Sanofi Korea Privacy Policy

If you are a healthcare professional, please click here

Privacy Policy

1. Definition

1.1. Who is subject to this Privacy Policy?

'Data Subject' refers to any individual whose identity can be verified or verifiable, to whom Sanofi Korea processes personal information and is subject to this Privacy Policy. This includes patients, customers, and anyone related to Sanofi Korea's business (hereinafter collectively referred to as 'Data Subject').

If you are a healthcare professional or other professional, please refer to the 'Privacy Policy for Healthcare Professionals and Other Professionals provided at the link above.

1.2 Who is responsible for managing your personal information?

When referring to 'Sanofi Aventis Korea Ltd. (hereinafter referred to as 'Sanofi Korea') and Sanofi Korea, 'we', 'we', and 'we' are responsible for your personal information processing in accordance with this Privacy Policy. Contact information for our personal information protection officer and the department handling personal information-related requests is specified in Article 14.

1.3. What other terms should I understand?

'Personal information' refers to information about a living individual, including any information related to an identified or identifiable individual or data subject. This may be directly identifiable (e.g., name) or indirectly identifiable information that can be easily combined with other information (e.g., gender, date of birth, address).

'Personal Information Laws' refers to the Personal Information Protection Act (hereinafter referred to as the 'Protection Act'), its enforcement decree, notices and guidelines announced by the Personal Information Protection Commission (hereinafter referred to as the 'Protection Commission'), and other laws and regulations of the Republic of Korea applicable to processing activities. 'Personal Information Processing Policy' refers to this Privacy Policy, which provides detailed general information regarding the processing of personal information by Sanofi and its subcontractors. This Privacy Policy explains how Sanofi Korea processes personal information by collecting, storing, using, providing, transferring, and otherwise processing it.

'Processing Activities' means any action or series of actions performed regarding personal information or its personal data, including collection, recording, organizing, storing, modifying, searching, viewing, using, disclosing by transmission or otherwise providing or sorting or combining, blocking, restricting, pseudonymization, anonymization, deletion, or destruction, whether or not performed by automated means.

'Sanofi Group' refers to its affiliates.

2. Sanofi Korea's Commitment

Sanofi Korea fully understands the importance of personal data protection and is committed to ensuring the protection and security of personal information at all levels within the organization for the benefit of all data subjects who interact with Sanofi. Through this Privacy Policy, Sanofi Korea provides guidance on the purpose and methods of processing personal information you provide, automatically collected personal data, or personal information received from third parties, as well as how you can exercise your rights.

3. Personal Information

3.1 What personal information does Sanofi Korea process, and why?

Sanofi Korea processes the following personal information for the following purposes:

Legal Basis	Items of Personal Information Collected	Purpose of Collection and Use	Retention and usage period
Consent(Protection Act Article 15, Paragraph 1, Subparagraph 1)	Name, email address, phone number, subject and content of the inquiry	Handling and responding to inquiries on the Sanofi Korea website	Until consent is withdrawn
Consent(Protection Act Article 15, Paragraph 1, Subparagraph 1)Separate Consent for Sensitive Information(Article 23, Paragraph 1, Subparagraph 1 of the Protection Act)	[General Information]Subject number (identification code), age, gender, date of birth, (if applicable) information of the subject's legal guardian (name, relationship to subject) such as minors※ Information about participants in clinical activities is verified only by unique code numbers and is processed to prevent identity verification. Subjects' names, contact details, and address details are retained only at clinical trial sites (medical institutions) unless there are special exceptions specified in the clinical trial protocol.[Sensitive Information]• Race and ethnicity information• Health-related information - Physical examination including vital signs, height, and weight- Medical history, medication history, treatment history, and disease information - Information on concomitant drugs - Medical information related to the safety and efficacy of investigational drugs (including adverse events)- Test results (including laboratory tests, imaging tests, and physiological test results obtained through equipment)- Clinical report results and patient-reported results through questionnaires, etc.- Pregnancy or breastfeeding status (if applicable)- Information about pregnancy including health status during pregnancy, birth details, and infant health (if applicable)- Other biological specimens such as blood and tissue	Conducting clinical trials, organizing, analyzing, reporting, and processing clinical trial data, collecting, analyzing, and reporting adverse events, publishing and publishing academic research results (disclosure of identification information)	Retained for up to 25 years after study reporting(If applicable laws, regulations, or regulatory authorities require a longer retention period, those periods apply.)
Consent(Protection Act Article 15, Paragraph 1, Subparagraph 1)Separate Consent for Sensitive Information(Article 23, Paragraph 1, Subparagraph 1 of the Protection Act)	[General Information]Subject number (identification number), age, gender, date of birth, (if applicable) information of the legal guardian of the subject such as minors (name, relationship with the subject)[Sensitive Information]Health-related information- Height, weight, vital signs- Medical history, medication history, treatment history, and disease information- Drug combination information- Medical information related to the safety and efficacy of investigational drugs (including adverse event cases)- Test results (laboratory tests, imaging tests, etc.)- Patient-reported results through questionnaires and other forms- Pregnancy or breastfeeding status (if applicable)- Information about pregnancy including health status during pregnancy, birth details, and infant health (if applicable)※ Information about subjects participating in the investigation will be verified only by unique code numbers and will be processed to prevent identity verification. Direct identification information such as the name and contact information of the survey subject will be retained only by the investigation institution (medical institution) unless there is an exception specified in the investigation plan.	Non-interventional studies, post-marketing surveillance (including usage surveys and post-marketing drug safety and efficacy investigations);Activities such as evaluating the safety and efficacy of drugs in actual post-marketing use environments, collecting, analyzing, and reporting adverse reactions, organizing, analyzing, and reporting investigation data, re-examining drugs, preparing materials to be submitted to regulatory authorities regarding approval and insurance coverage, and publishing academic presentations and papers (non-disclosure of identifying information)	Retention for up to 5 years after study completion(If relevant laws or regulatory authorities require a longer holding period, that period applies.
Consent(Protection Act Article 15, Paragraph 1, Subparagraph 1)Separate Consent for Sensitive Information(Article 23, Paragraph 1, Subparagraph 1 of the Protection Act)	[General Information]Name, address, phone number, email address, age, date of birth, gender, family relationships, date of joining, and general personal information you voluntarily provide during program participation, telephone consultations, and adverse event notifications.[Sensitive Information] Health information provided by you or your prescribing physician, name of the institution and attending physician, date of administration, medication history, treatment and medication history including reason for hospitalization, rare disease information, major symptoms, medical records, weight, date of initial diagnosis, date of treatment, marital status, adverse reactions, complications, and medical history, as well as health information voluntarily provided during the adverse reaction reporting process	Patient Assistance Programs: Provide support to patients prescribed the product and/or related to their condition	Retained for up to 10 years from the date of participation

Sanofi Korea processes sensitive information such as health information under Article 23 of the Protection Act only when you have separately consented or when such processing is required or permitted by law. Unique identification information under Article 24 of the Protection Act is processed only with separate consent or when required or permitted by law, and resident registration numbers are processed only when specifically required or permitted by law under Article 24-2 of the Protection Act.

How does Sanofi Korea collect your data?

Sanofi Korea collects personal information through the following methods.

Written forms received in person-to-face contact or by mail, for example,
Digital forms on the Sanofi Korea website or various websites or tools (including third-party websites) operated or used for complaint handling, medical information, safety reporting, etc.
Collection through information generation tools

This list is not exhaustive, and Sanofi Korea may use additional methods to collect your personal information. In all cases, Sanofi Korea will provide you with the relevant Privacy Policy when collecting your personal information.

3.2 Why can Sanofi process your personal information?

Sanofi Korea uses the collected personal information for purposes such as conducting pharmaceuticals and other medical and scientific research, operating various support programs for patients, collecting and managing drug safety information, and providing medical information services.

Each processing activity carried out by Sanofi Korea pursues a specific purpose and is based on corresponding legal grounds. Examples include:

Contract Fulfillment
Meeting legal or regulatory requirements
If you have provided us with permission or consent
To enable Sanofi to successfully operate its business
When protecting your or others' vital interests
When necessary for significant public interest reasons based on relevant laws

4. Who can access your personal information?

4.1 Provision of Personal Information to Third Parties

As part of the processing activities carried out by Sanofi Korea, personal information is provided to third parties as follows:

Legal basis for provision	Recipient	Personal information items provided	Purpose of Use by the Recipient	Retention and usage period of the recipient
Consent(Protection Act Article 17, Paragraph 1, Subparagraph 1)Consent(Protection Act Article 17, Paragraph 1, Subparagraph 1) (Protection Act Article 17, Paragraph 1, Subparagraph 1)	Ministry of Food and Drug Safety (MFDS) / Korea Institute of Drug Safety Management (KIDS)	[General Information]Full Name (initials), gender, date of birth[Sensitive Information] Height, weight, Hospital address, mobile phone numbernumber, email address, andAdverse drug reaction report	Adverse drug reaction reports, as well as various reports and applications according to relevant laws and regulations.	Except as otherwise provided by law, the program will be retained for 10 years after the cost settlement for program operation is completed, and supporting documents are retained.
Consent (Protection Act Article 17, Paragraph 1, Subparagraph 1)	National Health Insurance Service	All general and sensitive information requested from the National Health Insurance Service specified in Clause 3.1	Payment of high-cost medical expenses; Verification of appropriateness of refund amounts	Except as otherwise provided by law, supporting documents for program operation will be retained for up to 10 years after refund completion
Consent (Protection Act Article 17, Paragraph 1, Subparagraph 1)	Each hospital's ethics committee / Clinical Trial Review Board (IRB)	Within the scope necessary to provide services to each beneficiary, the items collected in the clinical study under Clause 3.1 are the same as those	Review and approve study protocols and documents for conducting clinical trials at the institution	Except as otherwise provided by law, within the period prescribed by the relevant research institution,

4.2 Outsourcing of Personal Information Processing Tasks

As part of the processing activities carried out by Sanofi Korea, personal information processing may be entrusted to third parties listed below to support service provision according to the purpose of the outsourcing.

trustee	Details of the Entrusted Work
IQVIA Solutions Korea Co., Ltd	Patient program management, member management, website maintenance, starter kit delivery, medication reminders, and self-medication guidance video (SMS) delivery Management of drug cost reimbursement patient support programs, registration and verification of registered member documents, collection of general and sensitive information (health information) of registered members, telephone consultation and guidance, management of business-related systems (website, email, work computers, cloud, etc.), and IT infrastructure security management and maintenance
SinaforYou	Delivery (shipping) of the Patient Support Program Starter Kit
Iron Mountain Korea	Document Storage and Destruction
Havas Korea	Operation and management of support programs, including the collection and processing of personal information and sensitive information. System management related to this (IT infrastructure operation management, security management and maintenance, etc. — including email, office computers, cloud services, etc.)
Crenor	Patient program phone consultations, delivery of textbooks and patient kits, medication reminder calls
LSK Korea	Clinical Research Institutions (CROs) for Clinical Trial/Site Management
Novotech Korea	Clinical Research Institutions (CROs) for Clinical Trial/Site Management
CRScube	Clinical trial data will be processed through EDC (Electronic Data Collection) and ePRO (Electronic Patient Reporting Results).
Target Health	Clinical trial data is processed through an EDC (Electronic Data Acquisition) system
Brands Korea	Investigational Drug (IMP) and Clinical Supply Logistics Management
Hanju Customs Clearance Agency Co., Ltd.	Customs clearance for clinical trial items

4.3 Overseas Transfer of Personal Information

Sanofi Korea is part of a multinational organization that conducts international governance and activities, with staff, partners, and service providers in many countries around the world. For these reasons, your personal information may be transferred outside Korea or to countries with different privacy laws and protection standards.

Sanofi implements appropriate protective measures as required by privacy laws (e.g., binding corporate rules (BCR) approved by EU data protection authorities, adequacy determinations issued by competent authorities, and/or standard contractual clauses (SCC); you may contact Sanofi to obtain copies of these SCCs).

Depending on the level of protection required to protect your personal information, Sanofi may require additional technical and administrative safeguards from the recipient to effectively safeguard and securely manage your personal information.

As part of the processing activities carried out by Sanofi Korea, personal information is provided to third parties located overseas as follows:

Recipient (Contact Information)	Countries to which they are transferred	Timing and Method of Relocation	Items of Personal Information to Be Transferred	Purpose of Use by the Transferee	Retention and usage period of the transferee	Legal Basis for Overseas Transfer
Sanofi Corporation*	France and other countries where affiliates are located*	When necessary to achieve the timing and prior purpose of collection, encrypted transmission via information and communication networks	[All personal information listed in Section 3.1]	[Only for purposes specified in Clause 3.1]	[During the retention period specified in Clause 3.1]	[Conclusion and Performance of Contracts (Personal Information Protection Act Article 28-8, Paragraph 1, Subparagraph 3)]
Central laboratory and other clinical research service providers (recontractors); Each transferred recipient and contact information is provided in the appendix at the end of this Privacy Policy*	Countries listed in the appendix	When collecting data and when necessary to carry out entrusted tasks, encrypted transmission via information and communication networks	Within the scope necessary for each recipient to perform the service, the same items collected in paragraph 3.1	Clinical trial services including electronic TMF management, electronic data collection (EDC), randomization and clinical trial supplies management via interactive response technology (IRT), central laboratory testing, clinical imaging, investigator site training and research portals, transparent reporting of payments to healthcare professionals (HCPs), and PMS support	Retained for up to 30 years from the study end date in accordance with relevant clinical trial regulations	[Conclusion and Performance of Contracts (Personal Information Protection Act Article 28-8, Paragraph 1, Subparagraph 3)]
PAREXEL International (IRL) Limited	India, China	As needed, we can use the network system from time to time.	The same items collected in Clause 3.1 as necessary for the provision of services by each transferred recipient	Performing pharmacovigilance tasks required by post-marketing safety control standards; Reporting adverse reactions to the Sanofi Group	Except as otherwise provided by law, reimbursement of program operation costs and supporting documents will be retained for 10 years after completion	[Conclusion and Performance of Contracts (Personal Information Protection Act Article 28-8, Paragraph 1, Subparagraph 3)]
Salesforce.com, Inc, (Re-trustee) (+1 800 664 9073)	Sweden	As needed, we can use the network system from time to time	Within the scope necessary for each recipient to provide services, the same items collected in paragraph 3.1	Operation and management of support programs, including the collection and processing of personal and sensitive information. System management related to this (e.g., IT infrastructure operation management, security management and maintenance, etc. — including email, office computers, cloud services, etc.)	To maintain operational and supporting documents for the program, it is retained for 10 years after the program ends.	[Conclusion and Performance of Contracts (Personal Information Protection Act Article 28-8, Paragraph 1, Subparagraph 3)]

* You can find the list of Sanofi affiliates (including addresses and contact information) here. Download the list of Sanofi affiliates from the bottom of the page.

You may request that your personal information is not transferred abroad through [link] or by contacting the department specified in Article 10. However, if you refuse such overseas transfers, you may not be able to use some or all the services provided by Sanofi Korea.

5. Installation, operation, and refusal of automatic data collection devices (cookies)

Sanofi Korea uses cookies to store and retrieve usage information from time to time for website operation, remembering your preferences, and analyzing website usage. Cookies are small pieces of information sent from the website server to your browser and may be stored on your device. Information about the types of cookies and other technologies we use, their purposes, retention periods, and how we manage cookie preferences can be found in our Cookie Policy here.

You can refuse to store cookies through your browser settings. If you refuse cookies, some website functions may not function properly. Here.

6. How long does Sanofi retain your personal information?

Sanofi Korea processes and stores personal information within the retention period prescribed by law or within the period you agreed upon at the time of collection. The retention period for each purpose is specified in Article 3.1. However, if an investigation or legal dispute related to you is ongoing, personal information will be retained until the matter is resolved.

7. What is Sanofi's responsibility regarding the destruction of personal information?

In principle, once the purpose of collecting and using personal information is achieved, Sanofi Korea will promptly destroy the relevant personal information. However, if personal information must be retained according to relevant laws, it will be retained for the period and purpose prescribed by law. Cases where retention is regulated by law are as follows:

Protection of Communications Secrets Act (Article 15-2)
- Computer communication records or internet access records, access point tracking data (3 months)

Additionally, Sanofi Korea defiles personal information as follows:

Sanofi Korea selectively destroys personal information subject to destruction.
Sanofi Korea destroys personal information recorded and stored in electronic files in an irrecoverable manner, and personal information recorded and stored in paper documents is shredded or incinerated.

8. Processing of Personal Information of Children Under 14

If consent is required for the processing of personal information of children under 14, Sanofi Korea obtains consent from the child's legal guardian.

When obtaining the legal guardian's consent for the processing of personal information of children under 14, Sanofi Korea may request the minimum necessary information from the child, such as the legal guardian's name and mobile phone number. Sanofi Korea confirms consent by having the legal guardian indicate consent on a website showing the consent details and then notifies the legal guardian by text message that the consent has been confirmed.

9. How can data subjects exercise their rights?

Data subjects and their legal representatives (guardians or guardians of minors who exercise authority under the law without the individual's consent) may exercise the following rights at any time. The exercise of rights for children under 14 must be made directly by the legal guardian, and data subjects who are minors aged 14 or older may exercise rights regarding their personal information either by themselves or through a legal representative.

Request to access personal information (Protection Act Article 35)
The right to request correction or deletion of personal information (Protection Act Article 36)
Request for suspension of processing or withdrawal of consent (Protection Act Article 37)
If applicable, refusal or request for explanation of automated decisions (Protection Act Article 37-2)

If you wish to exercise any of these rights, please use Sanofi's inquiry form to submit a request for access, etc. You also have the right to file a complaint with relevant authorities such as the Personal Information Protection Commission regarding the processing of your personal information.

10. What security measures does Sanofi implement?

Sanofi Korea takes the following measures to ensure the security of personal information in accordance with Article 29 of the Protection Act and the "Standards for Measures to Ensure the Security of Personal Information":

Administrative measures: Establishment and implementation of internal management plans, regular personal information protection training for employees
Technical measures: management of access rights, operation of access control systems, encryption of unique identification information and other information requiring encryption, installation and updating of security software
Physical measures: Access control to computer rooms and data storage areas

The digital ecosystem, cutting-edge technologies, and data processing capabilities are enhancing how Sanofi Korea interacts with people and organizations to achieve its goals. To protect data privacy, the Sanofi Group has introduced the 'Group Privacy Framework' and the 'Global Cybersecurity and Security Framework' to safeguard personal data and maintain the security and confidentiality of its information technology systems, assets, information, and databases.

The Sanofi Group implements various technical and administrative procedures and measures to ensure the integrity and confidentiality of your personal information and to protect it from unauthorized access, use, alteration, and disclosure.

11. Additional Use and Provision of Personal Information

In accordance with the Protection Act, Sanofi may use or provide personal information within the scope reasonably related to the original purpose of collection, considering whether any disadvantage has occurred to the data subject and whether necessary security measures such as encryption have been taken. Sanofi will carefully decide whether to use or provide personal information based on general circumstances, including relevant laws such as the Protection Act, the purpose of using or providing personal information, the methods of use or provision, the items of personal information to be used or provided, matters agreed to by the data subject or notified or disclosed to the data subject, the impact of use or provision on the data subject, and measures taken to protect the data subject. Specific considerations are as follows:

Whether the additional use or provision of personal information is related to the original purpose of collection;
Whether further use or provision of personal information is predictable given the circumstances at the time of collection or personal data processing practices;
Whether further use or provision of personal information unfairly infringes on the user's interests; and
Whether necessary measures such as pseudonymization or encryption have been taken to ensure security.

12. Collecting behavioral information from SANOFI

SANOFI collects and uses behavioral information through cookies and other technologies on our website. Information about the types, purposes, retention periods, and how you manage cookie preferences is specified in our Cookie Policy here. You can refuse cookies by changing your web browser settings (e.g., Chrome: settings > privacy and security > third-party cookies; Edge: settings > cookies and site permissions). If you refuse cookies, you may not be able to use some features of our website.

13. Collection of behavioral information by third parties

During your use of Sanofi websites and applications, Sanofi allows advertising partners to use cookies to build your interest profile and display relevant ads on other sites. They do not store personal information directly but rather use a unique identification method that identifies your browser and internet device.

You can change your browser cookie settings to manage or block third-party collection of behavioral information. For more details on how our advertising partners use cookies, please refer to our Cookie Policy here.

14. Personal Information Protection Officer and Grievance Handling Department

If you have concerns about how Sanofi collects or processes your personal information, or if you have any inquiries about this Privacy Policy, you can exercise your privacy rights through this link. Requests submitted by data subjects in Korea are handled by the Personal Information Protection Officer responsible for the Korean business location.

- Local Privacy Officer: Rachel Somervaille (PrivacyOfficeSouthKorea@sanofi.com)
- Personal Information Access Request and Grievance Handling Department: Personal Information Protection Team (Ethics and Business Integrity)

If you wish to report a privacy breach or need advice, you can contact the following organizations:

Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr)
Personal Information Infringement Report Center (118, www.privacy.kisa.or.kr)
Supreme Prosecutors' Office (1301, www.spo.go.kr)
National Police Agency (182, www.ecrm.polic.go.kr)

15. Amendment to this Privacy Polic

Sanofi may revise this Privacy Policy from time to time. Sanofi will announce changes through its website before they take effect. Any changes that may significantly affect your rights will be notified in advance.

The Sanofi Korea Privacy Policy takes effect from 2026.11.05. You can check the previous Privacy Policy below.

-2018.06.15~ 2026.11.05 (Click)

Appendix. Central laboratories and other clinical research service providers

The following persons receive personal information as subcontractors of Sanofi S.A. in accordance with the clinical research items in Article 4.3. The status of sub-consignment and overseas transfers of each transferee can be found in the privacy policy of each transferee.

Previous recipient (Contact Number)	Countries where personal information is transferred	Purpose of Use by the Transferee
ICON CLINICAL RESEARCH LTD(data_privacy_officer@iconplc.com)	Ireland	Clinical trial sites (site management and clinical trial management)Firecrest; E-learning system, review and evaluation of inclusion/exclusion criteria as a judging committee
Cineos Health(data.privacy@syneoshealth.com)	United States	Clinical Research Institutions for Site Management
Medidata(mdsol.NAM.dataprivacy@3ds.com)	United States	EDC/eData (Electronic Data Collection),
QuantifiCare(+33 4 92 91 54 20)	France	Imaging equipment suppliers and other service providers supporting clinical trials and conducting clinical research.
Veeva Systems(privacy@veeva.com)	United States	eLearning system (ClinOvault Study Training), clinical trial management system, eTMF (Secure Document Management System)
LabCorp(privacyofficer@labcorp.com)	United States	Central laboratory
Endpoint Clinical(DPO@endpointclinical.com)	United States	IRT: Subject Visit Enrollment, Investigational Drug Supply, and Dispensing Management
Thermo Fisher Scientific(data.privacy@thermofisher.com)	United States	PPD Central Laboratory (Third-Party Laboratory; PK/ADA)