Source: http://sirtex.com/us/privacy-information/
Timestamp: 2019-04-26 00:11:22+00:00

Document:
The information below is also available as a PDF document.
The purpose of this Policy is to define how Sirtex collects, uses and discloses personal information.
This Policy applies to all personal information collected and used by Sirtex Medical Limited and all its subsidiary companies.
GDPR: General Data Protection Regulation. The General Data Protection Regulation 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the export of personal data outside the EU and EEA areas. The GDPR aims primarily to give control to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.
Personal information: For the purposes of this Policy “personal information” (or “personal data”) means any information related to an identified or identifiable natural person. This includes, for example, your name, your address and your IP address.
All Sirtex personnel are responsible for reading, understanding and complying with all formal Sirtex policies, procedures and protocols, including those related to privacy and personal data.
All Sirtex personnel will be aware of this policy and suitably trained in their responsibilities under this policy.
Sirtex Medical Limited ACN 078 116 122, Level 33, 101 Miller St, North Sydney NSW 2060, Australia, and all of its subsidiaries are committed to protecting the privacy of information, and to handling personal information in a responsible manner in accordance with the Privacy Act 1988 (Cth), the Privacy Amendment (Enhancing Privacy Protection) Act 2012, the Australian Privacy Principles (“APPs”), relevant Australian State and Territory privacy legislation as well as appropriate legislation concerning privacy in other countries and regions in which Sirtex operates and/or where Sirtex products are distributed, including but not limited to the GDPR and US Health Insurance Portability and Accountability Act of 1996 (HIPAA), (collectively referred to as privacy legislation).
EU residents may find specific information on the data processing, including the relevant legal bases and their rights regarding the processing, in Section 7.20 of this Policy.
consents and agrees to such collection and processing.
The type of personal information that may be collected will depend on Sirtex’s relationship with the person, and the circumstances of collection.
details of relevant health care professional(s).
information provided in “free text” fields when completing information sheets and forms, such as pre-treatment evaluation forms.
doctors’ certificates in the case of sick leave.
so as to better provide tailored information around Sirtex products and services.
7.3 From whom does Sirtex collect personal information?
Wherever practicable Sirtex will only collect information from any person personally. However, Sirtex may also need to collect information from other sources such as treating health care providers, carers and guardians. Where personal data is obtained from a third person other than the data subject, the data subject must be informed about the data processing after obtaining the information.
In the case of persons seeking employment with Sirtex, information in an applicant’s resume may be verified by contacting referees. Sirtex may also obtain information about an individual seeking employment from a recruiter.
Salary survey data may be collected from third parties which is used to assess and determine salaries to be paid to officers of Sirtex and staff.
Sirtex will only collect information from third parties when it is not reasonable and practical to collect the information from any person directly.
7.4 When does Sirtex collect Personal Information?
Sirtex may also need to collect personal and sensitive information in order to comply with legal obligations.
Personal information is stored and held in a combination of hard copy and electronic files maintained by Sirtex, and on personal devices, including laptop computers.
7.6 How is Personal Information Used?
Sirtex uses personal information that is reasonably necessary for one or more functions (the primary purpose), or for a related secondary purpose that would be reasonably expected by any person, or to which any person has consented.
to manage the relationship between Sirtex and officers, contractors and employees (including making salary and superannuation payments, managing performance and managing a person’s career with Sirtex).
When collecting personal data Sirtex will inform the data subject as to which specific categories of personal data are being collected and for which purposes.
for a permitted health situation (as defined in Section 16B of the Privacy Act 1988 (Cth) (or other international privacy legislation)).
Sirtex service providers are required by contract to protect the confidentiality of the personal information Sirtex shares with them, and to use it only to provide services on behalf of Sirtex.
7.9.5 When does Sirtex disclose Personal Information?
Sirtex Medical Limited has business operations in numerous locations worldwide. By sharing personal information with Sirtex, that personal information may be transferred to, or be accessible by businesses in other countries that form part of the Sirtex group.
The countries in which such recipients are likely to be located are Australia, Singapore, United States & Germany.
Information may be provided to service providers located outside Australia. The locations of the service providers may change from time to time.
The countries in which service providers are likely to be located are Australia, Singapore, United States & Germany.
When disclosure is to be made to a known overseas entity, Sirtex will take reasonable steps to assess the privacy laws of the country where information will be disclosed to determine whether the overseas recipient is required to comply with privacy laws that are at least as stringent as the APP requirements in relation to information. Sirtex service providers are required to enter into a contract pursuant to which they agree to protect the confidentiality of the personal information Sirtex shares with them, and to use the information only to provide services on behalf of Sirtex.
At the request of Sirtex, Google will use this information for the purpose of measuring any person’s activity on our website, compiling statistical reports on overall website activity for Sirtex on an anonymous basis and providing other services relating to website activity and internet usage. The IP address transmitted by Google Analytics as part of Google Analytics will not be merged with other Google data.
In addition, any person can prevent the collection of the data generated by the cookie by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available from the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
Sirtex takes all reasonable steps to ensure the personal information Sirtex holds, uses and discloses is accurate, complete and up-to-date. These steps include ensuring that the personal information is accurate, complete and up-to-date at the time of collection, and when using or disclosing the personal information.
On an ongoing basis Sirtex maintains and updates personal information when Sirtex is advised by any person or when Sirtex becomes aware through other means that the personal information has changed.
Please contact Sirtex if any of the details provided to Sirtex change. Any person should also contact Sirtex if they believe that the personal information Sirtex has about them is not accurate, complete or up-to- date.
Employee personal information is retained in secure hard copy and electronic files, and is only accessible by human resources staff, accounts staff and directors on a need to know basis.
Whilst Sirtex endeavours to take all appropriate measures, Sirtex cannot guarantee the security of personal information sent online. Persons must bear this in mind when providing personal information online to Sirtex.
If Sirtex no longer needs the personal information for any purpose for which it may use or disclose the information (for example when an employee has been terminated), and the information is not otherwise required to be kept under an Australian law or court order, Sirtex will take reasonable steps to destroy or permanently de-identify the information as appropriate.
Sometimes Sirtex may be provided with personal information without having sought it through normal means of collection. Sirtex refers to this as “unsolicited information”. Where Sirtex collects unsolicited information Sirtex will only hold, use and or disclose that information if Sirtex could otherwise do so had Sirtex collected it by normal means. If that unsolicited information could not have been collected by normal means then Sirtex will destroy, permanently delete or de-identify the information as appropriate.
Persons may request access to the personal information Sirtex holds about them, or request that Sirtex change and/or update the personal information Sirtex holds, by contacting Sirtex.
Upon request, Sirtex will give any person access to the personal information held about them, unless specific limitations apply (for example, if the request is frivolous or vexatious, or providing access would be unlawful).
Sirtex will respond to a request for access to personal information within a reasonable period after the request is made, and give access to the personal information in the manner requested, if it is reasonable and practicable to do so.
If Sirtex does not agree to provide any person with access, or to amend their personal information as requested, the person will be notified accordingly. Where appropriate Sirtex will provide the reason/s for the decision, and the mechanisms available to complain about the refusal. If the rejection relates to a request to change a person’s personal information, that person may make a statement about the requested change and Sirtex will attach this to their record.
Where the request to access personal information is made by or on behalf of a current or former employee, disclosure of such information shall be made in line with the prevailing privacy legislation in that jurisdiction.
If any person has a complaint about the privacy of their personal information, Sirtex requests that they contact Sirtex in writing by email, letter, and facsimile or by personal delivery to any one of the Sirtex contact details as set out below. Any person may also make a complaint verbally. Upon receipt of a complaint Sirtex will consider the details and attempt to resolve the matter in accordance with Sirtex complaints handling procedures.
Sirtex will respond to the complaint within a reasonable time (usually no longer than 30 days), and Sirtex may seek further information from the person in order to provide that person with a full and complete response.
If any person is dissatisfied with Sirtex’s handling of a complaint or the outcome, they may make an application to the Office of the Australian Information Commissioner by calling them on 1300 363 992, contacting them online at www.oaic.gov.au, or by writing to the Office of the Australian Information Commissioner at GPO Box 5218 Sydney NSW 2001, or the Privacy Commissioner in your State or Territory.
If any person chooses to provide Sirtex with personal information, that person understands and consents to the transfer of their information to Sirtex locations and systems in Australia and around the world.
Sirtex websites may contain links to other websites. Sirtex does not share personal information with those websites, and Sirtex is not responsible for their privacy practices. Sirtex is not responsible or liable for, and does not endorse, the data privacy practices or the content of any other linked sites.
Any person can contact Sirtex using the contact form provided on the website, via e-mail or phone, e.g. for requesting information about Sirtex products, services or clinical trials. In this case Sirtex processes the details from the inquiry form, including the contact details (e.g. name, e-mail address, country of origin) the sender’s role, the topic of the request and any other information provided by the sender in the inquiry. Sirtex will use this information to respond to the communications, fulfil the requests, or provide other support. The legal basis is Art. 6 (1) 1 lit. b GDPR. The information will be deleted after the inquiry is concluded.
If a person visits a Sirtex website without using the service offered by Sirtex and without providing Sirtex with personal data, Sirtex automatically collects information about the user in so-called server log files. This information includes the browser type and browser version, the operating system used, the referrer URL, the host name of the accessing computer, time of service request, and the IP address. The user’s browser automatically sends this information to Sirtex.
The legal basis for the processing of personal data is Art. 6 (1) 1 lit. b GDPR and Art. 6 (1) 1 lit. f GDPR. We have a legitimate interest in ensuring the security, stability and effective use of our website. We assume that the problem-free use of the website is in your interest as well.
documents provided as evidence of skills, qualifications, training, work history, identity and legal right to work.
Where the applicant is a health professional, this may additionally include the data listed in Section 7.2.3.
Personal data provided by any person to support their job application is used for the purpose of managing the Sirtex recruitment process. The legal basis is Art. 6 (1) 1 lit. b GDPR.
If the application process is completed without an offer for employment the personal data will be deleted six months after the conclusion of the recruitment process, unless the applicant agrees that Sirtex will keep a record of the application in order to contact that person about future job opportunities, and send emails about job opportunities with Sirtex. The legal basis is Art.6 (1) 1 lit. a GDPR. The consent is given freely and can be withdrawn any time with effect for the future.
The legal basis for processing is Article 6 (1) (1) (b) GDPR. The personal data will be stored for the duration of the employment. Legal retention obligations remain unaffected.
If a person is interested in applying for and/or participating in a clinical trial, Sirtex will then provide more information on the intended data processing prior to the application, including with regard to health data where an explicit consent will generally be necessary. Sirtex may then process the data listed in Section 7.2.1. The data will be used by Sirtex to evaluate whether an individual is suitable to participate in a clinical trial. The details of the clinical trial, including the relevant data processing, will be outlined in the Patient Information Sheet & Consent Form that any person will be provided before participating in a clinical trial. The personal data, particularly the health data, will only be processed for the clinical trial after the person consented. The legal basis is Art. 6 (1) 1 lit. a GDPR.
If a person is interested in applying for and/or participating in the conduct of a clinical trial, Sirtex will then provide more information on the intended data processing prior to the application, including with regard to health data where an explicit consent will generally be necessary. Sirtex processes the personal data listed in Section 7.2.3 of health professionals for the purposes of applying to, and/or participating in conducting clinical trials. The legal basis is Art. 6 (1) 1 lit. b GDPR. The data will be deleted as soon it is not needed anymore for the above-mentioned purposes.
If a person is interested in attending a Sirtex presentation or training session Sirtex will process the person’s name and contact details (address, e-mail-address). If the person is health professional, Sirtex may additionally use the personal data listed in Section 7.2.3.
Sirtex may use some of the personal information (e.g. in particular health information) to create a profile from the interactions Sirtex has with any person to help Sirtex understand what information that person might be interested in receiving, to invite any person to participate in surveys and provide feedback to Sirtex, to provide a personalised experience when any person interfaces with Sirtex and/or to contact any person with information and notices related to their use of Sirtex websites. In these instances an explicit consent is necessary.
The legal basis is Art. 6 (1) 1 lit. f GDPR. Sirtex has a legitimate interest to analyse our customers’ interests and provide direct marketing upon receipt of appropriate consent.
Where the transfer is necessary to fulfill a contract, the legal basis is Art. 6 (1) 1 lit. b GDPR. If Sirtex is required to transfer data by law the legal basis is Art. 6 (1) 1 lit. c GDPR.
Where the third party is located outside the European Union and/or the European Economic Area, particularly Australia, Singapore, USA. Sirtex will only transfer data to recipients in these countries if an adequate level of data protection at the location of the recipient is ensured, e.g. because the recipient (in the USA) is EU US Privacy Shield certified or the recipient and Sirtex concluded standard contractual clauses (for processors: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0087, for controllers: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32004D0915).
Sirtex may use the personal information listed above to comply with regulatory requirements, such as maintaining a record of medical queries, complaints, adverse events and recalls relating to Sirtex products and/or to contact any person to satisfy any of our legal or regulatory obligations. This may also include disclosure of personal information if such disclosure may prevent the investigation of a crime, facilitate an investigation related to public safety, protect the security or integrity of our service, or enable us to take precautions against liability or to protect our rights. The legal basis for such disclosure is Article 6 (1) 1 lit. c (“compliance with legal obligation”) and lit. f (“legitimate interest”) GDPR. It is our legitimate interest to comply with the legal requirements of EU Member States and Australian law.
take legal actions in relation to any potential breach of his/her rights regarding the processing of his/her personal information, as well as to lodge complaints before the competent data protection regulators.
require (i) to receive the personal information concerning him/her, which the data subject has provided to Sirtex, in a structured, commonly used and machine-readable format and (ii) to transmit those data to another controller without hindrance from Sirtex’ side; where technically feasible the data subject shall have the right to have the personal information transmitted directly from Sirtex to another controller.
You may (i) exercise the rights referred to above or (ii) pose any questions or (iii) make any complaints regarding our data processing by contacting us under the contact details set out above in Section 7.22.
Calling: +61 2 9964 8400.
If practical, any person can contact Sirtex anonymously (i.e. without identifying themselves) or by using a pseudonym. However, if any person chooses not to identify themselves, Sirtex may not be able to give that person the information or provide the assistance they might otherwise receive if it is not practical to do so.
Updated to reflect requirements of GDPR and ensure HIPAA Compliance.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art.6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6