GSK Healthcare Professional Privacy Notice

What personal information do we collect about you? 

What personal information do we collect about you? 

The personal information we collect, and process, may include:

• Basic information – your name, surname (including prefix or title), alias, gender, age or date of birth, as well as your preferred language; your city of location;
• Personal identity information – ID card number.
• Contact information – information that enables us to contact you, e.g. your email address, mailing address, telephone numbers and profile on a social media platform; 
• Professional information and experience – information related to your qualifications, areas of expertise, place of practice, medical practitioner number and qualification certificate information; hospital level, hospital address, your hospital and department, professional title, position, expertise; academic research records, publications, etc.;
• Financial information – bank account information, remuneration details;
• Technical and network activity information – information about your device and your usage of our websites, apps, WeChat mini programs, WeChat official accounts and systems, including your IP address, device ID, hardware model and version, mobile network information, operating system and other online identifiers, website browsing logging; your WeChat open ID, unique ID, nick name and profile picture;
• Conflicts – circumstances which may create a conflict of interest – including whether you or a close family member are an officer or employee of a political party, candidate for public office or hold a position in government;
• Professional biography and/or other information – including your CV/resume, academic information and your interests (such as any specific health care topics about which you request information from GSK);
• Product use – data related to your use of our products, your interactions with us, your preferred method of communications with us, and services you may use, your activity data (for example, whether you have opened the email we sent to you, whether you have accept invite to webinar, whether you have opened and read the WeChat promotion articles we shared with you, whether you have attended meetings hosted by GSK and/or partners, meeting durations etc.)
• Signature – copy of your hand-written signature or your e-signature;
• Photo or video that contains individual – photo or video that records taken when you attend meeting or activity hosted by GSK and/or partners, photo collected to verify your qualification; and
• Survey result – your answers to survey, including any survey result involving illness or physician practice.

You can choose not to give us personal information when we ask you for it. If you decide not to give us your personal information, it may restrict our relationship with you. For example, we may not be able to provide you with the services that you have requested.

How do we collect your personal information?

Directly from you when you:

• Create an account and profile in the GSK Pro Portal or other GSK websites, apps, WeChat mini programs, WeChat official accounts and systems; 
• Share or use your social media profile to contact GSK; 
• Register with us to use GSK’s authentication services;
• Use GSK Pro Portal or other GSK websites, apps, WeChat mini programs, WeChat official accounts and systems;
• Sign up with us to receive promotional material; 
• Engage with one of our sales representatives, medical science liaisons or call centers;
• Get in touch for support or to provide feedback;
• Attend an online event such as a webcast;
• Respond to any surveys that you may choose to participate in;
• Share adverse events or medical information enquiries with us; and 
• Attend offline meetings, such as advisory boards or conferences.

From other sources:

• Data companies providing information services in the healthcare sector (including Veeva Opendata, aPureBase, IQVIA and Wilmington Healthcare);
• Third-party cooperation platform authorized by you;
• Publicly accessible sources;
• Joint marketing partners;
• Marketing vendors;
• Healthcare provider directories;
• Patient organisations;
• Events management agencies;
• Professional social media platforms; and
• When you talk about us online, like when you mention a GSK product in a Tweet.

If you connect your social media account to your GSK Pro Portal or other GSK portal account, you will share certain personal information from your social media account with us. This may include your name, email address, photo, list of social media contacts, and any other information you make accessible to us when you connect your social media account to your GSK Pro Portal or other GSK portal account.

We also combine information about you from various sources, including the information you provide to us and personal information, which is collected during your relationship with us.

Why we are allowed to process your personal information?

We can process your personal information when one of the following applies:

• Where your consent is obtained;
• Where it is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or for the implementation of human resources management in accordance with the labour rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law;
• Where it is necessary for the performance of statutory duties or statutory obligations, such as providing your personal information to the social insurance authorities for the purpose of making social insurance contributions;
• Where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person;
• Where such acts as news reporting and supervision by public opinions are carried out for the public interest, and the processing of personal information is within a reasonable scope;
• Where it is necessary to process the personal information disclosed by you or other personal information that has been legally disclosed within a reasonable scope in accordance with the law; and
• Other circumstances prescribed by laws and administrative regulations. 

What are your rights regarding your personal information?

You have rights we need to make you aware of. The rights available to you depend on our reason for processing your personal information and the laws and regulations in China. Depending on this you may have the right to take the following actions to the extent permitted by the law:

• Ask us for copies of your personal information;
• Ask us to correct information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete;
• Ask GSK about the processing of your personal information;
• Ask us to delete your personal information under any of the following circumstances;
  • where the purpose of processing has been achieved, it is impossible to achieve such purpose, or it is no longer necessary to achieve such purpose;
  • where we cease to provide products or services, or the retention period has expired;
  • where you withdraw your consent;
  • where we process your personal information in violation of laws, administrative regulations or the agreement with you; or
  • other circumstances stipulated by laws and administrative regulations;
• Ask us to restrict the processing of your information;
• Object to our processing of your personal information; 
• Ask us to explain our rules for processing your personal information;
• Ask that we transfer information you have given us from one organisation to another, or to give it to you; and
• If we deny your request to exercise your rights or your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal information, you can file a lawsuit in the People's Court in accordance with the law.

You can find out how to get in touch with us to ask us to do any of the above by looking at the ‘Contact information and your privacy point of contact’ section.

For your protection, and to protect the privacy of others, we may need to verify your identity before completing what you have asked us to do. After verifying your identity, we will respond to your request based on the above rights in a timely manner and give a reply and reasonable explanation within 15 working days after receiving your request.

If you object to us using your personal information or withdraw permission for us to use your personal information, after initially giving it to us, we will respect your choice in line with applicable law. However, by objecting or withdrawing your permission, we may not be able to complete the processing activities described in the “How do we use your personal information or process your personal information in other ways”. Please note that if your personal information is processed based on a statutory basis other than your individual consent, the processing will not be impacted by the withdrawal of your consent. In addition, according to the relevant laws, if you withdraw your consent, it will not affect the validity of any personal information processing activity conducted based on your consent before such withdrawal.

Will your personal information be shared, transferred or disclosed?

Will your personal information be shared, transferred or disclosed?

We share your personal information on a need to know basis, and to the extent necessary for the purposes listed in “How do we use your personal information or process your personal information in other ways” and provided that laws and regulations are followed.

We share your personal with members of the GSK group. You can query the name and contact information of GSK affiliates by accessing GSK’s worldwide contacts. We promise that all sharing is limited to your necessary personal information and is subject to this Privacy Policy; If we want to change the purpose of using and processing personal information, we will ask your authorization again. At the same time, we will strictly comply with the requirements of relevant laws and regulations on cross-border data transmission.

Except for the following circumstances, we will not share your personal information with any company, organization or individual other than members of the GSK group:

• We may share your personal information with your explicit consent: After obtaining your explicit consent, we will share your personal information with other parties. 
• We may share your personal information in accordance with the laws and regulations, or mandatory requirements from government authorities. 
• We may share your personal information with the authorized partners: solely for the purpose stated in this policy, some of our services will be provided by the authorized partners. We list the circumstances where we share your personal information with the authorized partners. For any details, please refer to Third Party List. 

For authorized partners who we share your personal information with, we will sign a strict confidentiality agreement with each of them and ask them to handle your personal information in accordance with our instructions, this Privacy Policy and any other relevant confidentiality and security measures.

Entrustment

We will also share your personal information with other specialised service providers (please write to inquire about the specific name and contact information through the contact information set forth in this Privacy Notice) who work with us. They will process your personal information on behalf of GSK, and GSK will supervise the personal information processing activities of the third parties in accordance with the laws and regulations to ensure that they only process personal information within the scope of processing purposes, processing methods and types of personal information agreed with GSK:

• Event agencies; 
• Marketing agencies;
• Technology suppliers who work with us to develop and improve our websites, digital forums and apps;
• Media services providers who work with us;
• Healthcare service providers who work with us;
• Suppliers managing adverse event reports; and
• Professional advisors, such as auditors, accountants and lawyers.

Transfer

We will not transfer your personal information to any company, organization or individual, except: 

• Transferring with your explicit consent: After obtaining your explicit consent, we may transfer your personal information to other parties; 
• During merger, division, dissolution or bankruptcy liquidation, if the transfer of personal information is involved, we will require the new entity holding your personal information to seek for consent from you. We will comply with the corresponding notification and other obligations in accordance with the law.

Public disclosure

We will not publicly disclose your personal information without obtaining your prior consent, unless we have a legal right or obligation to do so.

How do we process personal information of minors?

Our services are not directed to minors and we do not collect any personal information from minors.