Privacy Notice, and Informed Consent Form (ICF) for Health Care Professional (HCP)

MYCare Program

We, Novartis Corporation (Malaysia) Sdn. Bhd. (“Novartis”), together with Novartis’ affiliated companies, are responsible for processing your personal information for the MYCare Patient Support Program (“Program”) as the ‘data controller’, we decide why and how we do this.

This Program is being managed by IQVIA Solutions Malaysia Sdn Bhd , a duly appointed administrator of the Program (“Program Administrator”) appointed by Novartis. Employees and/or agents of IQVIA Solutions Asia Pte Ltd shall handle your Personal Data (as Data Processor), which is processed in accordance with applicable privacy laws and Novartis privacy/data protection standards.

You will be notified if the Program Administrator changes and your Personal Data will continue to be protected with equivalent safeguards.

Please read this Privacy Notice (“Notice”) carefully as it contains important information about how Novartis process information that relates directly or indirectly to you (“personal data”) and explains your rights with respect to the processing of your personal information.

Participation in this Program is voluntary.

Program Details: The Program is a patient support program initiated and owned by Novartis that aims to support patients who are taking Entresto to manage their health condition. The Program offers a 6+1 free good scheme wherein patients must purchase 6 boxes of Entresto to be eligible for a 1 free box.

This Program is strictly for patients who are prescribed Entresto (50mg, 100mg, or 200mg) for heart failure or essential hypertension. Patient enrolment runs from May 2019. The decision to continue, terminate or extend the Program lies with Novartis. In such cases, the Program Administrator will notify you.

Adverse Event (“AE”)/ Product Technical Complaint (“PTC”) Reporting

  1. You agree to report any Adverse Event1/ Product Technical Complaint2/ Medical Device Incident3 that may occur to any patients enrolled in the Program and allow the Program Administrator to report any AE/ PTC/ Medical Device Incident that may be identified by the Program Administrator during the Program. These reports may be forwarded to Novartis and Health Authority following PV regulation.

Note:

  1. An “Adverse Event” shall mean any untoward medical occurrence in a patient administered with the Product, which does not necessarily have to have a causal relationship with this treatment.
  2. A “Product Technical Complaint” is any report (written, electronic or verbal communication) about a potential or alleged failure of the Product in its quality (including the identity, durability, reliability, safety, efficacy or performance) or suspect counterfeit. The complaint may or may not represent a potential risk to the patient.
  3. All known cases of exposure during pregnancy (including paternal exposure) and breastfeeding, misuse, abuse, lack of drug effect, overdose (accidental and intentional), medication error/ use error, drug dependency, suspected transmission of an infectious agent, withdrawal syndrome, drug interactions, occupational exposure, off-label use, rebound effect, disease progression and aggravation, overdose, treatment non-compliance with adverse event or unexpected product benefit with respect to Entresto must be reported in the same manner as an AE and/or PTC. For medical devices, all AE, medical device malfunction (defined as a failure of a device to meet its performance specifications or otherwise to perform as intended) and near incident/event (defined as an unplanned event that did not result in an actual injury, illness, damage, but had the potential to do so) shall be reported.

Purposes of Processing Personal Information: We will collect and use your personal information for the following purposes:

  1. For your successful enrolment in the program
  2. To communicate with you for the fulfillment of program operations
  3. To facilitate communication between stakeholders
  4. To meet requests from health authorities or regulatory obligations regarding reporting and managing adverse events. If you report an undesirable incident, please refer to our Privacy Notice for processing of personal data for the purpose of patient safety, medical information and quality, available here ( https://www.novartis.com/my-en/privacy-notice-individuals-involved-adverse-event medical-information-query-or-product-complaint ).
  5. To perform verification of the source documents for the mentioned program PSP_HF_CON_04/2026-MAR/FA-11616316
  6. Provision of Program’s services (e.g., sharing Program benefits, delivery of the medicines when ordered for patients and as applicable among other services (collectively “Services”));
  7. To respond to questions or requests you may have regarding the Program
  8. Gaining your insights or seek your feedback regarding the Program
  9. Meeting any legal or regulatory requirements relating to our provision of services and products and making disclosure under the requirements of any applicable law, regulation, direction, court order, by-law, guideline, circular and/or code applicable to us
  10. To conduct analyses for commercial, research, audit, review and monitoring purposes by using only anonymized data.

We will only process your personal data within the intended purpose of the Program and as foreseen in the law for that purpose after we have obtained your prior consent. No personal data will be used for direct marketing.

Processing Your Personal Information: For the purposes listed above, Program administrator, on behalf of Novartis, will collect the following information from you under this program: Your full name, contact details (e.g. WhatsApp number, email), Hospital Name/Pharmacy name, DKSH Account Number.

Your personal data may be collected via digital registration through the MYCare mobile applications managed by the Program Administrator.

Processing of your personal information by Program Administrator:

The Program Administrator will process your personal information as agreed with Novartis through a written contract and implement all necessary controls to safeguard your personal information in its systems or environment [To know more about the use of your personal information, you can contact the Program Administrator at email: mycare_support@psplink.com]

Sharing Your Information with Other Recipients:

Only the people involved in these activities will have access to your information. By law, these people and organizations must protect the confidentiality and security of your information.

The Program Administrator will, at the request of Novartis only share Anonymized or Aggregated data with Novartis. No other parties besides Novartis Employees, authorised third parties or Program Administrators, third parties authorised by the program administrator for the purpose of this program will have access to/share/disclose your information.

Your information may be processed in, accessed from, or stored in a different country from the one you are located in. In the event Novartis requires this, and the other country does not have the same level of legal protection for your data, we will make sure your information is protected as required by the law where you are located. We will do this by using ‘binding corporate rules’ and ‘standard contractual clauses’ - for more information about these email us at the address below or at my.cdpo@novartis.com

Storing Your Information:

  1. All personal data recorded through and for the Program shall be retained until all the Purposes have been fulfilled. Such data may be used for generating physical and/ or digital statistical or analytical reports, monitoring and regulatory purposes by the Company, third party service provider vendors, outsourced personnels, affiliates, and subsidiaries. De-identified, aggregated, or anonymized data may continue to be used as described above.
  2. Notwithstanding the above, in case of Adverse Events, all pharmacovigilance data and documents relating to individual registered medicine products must be retained for the product lifecycle and for at least an additional 10 years after the product is deregistered to comply with the regulatory requirements.
  3. This period is known as the retention period. We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.
  4. When this period expires, your personal data is removed from our active systems
  5. Please take note that your personal data may be stored in cloud-based services owned and operated by the Program Administrator, physically located in Singapore.

Protecting Your Information: The Program Administrator has taken appropriate measures in place to provide an adequate level of security and confidentiality to personal information as required under Malaysia Personal Data Protection Act. These measures will protect your information against accidental or unlawful destruction or alteration, accidental loss, unauthorized access or sharing, and any unlawful forms of processing.

Data Subject Right: You may exercise the following rights under the conditions and within the limits set forth in the law:

  1. the right to access your personal data as processed by Data controller and its authorized third party and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating.
  2. the right to request the erasure of your personal data or the restriction thereof to specific categories of processing.
  3. the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal and subsequent data retention in accordance with applicable local law [Note: Withdrawing consent will result in termination of participation in the Program and its Services and no new personal data will be collected];
  4. the right to object, in whole or in part, to the processing of your personal data; and
  5. the right to request its portability, i.e. that the personal data you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations.
  6. Right to Prevent Processing likely to cause damage or distress;
  7. Right to Prevent Processing for Direct Marketing purpose; and
  8. Right to File a Complaint with the competent data protection authorities.

If you have a question or want to exercise the above rights, you may send an email to MYCare Customer Support team (Email: mycare_support@psplink.com). Please note that you are required to provide Personal Data to participate in the Program and it will be necessary for the Personal Data to be processed for the Purposes listed above, without which you will not be able to participate in the Program.

Attestation:

By clicking “I Agree”, you are declaring that you have read, understood, and agreed to the terms above and you further certify that (Please do not sign below if any of the term is not acceptable to you):

  1. You have read and understood the Privacy Notice (this document)
  2. You authorize Novartis and the Program Administrator together with its affiliates and authorized third parties to collect and process your personal data for the Purpose and manner stated in this Form;
  3. You have been given the opportunity to ask questions about this Program and get clarifications with respect to this Form;
  4. You understand that your participation is voluntary, and you may withdraw at any time.
  5. You have reviewed and assessed the patient’s medical condition and you confirm that the patient meets the criteria to be enrolled into this Program;
  6. You are qualified and authorized to release the above-referenced information and other protected health information for the purpose of seeking assistance in initiating or continuing medication therapy and/or the evaluation of the patient’s eligibility to the Program;
  7. The medication, Novartis product in scope (please refer to above) that shall be dispensed to the patient under the Program shall be for the treatment of the patient and may only be used solely for the patient this matter and shall not be redistributed or sold.
  8. You have fully informed the patient of the terms and conditions of the Program;
  9. You confirm understanding and comply with the Program guidelines and understand and have informed the patient that Novartis, at its sole and absolute discretion, reserves the right to modify or discontinue the Program at any time;
  10. You agree that the Program Administrator may verify the accuracy of the submitted information, audit supplied goods inventory and share any findings with Novartis;
  11. You have provided the patient with complete information about their Entresto treatment, its benefits and its known risks.
  12. You have no financial interest in this Program and have not offered to make, offer, promise, authorize or accept any payment or give anything of value, including but not limited to bribes, either directly or indirectly to any public official, regulatory authority or PSP_HF_CON_04/2026-MAR/FA-11616316 anyone else for the purpose of influencing, inducing or rewarding any act, omission or decision in order to secure an improper advantage, or obtain or retain business in respect of the Program
  13. You have fully understood the role of the Program Administrator and you agree to pursue the Program as described in the “Program Details” enclosed herewith. The purpose of the Program is such that the Program Administrator in cooperation with my hospital, will carry out agreed activities aimed at enhancing the care of patients.You will not be influenced by this Program to prescribe Novartis products in scope for unsuitable patients.