Responsibility and contact
The International Association of Health Product Manufacturers, Rue du Marché 32, 1204 Genève, Switzerland, UID CHE-278.279.361, is responsible for programme personal-information processing. Use Contact and select Privacy to make a request.
Information processed
Account identity and verified email; organisation and authority details; applications and attachments; assessments and case messages; public award facts; optional-order contact and delivery details; and necessary technical, security and audit events.
Purposes and grounds
Information is used to provide the requested account, application, review and order services; maintain reliable records; protect security and programme integrity; respond to enquiries; and meet applicable obligations. Depending on the activity and applicable law, processing rests on providing a requested service, legitimate operational interests, a legal obligation or specific permission.
Who can access it
Access is limited to the applicant organisation and authorised personnel for intake, review, decision, appeal, publication and fulfilment. Cloudflare provides hosting, database, object storage and related delivery infrastructure. A named physical-item seller receives only what is needed for an accepted quotation or order.
International processing
Technical and review work may involve processing outside your location. Access is restricted by role, provider terms and applicable safeguards. Ask through Contact for information relevant to your submission before supplying material subject to a special transfer restriction.
Public and private fields
Product identity, assessed version, recognised context, citation, evidence scope and award status are public after confirmation and publication. Evidence files, contact details, assessments and case messages are private. Do not include personal study records that are unnecessary for review.
Retention
Unsubmitted drafts and inactive accounts are reviewed for removal after 12 months of inactivity. Submitted-case records are retained for up to seven years after closure where needed for decision integrity, disputes and obligations. Public award history is retained as a verification record. Security and rate-limit records have shorter operational retention; a legal hold can extend a relevant period.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing. A request may require identity checks. Some record information must be retained for a valid obligation or programme-integrity reason; the response explains an applicable limit. You may contact your competent data-protection authority.
Security and incidents
Accounts use secure sessions and role restrictions. Files are private and checked before reviewer release. Report a suspected disclosure through Contact without including passwords or secret keys. An incident is assessed and notifications made where required.