GDPR Data processing modelPharmacovigilance and Health Risk Management System

PrivateHealthPublic

Processing of personal and health data to monitor, analyse, and respond to adverse health events related to medicines, medical devices, or health products, ensuring compliance with UK patient safety obligations.

Purposes (2)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Management of contact with notifier of adverse event

Contacts with the data controller and the Member of an approved association, healthcare professional, member of a health authority, patient, etc., or the healthcare professional who can be contacted to obtain, in compliance with medical confidentiality, details about the adverse health event reported (professional following the person who was the victim of the adverse health event, etc.).

Public interest

Legal basis: UK GDPR Art. 6(1)(e), Art. 9(2)(i). Necessary to ensure safety monitoring and follow-up in line with MHRA requirements.

Collection and analysis of data relating to adverse events

Collection, recording, analysis, follow-up, documentation, transmission and storage of information

Public interest

Legal basis: UK GDPR Art. 6(1)(e), Art. 9(2)(i). Necessary for pharmacovigilance, mandatory under UK medicines/device safety law.

Data categories (4)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Notifier contact details

Data details

healthcare professional's specialtyrequired

Telephone numberrequired

Emailrequired

Postal Addressrequired

Name and surnamerequired

Data conservation rules

Active base:

Retained as long as necessary for the vigilance report.

Intermediate archiving:

Retained for statutory pharmacovigilance obligations.

Destruction

Product identification data

Data details

Serial numberrequired

Device or product usedrequired

Drug namerequired

Data conservation rules

Active base:

While vigilance case is under investigation.

Intermediate archiving:

Retained per legal retention rules.

Destruction

Patient identification data

Data details

Identification numberrequired

Size and weightrequired

Genderrequiredsensitive data

Year or date of birthrequired

Agerequired

Data conservation rules

Active base:

While event report is active.

Intermediate archiving:

Retained for statutory pharmacovigilance obligations.

Destruction

Patient health data

Data details

Data relating to working liferequired

Lifestylerequired

Therapeutic conduct of prescriber or healthcare professionalsrequiredsensitive data

Prescribing mode and drug userequiredsensitive data

Search for antecedents and risk factorsrequiredsensitive data

Related diseases or eventsrequiredsensitive data

Medical Historyrequiredsensitive data

Nature of adverse effectsrequiredsensitive data

Medical Examination Resultsrequiredsensitive data

Treatments in progressrequiredsensitive data

Data conservation rules

Active base:

For the duration of vigilance assessment.

Intermediate archiving:

Retained per MHRA requirements.

Destruction

Data subject (3)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Patients
Healthcare Professionals
Notifiers

Created at:07/08/2023

Updated on:08/01/2025

Nb using:4

GDPR Data processing modelPharmacovigilance and Health Risk Management System

Purposes (2)

Data categories (4)

Notifier contact details

Product identification data

Patient identification data

Patient health data

Data subject (3)

Access the full processing template