Chatbot Privacy Notice

Takeda UK Limited ('Takeda', 'we') is strongly committed to protecting your privacy and will make efforts to protect your personal data in accordance with the following privacy notice (“Notice”) which applies to the personal data that Takeda collects and processes in relation to users of the Chatbot.

Personal data collected

The type of personal data we collect may include:  

  • a unique Facebook identifier code;
  • Chatbot timestamp;
  • Chatbot feedback ratings;
  • your email address (if you sign up to receive emails)
  • your name (if you sign up to receive emails)
  • information in relation to adverse event and product complaint regulatory requirements if manually inputted into the Chatbot; and
  • other additional information that you manually input into the Chatbot as part of exercises, in order to generate bespoke PDF downloads such as Intervention Plans and Patient Evaluations.

Lawful basis of processing

Our processing of your personal data may take place where you have given us your consent to do so, such as when you have signed up to received emails, and is necessary: (i) in order to comply with a legal obligation to which we are subject; (ii) for the purposes of legitimate interests pursued by us, namely: (a) to provide guidance, support and experience to healthcare professionals that administer Takeda products (b) [to ensure patient safety; and (iii) in order to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others.

Purpose for collecting personal data

Personal data collected by Takeda will be encrypted and stored by a third party service provider in a dedicated database and will only be accessed to send emails about the IBD Empower programme if you have consented to them, or to follow up either in Facebook Messenger or through another communication channel for the specific purpose of: (i) provide guidance, support and experience responding to or otherwise resolving an adverse event; or (ii) product complaint which is necessary for mandatory reporting to regulatory agencies.

Sharing of personal data

Takeda uses third party service providers to store personal data in a database. If you submit any manually inputted text, that text may be forwarded to appropriate Takeda third party contacts, who may be required, by law, to follow up either in Facebook Messenger or through another communication channel, such as email (if provided) if the text contains an adverse event or a product complaint. In these instances, additional information about you must be stored until all appropriate communication has occurred, which may include mandatory reporting to regulatory agencies. Takeda will not share your information with anyone who is not directly connected with this purpose.

Takeda will not directly access your personal data and only receive aggregated and anonymized information from third party service providers acting on its behalf, unless Takeda is required to do so because of applicable law, court order or governmental regulation.

Transfer of personal data outside of the EEA

Takeda has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by EU law, in an effort to ensure effective levels of data protection for sharing personal data within Takeda, in particular relating to transfers of personal data outside the EEA.

Your personal data will be processed by third parties as described above. These third parties may be located in countries or territories outside the EEA or do not otherwise offer the same level of data protection as the country in which you reside. In instances where a lesser level of protection is provided by a receiving country, Takeda undertakes to enter into contractual agreements (e.g., European Union Standard Contractual Clauses), or relies on other available data transfer mechanisms that aim to provide adequate protections.

Retention of personal data

Personal data is retained by Takeda for a period of 1 year after which it is destroyed automatically. The period is defined as being one year following your last recorded interaction with the bot for your given Facebook ID. There may be cases when your personal data or part of it may be stored for a longer time period if Takeda is required to do so because of an applicable law, court order or governmental regulation or if such retention is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Protection of your personal data

Takeda has implemented appropriate technical and organizational measures to provide an adequate level of security and confidentiality to your personal data, taking into account the nature of the data and the risk of processing such data. The purpose thereof is to protect it against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing. Moreover, when handling your personal data, Takeda complies with the following obligations:

  • Takeda only collects and processes personal data, which is adequate, relevant and not excessive, as required to meet the above purposes; and
  • Takeda ensures that your personal data remains up to date and accurate. For the latter, we may request you to confirm the personal data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your personal circumstances so we can ensure your personal data is kept up-to-date.

Exercise of access rights and contact details

You may exercise the following rights under the conditions and within the limits set forth in the law:

  • the right to access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
  • the right to request the erasure of your personal data or the restriction thereof to specific categories of processing;
  • the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
  • the right to object, in whole or in part, to the processing of your personal data;
  • the right to object to a channel of communication used for direct marketing purposes; and
  • to the extent applicable the right to request its portability, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.

If you wish to query the data that is held on you at any time, you can do so by selecting the menu item in the Facebook Messenger that is labelled “Manage my data”. This will present you with options to:

  • immediately request a log of what data is held in relation to your user profile - In this instance, your data will be presented to you via the Facebook Messenger chat interface
  • request deletion of the data held on you - In this instance the chat interface will ask you to email the Takeda data privacy officer to request data deletion. The email address for this request is privacyoffice@takeda.com.The privacy officer will delete all the data that we hold about you and will inform you when the request has been processed. Please note that when delete your user profile, Takeda will remove your user profile, preferences and history from its databases, however your conversation history will still be retained by Facebook in line with your agreement with that platform.

If you have a question, if you are not satisfied how Takeda processes your personal data or if you want to exercise the above rights, you may send an email to privacyoffice@takeda.com. When contacting Takeda, please add a description of your relationship and/or your interactions with us. If you wish to receive information related to your personal data, please also add a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity. When sending such a scan, please make sure to redact your picture and national registry number or equivalent on the scan. In addition, you also have the right to complain to the Information Commissioners Office https://ico.org.uk/global/contact-us/.

 

UK/WBC/1707/0007h

Date of Preparation: May 2020