Sanofi

South Korea Supplementary HCP Privacy Policy

to be read in conjunction with

Global Privacy Policy for Healthcare Professionals and other experts

Last updated: 5 November 2026

1. Supplemental Jurisdiction – Republic of Korea

    1. 1. Data Controller

For the Republic of Korea, ‘Controller’ refers to Sanofi-Aventis Korea Co., Ltd. or ‘Sanofi Korea’.

    1. 2. Collection and Use of Personal Data

In addition to the collection and use of Personal Data included in article 3 of the Global Privacy Notice for Healthcare Professionals and other experts “Personal Data” and article 4 “Why may SANOFI process your Personal Data?” SANOFI may collect and use your Personal Data for the following purposes:

Legal GroundsItems of Personal Data CollectedPurpose of Collection and UsePeriod of Retention and Use
Consent(Article 15(1)(1) of the PIPA)
Name, email address, affiliation, region, specialty, phone number
Electronic transmission of personalized communications from Sanofi about healthcare products, services, solutions related to medicines and vaccines, and other promotional information
Until the consent is revoked
Consent(Article 15(1)(1) of the PIPA)
Name, email address, phone number, subject and content of the enquiry
Handling and responding to inquiries in Sanofi Korea website
Until the consent is revoked
Contractual necessity (Article 15(1)(4) of the PIPA)Consent(Article 15(1)(1) of the PIPA)
[Required]Name, email address, password, affiliation, region of affiliated hospital, specialty[Optional]Areas of interest, mobile phone number
Membership registration, account management and provision of Sanofi Campus services, including access to other Sanofi websites or social media
Until the consent is revoked
Contractual necessity (Article 15(1)(4) of the PIPA)
Curriculum Vitae (educational background, work experience, institutional affiliations and other achievements), full name, place of work and address, phone number / contact details, bank account details
To assess suitability and engage services under a contract, including administering service payments, and meeting legal and regulatory requirements
Retained for up to 3 years from the termination of the service agreement
Contractual necessity (Article 15(1)(4) of the PIPA)Consent (Article 15(1)(1) of the PIPA)Separate consent for sensitive information (Article 23(1)(1) of the PIPA)
[Required] Name, email address, specialty, postal code, emergency contact name and phone number[Optional]Title, company/hospital affiliation, medical council number, mobile phone number, work address[Sensitive Information]Dietary restrictions
Manage participation in events, webinars organized, sponsored or promoted by Sanofi
Retained for up to 5 years from the date of the event
Contractual necessity (Article 15(1)(4) of the PIPA)
Name, affiliation, department name, email address, mobile phone number, membership number (if applicable), date of birth
Booking of accommodation and transportation for HCPs attending SANOFI events
Retained for up to 5 years from the date of the event
Contractual necessity (Article 15(1)(4) of the PIPA)Separate consent for Unique Identification information (Article 24(1)(1) of the PIPA)
Passport information other than passport number (passport English name, nationality, date of birth, gender, expiry date)[Unique Identification Number]Passport Number
Booking of international flights and accommodation for HCPs attending SANOFI events and identity verification
Retained for up to 3 years from the date of the event
Complying with legal obligations(Article 15(1)(2) of the PIPA and Article 47-2 of the Pharmaceutical Affairs Act)
Name, name of code of healthcare institution, details of economic benefits provided (type, date, amount)
Preparation, retention, submission and disclosure of expenditure reports on economic benefits provided to MOHW
Retained for 5 years from the date of preparation of the report
Consent(Article 15(1)(1) of the PIPA)
Name, Organization, Professional information, engagement details, payment/expense information
Industry transparency and compliance reporting to KRPIA
Retained for up to 5 years from the collection
Complying with legal obligations(Article 15(1)(2) of the PIPA and Article 68-8 of the Pharmaceutical Affairs Act)
Reporter’s qualification
PV and Safety Reporting including reporting of adverse drug reactions to MFDS
Retained for up to 10 years
Consent (Article 15(1)(1) of the PIPA)
Name, affiliation, job title, department, address, phone number, country
Verification of adverse event reports
Retained for up to 10 years
Complying with legal obligations(Article 15(1)(2) of the PIPA)
Name, address, payment details (amount and date of payment)
Filing and payment of taxes relating to contracted services, including withholding tax
Retained for up to 5 years from the day following the statutory filing deadline for the relevant tax period
Complying with legal obligations(Article 24-2(1)(1) of PIPA)
Resident Registration Number
Filing and payment of taxes relating to contracted services, including withholding tax
Retained for up to 5 years from the day following the statutory filing deadline for the relevant tax period
Complying with legal obligations(Article 24(1)(2) of PIPA)
Foreigner Registration Number
Filing and payment of taxes relating to contracted services, including withholding tax
Retained for up to 5 years from the day following the statutory filing deadline for the relevant tax period
Consent(Article 15(1)(1) of the PIPA)
Name, hospital name, department name, contact information, address, email, position, educational background, work experience, license number, photograph
Conducting clinical studies, post marketing surveillance (PMS) and investigator-initiated studies (ISS), including study management, payments and regulatory reporting
Up to 30 years from the completion of the study, as required under applicable clinical trial regulations
Consent(Article 15(1)(1) of the PIPA)
Name, Photograph, mobile phone number
Operation of the media interviews requested by media companies
Until the consent is revoked
Consent(Article 15(1)(1) of the PIPA)
Name, healthcare institution, department, email address, phone number
Operation of the managed access program (MAP), including requests for the importation of unapproved medicines
Until the consent is revoked
Consent(Article 15(1)(1) of the PIPA)
Name, email address, department/institution, address
Operation of the Rare Disease (RD) diagnosis program, including sign-up the platform and diagnostic testing
Until the consent is revoked
Consent(Article 15(1)(1) of the PIPA)
Name, hospital name, department name, email address
Operation of patient support programs
Until the consent is revoked or 10 years post program closure

* The Personal Information Protection Act or ‘PIPA’

 

    1. 3. Provision of Personal Data to Third Parties

In addition to article 6 of the Global Privacy Notice for Healthcare Professionals and other experts “Who can access your Personal Data?” and article 7 “Personal Data Transfers” SANOFI provides Personal Data to third parties as described below:

Legal GroundsName of RecipientItems of Personal Data ProvidedRecipient’s Purpose of UsePeriod of Retention and Use by Recipient
Complying with legal obligations (Articles 17(1)(2) of the PIPA, Article 68-8 of the Pharmaceutical Affairs Act)
Ministry of Food and Drug Safety (MFDS), including the Korea Institute of Drug Safety and Risk Management (KIDS)
Reporter’s qualification
Report of adverse drug reactions, and other safety information under Pharmaceutical Affairs Act
Retention and use of personal information until the purpose of use is achieved or for the period prescribed by relevant laws
Complying with legal obligations (Article 17(1)(2) of the PIPA, Article 47-2 of the Pharmaceutical Affairs Act)
The Ministry of Health and Welfare (MOHW)
Name, name of code of healthcare institution, details of economic benefits provided (type, date, amount)
Expenditure reports on provision of economic benefits to HCP and response to MOHW requests for reports and supporting documents
Retained for up to 5 years from the date of provision, as required by law
Consent(Article 17(1)(1) of the PIPA)
The Korean Research-based Pharmaceutical Industry Association (KRPIA)
Name, organization, professional information, engagement details, payment/expense information
Industry transparency and compliance reporting relating to transfers of value
As set by KRPIA 5 years from the date of provision
Complying with legal obligations(Article 17(1)(2) of the PIPA and Article 24-2(1)(1) of the PIPA)
National Tax Service
Name, payment details (amount and date of payment), resident registration number/foreigner registration number
Withholding and filing of income tax and submission of payment statements under the Income Tax Act
Retention and use of personal information until the purpose of use is achieved or for the period prescribed by relevant laws
Consent(Article 17(1)(1) of the PIPA)
Accommodation providers, Rail and ground transportation providers (the specific provider for each event is identified in the event invitation and booking confirmation)
Name, affiliation, department name, email address, mobile phone number, membership number (if applicable), date of birth
Room reservation, check-in, and guest management, ticket reservation and issuance
Retained for up to 5 years from the date of provision

    1. 4. Delegation of Personal Information Processing

In addition to article 6 of the Global Privacy Notice for Healthcare Professionals and other experts “Who can access your Personal Data?” SANOFI delegates the processing of Personal Data as described below, and the delegatees may process Personal Data according to the purpose of the delegation. SANOFI also delegates the processing of Personal Data to overseas delegatees. Details of such delegatees and the delegated services are set out in Section 1.5:

DelegateeDescription of Delegated Services
LSK Global Pharma Services, Novotech Asia Korea Co., Ltd
Conduct of post-marketing surveillance (PMS) and clinical studies (CRO services)
Wise Q&A
Web page development and reports creation
Markit(Re-delegation: Kakao)
Web page development and management of Sanofi-sponsored mobile messaging programs (including Kakaotalk message distribution)
Crenor Healthcom Co., Ltd
Web content development, webcast event management services and PV reporting
M2 Comm Co., Ltd
Event Management and Transparency Reporting (domestic)
Medigate
Electronic communications and webinars
OnInteraction Co., Ltd, Medi C&C Co., Ltd.
Event Management and Transparency Reporting
IQVIA Korea
Management of patient support program
DB Schenker Korea Co., Ltd.
Logistics services for investigator-initiated studies (ISS)
SCL Healthcare Co., Ltd
Operation of the web-based platform for the Rare Disease Diagnosis Program and related diagnostic testing
EONE laboratories
Diagnostic testing for the Rare Disease Diagnosis Program
HR Outsourcing Korea Co., Ltd
Filing of other income tax returns and withholding tax reporting
Redcap
Travel agency services (booking of flights, accommodation)

    1. 5. Overseas Transfer of Personal Data

In addition to article 7 of the Global Privacy Notice for Healthcare Professionals and other experts “Personal Data Transfers,” SANOFI transfers Personal Data overseas as follows:

Legal GroundsRecipient’s Name (Contact Information)Country to which Personal Data to be TransferredDate, Time and Method of TransferItems of Personal Data to be TransferredRecipient’s Purpose of UsePeriod of Retention and Use by Recipient
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
SANOFI legal entity*
France and other countries where affiliates are located*
Upon collection and whenever necessary to fulfil the purpose of the transfer, via encrypted transmission over the information and communications network
Curriculum Vitae (or educational background, work experience, institutional affiliations and other achievements), full name, place of work and address, phone number / contact details, bank account details
Development, operation, maintenance and management of global system Support for data collection, analysis, operation and management of programs such as clinical trials, identification of anomalies and other safety informationProcessing of safety information, reporting to overseas health and medical authoritiesSpeaker event management and payments
Until the consent is revoked
[Consent(Article 17(1)(1) and Article 28-8(1)(1) of the PIPA)]
Healthcare authorities/regulators of the countries in which SANOFI legal entities are located, including US FDA, EMA(Please visit each country's regulatory authority websites for contact information*)
US and other countries in where SANOFI legal entities are located
Upon each safety report, via encrypted transmission over the information and communications network
Reporter’s name, Contact details, affiliation, occupation
Reporting of safety information as required under the laws of the recipient’ country
Until the retention period under the relevant regulations of each country
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Central laboratories and other clinical study service providers (sub-delegatee); each recipient and its contact details are listed in the Annex at the end of this privacy policy*
The countries listed in the annex
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Same as the items collected for clinical studies, PMS and ISS in Section 1.2 to the extent required for each recipient's service
Clinical study services, including management of the electronic trial master file, electronic data capture, randomisation and trial supply management through interactive response technology, central laboratory testing, clinical imaging, investigator site training and study portal, transparency reporting of payments to HCPs and PMS support
Retained for up to 30 years from the end of the study, as required under applicable clinical trial regulations
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
IQVIA(re-delegation)(+46 8 50 88 42 00)
Sweden
Quarterly through the information and communications network
OneKey code, full name, hospital name, hospital address/telephone, specialty
Used as reference information by the Patient Experience team to link HCP records with patient data within the iCare application
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)] for required items; [Consent (Article 28-8(1)(1) of the PIPA)] for optional items;[Consent (Article 23(1)(1) and Article 28-8(1)(1) of the PIPA)] for sensitive information
Cvent(re-delegation)(privacy@cvent.com)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
[Required] Name, email address, specialty, postal code, emergency contact name and phone number[Optional]Title, company/hospital affiliation, medical council number, mobile phone number, work address[Sensitive Information] Dietary restrictions
Event Management and Transparency Reporting
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)] for required items; [Consent (Article 28-8(1)(1) of the PIPA)] for optional items;[Consent (Article 23(1)(1) and Article 28-8(1)(1) of the PIPA)] for sensitive information
MCI(re-delegation)(+41 22 33 99 500)
Switzerland
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
[Required] Name, email address, specialty, postal code, emergency contact name and phone number[Optional]Title, company/hospital affiliation, medical council number, mobile phone number, work address[Sensitive Information] Dietary restrictions
Event Management and Transparency Reporting
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Consent (Article 28-8(1)(1) of the PIPA)]
Salesforce Marketing Cloud(re-delegation)(1-800-664-9073)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Marketing campaign and engagement activities
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Consent (Article 28-8(1)(1) of the PIPA)]
EPAM Systems, Inc.(re-delegation)(privacy@epam.com)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Marketing campaign and engagement activities
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Consent (Article 28-8(1)(1) of the PIPA)]
Clever Age(re-delegation)(drh@clever-age.com)
France
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Marketing campaign and engagement activities
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
SpotMe(re-delegation)(privacy@spotme.com)
Singapore
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Name, Email address, HCP ID
Engagement platform for Events, Meetings, Congresses and HCP Communities
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Cognizant Technology Solutions Corporation(re-delegation)(dataprotectionofficer@cognizant.com)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Online Campaign Platform Operation
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Veeva Systems Inc.(re-delegation)(privacy@veeva.com)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Operation and hosting of the Customer Relationship Management system
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Orange Business(re-delegation)(obs.dpo@orange.com)
France, Mauritius
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Data foundation for customer interactions
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Snowflake(re-delegation)(privacy@snowflake.com)
Ireland
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Full name, gender, HCP tier, job title, hospital name, hospital address, telephone number, specialty, email address, phone number, subscriber key, contact key, One key code, HCP ID, call records, marketing consent status, service usage records
Data foundation for customer interactions
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
SAP SE(re-delegation)(privacy@sap.com)
Germany
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Name, hospital name, HCP ID, Address, phone number, bank account number
Payment management system for services provided
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Auth0 (OKTA), Inc.(re-delegation)(privacy@okta.com)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Email address, name, specialty, preferences, address, marketing consent status, MDM ID, OneKey ID
User authentication, portal registration, login and customer profile management
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
PAREXEL International Limited(sub-delegatee)(+1 919 544 3170)
India
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Email address
Management of Adverse Events and Safety Reporting
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Salesforce.com, Inc,(sub-delegatee)(+1 800 664 9073)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Name
iCare global Patient Support Program operation
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Clinigen Healthcare Limited(sub-delegatee)(DPO@clinigengroup.com)
United Kingdom
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Name, healthcare institution, department, email address, phone number
Operation of the website for MAP requests, including the importation of unapproved medicines
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Contractual necessity (Article 28-8(1)(3) of the PIPA)]
Medispend (privacy@medispend.com)
USA
Upon collection and whenever necessary to perform the delegated services via encrypted transmission over the information and communications network
Name, name of code of healthcare institution, details of economic benefits provided (type, date, amount)
Provision of services for the execution of expenditure reporting tasks
Until the purpose of processing is achieved or the service agreement is terminated, whichever comes first
[Consent(Article 17(1)(1) and Article 28-8(1)(1) of the PIPA)][Separate Consent(Article 24(1)(1) of the PIPA)] for Unique identification number
Foreign airlines and accommodation providers located in the destination country of the relevant event (the specific provider and its contact details are identified in the booking confirmation)
Country where the event is held and any transit country
At the time of booking and check-in, via encrypted transmission over the information and communications network
Name, affiliation, department name, email address, mobile phone number, membership number (if applicable), date of birth; [Unique identification number]Passport number
Room reservation, check-in, and guest management, ticket reservation and issuance
In accordance with the accommodation/airline's policy and the laws and regulations of the country where the accommodation/airline is located

* To access the list of SANOFI legal entities, including their name, country and contact details, click here.

* To access the list of each country's regulatory authority websites, including their country and contact details, click here.

You may have the right to refuse the overseas transfer of your Personal Data as described above. You may exercise this right by contacting the privacy officer or by using SANOFI’s contact form. However, in doing so, you may not be able to use our services for which overseas transfer of Personal Data is necessary.

 

 

    1.6. Destruction of Personal Data

In addition to the security measures under article 11 of the Global Privacy Notice for Healthcare Professionals and other experts “Security Measures,” in principle, when the purposes of collection and use of Personal Data are achieved, SANOFI will destroy the Personal Data without undue delay. However, if any Personal Data is required to be retained under applicable law, such Data will be retained for the period and purpose as prescribed by law. Examples of retention prescribed by law are as follows:

  • Pharmaceutical Affairs Act (Article 47-2(1)) 
    - Expenditure reports and related ledgers, supporting documents (5 years)
  • Protection of Communications Secrets Act (Article 15-2)
    - record of computer communication or Internet log, trace data of access point (3 months)

And SANOFI will destroy Personal Data as follows:

  • SANOFI will select the Personal Data subject to destruction and destroy it.
  • SANOFI will destroy Personal Data recorded and stored in electronic files in an irrevocable manner, and shred or incinerate Personal Data recorded and stored in paper documents.

 

    1.7. Additional Use and Provision

In accordance with the PIPA, SANOFI may use or provide Personal Data within the scope of reasonably related to the initial purpose of the collection, in consideration of whether disadvantages have been caused to data subjects and whether necessary measures have been taken to secure such as encryption, etc. SANOFI will determine with due care whether to use or provide Personal Data in consideration of general circumstances including relevant laws and regulations such as the PIPA, purpose of use or provision of Personal Data, how Personal Data will be used or provided, items of Personal Data to be used or provided, matters to which data subjects provided consent or which were notified/disclosed to data subjects, impact on data subjects upon the use or provision, and measures taken to protect subject data. Specific considerations are as follows:

  • Whether the additional use or provision of personal data is related to the original purpose of collection;
  • Whether the additional use or provision of personal data is foreseeable in light of the circumstances in which personal data is collected or practices of processing personal data;
  • Whether the additional use or provision of personal data unduly infringes on the interests of users; and
  • Whether necessary measures have been taken to ensure security, such as pseudonymization or encryption.

 

    1.8. Collection of Behavioral Information by SANOFI

SANOFI collects and uses behavioral information, such as cookies and other technologies on our websites Information about the types of cookies and other technologies we use, their purposes, retention periods, and how you can manage your cookie preferences is available in our Cookie Policy here. You may refuse the storage of cookies by changing your web browser settings (e.g., Chrome: Settings>Privacy and Security>Third-party cookies; Edge: Settings>Cookies and site permissions). If you refuse cookies, some features of our website may not be available.

 

    1.9. Collection of Behavioral Information by Third Parties

In the course of using SANOFI websites and applications, SANOFI allows advertising partners to use cookies to build a profile of your interests and show you relevant advertisements on other sites. They do not store directly Personal Data but are based on uniquely identifying your browser and internet device.

You can manage the permission or block the collection of behavioral information by third
parties by changing your browser’s cookie settings. For more information on how our
advertising partners use cookies, please see our Cookie Policy here.

 

    1.10. Contact Information

If you have any concerns about the way your Personal Data has been collected or handled by SANOFI, or any queries regarding this Privacy Policy, you can exercise your data protection rights here. Requests submitted by South Korean data subjects will be handled by the Privacy Officer responsible for South Korean operations.

    - Local Privacy Officer: Rachel Somervaille (PrivacyOfficeSouthKorea@sanofi.com)

    - Department handling privacy requests and complaints: Privacy Team (Ethics and Business Integrity)

If you need to report or seek advice on an infringement of your Personal Data, you may contact the following organizations:

  • Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr)
  • Personal Information Infringement Report Center (118, www.privacy.kisa.or.kr)
  • Supreme Prosecutors’ Office (1301, www.spo.go.kr)
  • Korean National Police Agency (182, www.ecrm.polic.go.kr)

 

    1.11. Updates to the Privacy Policy

As explained in article 12.2 “Updates to the Privacy Policy,” SANOFI may revise this Privacy Policy from time to time. SANOFI will give notice of any amendments to its website before it takes effect. Amendments that may materially affect your rights will be notified in advance.

This Privacy Policy applies from 2026. 11. 05. The previous privacy policy can be found
below.
2024. 04. 01 ~ 2026. 11. 05 Privacy Policy

 

    Annex. Central Laboratories and Other Clinical Study Service Providers

These recipients receive data under the clinical study row of Section 1.5 as sub-delegatees of Sanofi S.A. Each recipient’s own sub-delegation and overseas transfers are described in its own privacy policy.

Recipient’s Name (Contact Information)Country to which Personal Data to be TransferredRecipient’s Purpose of Use
ICON CLINICAL RESEARCH LTD(data_privacy_officer@iconplc.com)
Ireland
Clinical Research Organisations for Site Management and trial managementFirecrest; eLearning system, Review and evaluation of inclusion/exclusion criteria as an adjudication committee
Syneos Health(data.privacy@syneoshealth.com)
USA
Clinical Research Organisations for Site Management
Medidata(mdsol.NAM.dataprivacy@3ds.com)
USA
Clinical Research Organisations for Site Management
QuantifiCare(+33 4 92 91 54 20)
France
Imaging vendors and other service providers supporting the conduct of clinical trials and clinical research.
Veeva Systems(privacy@veeva.com)
USA
eLearning system (ClinOvault Study Training), Clinical Trial Management System, eTMF(secure document management system)
LabCorp(privacyofficer@labcorp.com)
USA
Central laboratory
Endpoint Clinical(DPO@endpointclinical.com)
USA
IRT: Subject visit registration, investigational medicinal product supply and dispensing management
Thermofisher Scientific (data.privacy@thermofisher.com)
USA
PPD Central Laboratory (Third party lab ; PK/ADA)