Privacy Policy

This Privacy Policy describes our practices in connection with information that we or our service providers collect through the website or application operated and controlled by us from which you are accessing this Privacy Policy. By providing personal information to us, you acknowledge that you have read and understand this privacy policy.

1. THE TYPES OF INFORMATION WE PROCESS

We may process information about you including, but not limited to:

General information, such as name, postal and/or email address, phone number, date of birth, occupation, job title, and other information; and

Digital information generated from your use of our websites and mobile applications, such as IP address, geo-localization, device ID and data transmitted via cookies. For more information on the cookies used by Orphalan please see our Cookie Policy.

2. WHY WE PROCESS YOUR INFORMATION

2.1 – We may process your personal information for purposes including, but not limited to:

• Providing information and updates on our products.
• Responding to enquiries, and inviting individuals to our events;
• Engaging with healthcare professional and key opinion leaders;
• Conducting surveys and interviews with healthcare professional to help us improve our products;
• Providing information about our products and services;
• Complying with regulatory obligations;
• Improving the content, functionality and usability of our websites;
• Personalising the content of our websites according to the user’s interests;
• Managing and administrating our business.

2.2 – Where we process personal information, we make sure that we have a lawful basis, including:

• Processing is necessary to perform our contractual obligations with our customers;
• You have provided consent/authorization (in which cases, such consent can be withdrawn at any time);
• Processing is necessary to comply with legal and regulatory obligations;
• Processing is necessary to protect the vital interests of an individual;
• Processing is in the public interest;
• Processing is necessary to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
• Processing is in Orphalan’s legitimate interests, such as managing and administrating the operation of our business effectively and efficiently; complying with internal policies and procedures; monitoring the use of our copyrighted materials; conducting scientific and statistical research; improving our products and services; and obtaining further knowledge of current threats to network security to update our security solutions and provide these to the market.

2.3 – SENSITIVE INFORMATION

Unless we specifically request or invite it and ask for your prior written authorisation where required by law, we ask you not to send us, and not to disclose, any sensitive personal information or any protected healthcare information (e.g., Social Security numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health or medical conditions, sex life or sexual orientation, criminal background, or trade union membership, or biometric or genetic data) on or through the Website or otherwise to us.

3. USE BY MINORS

The Service is not intended to individuals under the age of 18, and we request that these individuals not provide personal information through the Website. We protect children privacy rights in line with US Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Act (GDPR). The website does not knowingly collect, use, or disclose personal information from children without prior parental consent, except as permitted by applicable legislation.

If your child has submitted personal information and you would like to request that such personal information be removed, please contact us as explained below under Contacting Us.

4. DISCLOSURE OF YOUR INFORMATION TO THIRD PARTIES

4.1 We may share your personal information within the Orphalan group of companies worldwide for the purposes described above.

4.2 We may also share your personal information outside of the Orphalan group for the following purposes:

• with our business partners. For example, this could include our partners from whom you or your company or your organisation purchased the Orphalan product(s). Personal information will only be transferred to a business partner who is contractually obliged to comply with appropriate data protection obligations and the relevant privacy and confidentiality legislation;
• with third party agents and contractors for the purposes of providing services to us (for example, Orphalan’s accountants, professional advisors, IT and communication and marketing providers and debt collectors). These third parties will be subject to appropriate data protection obligations and they will only use your personal information as described in this Privacy Policy;
• to the extent required by law, for example if we are under a duty to disclose your personal information in order to comply with any legal obligation (including, without limitation, in order to comply with tax reporting requirements and disclosures to regulators), or to establish, exercise or defend its legal rights;
• if we sell our business or assets, in which case we may need to disclose your personal information to the prospective buyer for due diligence purposes; and
• if we are acquired by a third party, in which case the personal information held by us about you will be disclosed to the third party buyer.
• We do not sell your personal information to any third parties for direct marketing or advertising purposes. Currently we do not use advertisement related cookies (in detail please read the Cookie Policy).
• We have worked with certain third-party social media providers to offer you their social networking services through our website. For example, you can use third-party social networking services, including but not limited to LinkedIn and others, to share information about our Services which you can access via our website. These social networking services may be able to collect information about you, including your activity on our Services. These third-party social networking services also may notify your connections, in accordance with applicable law and their own privacy policies. If you choose to access or make use of third-party social networking services, we may receive information about you that you have made available to those social networking services.

5. INTERNATIONAL TRANSFERS OF PERSONAL DATA

5.1 Where we transfer your personal information to another country outside the USA, we will ensure that it is protected and transferred in a manner consistent with legal requirements. In relation to data being transferred outside of USA, for example, this may be done in one of the following ways:

• as we are a European Company subject to GDPR the country that we send the data to might be approved by the European Commission as offering an adequate level of protection for Personal Data;
• the recipient might have signed up to a contract based on “model contractual clauses” obliging them to protect your personal information.

5.2 You can obtain more details of the protection given to your personal information when it is transferred outside USA (including a copy of the standard data protection clauses) by contacting us as described in paragraph 10 below.

6. HOW WE SAFEGUARD YOUR INFORMATION

6.1 We have extensive controls in place to maintain the security of our information and information systems. Client files are protected with safeguards according to the sensitivity of the relevant information. Appropriate controls (such as restricted access) are placed on our computer systems. Physical access to areas where personal information is gathered, processed or stored is limited to authorised employees.

6.2 As a condition of employment, Orphalan employees are required to follow all applicable laws and regulations, including in relation to data protection law. Access to sensitive personal information is limited to those employees who need to it to perform their roles. Unauthorised use or disclosure of confidential client information by a Orphalan employee is prohibited and may result in legal and disciplinary measures.

7. HOW LONG WE KEEP YOUR PERSONAL DATA

How long we will hold your personal information for will vary and will be determined by the following criteria:

• the purpose for which we are using it – Orphalan will need to keep the data for as long as is necessary for that purpose or
• until your consent/authorization is withdrawn; and
• legal obligations – laws or regulation may set a minimum period for which we have to keep your personal information.

8. YOUR RIGHTS

8.1 In all the above cases in which we collect, use or store your personal information, you may have the following rights, and, in most cases, you can exercise them free of charge. These rights include:

• the right to obtain information regarding the processing of your personal information and access to the personal information which we hold about you;
• the right to withdraw your consent/authorization to the processing of your personal information at any time. Please note, however, that we may still be entitled to process your personal information if we have another legitimate reason for doing so. For example, we may need to retain personal information to comply with a legal obligation;
• in some circumstances, the right to receive some personal information in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to personal information which you have provided directly to Orphalan;
• the right to request that we rectify your personal information if it is inaccurate or incomplete;
• the right to request that we delete your personal information in certain circumstances. Please note that there may be circumstances where you ask us to erase your personal information but we are legally entitled to retain it;
• the right to request that we restrict our processing of your personal information in certain circumstances. Again, there may be circumstances where you ask us to restrict our processing of your personal information but we are legally entitled to refuse that request; and
• the right to lodge a complaint with the relevant data protection regulator if you think that any of your rights have been infringed by us.

8.2 You can exercise your rights by contacting us using the details listed in paragraph 10 below.

9. ACCESS FROM STATE CALIFORNIA

9.1 CCPA Privacy Notice (Notice for California Consumers)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”) gives California residents the right to know what Personal Information Orphalan SA (“Orphalan,” “we,” “us,” or “our”) collects about them, including whether it is being sold or disclosed to third parties. “Personal Information” (or “PI”) means any information that identifies, relates to, describes, or is capable of being associated with you or your household, whether directly or indirectly.

The types of Personal Information we collect and disclose depends on your relationship and interaction with us. Please review the information below to learn about our data collection and disclosure practices generally. The information below describes the categories of personal information we have collected in the preceding 12 months, including the categories of data sources from which the personal information was collected, the purposes for collecting or disclosing the PI, and the third parties to whom we disclose the personal information.

We have not sold or shared PI about California consumers in the past twelve months. Relatedly, we do not have actual knowledge that we sell or share PI of California consumers under 16 years of age. For purposes of the CCPA, a “sale” is the disclosure of PI to a third party for monetary or other valuable consideration without the data subject directing us to do so.

To “share” is the disclosure of PI to a third party for cross-context behavioural advertising, whether or not for monetary or other valuable consideration, without the data subject directing us to do so.

We may collect and disclose any and all PI to our service providers and corporate affiliates (but only as necessary or appropriate to perform legitimate business purposes). We also collect and disclose any and all PI as necessary to: comply with laws and regulations; for compliance reasons and legal and regulatory requirements; comply with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and exercise or defend our legal rights and our employees, affiliates, customers, contractors, and agents. In case of change to the above we will provide you notice in advance.

9.2 Rights under CCPA

• Notice: Before or at the time we collect Personal Information from you, you have the right to receive notice of the Personal Information to be collected and the purposes for which we use it, and the right to request that we disclose to you the categories of PI we have collected about you in the preceding 12 months, and its data source categories and purpose for collecting or selling the PI, the categories of third parties to whom we disclosed the PI, and the categories of third parties to whom we sold the PI, if any.
• Access: to request that we disclose or provide you with access to the specific items of PI we have about you collected in the preceding 12 months.
• Deletion: to request that we delete your PI we collected. However, in certain situations we are not required to delete your PI. If the information is necessary in order to complete the transaction for which the PI was collected, to provide a requested goods or services, to comply with a legal obligation, to engage in research, to secure our websites or other online services, or to otherwise use your Personal Information internally in a lawful manner that is compatible with the context in which you provided the information.
• Correction: we must correct any inaccurate PI of you that we process, upon your request.
• Limit the Use of Sensitive Personal Information (“SPI”):

You can limit the use of your SPI to the CCPA authorized purposes.

• Not to Be Subject to Discrimination: to be free from discrimination or retaliation for exercising any of your rights under the CCPA as described above.

You can exercise your rights by writing an email to the address specified at Section 10.

Verification: if you exercise your above rights we must first verify your identity to make sure that you are the person about whom we have collected PI.

9.3       Disclosure About Direct Marketing for California Residents

California Civil Code § 1798.83 Disclosure statement: We do not distribute your PI to other entities for their own direct marketing purposes.

Notice (required information on the PI we collect):

Identifiers:  A real name, alias, postal address, unique personal identifier, online identifier, internet protocol (IP) address, email address, account name, phone number or other similar identifiers. (not an exhaustive list)

Source(s) of PI:

• Directly from you
  • From non-affiliated parties, including those to whom you have previously provided data

Purpose(s) for Collection or Disclosure of the PI:

• For our regular business purposes, like to process your requests, inquiries, or other communications with us
  • To conduct research related to our current or prospective products or services
  • To detect security incidents and other fraudulent activity
  • To monitor and improve our website functionality
  • For marketing purposes to deliver content and product and service offerings, including targeted offers and ads (with your consent, as required by law)
  • To help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business
  • To respond to law enforcement requests as required by applicable law, court order, or government regulation

Third Parties to Whom We Disclose PI:

• Service providers
  • Government organisations

Third Parties to Whom We Sell PI:

• We do not sell this PI

Network Activity Data: Internet or other digital network activity information, such as browsing & search history, and information regarding an individual’s interaction with an internet website, application, or advertisement. (not an exhaustive list)

Source(s) of PI:

• Directly from you
  • From non-affiliated parties, including those to whom you have previously provided data

Purpose(s) for Collecting or Disclosing PI:

• For our regular business purposes such as to process your requests, inquiries, or other communications with us
  • To detect security incidents and other fraudulent activity
  • To monitor and improve our website functionality
  • To personalize your website experience
  • For marketing purposes to deliver content and product and service offerings, including targeted offers and ads (with your consent, as required by law)
  • To help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business
  • To respond to law enforcement requests as required by applicable law, court order, or government regulation

Third Parties to Whom We Disclose PI:

• Service providers
  • Government organizations

Third Parties to Whom We Sell PI:

• We do not sell this PI

10. QUESTIONS AND CONCERNS

10.1 If you have any questions or concerns about Orphalan’s handling of your Personal Data, or about this Policy, please contact our Data Privacy Officer using the following contact information:

Address:
Orphalan Inc.
159 North Sangam on Street, Suite 200,
Chicago,
Illinois 60607, United States of America

Email Address: dataprivacy@orphalan.com

10.2 We are usually able to resolve privacy questions or concerns promptly and effectively. If you are not satisfied with the response you receive, you may escalate concerns to the applicable privacy regulator in your jurisdiction. Upon request, Orphalan’s Data Privacy Officer will provide you with the contact information for that regulator.

11. UPDATES TO THIS PRIVACY POLICY

11.1 – We may change this Privacy Policy at any time. Any changes will become effective when we post the revised Privacy Policy on this website. Your use of our services following these changes means that you accept the revised Privacy Policy. We recommend that you regularly review the Privacy Policy when you visit our website.

11.2 – This policy was last updated in February 2023.