Protecting the Privacy of Personal Data

1. Introduction
The fair, lawful and transparent processing of personal data is a top priority for Lundbeck Limited. This privacy notice explains when and why Lundbeck Limited (“Lundbeck”, “we”, “us”, “our”) collects and holds personal data about Healthcare Professionals (HCPs) and Other Relevant Decision Makers (ORDMs) as defined by the ABPI Code of Practice in the course of our business, how that data is used, the conditions under which it may be disclosed to others and how it is kept secure.

This privacy notice is separate from the privacy notice on our general UK website, which relates to users and visitors of the website. Links to specific social media privacy notices may also be available on our website or on our relevant social media pages or channels. If our website or these links are unavailable, please contact us using the details at the end of this notice and we can provide copies.

Lundbeck Limited (company number 01040798) is the data controller in relation to the processing activities described in this notice. This means that we decide why and how your personal data is processed.

In processing your personal data, Lundbeck will comply with applicable data protection laws, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

2. What personal data do we process?
As part of our professional dealings with you, we may collect, store, and use the following types of personal data:

• Contact details, including name, title, work location, work address, telephone number, email address, and preferred communication method.•
• Work or professional information, including job title or position, professional qualifications, professional registration number, OneKey ID or other secure identification number, specialty, working hours and preferred visiting hours.
• Information on professional interests and focuses, including areas of professional interest, business or treatment focus, information or advice requested about products and services, details of events signed up for or attended, and details of publications.•
• Communications and other information, including enquiry details, marketing preferences, information contained in correspondence or other communications with you, and information relating to claims, concerns or issues raised by or involving you.
• Professional engagement information, including details relating to advisory boards, consultancy arrangements, speaker engagements, market research, medical education activities, sponsorship arrangements, grants, donations, benefits, payments, expenses, and other transfers of value.
• Technical information, where relevant, including anonymous data collected by hosting servers for statistical purposes, IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform.

We may collect personal data directly from you through our interactions with you, including through field representatives and office staff, data collection at trade fairs, conferences and other events, and correspondence by phone, video conference, email or otherwise. We may also collect information where you contact us about our products or services, make an enquiry, report a problem with our site, or complete a survey for research purposes.

We may also obtain personal data from sources outside Lundbeck, including group companies, third-party healthcare professional and ORDM reference databases, marketing partners, event organisers, professional registration bodies, publicly available professional sources, and service providers acting on our behalf. Where personal data is obtained indirectly, we will process only personal data necessary for legitimate business, scientific, medical, regulatory or compliance purposes and will provide transparency information in accordance with applicable data protection laws.

Please see our Cookies Policy for further information on how we use cookies.

3. How and why, we use your personal data
As an overriding principle, we only process personal data that is necessary to achieve the relevant purpose of processing. Where possible and appropriate, we apply data minimisation, privacy by design, pseudonymisation, anonymisation and confidentiality measures.

The purposes for which we collect and use personal data, and the legal bases under data protection laws on which we may rely, include the following:

4. Legitimate interests
Lundbeck relies on legitimate interests as a legal basis for the collection, processing, retention and disclosure of personal data relating to Transfers of Value provided to Healthcare Professionals (HCPs), Other Relevant Decision Makers (ORDMs), and Healthcare Organisations (HCOs) in accordance with applicable transparency requirements, industry standards and the Association of the British Pharmaceutical Industry (ABPI) Code of Practice. 

This processing may include the collection and maintenance of information relating to professional engagements, consultancy arrangements, speaker activities, advisory board participation, sponsorship, grants, donations, fees for service, expenses and other Transfers of Value provided by Lundbeck. 

Lundbeck undertakes this processing to support transparency, accountability, and trust in its interactions with Healthcare Professionals, ORDMs and Healthcare Organisations and to demonstrate compliance with applicable industry, governance, and compliance requirements.

Before relying on legitimate interests as a legal basis for processing, Lundbeck undertakes a documented Legitimate Interests Assessment (LIA) to ensure that the processing is necessary, proportionate, and appropriately balanced against the rights, freedoms, and interests of the individuals concerned.

Where personal data is processed on the basis of legitimate interests, Healthcare Professionals and ORDMs have the right to object to such processing. Any objection will be assessed in accordance with applicable data protection legislation, the circumstances of the individual case and Lundbeck's documented Legitimate Interests Assessment.

Where Lundbeck determines that it no longer has compelling legitimate grounds to continue processing the personal data, the relevant processing activities will cease. Where compelling legitimate grounds exist, including where processing is necessary to meet legal, regulatory, compliance, transparency, governance, or audit requirements, Lundbeck may continue the processing in accordance with applicable data protection laws.

To exercise your right to object, or for further information regarding Lundbeck's use of legitimate interests as a legal basis for processing, please contact DataPrivacyUK@lundbeck.com.


5. Healthcare Professional and ORDM transparency and disclosure reporting
As a member of the Association of the British Pharmaceutical Industry (ABPI), Lundbeck processes personal data relating to healthcare professionals, ORDMs and healthcare organisations in connection with transparency reporting and disclosure obligations.

This may include information relating to professional engagements, consultancy activities, advisory services, speaker engagements, educational activities, sponsorship arrangements, grants, donations, transfers of value and other relevant interactions.

Lundbeck processes this information to support transparency, accountability, ethical engagement with healthcare stakeholders and compliance with applicable industry standards, governance requirements, and regulatory obligations.

Where personal data is processed on the basis of Lundbeck’s legitimate interests, Lundbeck undertakes an assessment to ensure that such processing is necessary, proportionate, and appropriately balanced against the rights, freedoms, and interests of the individuals concerned.

Personal data processed for transparency, compliance, governance, and audit purposes will be retained only for as long as necessary to fulfil applicable legal, regulatory, compliance, business, and record retention requirements.

6. Profiling and professional relationship management
As part of its interactions with healthcare professionals and ORDMs, Lundbeck may maintain professional records containing information such as professional specialty, role, areas of expertise, professional interests, scientific interests, previous interactions, educational preferences, and participation in Lundbeck activities.

This information is used solely to support appropriate, relevant, and compliant professional engagement and communication. It may help Lundbeck understand which information, educational activities or professional engagements may be most relevant and appropriate in the context of your professional role.

Lundbeck does not undertake solely automated decision-making that produces legal effects or similarly significant effects on healthcare professionals or ORDMs within the meaning of applicable data protection legislation.

7. Who may receive or have access to your data?
Access to personal data is restricted to Lundbeck personnel to the extent necessary for the processing purposes described in this notice. We may also disclose personal data to the following categories of recipients:

• Companies within the Lundbeck group where necessary for data analysis, business management, compliance, governance, transparency reporting or the provision of content, products, or services.
• The ABPI and other relevant bodies, where applicable, in connection with transparency reporting and industry code requirements.
• Service providers, agents, subcontractors, and other organisations that provide services to us or on our behalf, including CRM, healthcare professional and ORDM reference databases, cloud services, IT providers, professional advisers, communication fulfilment providers, research organisations, and administrative service providers.
• Third-party research companies, where they contact you for the purpose of gathering general or specific information relating to Lundbeck or our products and services.Third parties involved in a business sale, restructuring, liquidation, dissolution, or administration.
• Public authorities, regulators, investigation bodies, courts, professional advisers or other third parties where disclosure is required or permitted by law, regulation, legal process, contractual rights or to protect rights, property, or safety.

When we use third-party service providers, we disclose only the personal data necessary for them to provide their services and require them to keep information secure and process it only in accordance with our instructions or other lawful basis.


8. Where is your data stored and transferred?
Personal data you provide to us is stored on secure servers located within the United Kingdom and/or the European Economic Area. We also collect and store personal data in systems used to manage healthcare professional and ORDM relationships and records, including systems provided and maintained by third-party service providers such as Veeva Systems Inc. and healthcare professional and ORDM reference databases such as IQVIA OneKey.

Where personal data is transferred outside the United Kingdom, the EEA or a jurisdiction recognised as providing an adequate level of protection, Lundbeck will ensure that appropriate safeguards are implemented in accordance with applicable data protection legislation. Such safeguards may include UK International Data Transfer Agreements, UK Addenda to the European Commission Standard Contractual Clauses, European Commission Standard Contractual Clauses, intra-group agreements, or transfers to countries benefiting from a recognised adequacy decision.

A copy of relevant safeguards may be requested using the contact details provided in this notice, where applicable.


9. How long do we store your personal data?
The length of time we retain personal data is determined by a number of factors, including the purpose for which the information is used, applicable legal, regulatory, compliance, audit, and business requirements, and whether the information is needed to establish, exercise or defend legal claims.

• Business letters and comparable correspondence are generally retained for six years.
• Invoice-related documents and contract documents are generally retained for seven years.
• Personal data in CRM systems is retained for the duration of the relevant professional relationship, subject to periodic review and data quality processes.
• Data relating to transfers of value is retained in accordance with applicable transparency reporting, industry code, and record retention requirements.
• Complaint, enquiry, investigation, audit, or compliance-related records are retained for as long as reasonably required to resolve the matter and meet applicable legal, regulatory, compliance or governance requirements.

When it is no longer necessary to retain personal data in an identifiable format, we will delete it, anonymise it or aggregate it so that it can no longer be linked back to an identifiable individual. In limited cases, we may retain personal data for longer where required or permitted by law, regulation, industry code, legal claims, audit requirements, or compliance obligations.


10. Security and links to other sites
Lundbeck implements reasonable and appropriate technical and organisational controls to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. However, transmission of information via the internet is not completely secure and any transmission is at your own risk until received by us.

Our sites may contain links to websites run by other organisations. This notice does not apply to those websites and we encourage you to read their privacy notices. Lundbeck is not responsible for the privacy policies or practices of other websites.


11. Data anonymisation and aggregated information
Personal data may be converted into statistical or aggregated data in such a way that individuals are not identified and are not identifiable from it. Aggregated data cannot be linked back to an identifiable natural person. We may use aggregated or anonymised data for analytical, research, business planning, or reporting purposes.


12. Your rights
Subject to applicable law, you may have rights in relation to your personal data, including:

• Right of access: to request access to personal data Lundbeck processes about you.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of personal data in certain circumstances.
• Right to restriction of processing: to request restriction of processing in certain circumstances.
• Right to data portability: where processing is based on consent or contract and conducted by automated means.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: where processing is based on legitimate interests, you have the right to object to that processing at any time.
• Right to complain: to lodge a complaint with the Information Commissioner’s Office or, where relevant, another competent supervisory authority.

13. Right to object to processing based on legitimate interests
Where Lundbeck processes your personal data on the basis of legitimate interests, you have the right to object to that processing at any time.Upon receiving an objection, Lundbeck will assess the request in accordance with applicable data protection legislation and will consider:

• nature of the processing;
• purpose for which the personal data is being processed;
• Lundbeck’s legitimate interests;any legal, regulatory, compliance, transparency, governance, or audit obligations applicable to Lundbeck; and
• the rights, freedoms, and interests of the individual concerned.

Where Lundbeck determines that it no longer has compelling legitimate grounds to continue processing the personal data, the relevant processing activities will cease. Where compelling legitimate grounds exist, including where processing is required to satisfy legal, regulatory, transparency, governance, compliance, or audit obligations, Lundbeck may continue the processing in accordance with applicable data protection laws.

To exercise your right to object, or for further information regarding Lundbeck’s use of legitimate interests as a legal basis for processing, please contact DataPrivacyUK@lundbeck.com.


14. Complaints
If you wish to make a complaint regarding Lundbeck’s processing of your personal data, you can contact us using the details at the end of this notice.

You also have the right to complain to the relevant data protection authority. In the UK, this is the Information Commissioner’s Office (ICO).

• Information Commissioner’s Office
  Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  Telephone: 0303 123 1113
  Website: https://ico.org.uk/

15. Children
Our site is not intended or designed to attract children. Lundbeck does not knowingly collect personal data from any person we know to be under the age of 18 years.

16. Changes to this notice
We may review this notice from time to time. Any changes will be notified by posting an updated version on our site and/or by contacting you by email where appropriate. Any changes will take effect in accordance with the notice provided at the time. We recommend that you regularly check for changes and review this notice whenever you visit our site.

This notice was last updated in July 2026.

17. Contact

If you have any questions regarding this privacy notice or Lundbeck’s processing of your personal data, please contact our Data Protection Officer or Data Privacy team using the details below:

• Email for UK data protection queries: DataPrivacyUK@lundbeck.com
• General data protection email: dataprivacy@lundbeck.com
• Post: Lundbeck Limited, Iveco House, Station Road, Watford, Hertfordshire, England, WD17 1ET
• Phone: 01908 649 966