Novartis – General Privacy Notice for Health Care Professionals
[Last Modified: June 2025]
This Privacy Notice is addressed to:
the healthcare professionals with whom we create or maintain a relationship;
the representatives or contact persons of our customers or prospects who are legal entities.
You are receiving this Privacy Notice because Novartis Israel Ltd. located at 6 Tozeret Haaretz Street, Tel Aviv, Israel and its affiliates (“Novartis”) is processing information about you which constitutes personal data and Novartis values the protection of your personal data.
In this Privacy Notice, “we” or “us” refers to Novartis.
Novartis is responsible for the processing of your personal data as it decides why and how it is processed, thereby acting as the controller. We invite you to carefully read this Privacy Notice, which sets out in which context we are processing your personal data and explains your rights and our obligations when doing so, in accordance with relevant privacy regulation, including the Israeli Privacy Protection Law, 1981 and the regulations and guidelines promogulated under.
Should you have any further question, we invite you to contact Novartis Data Privacy Department at [email protected].
You are not required by law to provide us with any personal data. However, please note that in certain cases, in order to provide you with information and certain services or contractual or regulatory obligations in a way that most suits your interest and field of expertise, we may need to process certain personal data relating to you, and without such data we may not be able to provide you with all of such information and services.
What information do we have about you?
This information may either be directly provided by you, by our business partners (i.e. the legal entity for whom you work), by third parties (e.g. medical companies) or be obtained through trusted publicly available sources (such as Ministry of Health records, PubMed, Clinical Trials.gov, congress websites or university websites), having obtained your consent to provide us with such personal data where necessary under applicable law. We collect various types of personal data about you, including:
your general and identification information (e.g. full name, gender, email and/or postal address, fixed and/or mobile phone number);
your function (e.g. title, position, name of employer, as well as, for healthcare professionals, first specialty, second specialty, professional experience, education);
Payment information (e.g., bank account details), photo ID, number of licensed dealer (as relevant), C.V. – all are collected for health care professionals who provide services to Novartis, such as lectures or consultancy;
Novartis unique business partner ID and profile;
your electronic identification data where required for the purpose of delivering products or services to our company (e.g. login, access right, passwords, badge number, IP address, online identifiers/cookies);
information regarding your interaction with us and with the content we send you to improve our services and tailor the communications we send you.
information regarding your preferences including in terms of channels of communication and frequency;
data you provide to us for example when you fill in forms or during events you attend, or when you answer questions in a survey;
data which relate to our products and services; and
information about the scientific and medical activities/interactions you have with us, including potential future interactions.
If you intend to provide us with personal data about other individuals (e.g. your colleagues), please refer them to this Privacy Notice.
For which purposes do we use your personal data and why is this justified?
We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data for the following purposes:
manage our relationship with you (e.g. through our databases);
implement tasks in preparation of or to perform existing contracts;
evidence transactions, when applicable;
provide you with adequate and updated information about disease, drugs as well as our products and services;
improve the quality of our services by adapting our communication and information to your specific needs;
answer your requests and provide you with efficient support;
send you surveys (e.g. to help us improve your future interactions with us);
send you communications regarding products or services that we promote, subject to your subscription or where permitted by law. You may unsubscribe at any time by using the link provided in the message or by contacting us at [email protected]. Please note that even after unsubscribing, we may still send non-marketing communications.
process information about how you interact with our digital content in order to provide personalized medical and scientific updates tailored to your area of expertise. Where legally required, we will request your consent before sending direct marketing communications;
manage communications and interactions with you (e.g. through the operation of a database keeping records of interactions with healthcare professionals or managing interaction planning as well as interaction reporting);
track our activities (e.g. measuring interactions or sales, number and quality of interactions);
invite you to events or promotional meetings sponsored by us (e.g. scientific events, conferences, etc.);
grant you access to our training modules allowing you to provide us with certain services;
manage our IT resources, including infrastructure management and business continuity;
preserve the company’s economic interests and ensure compliance and reporting (such as complying with our policies and local legal requirements, adverse event reporting, tax and deductions, managing alleged cases of misconduct or fraud; conducting audits and defending litigation);
manage mergers and acquisitions involving our company;
archiving and record keeping;
billing and invoicing; and
any other purposes imposed by law and authorities.
How do we use cookies and other similar technologies on our websites and apps?
We use cookies to improve our websites. Cookies do not track individual visitors but help us understand usage patterns. You can manage cookies through your browser settings. We may also use other technologies like internet tags and Adobe Flash for similar purposes.
Please note that, in certain circumstances, your refusal to accept cookies or your browser settings may affect your browsing experience and prevent you from using certain features on our websites or apps.
Who has access to your personal data and to whom are they transferred?
We will not sell, share, or otherwise transfer your personal data to third parties other than those indicated in this Privacy Notice.
In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data can be accessed by or transferred to the following categories of recipients, on a need to know basis to achieve such purposes:
our personnel (including personnel, departments or other companies of the Novartis group);
our independent agents or brokers (if any);
our suppliers and services providers that provide services and products to us;
our IT systems providers, cloud service providers, database providers and consultants;
our business partners who offer products or services jointly with us or with our subsidiaries or affiliates;
any third party to whom we assign or novate any of our rights or obligations; and
our advisors and external lawyers.
The above third parties are contractually obliged to protect the confidentiality and security of your personal data, in compliance with applicable law.
Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.
The personal data we collect from you may also be processed, accessed or stored in a country outside of Israel, which may not offer the same level of protection of personal data. However. If we transfer your personal data to external companies in other jurisdictions, we will make sure to protect your personal data by (i) applying the level of protection required under the local data protection laws applicable in Israel, and (ii) acting in accordance with our policies and standards.
For intra-group transfers of personal data to our group companies, the Novartis Group has adopted Binding Corporate Rules, a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection relating to transfers of personal data outside the European Economic Area.
How do we protect your personal data?
We have implemented appropriate technical and organisational measures to provide an adequate level of security and confidentiality to your personal data. There are some risks which cannot be completely prevented, and can only be minimized by implementing these kind of measures, which take into account:
the state of the art of the technology;
the costs of its implementation;
the nature of the data; and
the risk of the processing.
The purpose thereof is to protect it against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.
We aspire to keep your personal data up to date and accurate. For that, we may request you to confirm the personal data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your personal circumstances so we can ensure your personal data is kept up-to-date.
How long do we store your personal data?
We will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.
For contracts, the retention period is the term of your (or your company’s) contract with us, plus the period of time until the legal claims under this contract become time-barred, unless overriding legal or regulatory schedules require a longer or shorter retention period. When this period expires, your personal data is removed from our active systems.
What are your rights and how can you exercise them?
You may exercise the following rights under the conditions and within the limits set forth in the law:
the right to access your personal data as processed by us, and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
in some cases, the right to request the erasure of your personal data or the restriction thereof to specific categories of processing;
the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
the right to object, in whole or in part, to the processing of your personal data;
the right to object to a channel of communication used for direct marketing purposes; and
If you have a question or want to exercise the above rights, you may send an email [email protected] with a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity and shall not retain the scan after completion of the verification. When sending us such a scan, please make sure to redact your picture and identification number or equivalent on the scan.
If you are not satisfied with how we process your personal data, please address your request to our data protection officer at [email protected], who will investigate your concern.
Please note that you are under no legal obligation to provide us with any personal data, and the provision of personal data is subject to your consent. However, in the event you do not consent to provide us with certain personal data, as well as your consent to the processing of such personal data in accordance with this notice, we will not be able to cooperate with you or provide you with some of our services.
How will you be informed of the changes to our Privacy Notice?
We may change or update this Privacy Policy from time to time by posting a new privacy policy on this website.
Miscellaneous
This Privacy Notice (i) complements any data protection policy or a similar document introduced within Novartis before the date of this Privacy Notice and (ii) applies to any consent form signed by any data subject for Novartis on, before and after the date of this Privacy Notice