Privacy notice on product safety activities
Data controller
Galena Pharma Oy, Sammonkatu 10, 70500 Kuopio, Finland
Business ID: 1057172-0
Contact information
Piritta Maunu, Director, Regulatory Affairs and Product Safety, PRRC
Phone: +358 40 6350649
e-mail: piritta.maunu@galena.fi
General Information
Galena Pharma has a legal obligation to monitor adverse events and adverse reactions related to its products in the countries where they are marketed and to continuously assess the benefit-risk balance of its products. This comprehensive activity is referred to as product safety activities.
Through this system and the company's quality policy, Galena Pharma is able to manage adverse events and protect public health. This helps ensure the continued safety of Galena Pharma's products. Competent authorities are responsible for inspecting and assessing the company's product safety system and verifying that it operates in compliance with applicable requirements.
As part of its product safety obligations, Galena Pharma must process information concerning patients and/or reporters of adverse events from which individuals may be directly or indirectly identified. Such information constitutes personal data, and its processing is necessary for Galena Pharma to comply with its legal obligations and to report adverse events and reactions appropriately to the relevant competent authorities.
This Privacy Notice explains how personal data are processed for product safety purposes in accordance with applicable data protection laws and the General Data Protection Regulation (EU) 2016/679 ("GDPR"). If you have any questions regarding this Privacy Notice or the use of your personal data, please contact us using the contact details provided above.
The purpose of processing personal data for product safety activities
As part of its legal obligations, Galena Pharma may process personal data for the following purposes:
- to investigate adverse events and adverse reactions
- to contact you regarding a reported adverse event
- to combine information from the reported adverse event with other adverse event reports received by Galena Pharma in order to conduct an overall assessment of product safety
- to submit the required reports to the competent authority
Classification of personal data
The processing of personal data for product safety purposes is not based on the data subject's consent but on applicable product safety legislation and related legal obligations.
Galena Pharma may process the following categories of personal data:
Patient information
- patient's name and/or initials
- date of birth/age group, sex, height, weight
- information on health status
- Medical history, including
- Information concerning a Galena Pharma product suspected of causing an adverse event, including dosage information, reason for use or prescription, and any modifications to the treatment regimen
- Information concerning the use of other medicinal products or treatments administered during the adverse event or treatment period, including dosage information, duration of use, reason for use or prescription, and any modifications to the treatment regimen
- Information relating to the reported adverse event and its impact on health, treatment received, and any other information potentially relevant to the adverse event, including laboratory test results, previous medications, and medical records
Information on the notifier of an adverse reaction
- name
- contact information (e.g., postal address, e-mail address, telephone number)
- profession (the content of questions according to presumed medical knowledge)
- relationship with the person to whom the notification relates to
Disclosure and transfer of personal data
As part of product safety activities, Galena Pharma may share and/or disclose personal data
- within Galena Pharma for analysis and processing of an adverse event
- with competent authorities in connection with a suspected adverse event
- with service providers engaged by Galena Pharma, including providers of safety databases and medical assessment services
- To companies responsible for the marketing or distribution of products for which Galena Pharma is responsible
- To licensing partners where product safety obligations require the exchange of information
- When publishing information relating to adverse events, such as case studies, in which all identifying information is removed to preserve anonymity
Galena Pharma's product safety databases are located within Europe. However, personal data may need to be transferred to third parties (business partners) and competent authorities. Such recipients may be located outside the European Economic Area (EEA), including countries for which the European Commission has not issued an adequacy decision regarding data protection.
Where personal data are transferred outside the EEA to a country not covered by an adequacy decision, the transfer will be carried out using the European Commission's approved Standard Contractual Clauses (SCCs) or another transfer mechanism permitted under applicable data protection legislation.
Protection of personal data
Galena Pharma has implemented appropriate technical and organizational measures to protect personal data processed for product safety purposes. Access to personal data is restricted to individuals who require such access in order to perform their duties and fulfil applicable legal obligations.
Galena Pharma also maintains procedures designed to protect personal data against accidental or unlawful loss, destruction, alteration, or damage.
Retention period
Galena Pharma retains personal data in accordance with the requirements of applicable product safety legislation for the entire lifecycle of the medicinal product and for 50 years thereafter following the expiry of the marketing authorization of the medicinal product or the withdrawal of the medical device from the market.
Legal grounds for the processing of personal data
The processing of personal data is based on Article 6(1)(c) of the GDPR, which permits processing necessary for compliance with a legal obligation to which the controller is subject, and Article 9(2)(i) of the GDPR, which permits the processing of special categories of personal data for reasons of public interest in the area of public health, as well as any other applicable product safety legislation.
Right to information
You have the right to
- request information about the personal data concerning you that are processed by Galena Pharma
- request the rectification of inaccurate or incomplete personal data
- lodge a complaint to the office of the data protection ombudsman (www.tietosuoja.fi)
- to object to the processing of your personal data where such right is available under applicable data protection legislation
- request erasure of your personal data
The right to erasure may be restricted where the retention of personal data is necessary for Galena Pharma to comply with product safety and regulatory obligations. The above rights may also be restricted to the extent permitted by applicable legislation and where necessary to fulfil legal obligations related to product safety activities.
Galena Pharma will verify the identity of the requester before processing any possible request. The request for information must be sent in writing to the data controller. The data controller will reply to the customer within the set time frame set under the EU Data Protection Regulation (typically within one month). The right to request for information is free of cost when performed once per year maximum.
Changes to this statement
We reserve the right to update this statement as necessary as a part of legislation requirements or the development of our services or website.
Kuopio 30.06.2026
Galena Pharma Oy
