Privacy Notice – Social Media Monitoring and Listening

This privacy notice sets out how Ipsen uses media monitoring and social media listening tools to identify and analyze trends and gather information related to our business. It covers different types of activity using social media sources, including general media monitoring, and social media listening projects that focus on public posts made by HCPs, patients and caregivers (carers) and other stakeholders.

We use media monitoring to help us to:

  • Identify news, trends and developments relating to our areas of interest, Ipsen and relevant industry leaders;
  • Understand the effectiveness of our media communications, websites and campaigns so we can adapt and improve our approach;
  • Track how we are doing as a company in terms of reputation and brand against competitive brands; and
  • Identify potential crises related to the Ipsen brand and its products as well as communications opportunities in our areas of interest.

We use social media listening focused on patients and caregivers to help us to:

  • Understand the experiences of patients and caregivers living with the conditions in our areas of interest, including their treatment pathways and journeys, quality of life and unmet needs;
  • Understand how patients and caregivers look for information and support, and identify emerging topics and concerns; and
  • Use these aggregated insights to improve our understanding of patient needs and the support, information and services we provide.

We use social media listening focused on other stakeholders, such as healthcare professionals (HCPs), patient advocacy groups and policymakers, to help us to:

  • Understand professional perspectives on the conditions in our areas of interest, including clinical practice, treatment approaches and unmet medical needs;
  • Understand views and trends on access, reimbursement and healthcare policy; and
  • Use these aggregated insights to improve the information, services and medical education we provide.

Who is the controller of your personal information?

For the purposes of this Global Privacy Notice, Ipsen Pharma SAS, headquartered at 70 Rue Balard, 75015, Paris, France, and its affiliates, are data controllers for the personal data processing described (referred to as Ipsen, we or us in this notice).

Ipsen is an international group of companies. As our headquarters are based in France, this notice is based on GDPR. For information related to Ipsen activity in your country and adherence to local privacy laws, please refer to the Privacy Notices on your country’s Ipsen website, which can be accessed via www.ipsen.com.

What personal information do we collect about you?

General media monitoring

When we run our media monitoring activities, we use keywords and other search parameters to collect information from our own websites and other publicly available sources, such as Wikipedia and social media sites like LinkedIn. Our primary aim is to create aggregated analysis, however, through the process of searching content and results we will collect certain personal data incidentally. For general media monitoring, this includes:

  • Identification: your name, username, pseudonym, handle, or other identifier;
  • Professional: your job title or profession (including category of profession, for example “CEO”);

We may also analyze the personal data in individual posts to infer other information about you, in order to group the analyses by different stakeholder groups.

In some cases, we may monitor the performance of the posts of key stakeholders, but we will not use that information to target or contact those people, but rather to meet our aims of understanding the volume of relevant content.

Social media listening

Patients and caregivers

When we carry out social media listening projects focused on patients and caregivers, we (or our suppliers on our behalf) collect public posts that patients and caregivers have themselves chosen to share publicly about their own experiences. This may include the text of your post and associated public information needed to collect it, such as the date and the platform; your opinions and experiences; and information about your health, such as your condition, symptoms, treatments and experience of care, where you have shared this about yourself.

We do not aim to collect your name, profile photograph, profile link, precise location, contact details or complete profile or discussion threads. Usernames, handles or links to posts may be processed temporarily by our suppliers only where technically necessary to collect the content or to report a possible side effect, and are removed or pseudonymized as early as practicable.

If you are a caregiver, we only use your posts to understand your own experience and needs as a caregiver. We do not aim to collect information that could identify the person you care for, including their name, age, school, hospital, doctor or location. Our suppliers use technical filters and human checks to identify and remove information that may identify that person.

Other stakeholders

When we carry out social media listening projects focused on other stakeholders, such as HCPs, patient advocacy groups and policymakers, we (or our suppliers on our behalf) collect public posts these stakeholders have shared in a professional capacity. This may include the text of the post, the date and platform, your opinions, and professional information such as your profession, specialty, role or organization where publicly stated. Where you are a recognized public expert, we may note that a post was made by you in order to understand the views of key stakeholders, but we will not use this information to target or contact you for promotional purposes. We limit collection to what is needed to understand themes, opinions and trends, and use technical filters and human checks to remove unnecessary personal data. Where posts include information about patients or other individuals, such as case discussions, we do not aim to collect it and seek to exclude any identifiable data and remove it during the process.

Why are we allowed to collect and use your personal information?

We process personal data in media monitoring activity for the following legal bases.

Article 6 1 (f) Legitimate interestsPersonal data obtained through media monitoring and social media listening activities is processed under Ipsen’s legitimate business interests in:
– Understanding how effective our media strategies are
– Gathering information about our reputation in relation to our areas of interest
– Comparing and benchmarking performance of communications related to our leaders vs the leaders of competitive companies
– Understanding what our key stakeholders are concerned with; and tracking trends, news and developments in our areas of interest.
– For social media listening focused on patients and caregivers – we use the results to understand patient and caregiver experiences, treatment journeys, unmet needs and information and support needs.
– For social media listening focused on other stakeholders, we use the results to understand professional and policy perspectives in our areas of interest.

When relying on legitimate interests we take steps to make sure our use of the data is balanced with the rights and interests of individuals involved. In social media monitoring and listening exercises, this includes minimizing data, pseudonymizing data, and using de-identified insights.
Article 6 1 (c) Legal ObligationOur media monitoring and social media listening tools may pick up reports of adverse events, or side effects related to our medicines. If this happens, we will process that data on the basis of our legal obligations to manage such cases.

Where we collect special categories of personal data about you, we need an additional legal basis. If the personal data is related to adverse events or side effects, we will rely on GDPR (EU and UK) Article 9 2 (i), which is about managing the quality and safety of medicines.

If we come across other special category data during general media monitoring activity (though this is not our aim or intention), then we will rely on the fact that such data has been manifestly made public, which is Article 9 2 (e).

For patient and caregiver social media listening, we rely on Article 9(2)(e) GDPR only where you have clearly and deliberately made information about your own health available to the general public. We will not use any of this data to target and profile you based on sensitive categories of personal data (e.g. health status, sexual orientation, political beliefs, etc.). In general, when posts include health information about another person (and it is not related to any adverse events or side effects), we will use filters and exclusion techniques to avoid collection and analysis.

Where do we get your personal data from?

In our media monitoring and social media listening activity, we collect data indirectly by running keyword and targeted searches on a range of publicly available sources. Depending on the specific project and subject to the platform’s accessibility settings and terms of use, sources may include online news sites, websites, forums, Wikipedia, LinkedIn, X, Instagram, YouTube, Facebook, Reddit, TikTok and Bluesky, and public patient forums and communities. For example, we may collect information on how users on X or LinkedIn comment on Ipsen as a company or on specific campaigns, such as one of our disease areas, or how patients and caregivers describe their experience of a condition in a public Reddit thread.

We will only obtain data based on the privacy settings you have set on any social media sites you use. For social media listening focused on patients and caregivers and other stakeholders, we only collect content that is accessible to anyone without logging in, registering or joining a group, and we do not collect content from private accounts, closed or private groups or communities, or where collection is not permitted by the platform’s terms of use. You can control these settings on the social media sites themselves, and you can also refer to their privacy notices or policies to check how your personal data is used by each platform.

We use specialist media-monitoring and social-listening tools, including platform-approved APIs where applicable, together with limited manual review of eligible public content.

We also track activities on our own websites using analytics software Piwik PRO (see the website user privacy notice for more information on this, and the pop-ups that appear on our websites when you visit them).

With whom do we share your personal information?

The main focus of our media monitoring activity is to create aggregated analyses that do not contain personal data. However, personal data is included during the process of creating those reports and we may also track certain key stakeholders’ activity. When we do have access to personal data, we ensure that it is only accessed by authorized employees at Ipsen, with a relevant and tangible need to access the information.

We also work with suppliers who, when relevant, may have access to personal data. When we do this, we require our suppliers to enter into appropriate contractual and data protection terms, implement suitable technical and organizational measures, and process personal data only on Ipsen’s documented instructions.

For social media listening focused on patients and caregivers (and other stakeholders), we work with specialist healthcare communications and research agencies, acting as our data processors, and the social listening platforms they use. Only their authorized and trained project staff can access post-level data.

For exercises focused on patients and caregivers, Ipsen receives only aggregated, anonymized reports and does not receive usernames, links, or screenshots, except for the minimum information needed to report on possible side effects to our Pharmacovigilance team. Where limited quotations are used, direct and indirect identifiers are removed, and a searchability assessment is performed. Quotations are modified, paraphrased or combined where necessary to prevent identification of the original post or poster.

How long do we keep your personal information?

For general media monitoring, we will only retain your information for the duration of up to 6 months, in order to meet our operational needs and to comply with legislative requirements for retention in line with Ipsen’s retention policies.

For social media listening focused on patients and caregivers and other stakeholders, our suppliers keep the collected posts and working data only for the period necessary to complete the relevant project, then this is deleted when no longer required.

Information reported as a possible side effect is retained in line with our pharmacovigilance legal obligations.

How do we protect your personal information?

To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, Ipsen and its third-party service providers have put in place appropriate physical, electronic, and organizational procedures to safeguard and secure the information we collect.

For social media listening focused on patients and caregivers, these include carrying out a data protection impact assessment before each project, restricting access, pseudonymizing data early, de-identifying outputs, and prohibiting our suppliers from reusing the data for other purposes.

Transfer of personal data outside of your home country?

We work all over the world. Therefore, personal data may be processed, accessed, or stored in a country outside the country where you are located, which may not offer the same level of protection of personal data as your home country.

When we transfer personal data to external companies in other countries, or across our International Ipsen entities, we will protect personal data by putting in place appropriate contractual agreements. When we transfer personal data from Ipsen companies in the European Economic Area (“EEA”) to a third country without an adequacy decision from the EU Commission, we will do so on the basis of standard contractual clauses approved by the European Commission. Similarly, we will protect personal data transfers from other countries including the UK and Switzerland using appropriate contractual clauses approved by the relevant authorities in those countries.

Why are we not informing you directly?

As we collect information indirectly from public sources and generally do not have sufficient information to contact all individuals, providing this notice directly may be impossible or involve disproportionate effort. Where Ipsen relies on the exemption under Article 14(5)(b) GDPR, the justification is assessed and documented for the relevant activity. We make this notice publicly available and apply the safeguards described above to protect individuals’ rights.

What are your rights regarding your information?

You may have the following rights regarding your information depending on the circumstances and applicable legislation:

1. The right of access

You have the right to obtain access to the information processed by Ipsen.

2. The right to rectification

You are entitled to have your information corrected if it is inaccurate or incomplete.

3. The right to erasure

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for Ipsen to keep using it. This is not a general right to erasure; there are exceptions.

4. The right to restrict processing

You have rights to ‘block’ or suppress further use of your information in certain circumstances. When processing is restricted, Ipsen can still store your information, but may not use it further.

5. The right to data portability

You have rights to obtain and reuse your personal data in a structured, commonly used, and machine-readable format in certain circumstances.

6. The right to object

You have the right to object to certain types of processing, in certain circumstances.

7. The right to withdraw consent

If we are using your personal data on the basis of your consent, you have the right to withdraw that consent at any time.

information

Contact information

If you would like to exercise any of these rights by contacting us at Ipsen, please use this form.

However, please be aware that we may not be able to identify you through the information that has been processed for us, and so we may need to ask for further information from you to be able to deal with your request. For many media and social media listening projects Ipsen only receives pseudonymized/anonymized reports and our suppliers delete working data after a short period, so we may no longer hold any information that relates to you.

Where your personal data has come from posts on social media, you have control over what you want to post on those sites and how you make that available via the site’s privacy settings. You may also manage the content and privacy settings of your account or exercise your rights with the relevant social media platform in accordance with that platform’s privacy notice.

If you would like to ask us about how Ipsen handles your personal data, or have any concerns or questions, you can contact our Global Privacy team at dataprivacy@ipsen.com

If you are not satisfied with how Ipsen is handling your personal data, or you think that our processing is not compliant with data protection laws, you have the right to complain to the relevant data protection supervisory authority.

Our lead data protection supervisory authority is:

The Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, FRANCE.

information

V3.2s MPN

Related links