Top of this page
Skip navigation, go straight to the content

Home Privacy policy for Healthcare Professionals




UCB or we means UCB S.A., a Belgian company with registered office at 60, Allée de la recherche, 1070 Anderlecht and its affiliates. For more information on the contact details of the UCB affiliate in your jurisdiction, please visit the ‘UCB Worldwide’ overview at and select your country.

As controller, i.e. the legal entity that decides on the why and how information relating to you (personal data) is collected and processed by us in the context of your or your healthcare organisation’s relationship with UCB, we respect your right to privacy.

We will only process your personal data as described in this UGPPH or policy, supplemented by our other privacy policies - to the extent that those may apply to you -  e.g. within the framework of your participation as a healthcare professional (HCP) in our Patient Support Programmes (PSPs), studies (including observational studies, clinical trials etc.), or when browsing any one of our websites for which separate website privacy policies are in place. We will at all times process your personal data in accordance with the relevant data protection legislation, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR).

At UCB we have a data protection officer (DPO), who can be contacted by any of the following means for any privacy-related questions, including regarding how we collect, store and use your personal data:

  • E-mail:; or
  • Regular mail:  To the attention of the (global) Data Protection Officer, Allée de la recherche 60, 1070 Anderlecht or to the attention of the local UCB Data Protection Officer at the postal address of the UCB affiliate in your jurisdiction. For more information, please visit and select your country.


As a leading biopharmaceutical company, UCB has close relationships and engages in a continuous dialogue with many HCPs. The UGPPH governs the general collection, use and retention by UCB of personal data relating to (i) HCPs and (ii) HCPs acting as a representative or contact person for a healthcare organization (HCOs), with whom we have a business relationship. As indicated above, additional privacy related information may apply to you within the framework of your participation in e.g. our PSPs, studies or when browsing any one of our websites. You will find these additional privacy terms on the relevant webpage or tool. In other words, in addition to reading this UGPPH, please also carefully read through other privacy related information which may apply to you and this prior to participating in any UCB PSP, study or browsing any one of our websites.

The UGPPH consists of five main components and informs you about:

  1. Who we are and how you can contact us;
  2. The reason behind this policy;
  3. The purposes for which we process your personal data, the related legal basis under GDPR and applicable retention periods;
  4. What your rights are in relation to the personal data we hold about you and how you can exercise them; and
  5. Further details on how we process (including transfer) your personal data.


The UGPPH may be updated periodically to reflect changes in our personal data processing activities. In that case we will inform you of any significant changes by posting a prominent notice on (the Website) or by informing you through the same channel we usually use to communicate with you.



The table below indicates per purpose (i) the categories of personal data we collect and process concerning you, (ii) the source, (iii) how long we retain your personal data, (iv) who we share it with, and (v) the relevant legal basis under GDPR.


(*) We will retain your personal data in accordance with the retention periods set out in the table above. These retention periods, included in our data retention policy, are dictated by:

  • Applicable statutory/legal requirements;
  • Industry guidelines, and
  • For those data categories for which no express statutory or legal requirements apply, certain other determining factors such as the need to prove or enforce a transaction or contract, enforce our policies, etc.

We will delete your personal data once the abovementioned retention periods will have expired or if you object to or if you withdraw your consent to our processing of your personal data (to the extent such processing is based on your consent), except where we need to hold on to such data for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, for compliance with a European Union or European Union Member State legal obligation which requires such further processing or where we need to prove or enforce a transaction or contract or enforce our policies.

(**) For more information or if you have any questions regarding how we assess this balance, please contact us through any one of the channels set out under Section 1 above (“Who we are and how you can contact us”).


A. Your rights

B. How to exercise your rights

If you wish to exercise any of the rights mentioned above, please contact UCB as set out under section 1 (“Who we are and how you contact us”). Please clearly identify the right(s) you wish to exercise and include your contact details (including a valid e-mail or postal address) so that we can respond to your request. Please note that you may be asked to provide proof of your identity.

When you contact us to exercise any of the rights mentioned above, we will respond to your request within one month following receipt of the request. This period may be extended by two additional months where necessary, but in that case we will inform you of any such extension within one month of receipt of your initial request together with the reasons for the delay.

Right to lodge a complaint with supervisory authority

In accordance with article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the European Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that UCB’s processing of your personal data infringes the GDPR. Please visit the website of the relevant national supervisory authority for more information on how to submit such a complaint.


A. Who we share your
personal data with.


We will disclose your personal data only as described in this UGPPH (as further detailed above), as may be updated from time-to-time.


UCB affiliates and third party processors

UCB transfers or discloses your personal data to its personnel, affiliates, our third party service providers processing personal data on UCB’s behalf for the purposes set out above and our partners (including e.g. other pharmaceutical companies) with whom we have a collaboration agreement and who have a need to know this information.

Third party service providers include cloud service providers, IT services/ consulting/ outsourcing companies, database providers, market research suppliers, homecare delivery suppliers, event agencies and organizers, travel agencies and providers, banks and insurance companies that deliver services to us. These service providers provide their services from locations within and outside of the European Economic Area (EEA).

Other third parties include regulatory and government agencies (see further below in this UGPPH), our advisors and external legal counsel, our auditors and potentially, third parties with whom UCB may merge or which may be acquired by UCB (see further below in this UGPPH).  

Compliance with laws and legal proceedings

UCB will disclose your personal data where:

  • UCB is required to do so by applicable law, by a governmental body or by a law enforcement agency;
  • To establish or exercise our legal rights or defend against legal claims;
  • To investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our policies or as otherwise required by law.


If a third party acquires all (or substantially all) of our business and/or assets, we will disclose your personal data to that third party in connection with the acquisition. However, such disclosure will occur subject to and in accordance with applicable data protection laws, including the GDPR.

UCB will transfer your personal data to its affiliates, including our affiliates outside of the EEA. In that case UCB relies on UCB’s Binding Corporate Rules, which can be accessed through the following link:


The transfer of your personal data to third party service providers (as set out above under section 5A) in countries outside of the EEA that do not ensure an adequate level of (data) protection, occurs on the basis of Standard Contractual Clauses that have been executed between UCB and the relevant third party service provider. You may - by exercising your rights set out above under section 4.B (How to exercise your rights) - obtain a copy of the relevant safeguard UCB has put in place or ask UCB to redirect you to the place where they have been made available.

In the absence of the aforementioned appropriate safeguards, UCB may – to the extent permitted under and in accordance with applicable data protection laws (including the GDPR) - rely on a derogation applicable to the specific situation at hand (e.g. the data subjects’ explicit consent, the necessity for the performance of an agreement, the necessity for the establishment, exercise or defense of legal claims).

B. International transfers