Legal Statement

Please read the following carefully.

This Privacy Notice describes how Purdue Pharma Canada (“Purdue”) and its network of independent associated companies including Mundipharma (“Purdue”, also referred to as “we” or “us” or “our”) will process your information when you use our website https://www.purdue.ca/ ("Site"), or otherwise when you provide personal data to us through the means described in this Privacy Notice. This Privacy Notice supplements other privacy notices that we may provide on our Site or through other means from time to time when we process your information. Please note this Privacy Notice does not cover any third-party sites referred to or accessed using links or buttons on this Site. These third-party sites may have their own terms and conditions and privacy policies. We are not responsible for the terms and conditions, privacy policies or content of any website referred to or accessed through this Site. This Site is not intended for use by children (under 16 years old). However, the legal representative of a child may exercise the rights set out in this Privacy Notice on behalf of the child. Purdue takes the privacy of your personal data very seriously. In the event that you send us any of your personal data, we are committed to collecting, maintaining, and securing personal data about you in accordance with our internal data protection policies and local laws. To read more about how we use your personal data, please click on the topic of interest below.

PERSONAL DATA COLLECTED THROUGH OUR BUSINESS OPERATIONS
PERSONAL DATA COLLECTED THROUGH SOCIAL MEDIA PAGES
PERSONAL DATA COLLECTED FROM OTHER SOURCES
THE BASIS FOR USING YOUR INFORMATION
SHARING YOUR PERSONAL DATA
LOCATION OF PERSONAL DATA WE COLLECT
TRANSMISSIONS USING THE INTERNET
DATA RETENTION
AUTOMATED DECISION MAKING
YOUR RIGHTS
DEFINITIONS
CONTACT US

This Privacy Notice is reviewed and updated from time to time. If we update the terms, we will provide notice through our home page, or by other means, so you can review the changes. Please check back if you continue to use this Site or interact with Purdue.

1) PERSONAL DATA COLLECTED USING THIS SITE

Purdue may collect personal data when you provide it to us, including:

Contact details such as your name, professional title, email address, user names, phone numbers
Professional details such as data included in your CV, information about your qualifications, expertise, jobs, employers, professional affiliations, medical practitioner number or government issued ID, service and performance metrics, and scientific publications.
Communication records if you contact us, such as emails and call notes with our staff and representatives
Information about your visits to this Site, including the type of browser and operating system that you use, access times, pages viewed, URLs clicked on, your IP address and the page you visited before navigating to our Sites, and login credentials
Device information such as your IP address, device ID, device attributes and local information
Certain information from your social media account where you have chosen to connect your social media account with us
Communications data, such as your preferences in receiving communications from us

Adverse Event Reporting

An adverse event can be any untoward medical occurrence in a patient or clinical trial subject administered a medicinal product. It includes an unfavourable and unintended sign, symptom, or disease, associated with the use of a medicinal product, whether or not considered related to the medicinal product.

If you experience an adverse event when using one of our products, click here to find out how you should report it.

Please note that healthcare professionals are required to report actual and suspected adverse events of their patients to the relevant Marketing Authorisation holder for the medicinal product. We may also be provided with information about an adverse event that affected you by other third parties, such as nurses, pharmacists, lawyers, relatives or other members of the public.

Any personal data we receive regarding adverse events will be protected and kept confidential in line with our internal data protection policies and as well as local laws. The information provided will be used for the purpose of drug safety surveillance and to enable us to deal with your enquiry appropriately. It may be shared with health authorities and other third parties who are also responsible for drug safety surveillance.

Any personal data received by health authorities and/or other third parties will be processed in accordance with their own privacy policy.

Careers

The Careers section of this Site provides you with an opportunity to express an interest in a role being advertised. If you do express an interest, Purdue may use the details you provide to consider your application for the role. We may also keep hold of your details for future roles if you expressly consent to this. Please read our Candidate Privacy Notice for more information on our independent associated company site, Mundipharma.com.

Website and cookies

When you visit this Site, Purdue automatically collects information using cookies, such as your browser type and operating system, websites you visited before and after visiting our websites, standard server log information, and Internet Protocol (IP) addresses.

An IP address is an assigned number, similar to a telephone number, which allows your computer to communicate over the Internet. We pool this information and may combine it with other information to produce anonymous, aggregated statistical information which is helpful to us in improving our products and/or services. This information includes:

the total number of visits to our websites and mobile applications
the number of visitors to each page of our websites and mobile applications
the domain names of our visitors’ internet service providers.

2) PERSONAL DATA COLLECTED THROUGH OUR BUSINESS OPERATIONS

As well as information collected from you through this Site, we may obtain personal data in other ways, such as by phone, email or in paper form during the course of our business operations. In most instances, Purdue is the data controller for such activities. This information could include:

your name and other contact details
records of your correspondence with us
your billing and payment information if you are providing services to us

The personal data you provide to us will be used for the purposes of:

administering a contract we have entered into with you
providing you with information, including in response to queries regarding our products, therapy areas and/or services.
your billing and payment information if you are providing services to us
understanding our business needs and improving our products and/or services
holding discussion forums, such as scientific advisory boards

as well as the use(s) set out in the other Sections of this Privacy Notice.

We may also use your personal data to comply with applicable laws, or to perform a contract we have entered into with you, or other uses for which you have given your consent. If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you), or we may be prevented from complying with our legal obligations. In this case, we may have to cancel the provision of a product or service or other arrangement you have with us, but we will notify you if this is the case at the time.

In addition to the personal data we receive directly from you, we may also receive personal information from our business contacts or from others (about themselves or about other individuals) during the course of our business operations. We will handle that information in accordance with this Privacy Notice.

3) PERSONAL DATA COLLECTED THROUGH SOCIAL MEDIA PAGES

Purdue has a LinkedIn social media page. LinkedIn is the data controller for the purposes of using their website and services. Please ensure you check their privacy statement when using their services.

Purdue uses LinkedIn and may collect personal data from LinkedIn to facilitate recruitment to its business or an Associate’s business. As such, you may receive a communication from us via LinkedIn if you hold a LinkedIn account.

For further information regarding our use of candidate personal data for recruitment, please refer to the Candidate Privacy Notice .

By participating in social sharing on our social media pages, you may disclose personal information about yourself. Any information you post or disclose in this way will become public information, and may be available to visitors to these pages and to the general public. You should be very careful when deciding to disclose your or any third party’s personal information, or any other information, on social medial pages or in any communications with us. You may also disclose personal information if you include third parties in your electronic communications with us.

4) PERSONAL DATA COLLECTED FROM OTHER SOURCES

We may collect personal data from other third parties who act as data controllers. Where we are a data processor of that personal data, we will only use the personal data in accordance with the instructions of the data controller. Our contracts with such third parties require that they are legally able to provide the personal data to us. We may also collect personal data from public sources, for example, when we attend conferences or training events in order to stay in contact with you or to enquire about consultancy services we may wish to seek from you in relation to one or more of our therapy areas.

5) THE BASIS FOR USING YOUR PERSONAL DATA

We use your personal data to operate our business and manage our relationship with you. We only process data where we have a legal basis for doing so. The table below outlines the different purposes for which we process your personal data, and the legal bases we rely on:

Use	Legal Basis
Keeping you updated about Purdue products, services and events, including providing the latest company news, industry insights, disease awareness information, safety updates, training, important notices and other information that may be of interest	Our legitimate interests, except where we need your consent
Sending personalised communications tailored to your expertise and interests, including monitoring and analysing the use of our Sites and emails to understand which content is of the most interest and avoid sending you redundant information.
Improving our products, services and digital communications, including the use of data analytics to improve the way we do things
Responding to your queries or requests, accommodating certain personal requirements or preferences and handling complaints
Checking your eligibility to access or provide certain services, for example when accessing content or platforms intended only for healthcare professionals, or when entering a contract with you	Our legitimate interests, unless required to perform and manage our contract with you.
Evaluating your suitability to participate in our clinical trials, observational studies, market research, advisory boards and the provision of other research and/or services Setting up and assessing fair market value criteria, including remuneration for services, donations, sponsorship or grants	To perform and manage our contract with you or for our legitimate interests. In some circumstances, this is also needed to comply with our legal obligations or is in the public interest.
Administering a contract we have entered into with you
Complying with our legal and ethical obligations, internal company policies and industry standards, for example, disclosing information about payments or other transfers of value to you to meet our transparency obligations	To comply with our legal obligations, where the processing is in the public interest, or for our legitimate interests. We may seek your consent to disclose payments made to you on an individual basis.
Detecting and investigating harmful behaviour, including any abuse or attacks on our networks, allegations of misconduct or other behaviour that is harmful to our business, and taking proactive measures to prevent such behaviours
Due diligence, conflict checks, and information disclosure exercises in conjunction with legal proceedings, the purchase or disposal of business assets or operations, or to respond to requests for information from government or regulatory authorities

6) SHARING YOUR PERSONAL DATA

Purdue limits access to your personal data to those employees, agents, contractors, professional advisers (such as lawyers, bankers, auditors, accountants and insurers), service providers (such as the design and host contractor for this Site), Associates and other third parties who have a business need to know (such as suppliers managing adverse event reports or product complaints). If they are a data processor, they must only process your personal data on our instructions and they are subject to a duty of confidentiality.

We may need to share your personal information with a government authority, regulator, other public body or to otherwise comply with the law.

We may also disclose your personal data to third parties:

if Purdue is under a duty to disclose or share your personal information in order to comply with any legal obligation
in the event that Purdue sells, merges or reorganises any business or assets, in which case Purdue may disclose your personal information to the prospective acquirer of such business or assets;
if Purdue or substantially all of its assets is acquired by or merged with a third party, in which case personal data held by Purdue may form part of the transferred or merged assets.

Where we transfer your personal data from the Canada, we will use suitable measures, such as standard contractual clauses and (where appropriate) supplementary measures, to protect your personal data being shared outside of your country to countries that do not offer a suitable level of protection.

Purdue does not sell, rent, or trade personal data it collects with third parties. Any third parties with whom Purdue shares personal data are not permitted to sell, rent, or trade such personal data.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

7) LOCATION OF PERSONAL DATA WE COLLECT

Some of the personal data collected using this Site and third party sources may be stored or processed by our Associates and carefully selected third parties using computers and servers located in other countries, including by means of cloud computing.

Such computers and servers may be located both inside and outside of the Canada, where data protection laws may differ from the country you live in. We will only transfer personal data outside of the Canada where there is a legal basis for the transfer. In any event, Purdue will ensure suitable security measures are in place to protect your personal data.

8) TRANSMISSIONS USING THE INTERNET

Unfortunately, the transmission of information via the Internet is not completely secure. Although Purdue will use reasonable commercial efforts to protect your personal data, we cannot guarantee the security of your data transmitted using the Internet.

Anything you send by email or using the Internet is at your own risk. Once Purdue has received your personal data, we will secure your information in accordance with our security procedures and controls to try to prevent unauthorised access, alteration or loss.

9) DATA RETENTION

We will retain your personal data in accordance with our Global Privacy Policy. Generally, we will only retain personal data for the period necessary to fulfil the purposes for which the personal data was collected, unless a longer retention period is required or permitted by law or we have justifiable reasons for doing so.

10) AUTOMATED DECISION MAKING

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

11) YOUR RIGHTS

Purdue Pharma Canada is the data controller for the purposes of using this Site.

You have the following rights:

To ask about the processing of your personal data;
To request access to your personal data, its correction and/or deletion in certain casses;
If you have provided consent for us to process your personal data, you may withdraw it with limited exceptions. The withdrawal of consent shall not affect any processing based on consent before its withdrawal;
If you provided your personal data for a contract or with your consent you can also request receipt or transmission of your personal data to another organisation in a machine-readable form;
You can object to the processing or withdraw consent. This right is not absolute;
In certain cases you can request a restriction on the processing of your personal data, for example where you wish to verify the accuracy of your personal data or where you object to the processing.

If you would like to exercise any of these rights, you can get in touch with using the contact information in the "Contact us" section of this Privacy Notice.

If you are unhappy with how we process your personal data, you can complain to your local supervisory authority. In Canada this is the Office of the Privacy Commissioner of Canada (Office of the Privacy Commissioner of Canada - Office of the Privacy Commissioner of Canada). We would, however, appreciate the chance to deal with your concerns, so please contact us in the first instance.

Where you successfully request deletion or restriction rights, or object to or withdraw consent for our processing of your personal data for certain purposes, we may not be able to continue offering certain services to you or have a contractual relationship with you. We may be able to continue to process your personal information to the extent required or where otherwise permitted by law, for example to register your request to opt out of communications or in connection with our regulatory obligations, such as adverse effect reporting.

12) DEFINITIONS

“Associates” means any organisation within the Purude network of independent associated companies.

“data controller” means Purdue Pharma Canada

“data processor”, means the company or entity that processes or provides services related to personal data

"personal data” means any information about an identifiable individual; if there is a serious possibility that an individual could be identified through the use of the information, alone or in combination with other available information.

13) CONTACT US

You may contact Privacy Officer at privacy.inquiries@purdue.ca or via post at 3381 Steeles Ave E Suite 310, Markham, Ontario, M2H 3S7. if you have any questions or concerns regarding this Privacy Notice, including where you would like to exercise any of your rights. To help us efficiently deal with your request, it would be helpful if you could state in your communication your relationship and/or interactions with us, as well as the specifics of your query or request when contacting us.

Last Updated: April 2024

CONTENTS: