argenx Privacy Notice on the processing of Personal Data for the management of medical information enquiries, adverse event reports and product quality complaints

Scope of this notice

This privacy notice addresses  how argenx BV (collectively, “argenx” or the “Company”), (Industriepark Zwijnaarde 7, 9052 Zwijnaarde (Ghent), https://argenx.com/)  and its affiliates worldwide (each acting as a Data Controller) will collect and process your Personal Data for purposes related to the management of medical information enquiries, adverse event reports,  as well as product quality complaints related to argenx medicinal products and/or medical devices, if any.

For more information about argenx’s general privacy practices, please refer to our Privacy Policy, available on our corporate website at https://www.argenx.com/privacy-policy, as the scope of this privacy notice is limited to the collection and processing of your Personal Data for the purposes of management of medical information enquiries, adverse event reports and/or product quality complaints. 

Purpose & legal basis for processing

We will only process your Personal Data if we have a proper legal basis to do so. In this case, any Personal Data provided by you, or by an authorized third party on your behalf, will be processed exclusively for the management of medical information enquiries, adverse event reports (including special situations) and product quality complaints and for purposes compatible with the above. If we need to process and retain your information for additional purposes, we will inform you accordingly prior to the start of such additional processing and we will request your prior permission (where required to do so). Please note that if you share with argenx any personal information relating to third parties, you hereby represent that you have the authority to lawfully do so and to permit us to further use the information provided only for the purposes specified herein.

a)     Medical information enquiries

Any Personal Data provided by you to argenx which relates to a medical enquiry (i.e. in relation to the availability of products, clinical data, dosing and administration, formulation and stability, and interactions with other drugs, foods, and conditions) may be used to process your enquiry appropriately, follow up contact you or your treating physician to request additional information and to respond to your medical enquiry. We will also collect and process your data to comply with our legal obligations and industry codes to provide a medical information service for our medicinal products and a harmonious/homogenous dissemination of scientific, complete, objective, factual and non-promotional medical information across all the regions in which we operate, in the interests of wider society in the area of public health.

After handling your medical enquiry, we will also rely on our legitimate interests to further keep a record of your enquiry and/or request, and further store and maintain the related medical information data, in our global medical information database, to the extent and for as long as strictly required by law or is deemed necessary, for future historic reference, record keeping, auditing and compliance purposes as well as for the establishment, exercise or defense of legal claims.

When your medical enquiry will also involve the reporting of an adverse event or a product quality complaint,  we will also share your medical enquiry with authorized agents of our internal Pharmacovigilance and/or Product Quality teams as well as any external third party service providers, acting for and on our behalf as data processors, carrying out relevant pharmacovigilance or product quality complaints management activities  to comply with our safety and quality obligations under applicable laws and regulations; in such a case, we will also be required to further report any safety and quality related reported data to the competent regulatory health authorities. Your data will not be used for any other purposes outside those specified in this notice.

If you do not wish to provide your personal details to us, we will not be able to contact you back, provide you with a response if needed or further handle your request or enquiry appropriately.

b)     Adverse Event Reports and Special Situations  

Any Personal Data provided by you, as a reporter of an adverse event and/or special situation1 , whether you are reporting the adverse event and/or special situation to argenx being the person affected by such adverse event and/or special situation or whether you are reporting such adverse event and/or special situation on behalf of such a person, being the treating physician, pharmacist or caregiver of such a person  will be collected and used solely for purposes strictly related to the management and reporting of such adverse events and/or special situations. In particular, we will collect and use such adverse event and/or special situation related data to investigate the reported adverse event(s) and/or special situation(s), to follow-up contact with the patient, the patient’s doctor or the reporter, in general, to collect additional information about the reported adverse event and/or special situation, to analyze the safety of the product by combining and collating the information from one reported event with information about other events, to provide relevant pharmacovigilance reports to the competent regulatory authorities and to maintain any pharmacovigilance related information in our global pharmacovigilance database for as long as strictly necessary for future historic reference, record keeping, auditing and compliance purposes, as well as for the establishment, exercise or defense of legal claims.

1 Special situations may include (a)any unspecified event of death, (b) drug exposure during pregnancy or at the time of conception (maternal or paternal), (c) drug exposure during lactation,(d) lack of therapeutic efficacy, (e) overdose, (f) misuse (g) abuse, (h) medication error, - potential, intercepted or actual, (i) interactions (e.g. drug-drug, drug-food, drug-device, drug-alcohol), (j) unintended beneficial effects, (k) occupational exposure, (l) off label use, (m) withdrawal, or (n) suspected transmission of an infectious agent

We are required to collect and process any Personal Data (including any sensitive [health-related] Personal Data) provided by you, as a reporter, to comply with legal and regulatory pharmacovigilance obligations imposed on argenx by European, or other applicable safety reporting laws and regulations. The collection of any health-related information is necessary for reasons of public interest in the area of public health and aims at the detection, assessment and understanding of adverse events and any other medicine-related problem as well as to ensure compliance with high standards of quality and safety of health care and medicinal products in accordance with applicable laws and regulations.

c)     Product Quality Complaints

Any Personal Data provided by you to argenx which relates to a product quality complaint (i.e. any defect of a medicinal product or medical device related to its identity, quality, purity, durability, effectiveness, reliability, and/or safety) will be used solely for the purposes of management and reporting of the relevant product quality complaints. We will collect and process your data in accordance with applicable laws and regulations to ensure high quality product and to safeguard the safety of the patient.  

This information is very important for reasons of public health and will be used for the evaluation, assessment and investigation of the product quality complaint itself, to follow up contact the reporter to request additional information, and/or to respond to your complaint. We will also use the information to analyze the quality and safety of our medicinal products by combining and collating the information relating to one product quality complaint with information about other product quality complaints.

We will also store and maintain any product complaint-related information, in our global product quality management database for as long as strictly necessary for future historic reference, record keeping, auditing and compliance purposes, as well as for the establishment, exercise or defense of legal claims.

We may also be required to report the relevant product quality complaints data to the competent regulatory authorities to ensure compliance with high standards of quality and safety of health care and medicinal products in accordance with applicable laws and regulations.

Categories of personal data being processed

The type of information that we collect from you will depend on the type of processing activity and the data subject concerned:

a)     Medical information enquiries

For managing medical information enquiries, we may collect the name and surname of the requestor, the country, their contact details (such as phone numbers and email addresses) and the affiliation or profession or specialty of the individual making the enquiry (if it is a customer or a healthcare professional). This allows us to respond to queries and seek additional information as needed.

b)     Adverse Event reports or Special situations

 (i) Personal data relating to the Patient:

  • Patient’s name and contact details (address, e-mail address, phone number or fax number) needed, if patient is also the reporter, for effective follow-up activities;
  • Date of birth/age/age group, sex, weight, height;
  • Occupational data: current and past occupations;
  • Information regarding consumption of tobacco, alcohol, drugs;
  • Information on lifestyle, life habits and behaviors, including, e.g., dependency, physical exercise (intensity, frequency, duration), diet and eating behavior etc.
  • Information about health, racial or ethnic origin and sexual life; and
  • Medical history and status, which may, for example include, (other) administered treatments, test results, nature of the adverse effect(s), personal or family history, associated diseases or events, risk factors, information on how medicinal products are prescribed and used and on the therapeutic conduct of the prescriber or of the health professionals involved in the management of the disease or adverse health event.

 (ii) Personal data relating to the Reporter:

  • Reporter’s Name;
  • Contact details (address, e-mail address, phone number or fax number) needed to perform effective follow-up to ensure complete and accurate data are collected;
  • Profession; and
  • Relationship with the subject of the report.

c)    Product quality complaints

We may collect the name, contact details and affiliation/profession of the individual reporting the complaint. We may collect some additional personal data related to health and medical history of the individual affected by the product complaint if such information is relevant to evaluate, assess, and investigate the product quality complaint.

Recipients of your personal data

argenx shall share your data among its affiliates worldwide, business partners and service providers, to the extent strictly needed to be able to operate and manage the argenx global and/or regional relevant medical enquiries, pharmacovigilance and/or product complaints database respectively and fulfill its obligations 

deriving from relevant safety and quality reporting laws and regulations. argenx will not share, or otherwise transfer your data to third parties other than those indicated in this privacy notice.  

Specifically, your data can be accessed by, or transferred to:

  • The Heads of the relevant teams authorized to collect, process and manage medical enquiries, adverse events and/or product complaints respectively, as well as their authorized personnel;
  • The general manager and their representatives, within the limits of their attributions;
  • Members of the legal and regulatory affairs department, depending on their responsibility;
  • Audit department to check compliance with regulatory or internal requirements;
  • Other pharma companies whose product may be at stake (without disclosing your identity);
  • Health care providers concerned by the report;
  • Service providers acting on behalf of argenx, or other providers of IT systems, hosting providers and adverse events processing services (e.g., translation services).

Where our processing activities are outsourced to third party service providers, these entities will be acting for and on our behalf as data processors; in such cases we ensure that binding data processing agreements are in place and that such entities and their representatives and sub-contractors operate strictly under our instructions and only to the extent they are authorized to do so or are required to do so by applicable laws and company policies. All third parties acting on behalf of argenx are required to be appropriately trained and aware of their data protection obligations and to implement appropriate technical and organizational security measures.   

argenx is also obliged to report certain pharmacovigilance and product relevant information to Health Authorities worldwide, National or foreign public bodies in charge of vigilance in the exercise of their tasks as defined by law, foreign national health authorities or agencies and international health authorities or agencies (e.g. US Food and Drug Administration (FDA), European Medicines Agency), including those with different level of data protection compared to EU.

These reports will contain details about the adverse event but will only contain limited (non-identifying) personal data and in particular:

  • Patients: Information as provided, including date of birth/age/age group and gender (note that patient name will never be provided)
  • Reporting Individuals: Information as provided to allow the regulatory authority to follow up with the reporting individual, including name, profession, initials (to identify any duplications), address, email, phone number.

In the exchange of data within argenx, business partners and service providers, your personal data may be transferred to third countries (countries outside the EU/EEA, UK or Switzerland) that do not provide the same level of data protection as the country of your residence or place of work. Where data relating to medical information enquiries, adverse event reports and/or product quality complaints will be transferred to countries outside the EU/EEA, UK or Switzerland, argenx will ensure the adequacy of the recipient country and the security of the processing of personal data being transferred.

For more detailed information about argenx’s approach to cross-border data transfers and data transfer mechanisms implemented and/or executed, such as the EU Standard Contractual Clauses, please see argenx’s Privacy Policy.

Security of Processing

Within argenx we have implemented appropriate technical and organizational security measures, that are appropriate to the risk and the nature of the processing, in accordance with applicable laws and regulations, including any generally approved industry standards, as well as any guidance or standards issued by any competent data protection authority, to safeguard personal data (incl. special categories of personal data) being collected and processed in relation to the management of medical information enquiries, safety vigilance reports and product quality complaints, including safeguards and procedures designed to restrict access to personal data to those employees who are authorized to do so and on a need to know basis in accordance with their roles and responsibilities.

Moreover, we maintain physical, electronic and procedural measures with due regard to the risks presented by the processing in question, to safeguard the security of the processing of the personal data and in particular, at the time of collection, during their transmission as well as during storage, to prevent them from being distorted, damaged or accessed by unauthorized third parties.

Retention period

Your personal data will be kept for the time strictly necessary for the above-mentioned purposes and in accordance with applicable legal and regulatory requirements governing the storage and reporting of related information.

a)    Adverse Events and/or special situations: As information related to pharmacovigilance (reports about adverse events, special situations like lack of therapeutic efficacy, overdose  misuse, abuse, medication error etc.,  ) is important for public health reasons, in the absence of a legally imposed retention period, the relevant safety data will be kept for a minimum of 10 years after the withdrawal of the medicinal a)     product in the last country where the product is marketed.   At the end of these periods, the data will be securely deleted or archived in an anonymized form.

b)    Medical Information Enquiries: Personal data retained as part of a medical information inquiry are kept in a live database for a period of 5 years after case closure and then archived for a period not to exceed 10  . yearsafter the closure of the enquiry.

c)     Product Quality Complaints: As information related to product quality complaints and drug safety are important for public health reasons, product quality complaint records, including personal data contained therein, are kept for a minimum of 5 years.

The above retention periods may be extended if required by law or for other compelling legitimate grounds of argenx, which override the interests, rights and freedoms of the data subjects concerned, or for the establishment, exercise or defense of legal claims.

Information about your privacy rights and how to exercise them

You have the right to request from argenx to:

  • access your personal data and, if you believe that it is incorrect, obsolete or incomplete, to request that it be corrected or updated;
  • request the erasure of your personal data or the restriction of its use;
  • if the processing is based on your consent, to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
  • object, in whole or in part, to the processing of your personal data; and
  • request portability of your personal data (i.e. for it to be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format). The exercise of your rights is subject to the specific conditions set forth in the General Data Protection Regulation (GDPR) and other applicable data protection and privacy laws.

To the extent the processing is based on argenx’s compliance with a legal obligation, your rights to object, to erase data or to data portability will be restricted.

For EU residents: If we do not handle your request in a timely manner, or if you are not satisfied with our response to the exercise of these rights, you are entitled to submit a complaint with the competent supervisory authority of your country of residence or place of work. Further information and contact details of the European competent Supervisory Authorities can be found here:  https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

Fo UK residents may submit a complaint to the UK Information Commissioner’s Office (ICO) here: https://ico.org.uk/make-a-complaint/

For Swiss residents may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) here: https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html

Additional disclosures for California residents

If you are a California resident, you may have separate rights regarding your Personal Data, in accordance with California law.

California Consumer Privacy Act of 2018

The California Consumer Privacy Act of 2018 (the “CCPA”) grants California residents certain rights with respect to their Personal Data, including, as described below, the right to know about, and delete, their Personal Data. These rights are subject to certain limitations, however, such as that they do not all apply to certain uses of Personal Data about employees, job applicants, and contractors, or information processed exclusively in the business-to-business context (e.g., information about an individual acting in his or her capacity as a representative of an entity). Where exceptions to the CCPA apply to a request you submit, we will provide you with an explanation.

Right to request disclosure of information we collect or share about you.  You can submit a request to us for the following data regarding the Personal Data we have collected about you in the 12 months prior to our receipt of your request (a “request to know”):

  • The categories of Personal Data we have collected.
  • The categories of sources from which we collected the Personal Data.
  • The business or commercial purposes for which we collected the Personal Data.
  • The categories of third parties with which we shared the Personal Data.
  • The categories of Personal Data we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of Personal Data.
  • The specific pieces of Personal Data we collected.
  • Right to request the deletion of Personal Data we have collected from you. Upon request, we will delete the Personal Data we have collected about you, except for situations where specific information is necessary for us to provide you with a product or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; or comply with or exercise rights provided by the law.

The law also permits us to retain specific information for our exclusively internal use, but only in ways that are compatible with the context in which you provided the information to us or that are reasonably aligned with your expectations based on your relationship with us.

How can you make a request to exercise your rights? To submit requests to know or delete, you may contact us by phone at 1-(833) ARGX 411 or via email at privacy@argenx.com.

How we will handle a request to exercise your rights. For requests to know or delete, we will first acknowledge receipt of the request within 10 business days of receipt of your request. We will provide a substantive response to your request within 45 days from receipt of your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we’ll let you know.

When you make a request to know or delete your Personal Data, we will take steps to verify your identity. These steps may include asking you for Personal

Data, such as your name, address, or other information we maintain about you. If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of the denial.

You are also entitled to submit a request for Personal Data that could be associated with a household as defined in the CCPA. To submit a request to know or delete household Personal Data, such requests must be jointly made by each member of the household, and we will individually verify all of the members of the household using the verification criteria explained above, and separately verify that each household member making the request currently resides in the household. If we are unable to verify the identity of each household member with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of our denial.

You may also designate an authorized agent to submit requests on your behalf. If you do so, you will be required to verify your identity by providing us with certain Personal Data as described above. Additionally, we will also require that you provide the agent with written and signed permission to act on your behalf, and we will separately confirm with you that you provided the agent with permission to submit the request. We will deny the request if the agent is unable to meet submit proof to us that you have authorized them to act on your behalf or if any of the above verification criteria are not met.

We are committed to honoring your rights. If you exercise any of the CCPA rights explained in this Privacy Notice, we will continue to treat you fairly.

Shine the Light

California's "Shine the Light" law, Civil Code section 1798.83, requires certain businesses to respond to requests from California residents asking about the business' practices related to disclosing certain types of Personal Data to third parties for the third parties' direct marketing purposes. We do not disclose Personal Data to such entities, for such purposes.

Do Not Track

“Do Not Track” signals are options available on your browser to tell operators of websites that you do not wish to have your online activity tracked. We do not engage in the collection of personally identifiable information about your online activities over time and across third-party websites or online services, nor do we allow other parties to do so through our Site. Accordingly, we do not process or comply with automated browser signals regarding tracking mechanisms, which may include "do not track" instructions.

Other useful information Changes to Privacy Notice

If we make any material changes to this Privacy Notice we will notify you by means of a notice on the Site and will also post an updated version on the Site. Please check back periodically for updates.

Accessibility

We are committed to ensuring that our communications are accessible to people with disabilities.  To make accessibility-related requests or report barriers, please contact us by phone at 1 (833) ARGX-411 or via email at privacy@argenx.com.

Minors

The Site is not designed for or intentionally targeted at children 16 years of age or younger. Further, we do not knowingly sell the Personal Data of children under 16 years of age. If we become aware that a child under 16 has provided us with Personal Data, we will take reasonable steps to remove such information from our systems and terminate the applicable account.

All inquiries and requests with respect to the processing of your personal data, in the context of this privacy notice, by argenx or by third parties acting on argenx’s behalf, should be directed to the argenx Privacy Office and the designated Data Protection Officer by email at: privacy@argenx.com.  

Changes or additions to this notice will become effective upon uploading on the argenx website.

Last updated: March 27, 2025.