Safe Harbor Standards
This Safe Harbor Privacy Statement (the "Statement") sets forth the privacy principles followed by all Novartis US Group Companies which are Safe Harbor certified in connection with the transfer and protection of "personal information" received from the European Union (EU) or Switzerland. All Novartis US Group Companies which are listed below have certified to Safe Harbor. Each reference to "Novartis" in this Safe Harbor Privacy Statement means each Novartis US Group Company that is Safe Harbor certified.
About The Safe Harbor
The "Safe Harbor" program was jointly established by the United States Department of Commerce and the European Commission, as a method for transferring personal information from the European Union (EU), to companies in the United States. A similar arrangement was later reached between the US Department of Commerce and the Information Commissioner of Switzerland, so that the Safe Harbor program now includes the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. The Program is a voluntary self-certification process for companies operating in the United States. Companies that certify represent that they are upholding privacy standards for personal information received from the EU and Switzerland that have been accepted by the EU Commission, the Swiss Federal Data Protection and Information Commission and the US Department of Commerce. These standards exceed current US privacy standards. All Novartis US Group Companies which are listed below have certified to Safe Harbor and make that same representation.
"Personal Information" means information that can directly or indirectly lead to the identification of a living person, such as an individual's name, address, e-mail, telephone number, license number, medical identification number, photograph, or other identifying characteristic. The identification can occur by reference to one or more factors specific to the individual's physical, physiological, mental, economic, cultural or social identity. Personal information does not include information that has been anonymized, encoded or otherwise stripped of its identifiers, or information that is publicly available, unless combined with other non-public personal information.
Scope
This Statement governs personal information transferred from countries in the EU or Switzerland (which has adopted substantially similar privacy laws to those of the EU), to the United States on behalf of Novartis. It applies to personal information in electronic and off-line formats.
Safe Harbor Privacy Principles
The following privacy principles apply to the transfer, collection, use or disclosure of personal information from the EU or Switzerland by Novartis.
Notice: Novartis informs individuals in the EU and Switzerland about the purposes for which it collects and uses their personal information, how to contact Novartis the types of third parties with which Novartis shares their personal information, and the choice and means Novartis offers for limiting the use and disclosure of their personal information.
Consistent with the Safe Harbor requirements, Novartis may not be in a position to furnish notice in certain limited situations. Specifically, notice is not required where the processing of EU or Swiss personal information is necessary to respond to a government inquiry; is required by applicable laws, court orders or government regulations; or is necessary to protect [Group Company]Novartis's legal interests and providing notice would interfere with those interests.
Choice: Novartis will not process personal information about EU or Swiss individuals for purposes other than those for which the information was originally obtained or subsequently authorized by the individual unless the individual affirmatively and explicitly consents ("opt-in") to the processing, or unless an exception applies. Novartis also provides EU and Swiss individuals with the opportunity to withdraw consent at any time ("opt-out"), in which case their personal information will not be further processed. There are certain limitations on the right to opt-out, such as those that apply in the clinical research situation. In that situation, Novartis can continue to rely upon personal information already provided by clinical research participants who choose to discontinue participation in a clinical trial, to the extent needed to protect the integrity of the study, but cannot collect any additional personal information about that individual once the written request to withdraw participation is received.
Data Integrity: [Group Company] Novartis seeks to ensure that any personal information held about EU and Swiss individuals is accurate, complete, current and otherwise reliable in relation to the purposes for which the information was obtained. Novartis collects personal information that is adequate, relevant and not excessive for the purposes for which it is to be processed. EU and Swiss individuals have a responsibility to assist Novartis in maintaining accurate, complete and current personal information about them.
Transfers To Third Parties: Novartis will only transfer personal information about EU and Swiss individuals to third-parties where the third-party (a) has provided satisfactory assurances to Novartis that it will protect the information consistently with this Statement; or (b) is located in the EU, Switzerland or a country considered "adequate" for privacy by the EU or Swiss Commission, and therefore is required to comply with the EU or Swiss data protection laws or substantially equivalent privacy laws depending upon where the personal information originated ; or (c) the third-party has also certified to the Safe Harbor, and is accordingly independently responsible for complying with the Safe Harbor requirements.
Where Novartis has knowledge that a third-party to whom it has provided EU or Swiss personal information is processing that information in a manner contrary to this Statement or the Safe Harbor requirements, Novartis will take reasonable steps to prevent or stop the processing.
Access and Correction: Upon written request to Novartis, Novartis will provide EU and Swiss individuals with reasonable access to their personal information. Novartis will also take reasonable steps to allow EU and Swiss individuals to review their information for the purposes of correcting their information. There are certain limitations to the Access and Correction rights, as set forth in the US Department of Commerce's Safe Harbor website.
Security: Novartis takes reasonable precautions to protect EU and Swiss personal information in its possession from loss, misuse, unauthorized access, disclosure, alteration and destruction.
Enforcement: Novartis has established internal mechanisms to verify its ongoing adherence to this Statement. Novartis also encourages individuals covered by this Statement to raise any concerns about our processing of their personal information by contacting the appropriate Novartis' Privacy Office at the address below or by contacting their local privacy officer or Legal Department. Novartis will seek to resolve any concerns. Novartis has also agreed to participate in the dispute resolution programs provided by the European Data Protection Authorities.
Limitation On Scope Of Principles: Adherence to these Privacy Principles may be limited to the extent required to meet a legal, governmental, national security or public interest obligation.
Contact Information: The Novartis US Group Companies which are listed below have certified to the Safe Harbor. If you have questions or comments about this Statement, write to the Novartis US Group Company responsible for the collection and/or processing of your personal information or call the telephone number provided below:
The current list of Novartis US Group Companies which are Safe Harbor Certified includes:
- Novartis Corporation
Novartis Corporation US Privacy Officer
One South Ridge Avenue
East Hanover, NJ, USA 07936 - Novartis Pharmaceutical Corporation
US Pharmaceutical Privacy Office
1 Health Plaza
East Hanover, NJ, USA 07045 - Novartis Consumer Health, Inc.
Novartis Consumer Health US Privacy Officer
200 Kimball Drive
Parsippany, NJ, USA 10020 - Genomics Institute of the Novartis Research Foundation
Genomics Institute US Privacy Officer
10675 John Jay Hopkins Drive
San Diego, CA, USA 92121 - Ciba Vision Corporation
Ciba Vision Privacy Officer
6201 South Freeway Fort Worth, TX USA 76134-2099 - Novartis Vaccines and Diagnostics, Inc.
Novartis Vaccines and Diagnostics Privacy Officer
4560 Horton Street
Emeryville, CA USA 94608 - Sandoz Inc.
Sandoz Privacy Officer
506 Carnegie Center, Suite 400
Princeton, NJ USA 08540 - Novartis Institutes for Biomedical Research, Inc.
Novartis Institutes for Biomedical Research Privacy Officer
186 Massachusetts Avenue
Cambridge, MA USA 02139 - Novartis Animal Health US, Inc.
Novartis Animal Health Privacy Officer
3200 Northline Avenue, Suite 300
Greensboro, NC USA 47408 - Oriel Therapeutics
Oriel Therapeutics Privacy Officer
630 Davis Drive
Durham, North NC USA 27713 - Alcon Laboratories, Inc. (HR data only)
Alcon Laboratory Privacy Officer
6201 South Freeway
Fort Worth, TX USA 76134-2099 - Genoptix, Inc.
Genoptix Privacy Officer
1811 Aston Ave
Carlsbad, California 92008
