On 1 January 2015, the Irish Pharmaceutical Healthcare Association (IPHA) adopted Annex V of the IPHA Code of Practice for the Pharmaceutical Industry on disclosure of transfers of value from companies to healthcare professionals (HCPs) and healthcare organisations (HCOs). According to this, all member companies are obliged to disclose publicly details related to payments and other transfers of value made to HCPs and HCOs in Ireland. The main purpose of disclosure is to enhance transparency on interactions between the industry and HCPs and HCOs.
The IPHA Code states that in deciding how a transfer of value should be disclosed, companies should, wherever possible, identify and publish at the individual HCP (rather than HCO) level, as long as this can be achieved with accuracy, consistency and compliance with applicable law.
Roche Products (Ireland) Limited, its parent company Roche Holding Limited and all subsidiaries/affiliates thereof (Roche) are fully committed to complying with these requirements to the maximum extent possible. At the same time, Roche is dedicated to ensuring compliance with all applicable data protection laws and regulations and will therefore disclose publicly your personal data for this purpose only with your prior consent. Roche Products (Ireland) Limited at the address below is the controller of relevant personal data.
What individually identifiable Transfer of Value information would be made publically available concerning me?
The public disclosure, if you consent to it in respect of the year 2017, would include the following information:
· Full name
· Principal practice address
· Unique country identifier
· The aggregate amount of direct and indirect transfers of value attributable to you in the reporting period for each of the following categories:
o Contributions to costs of events:
- Registration fees
- Travel and accommodation
o Fees for service and consultancies:
- Related expenses agreed in the written agreement
The value of the disclosed transfers of value will be determined on the basis of the respective expenses incurred by Roche.
Where would such Transfer of Value information be published?
The report will be published on the IPHA website: www.transferofvalue.ie.
Transfers of value provided for the purpose of “research and development” will be published on an aggregate company basis without disclosing your identity and we are not relying on your consent for this processing, as a result. Individual Transfers of Value will also not be disclosed on an individual basis if not permitted for legal reasons.
Period for disclosures and retention of data
Disclosures are made on an annual basis until June 30 of each year for the preceding full calendar year (the reporting period). Disclosure will be made publicly and is required to remain in the public domain for at least three years after the time the information is first disclosed.
Roche will also document all individual Transfers of Value required to be disclosed under the IPHA Code and maintain the relevant records of the disclosures made under the Code for 5 years after the end of the relevant reporting period.
Nature of the consent and your ability to withdraw it
Consenting to the disclosure is entirely voluntary, is on an annual basis, and may be withdrawn at any time without any detrimental effect on you or on your relationship now or in the future with Roche Products (Ireland) Limited or the Roche group.
If you withdraw your consent to the processing of your individual transfers of value disclosure, we will remove such individual record from the information publically available on www.transferofvalue.ie and we will instruct any third parties processing such data on our behalf to do similarly. However, and as you might expect, we may not be able to delete information which is outside of our control. We will also delete the relevant information from our systems, except where required to keep it by law.
For process reasons, please communicate your wish to withdraw consent for an upcoming disclosure in writing to the Compliance Function of Roche Products (Ireland) Limited by no later than 31 May of that relevant year.
Where you do not respond to this letter, we will not publish any individual Transfer of Value information relating to you as you will not have given us your written consent.
Compliance with laws and transfers abroad
Roche as data controller as well as all other companies within the Roche Group are fully committed to complying with all applicable data privacy laws, including the GDPR (once applicable), the Swiss Data Privacy Act, and other applicable data privacy laws and principles as amended from time to time.
In connection with the above we may transfer your personal data outside the European Economic Area, including to a jurisdiction which is not recognised by the European Commission as providing for an equivalent level of protection for personal data as is provided for in the European Union. If and to the extent that we do so, Roche will ensure that appropriate measures are in place to comply with our obligations under applicable law governing such transfers to protect the privacy and fundamental rights and freedoms of individuals. Further details of the measures that we have taken are available from the Compliance Manager, contactable at (01) 4690700.
In addition to your right to withdraw your consent, as outlined above, you have the following rights, in certain circumstances, in relation to your personal data in the Transfer of Value context:
· the right to access your personal data;
· the right to request the rectification and/or erasure of your personal data;
· the right to restrict the use of your personal data; and
· the right to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format or to require us to transmit that data to another controller.
In order to exercise any of the rights set out above or for further information, please contact the Compliance Manager at (01) 4690700.
You have the right to lodge a complaint with the Irish Data Protection Commission (firstname.lastname@example.org) or your local data protection supervisory authority.