Laws and Regulations means the laws, administrative regulations, departmental rules, and mandatory national standards relating to personal information protection with which the personal information processing activities described in this Privacy Policy must comply, in each case as amended from time to time, including but not limited to the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Regulations on Network Data Security Management, the Drug Administration Law of the People's Republic of China, and the Good Pharmacovigilance Practice.
1.2 Personal Information means any information relating to an identified or identifiable natural person, recorded electronically or by other means, excluding information that has been anonymized.
1.3 Sensitive Personal Information means personal information that, once leaked or illegally used, may easily lead to infringement upon the dignity of natural persons or harm to personal or property safety, including biometric identification information, religious beliefs, specific identities, medical and health information, financial accounts, whereabouts and tracking information, and the personal information of minors under the age of 14. In this Privacy Policy, we use bold typeface or other means to draw your attention to the sensitive personal information we process.
1.4 Healthcare Professional (HCP) means any professional who is engaged in the diagnosis, treatment, or prevention of disease in the healthcare field and who is licensed or registered to practice, as well as any individual who supports such professional activities. The term also includes experts in other healthcare fields, such as key opinion leaders, members of the scientific community, and external scientific experts.
1.5 Processing of Personal Information means the collection, storage, use, alteration, transmission, provision, public disclosure, and deletion of personal information, and any similar operation.
1.6 Website means the online platform or platforms operated by the Company for healthcare professionals within Mainland China, currently accessible at www.thederma.com, together with any related portals, applications, and mini-programs through which this Privacy Policy is made available.
1.7 Affiliate means, in relation to the Company, any entity that directly or indirectly controls, is controlled by, or is under common control with the Company.
II. How We Collect Your Personal Information
In order to engage in academic exchange and interaction with you, we may collect your personal information in the following online and offline scenarios:
2.1 Account Registration and Identity Verification
To facilitate healthcare professionals' access to medical and pharmaceutical information through online channels, we operate a unified account system. When you create an account, we may collect:
• Registration information: name, username, password, email address, phone number, region, etc.;
• Identity verification information: practicing qualification certificate number, practicing institution, professional title, etc., to verify your identity as a healthcare professional;
• Preference settings: areas of expertise, therapeutic areas of interest, language preference, etc.
We collect the above information in order to verify your HCP identity, to ensure that the Website is used only by bona fide healthcare professionals, and to tailor the content we make available to you.
2.2 Provision of Medical Information and Services
When you use the Website to inquire about drug information, access academic materials, or participate in online meetings or training sessions, we may collect:
• Usage behavior information: pages you visit, content you view, materials you download, keywords you search, etc.;
• Interaction records: medical inquiries you submit, feedback, meeting sign-in records, etc.;
• Device information: IP address, browser type, operating system version, time of access, etc.
2.3 Academic Events and Interactive Exchanges
When you participate in academic conferences, advisory boards, or other events organized by us as a speaker, consultant, or participant, we may collect:
• Basic identity information: name, gender, email address, phone number;
• Professional and academic information: employer, professional title, areas of expertise, academic background, publications, professional memberships, etc.;
• Event-related information: attendance records, presentation content, travel arrangements;
• Sensitive personal information (where honoraria or reimbursement payments are involved): bank account information and resident identity card number.
The bank account and identity document information described above constitutes sensitive personal information. We collect it only in order to make honoraria or reimbursement payments to you and to comply with our tax, accounting, and transparency reporting obligations, and we will obtain your separate consent before collecting it. If you choose not to provide this information, we will be unable to make such payments to you, but this will not affect your access to the Website or to the other services described in this Privacy Policy.
2.4 Pharmacovigilance and Adverse Reaction Reporting
We are subject to statutory pharmacovigilance obligations. When you report an adverse event relating to our products, we may collect:
• Reporter information: your name, contact details, professional information;
• Sensitive personal information relating to the patient, de-identified to the greatest extent permitted by applicable pharmacovigilance reporting requirements: age, gender, description of the adverse reaction, medication history, and similar information;
• Detailed event information: time of occurrence, severity, outcome, etc.
We process pharmacovigilance information because doing so is necessary for us to fulfill our statutory obligations, which is a lawful basis under Article 13, paragraph 1, item (3) of the Personal Information Protection Law. Your consent is therefore not required for this processing, and withdrawing any consent you have given for other processing will not affect it. We process such information only to the extent necessary for pharmacovigilance purposes and not for any commercial purpose.
2.5 Website Security and Optimization
To ensure the secure operation of the Website and improve user experience, we may automatically collect:
• Log information: time of access, pages visited, referring URL, exit pages, etc.;
• Security information: abnormal access behaviors, security incident records, etc.
III. How We Use Your Personal Information
We may use your personal information for the following purposes:
3.1 To verify your HCP identity and ensure that the Website is used only by healthcare professionals;
3.2 To provide medical information services and respond to your inquiries and requests;
3.3 To manage our academic collaboration relationships with you and fulfill contractual and payment obligations;
3.4 To organize and conduct academic conferences, training sessions, advisory boards, and other events;
3.5 To improve our products, services, and solutions and to conduct research, development, and market research, in each case using de-identified or aggregated data wherever practicable;
3.6 To fulfill statutory and regulatory obligations, including pharmacovigilance and adverse reaction reporting;
3.7 To ensure the secure operation of the Website and information systems;
3.8 For any other purpose to which you have given your consent.
We will not process your personal information for any purpose beyond those set out above without first notifying you and, where required by Applicable Laws and Regulations, obtaining your consent.
IV. Legal Bases for Processing Your Personal Information
We process your personal information only where one of the following lawful bases set out in Article 13 of the Personal Information Protection Law applies:
4.1 Your consent: where you have given your consent to the processing and, where required by Applicable Laws and Regulations, your separate consent;
4.2 Necessity for the conclusion or performance of a contract: where processing is necessary in order to conclude or perform a contract to which you are a party (for example, a speaker agreement or a consultancy agreement);
4.3 Necessity for the fulfillment of statutory duties or obligations: where processing is necessary in order for us to fulfill our statutory duties or obligations (for example, our pharmacovigilance and adverse reaction reporting obligations); and
4.4 Other circumstances provided by laws and administrative regulations: including processing that is necessary in order to respond to a public health emergency or to protect the life, health, or property safety of a natural person in an emergency, and the processing, within a reasonable scope, of personal information that you have disclosed yourself or that has otherwise already been lawfully disclosed.
4.5 Where we wish to process your personal information for a purpose that is not covered by any of the bases set out above, for example in order to improve our products and services, to conduct market research, or to send you promotional communications, we will obtain your consent before doing so.
4.6 We will not refuse to provide you with products or services on the ground that you have declined to consent to processing that is not necessary for the provision of those products or services.
V. How We Entrust Processing, Share, Transfer, or Publicly Disclose Your Personal Information
5.1 Entrusted Processing
We may entrust third-party service providers (for example, IT and cloud hosting providers, and event management agencies) to provide services to you. In such cases, we will only entrust processing of your personal information for lawful, legitimate, necessary, specific, and explicit purposes, and require such third parties to comply with this Privacy Policy and applicable data protection laws, enter into confidentiality and data compliance agreements, strictly control data processing permissions, and prevent any leakage or misuse. In accordance with Article 21 of the Personal Information Protection Law, we agree with each entrusted party the purpose, duration, and method of the entrusted processing, the categories of personal information involved, the protection measures to be applied, and the rights and obligations of each party, and we supervise the entrusted party's processing activities. An entrusted party may not sub-entrust the processing to any other party without our prior consent, and must return or delete the personal information when the entrustment ends.
5.2 Sharing
We will not share your personal information with any company, organization, or individual outside the Company, except in the following circumstances:
(1) With your explicit consent;
(2) Statutory circumstances: as required by laws and regulations, for dispute resolution, or in response to lawful requests from administrative or judicial authorities;
(3) Sharing with Affiliates: in order to enable us to provide services to you, we may share personal information with our Affiliates, but only to the extent necessary for, and subject to, the purposes set out in this Privacy Policy.
Where we provide your personal information to a third party as described above, we will inform you of the recipient's name, contact information, processing purpose, and processing method, and of the categories of personal information involved, and we will obtain your separate consent, unless consent is not required under Applicable Laws and Regulations.
5.3 Transfer
In the event of a merger, division, dissolution, acquisition, or bankruptcy liquidation of the Company, if personal information is to be transferred, we will notify you of the name and contact information of the recipient and require the recipient to continue to comply with the privacy protection obligations under this Privacy Policy to ensure the continuity of your personal information rights. If the recipient changes the original purpose or method of processing, it must obtain your consent again.
5.4 Public Disclosure
We will not publicly disclose your personal information, except with your separate consent or where required by Applicable Laws and Regulations.
VI. How We Use Cookies and Other Tracking Technologies
6.1 What are Cookies?
Cookies are small text files sent by web servers to your browser when you visit a website and stored on your device by your browser. This Section VI also applies to other technologies with similar functions, such as web beacons, pixel tags, and software development kits (SDKs).
6.2 Types of Cookies We Use
• Strictly Necessary Cookies: necessary for the basic functioning of the Website, including page navigation and access to secure connections;
• Functional Cookies: remember your preferences and choices (e.g., language, region settings);
• Analytics/Performance Cookies: help us understand how you interact with the Website and optimize its functionality;
• Targeting/Marketing Cookies: record the pages you visit so that we can provide content and communications that are more relevant to you. We use these cookies only with your consent.
6.3 How to Manage Cookies?
When you first visit the Website, we will present a cookie notice, and you may choose to accept or reject non-essential cookies. You may also manage or delete cookies at any time through your browser settings. Declining non-essential cookies will not prevent you from accessing the core functions of the Website. You may change your cookie preferences at any time through the cookie settings available on the Website.
VII. How We Transfer Your Personal Information Cross-Border
7.1 As a general rule, personal information that we collect and generate within the territory of the People's Republic of China is stored within that territory. We transfer such personal information outside that territory only in accordance with this Section VII.
7.2 If a cross-border transfer is necessary for business purposes, we will, before the transfer takes place, carry out a personal information protection impact assessment in accordance with Applicable Laws and Regulations and:
(1) complete the cross-border transfer mechanism under Article 38 of the Personal Information Protection Law that applies to the transfer, namely passing a security assessment organized by the Cyberspace Administration of China, obtaining personal information protection certification from a specialized body, or entering into and filing a standard contract with the overseas recipient in the form formulated by the Cyberspace Administration of China;
(2) inform you of the name and contact information of the overseas recipient, the purpose and method of the processing, the categories of personal information to be transferred, and the means and procedures by which you may exercise your rights under the Personal Information Protection Law against the overseas recipient;
(3) obtain your separate consent, unless separate consent is not required under Applicable Laws and Regulations; and
(4) take the other measures required by Applicable Laws and Regulations to ensure that the overseas recipient's processing of your personal information meets the standard of protection required under the Personal Information Protection Law.
7.3 Where a transfer falls within an exemption under the Provisions on Facilitating and Regulating Cross-Border Data Flows, we may make the transfer without completing a mechanism described in Article 7.2(1), but we will continue to comply with the remaining requirements of Article 7.2 to the extent they apply.
VIII. How We Store and Protect Your Personal Information
8.1 Location of Storage
Personal information collected and generated within the territory of the People's Republic of China is stored within that territory. Section VII sets out the circumstances in which such personal information may be transferred outside that territory.
8.2 Duration of Storage
We will retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by Applicable Laws and Regulations. In particular, under Article 113 of the Good Pharmacovigilance Practice, pharmacovigilance records and data must be retained for at least ten years after the cancellation of the relevant drug registration certificate. Unless a longer period applies, we retain account and registration information for as long as your account remains open and for [___] months after it is closed, and we retain records relating to academic events and honoraria payments for [___] years after the relevant event or payment. When the applicable retention period expires, or when the purposes described in this Privacy Policy have been achieved or can no longer be achieved, we will delete or anonymize the personal information. Where a retention period prescribed by laws or administrative regulations has not yet expired, or where deletion is technically difficult to achieve, we will cease all processing of the personal information other than its storage and the application of necessary security measures.
8.3 Security Measures
We adopt security measures consistent with industry standards to protect your personal information, including but not limited to:
(1) Management systems: internal management systems for data classification and grading, access control, security audits, etc.;
(2) Technical measures: technical means such as encryption of data in transit and at rest, firewalls, intrusion detection, and de-identification, with particular attention to the protection of sensitive personal information;
(3) Personnel management: data protection training for employees, confidentiality agreements with employees, and strict access control to data.
8.4 Security Incident Response
In the event of a personal information security incident, we will immediately activate our emergency response plan, conduct investigations, mitigate damages, trace the source, and notify you and relevant regulatory authorities as required by laws and regulations. Our notification to you will describe the categories of personal information involved and the cause and possible harm of the incident, the remedial measures we have taken, the steps you may take to mitigate the harm, and our contact information. We will report the incident to the competent authorities within the time limits prescribed by Applicable Laws and Regulations.
IX. Your Rights
Under the Personal Information Protection Law and other Applicable Laws and Regulations, you have the following rights in respect of your personal information:
9.1 Right to Know and to Decide: You have the right to know how we process your personal information and to make decisions in relation to that processing;
9.2 Right of Access: You have the right to access the personal information we hold about you;
9.3 Right to Copy: You have the right to obtain a copy of your personal information;
9.4 Right to Rectification: You have the right to request the correction or completion of inaccurate or incomplete personal information;
9.5 Right to Erasure: You have the right to request that we delete your personal information where the statutory conditions are met. We will also delete your personal information on our own initiative where the purpose of processing has been achieved or can no longer be achieved, where we cease to provide the relevant products or services, where the retention period has expired, or where you withdraw your consent;
9.6 Right to Limit or Refuse Processing: You have the right to limit or refuse our processing of your personal information, except where laws or administrative regulations provide otherwise;
9.7 Right to Withdraw Consent: Where we process your personal information on the basis of your consent, you have the right to withdraw that consent at any time through your account settings or by contacting us using the details in Section XI. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before it was withdrawn, and does not affect processing that is not based on your consent, such as processing necessary for our pharmacovigilance obligations;
9.8 Right to Complain and to Bring Proceedings: You have the right to lodge a complaint with the competent regulatory authority and, if we reject a request by you to exercise your rights, to bring proceedings before a People's Court in accordance with the law;
9.9 Right to an Explanation: You have the right to request that we explain our personal information processing rules;
9.10 Right to Data Portability: Where you ask us to transfer your personal information to a personal information handler designated by you, and the conditions prescribed by the Cyberspace Administration of China are met, we will provide a means for that transfer; and
9.11 Rights of Close Relatives: Where an individual is deceased, his or her close relatives may, for their own lawful and legitimate interests, exercise the rights of access, copying, correction, and deletion in respect of the deceased individual's relevant personal information, unless the deceased individual arranged otherwise before death.
If you wish to exercise any of the above rights, please contact us using the details set out in Section XI of this Privacy Policy. We have established a convenient mechanism for accepting and handling such requests. We may first need to verify your identity. We will respond promptly and, in any event, within thirty (30) days of receiving your request. Where we reject a request, we will explain our reasons for doing so. We may decline a request that is manifestly unfounded or excessive, or where refusal is permitted under Applicable Laws and Regulations.
X. Privacy Protection for Minors
10.1 Our Website and services are intended for healthcare professionals and are not applicable to minors.
10.2 We do not knowingly collect personal information from minors under the age of 18.
10.3 If you become aware that we have collected personal information from a minor without legal authorization, please contact us promptly using the details set out in Section XI. We will verify the position and delete the relevant personal information without undue delay.
10.4 Where, in the course of adverse reaction reporting, we receive personal information relating to a patient who is a minor under the age of 14, we treat that information as sensitive personal information and process it only to the extent necessary to fulfill our statutory pharmacovigilance obligations.
XI. How to Contact Us
If you have any questions, comments, or suggestions regarding this Privacy Policy, or wish to exercise your rights relating to personal information, you may contact us through the following means:
• Tel: [(021) 6019 1661]
• Email: [PR@thederma.com]
• Personal Information Protection Officer: [name / title], [email address]
• Address: [Building 3 & 4, No. 865 Zuchongzhi Road, China (Shanghai) Pilot Free Trade Zone]
• Pharmacovigilance / Adverse Reaction Reporting: [PV@thederma.com]
We will review your request promptly and respond within the period described in Section IX.
XII. How We Update This Privacy Policy
12.1 We may update this Privacy Policy from time to time. We will post the updated version on this page and notify you through appropriate means (e.g., website announcement) before the update becomes effective.
12.2 If updates to this Privacy Policy involve material changes to your rights (e.g., significant changes to the purposes, methods, or scope of processing of personal information), we will notify you through prominent means (e.g., pop-up window, email notification) and obtain your consent again where required by Applicable Laws and Regulations.
12.3 We will indicate the "Effective Date" and "Date of Revision" at the top of this Privacy Policy page so that you can identify the current version. We recommend that you review this Privacy Policy periodically.
12.4 Where an update to this Privacy Policy does not involve a material change to your rights, your continued use of our services after the update takes effect will indicate your acknowledgment of the updated Privacy Policy. Where an update involves a change to the purpose or method of processing or to the categories of personal information we process, we will obtain your consent again before the change takes effect, and your continued use of our services alone will not be treated as consent.
12.5 This Privacy Policy is prepared in Chinese and English. In the event of any inconsistency between the two versions, the Chinese version shall prevail.
12.6 This Privacy Policy is governed by the laws of the People's Republic of China, for these purposes excluding the Hong Kong Special Administrative Region, the Macao Special Administrative Region, and Taiwan.
pv@thederma.com