Privacy Notice

GSK General Privacy Notice

China (Mainland)

 

Last Updated: June 29, 2023

This Privacy Notice is intended for:

  • users of GSK products and services (excluding research subjects);
  • visitors to GSK and GSK-owned websites;
  • users of GSK systems and applications;
  • members of the general public who are interested in contacting or are being contacted by GSK; and
  • any individual who has received this notice and to whom the other notices in this Privacy Centre do not apply.

We understand that privacy is important to you. We are committed to treating your personal information with care and integrity.

Our Privacy Notice tells you what personal information we collect and how we collect it. It explains what we use your personal information for and how we protect your personal information and keep it safe. This Privacy Notice explains our general practices.  If anything in this Privacy Notice conflicts with laws and regulations in China, the China laws and regulations shall prevail.

GlaxoSmithKline values your privacy. When we say “GSK”, “we”, “us” or “our”, we mean GlaxoSmithKline(China) Investment Co., Ltd. (at Unit 901, 9th Floor, Building 56, East 4th Ring Middle Road, Chaoyang District, Beijing) and its affiliated companies (e.g., GSK Shanghai R&D Co., Ltd.(at 1-3/F, No. 18, Lane 999, Huanke Road, China (Shanghai) Pilot Free Trade Zone, Shanghai)).

Personal information means various information related to identified or identifiable natural persons recorded electronically or in other ways, excluding anonymized information; “process(ing)” personal information refers to collection, storage, use, processing, transmission, provision, disclosure and deletion, etc. of personal information.

In this Privacy Notice, we explain:

h

Who is the controller of your personal information?

GlaxoSmithKline(China) Investment Co., Ltd. and its affiliated companies (e.g., GSK Shanghai R&D Co., Ltd.), are the controllers of your personal information.

Contact information and your privacy point of contact

If you want to exercise your rights, have any questions about this Privacy Notice, need more information or would like to raise a concern, please contact GSK China Privacy Office at cn.pharma-privacy@gsk.com .

What personal information do we collect about you?

The personal information we collect, and process, may include:

  • Basic information – your name, surname (including prefix or title), alias, gender, age or date of birth, employer, job as well as your preferred language; 
  • Contact information – information that enables us to contact you, e.g. your personal or business email, residential address, work address, address of the medical institution where the health professionals work, mailing address, telephone numbers and profile on a social media platform; 
  • Financial information – your bank details, including account name, account number and sort code, and other payment and remuneration details, reimbursement record;
  • Technical and network activity information – information about your device and your usage of our websites, apps and systems, including your IP address, device ID, hardware model and version, mobile network information, operating system and other online identifiers, type of browser, browsing history, search history, access time, pages viewed, URLs clicked on, forms submitted, physical location, WeChat nickname, WeChat profile photo and WeChat Open ID;
  • Product use – data related to your use of our products (including feedback), your purchase history and preferences, your interactions with us, your preferred method of communications with us, and services you may use;
  • Medical/Health information – your health status, health conditions you are experiencing and medical/health information inferred from information that you have provided to us (such as purchase history of medications);
  • Audio visual – photos, videos and voice recordings of you. We may collect photos, videos and voice recordings of you if GSK has installed CCTV in the office and you may have just visited the office; your communication with GSK to inquire about or give feedback on GSK's products or services;
  • Personal identity information: ID card number / passport number;
  • Adverse reaction/event reporting information: patient’s name/ initials, gender, age, physiological characteristics (e.g., height, weight) (if needed), date of birth, ethnicity, contact information, medical record number/clinic number, family history, medication information, allergy history, medical records (such as testing reports, diagnosis and treatment, symptoms, medication records), adverse event data (i.e., adverse reaction/event occurrence time, adverse reaction/event process description (including symptoms, characteristics, clinical tests, etc.) and treatment status and results), relevance information (including reporter’s name, contact number, employer, address, email address);
  • Signature information: your handwritten signature or a digitised electronic signature;
  • Background and experience information: specialty/skills, position, investigator number of clinical trials, healthcare professionals’ certificate number, information contained in the CV, such as degree, educational experience, professional qualifications, work experience;
  • Special categories of personal information (if applicable): This includes information about your health, disabilities or sexual orientation. We use this information to ensure that we comply with the requirements of relevant laws and regulations. Similar information about minors may also be collected in very limited circumstances, please refer to “Information about children” for more information;
  • Your views and opinions on GSK: the information you provide when participating in GSK investigations or using GSK’s “Speak up”;
  • Communication information – your communication records and content with GSK.
  • Information about your services to GSK: company, occupation details, due date, location of work, name of line manager.

You can choose not to give us personal information when we ask you for it. If you decide not to give us your personal information, it may restrict our relationship with you. For example, we may not be able to provide you with the services that you have requested.

How do we collect your personal information?

Directly from you when you:

  • Create an account and profile on one of our websites, or apps; 
  • Register with us to use GSK’s authentication services; 
  • Use your company’s sign on or other third-party authentication service (for example Microsoft, Google log in page) to gain access to our systems or apps. 
  • Use our websites, apps and systems;
  • Share or use your social media profile to contact GSK; 
  • Sign up with us to receive promotional material;
  • Enter a contest or competition organised by GSK; 
  • Engage with one of our sales representatives;
  • Get in touch for support or to provide feedback;
  • Attend an online event such as a webcast;
  • Respond to any surveys that you may choose to participate in;
  • Share adverse events or medical information enquiries with us; and 
  • Attend offline meetings, such as advisory boards or conferences.

From other sources:

  • Publicly accessible sources;
  • Joint marketing partners;
  • Marketing vendors;
  • Healthcare provider directories;
  • Events management agencies;
  • Social media platforms; and
  • When you talk about us online, like when you mention a GSK product in a Tweet.

If you connect your social media account to our websites, or apps, you will share certain personal information from your social media account with us. This may include your name, email address, photo, list of social media contacts, and any other information you make accessible to us when you connect your social media account to our websites, or apps.

We also combine information about you from various sources, including the information you provide to us and personal information, which is collected during your relationship with us.

h

How do we use your personal information or process your personal information in other ways?

We use your personal information for the purposes we have described below in this Privacy Notice, or for purposes which are reasonably compatible to the ones described. We cannot, and will not, use it for other purposes without your permission, unless we have a legal right or obligation to do so.

To manage our relationship with you.

We will use your personal information to:

  • Provide our products and services to you;
  • Provide you with a prize if you enter a prize draw or competition;
  • Provide online services such as webcasts, employment opportunities and financial results;
  • Manage your account on our websites, and apps;
  • Identify you and authenticate your access rights access to our websites, systems and apps;
  • To respond to your queries and provide you with information when you request it or when we believe our products and services may be of interest to you. If we intend to share electronic marketing with you, we will ask for your consent where required and you can opt out at any time;
  • Invite you to provide feedback, participate in research, surveys or attend events;
  • Personalise your experience when interacting with GSK;
  • Respond to your drug information inquiries, provide medical knowledge and medication guidance.
  • Report the adverse events you notify us about; and
  • Perform analytics, market research and segmentation to understand your preferences, improve our products and services and our communications to you.

To manage and improve our processes and our business operations.

We will use your personal information to:

  • Manage our network and information systems security; 
  • Manage our workforce effectively;
  • Respond to reports you make of a possible side effect associated with one of our products and to monitor the safety of our products;
  • Keep records related to our relationship with healthcare professionals;
  • Perform data analyses, auditing and research to help us deliver and improve our GSK digital platforms, content and services;
  • Monitor and analyse trends, usage and activities in connection with our products and services to understand which parts of our products and services are of the most interest and to improve them accordingly; and
  • Prepare and perform management reporting and analysis, including analytics and metrics.

To achieve other purposes.

We will use your personal information:

  • To follow applicable laws and regulations;
  • To respond to requests from competent public authorities;
  • To tell you about changes to our terms, conditions and policies;
  • To exercise or defend GSK against potential, threatened or actual litigation;
  • To investigate and take action against illegal or harmful behaviour of users.
  • To protect GSK, your vital interests, or those of another person;
  • To gain insights and feedback on our products and services in order to correct or improve them, by analysing information from external sources such as Google, Facebook and Twitter (and others);
  • To deliver services to you via your smart device and our mobile apps; and
  • When we sell, assign or transfer all or part of our business.

To provide products or services.

We will use your personal information:

  • To provide you with our vaccination reminder service and knowledge on disease prevention;
  • To optimise our information services during your use of our services.

To communicate with you.

We will use your personal information:

  • To respond to your queries and provide you with information when you request it or when we believe our products and services may be of interest to you. If we intend to share electronic marketing with you, we will ask for your consent where required and you can opt out at any time.

To report misconduct.

We will use your personal information:

  • To provide a channel for you to report misconduct, possible violations of the GSK’s code of conduct or suspected violations of laws and regulations;
  • To investigate and take action against illegal or harmful behaviour of users.

To ensure compliance.

We will use your personal information:

  • To follow applicable laws and regulations;
  • To exercise or defend GSK against potential, threatened or actual litigation;
  • To protect GSK, your vital interests, or those of another person.

To report adverse reaction / event.

We will use your personal information:

  • To process your inquires, complaints or adverse event report.

To provide reception services.

We will use your personal information:

  • To provide reception service for your offline visits;
  • To answer your incoming calls.

To provide you with security.

We will use your personal information:

  • To maintain public security.

To invite you to become our speaker.

We will use your personal information:

  • To invite you to participate as a speaker at our conferences.

To provide you with financial support or to make payment.

We will use your personal information:

  • To provide you with financial support;
  • To reimburse you for your expenses;
  • To make payment for services provided by you.

To verify your qualifications.

We will use your personal information:

  • To verify your qualification and arrange corresponding trainings before you provide the service;
  • To execute the paper or digital contract for the services you provide.

Why are we allowed to process your personal information?

We can process your personal information when one of the following applies:

  • Where your consent is obtained;
  • Where it is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or for the implementation of human resources management in accordance with the labour rules and regulations formulated in accordance with the law (including but not limited to this Privacy Notice) and the collective contract concluded in accordance with the law;
  • Where it is necessary for the performance of statutory duties or statutory obligations, such as providing your personal information to the social insurance authorities for the purpose of making social insurance contributions;
  • Where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person;
  • Where such acts as news reporting and supervision by public opinions are carried out for the public interest, and the processing of personal information is within a reasonable scope;
  • Where it is necessary to process the personal information disclosed by you or other personal information that has been legally disclosed within a reasonable scope in accordance with the law; and
  • Other circumstances prescribed by laws and administrative regulations.

How do we protect your personal information?

We want to make sure your personal information is not shared with or used by those not allowed to see it. We have used industry-standard security safeguards to protect the personal information you provide from unauthorized access, public disclosure, use, modification, damage or loss. We will take all reasonably practicable steps to protect your personal information.

We also require all personnel who may have access to your personal information to fulfil corresponding confidentiality obligations. Failure to fulfil these obligations may result in legal liability or suspension of the partnership with us. We carefully choose service providers to work with, and check they have security measures and technologies in place to protect your personal information. We do not allow our service providers and suppliers to use your personal information for their own and unauthorized purposes.

In the event of an unfortunate personal information security incident, we will promptly inform you of the following items in accordance with the requirements of laws and regulations: the basic situation and possible impact of the security incident, the disposal measures we have taken or will take, recommendations on the measures you can take to prevent and reduce risks on their own, remedies for you, etc. We will promptly notify you of the incident by email, letter, telephone, push notification, etc. When it is difficult to inform the subject of personal information incident individually, we will reasonably and effectively publish an announcement.

At the same time, we will also proactively report the handling of personal information security incidents in accordance with the requirements of regulatory authorities.

What are your rights regarding your personal information?

You have rights we need to make you aware of. The rights available to you depend on our reason for processing your personal information and the laws and regulations in China. Depending on this you may have the right to take the following actions to the extent permitted by the law:

  • Ask us for copies of your personal information;
  • Ask GSK about the processing of your personal information;
  • Ask us to correct information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete;
  • Ask us to delete your personal information under any of the following circumstances:
    • where the purpose of processing has been achieved, it is impossible to achieve such purpose, or it is no longer necessary to achieve such purpose;
    • where we cease to provide products or services, or the retention period has expired;
    • where you withdraw your consent;
    • where we process your personal information in violation of laws, administrative regulations or the agreement with you; or
    • other circumstances stipulated by laws and administrative regulations;
  • Ask us to restrict the processing of your information;
  • Object to our processing of your personal information; 
  • Ask us to explain our rules for processing your personal information;
  • Ask that we transfer information you have given us from one organisation to another, or to give it to you; and
  • If we deny your request to exercise your rights or your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information, you can file a lawsuit in the People's Court in accordance with the law.

You can find out how to get in touch with us to ask us to do any of the above by looking at the “Contact information and your privacy point of contact” section. 

For your protection, and to protect the privacy of others, we may need to verify your identity before completing what you have asked us to do. After verifying your identity, we will respond to your request based on the above rights in a timely manner and give a reply and reasonable explanation within 15 working days after receiving your request.

If you object to us using your personal information or withdraw permission for us to use your personal information, after initially giving it to us, we will respect your choice in line with applicable law. However, by objecting or withdrawing your permission, we may not be able to complete the processing activities described in the “How do we use your personal information or process your personal information in other ways”. Please note that if your personal information is processed based on a statutory basis other than your individual consent, the processing will not be impacted by the withdrawal of your consent. In addition, according to the relevant laws, if you withdraw your consent, it will not affect the validity of any personal information processing activity conducted based on your consent before such withdrawal.

How long do we keep your personal information?

We will keep your personal information only for as long as we have to so we can complete the activities we have explained in this Privacy Notice (Please refer to “How do we use your personal information or process your personal information in other ways”). After the activity is completed, we will retain your personal information in accordance with relevant laws and regulations and GSK's global records retention schedule.

In some jurisdictions, we are legally required to keep your personal information for certain periods. How long depends on the specific legal requirements of the jurisdiction you are in when you share your information with us.

We will always keep your personal information for the period required by law and where we need to do so in connection with legal action or an investigation involving GSK. After the storage period of your personal information expires, we will delete or anonymize your personal information to make it not accessible and keep relevant deletion or anonymization record, except for the personal information that must continue to be stored for a longer period of time according to laws and regulations.

Will your personal information be shared, transferred or disclosed?

We share your personal information on a need-to-know basis, and to the extent necessary for the purposes listed in “How do we use your personal information or process your personal information in other ways” and provided that laws and regulations are followed.

We share your personal information with members of the GSK group. You can query the name and contact information of GSK affiliates by accessing GSK’s worldwide contacts. We promise that all sharing is limited to your necessary personal information and is subject to this Privacy Notice; If we want to change the purpose of using and processing personal information, we will ask your authorization again. At the same time, we will strictly comply with the requirements of relevant laws and regulations on cross-border data transmission.

Except for the following circumstances, we will not share your personal information with any company, organization or individual other than members of the GSK group:

  • We may share your personal information with your explicit consent: After obtaining your explicit consent, we will share your personal information with other parties.
  • We may share your personal information in accordance with the laws and regulations, or mandatory requirements from government authorities.
  • We may share your personal information with the authorized partners: solely for the purpose stated in this policy, some of our services will be provided by the authorized partners. We list the circumstances where we share your personal information with the authorized partners. For any details, please refer to Third Party List.

For authorized partners who we share your personal information with, we will sign a strict confidentiality agreement with each of them and ask them to handle your personal information in accordance with our instructions, this Privacy Notice and any other relevant confidentiality and security measures.

Entrustment

We will also share your personal information with other specialised service providers who work with us. They will process your personal information on behalf of GSK, and GSK will supervise the personal information processing activities of the third parties in accordance with the laws and regulations to ensure that they only process personal information within the scope of processing purposes, processing methods and types of personal information agreed with GSK:

  • Event agencies; 
  • Marketing agencies;
  • Technology suppliers who work with us to develop and improve our websites, digital forums and apps;
  • Media services providers who work with us;
  • Any entity who may acquire us or part of our business or brands;
  • Suppliers managing adverse event reports;
  • Local regulators, courts, governments and law enforcement authorities;
  • Professional advisors, such as auditors, accountants and lawyers, industry professional consultants; and
  • Security providers.

Transfer

We will not transfer your personal information to any company, organization or individual, except:

  • Transferring with your explicit consent: After obtaining your explicit consent, we may transfer your personal information to other parties;
  • During merger, division, dissolution or bankruptcy liquidation, if the transfer of personal information is involved, we will require the new entity  holding your personal information to seek for consent from you. We will comply with the corresponding notification and other obligations in accordance with the law.

Public disclosure

We will not publicly disclose your personal information without obtaining your prior consent, unless we have a legal right or obligation to do so.

In what instances do we transfer your personal information outside China?

In principle, the personal information collected and generated in the People’s Republic of China will be stored in the People’s Republic of China. Since GSK is a multinational corporation, based on the needs of unified group operation and management, we provide products or services through resources and servers all over the world to ensure business continuity and system security, which means that your personal information below may be transferred to or accessed overseas jurisdictions of your country / region for the purposes listed below.

For the purposes of responding to your medical inquiries, providing medical knowledge and medication guidance: name, surname, telephone numbers, medical/health information, and purchase history of medications.

For drug safety reporting, adverse reaction/event reporting purposes: patient’s initials, gender, age, physiological characteristics (e.g., height, weight) (if needed), contact information, ethnicity, contact information, family history, medication information, allergy history, medical records (such as testing reports, diagnosis and treatment, symptoms, medication records), adverse event data; name, surname, telephone numbers, employer, address and email address of the reporters.

And for the specific processing purposes described in this Privacy Notice: name, surname (including prefix or title), gender, age or date of birth, email address, residential address, work address, address of the medical institution where the health professionals work, company, occupation details, telephone numbers, bank details, payment and remuneration details, reimbursement record, ID card number, specialty/skills, position, investigator number of clinical trials, healthcare professionals’ certificate number, due date, location of work, name of line manager, information contained in the CV, such as degree, educational experience, professional qualifications, work experience.

The overseas recipients include GlaxoSmithKline Services Unlimited (at 980 Great West Road, Brentford, Middlesex, TW89GS, UK)), GlaxoSmithKline LLC (at Corporation Service Company, 251 Little Falls Drive, Wilmington, Delaware, 19808, United States), GlaxoSmithKline Research & Development Limited (at 980 Great West Road, Brentford, Middlesex, TW89GS, UK)), GlaxoSmithKline Biologicals SA (at Rue de l'Institut 89, B-1330 Rixensart, Belgium) or other GSK affiliated companies. You can check the names and contact information of GSK's overseas affiliates by visiting GSK’s global contact information.

In addition, in order to better fulfill the functionality of our products and/or services, the overseas recipients may engage third-party service providers (for specific names and contact information, please inquire through the contact information in this Privacy Notice) to assist us in providing relevant operational and service support. During this process, such third-party service providers will act on behalf of GSK to process your personal information.

The personal information protection laws of the countries or regions where the recipients are located to which we transfer data may differ from the laws of China. We implement appropriate measures to protect your personal information when we transfer your personal information outside of China such as data transfer agreements with the data recipients that incorporate standard data protection clauses or CBDT security assessment, and we will also fulfill the obligations of cross-border transfer of personal information accordingly.

How do we process personal information of minors?

Whilst our services are not ordinarily directed to children, occasionally we may collect your child’s data, for example, when they enter a competition with one of our brands. We will follow the principle of minimum necessity to collect personal information of minors under the age of 14 directly from parents or guardians with the explicit consent of parents or guardians, based on the necessity to achieve the purpose of processing.

If you are the guardian of a child under the age of 14, you should carefully read this privacy statement, the specific privacy protection statement of the product or service (if any) and the Child Privacy Notice before helping the child complete the registration and use of the product or service, so that the child can use the product or service we provide.

Cookies, Website and Application Data; Use for Analytics and Marketing

Our websites may use cookies and similar technologies. You can choose to accept or decline cookies. If you choose to decline cookies, not all elements of our websites, apps and services may function as intended, so your experience may be affected.

To the extent that your local laws consider the information collected by cookies and other technologies as personal information, we will treat that information to the standards set out in this Privacy Notice.

You can find our SDK access list in the "Third Party List". We collect information about your computer browser type and operating system, websites you visited before and after visiting our websites, standard server log information, Internet Protocol (IP) addresses, location data, mobile phone service provider, and mobile phone operating system. We use this information to understand how our visitors use our websites and mobile applications so that we can improve them, the services we offer, and our advertising. We may also share this information with other companies within the GSK group and with other third parties. Some of our websites use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to analyse use patterns and may collect information about your use of the website, including your IP address. More information on Google Analytics can be found here. If you would like to opt-out of having your data used by Google Analytics, you can opt out here.

We also use remarketing services offered by our advertising partners to personalise advertisements for visitors to sites of their advertising networks (i.e. websites other than GSK’s). On these pages, you may be shown advertisements that refer to your interactions with GSK previously. To turn off personalisation for advertisements served by Google click here. To turn off personalisation for advertisements served by Facebook click here. Many companies that display interest-based advertising are members of the Network Advertising Initiative ("NAI"), the Digital Advertising Alliance ("DAA") or the European Interactive Digital Advertising Alliance (“EDAA”). To opt-out of interest-based advertising by members of these initiatives, you can visit their websites at https://optout.networkadvertising.org, https://optout.aboutads.info and https://www.youronlinechoices.com.

We may use the data you share with us to make decisions about your interests and preferences so we can make the marketing materials we send you more relevant. We may also combine the information we hold about you with data about your interests or demographics that third parties have collected from you online and offline, to make your experience more personalised and further tailor our marketing materials. You have certain rights in relation to this – please see “What are your rights regarding your personal information?” above for further information.

We use Facebook custom audience tools. This allows us to provide personalised advertising to you when you use Facebook’s platforms by matching the email address we hold for you with the email address Facebook holds for you, to show you the most relevant GSK advertisements. We only do this where you have given us consent. Sometimes we may also use information about you to build lookalike models. This allows us to generate similar audiences of prospective customers (who may have similar interests or demographics to you) through advertising platforms like Facebook or Google, based on data that the advertising platform holds about other people. Usually this means sharing your email address with our advertising partners. If you wish to opt out of similar audiences in Google, you can do so here.

How do we update this Privacy Notice

From time to time, we will update this Privacy Notice, so as to timely reflect the changes of national laws and regulations and the adjustment of our service policies. Any changes become effective when we post the revised Privacy Notice on our Privacy Centre. This Privacy Notice was last updated as of the “Last Updated” date shown above. If changes are significant, we will provide a more prominent notice to let you know what the changes are. If such updates involve the rights of personal information subjects and matters that may cause you to change your consent or need to obtain your consent again (for example, the purpose of processing, the type of information collected, etc.), we will re-seek your consent to the updated privacy notice in accordance with the provisions of laws and regulations.


Our responsibility regarding websites that we do not own or control.

Our websites and applications may contain links to websites or mobile applications we do not own or control. Our Privacy Notice does not cover them. Please read the privacy notices on those websites and mobile applications if you would like to find out how they collect, use and share your personal information.

Third Party List that GSK shares Personal Information With

SDK

We use SDK from the following parties:

Name of third party: AutoNavi Software Co., Ltd.

Product / type: location services

Personal information involved: technical and network activity information (i.e. physical location)

Purpose: obtain individual’s location

Processing scenario: attendance registration of conference / event, identification of nearby contact point of event

Method of sharing: directly collect by third party

Privacy notice: http://cache.amap.com/h5/h5/publish/238/index.html

 

Entrusted Party

We may share your personal information with the following parties for specific purpose:

Name of third party: AMEX

Personal information involved: basic information, contact information, travel related information (e.g. transportation method, room type), identification information

Purpose: provide conference-related service (including booking of air ticket, train ticket, hotel, within-conference meal ordering)

Processing scenario: conference related logistic arrangement

Method of sharing: collect and provide by GSK

 

Name of third party: Didi Chuxing Technology Co.

Personal information involved: basic information, contact information, travel related information (e.g. itinerary)

Purpose: provide conference-related ground transportation booking service

Processing scenario: conference related ground transportation

Method of sharing: collect and provide by GSK

 

Name of third party: Caocao Chuxing

Personal information involved: basic information, contact information, travel related information (e.g. itinerary)

Purpose: provide conference-related ground transportation booking service

Processing scenario: conference related ground transportation

Method of sharing: collect and provide by GSK

 

Name of third party: UCAR Inc.

Personal information involved: basic information, contact information, travel related information (e.g. itinerary)

Purpose: provide conference-related ground transportation booking service

Processing scenario: conference related ground transportation

Method of sharing: collect and provide by GSK