Legal notice and privacy

Learn about how we process personal data.

Personal data protection

IHI, like other EU institutions, bodies, agencies and offices (EU institutions), may process your personal data (also known as personal information) for a number of reasons, from dealing with public requests for information, staff matters, procurement contracts, grant agreements etc.

IHI is committed to user privacy.

Although you can browse through most of the pages of our website without giving any information about yourself, in some cases, personal information is required in order to provide the e-services you request, such as registration for participation in events organised by IHI, or signing up for its monthly newsletter.

The pages that require such information treat it according to the policy described in Regulation (EU) 2018/1725.

In this respect:

  • for each e-service, the purposes and means of the processing of personal data are specified in their corresponding privacy statement;
  • within IHI, the Data Protection Officer ensures that the provisions of the regulation are applied and advises controllers on fulfilling their obligations;
  • as for all the institutions, the European Data Protection Supervisor (EDPS) will act as an independent supervisory authority.

This policy is based on the above-mentioned regulation. It may be modified by the IHI from time to time, on its own initiative or on the advice of the EDPS.

IHI's websites may provide links to third-party sites. Since we do not control them, we encourage you to review their privacy policies.

1. Which personal data do we process?

1.1 - When you use our website or our social media channels, we process:

  • Technical information regarding your visit;
  • Any other personal data you provide us with.

1.2 - When you communicate with us via e-mail, telephone, or social media channels, we process:

  • Identity information you provide us with, such as your first name and last name;
  • Contact details you provide us with, such as your e-mail address, postal address, country and (mobile) telephone number;
  • Content of the communication, such as a question or complaint;
  • Technical information of the communication, such as with whom you communicate at our end, and date and time of the communication;
  • Any other personal data you provide us with.

1.3 - When you register for and participate in our events, we process:

  • Identity information you provide us with, such as your first name, last name and job title;
  • Contact details you provide us with, such as your e-mail address, postal address, country and (mobile) telephone number;
  • Business card details, if you provide us with your business card before, during or after the event;
  • Any other personal data you provide us with;
  • Photos may be taken during our events. In principle, photos are limited to wide crowd shots. If you pose for our photographer, we will derive your consent from this. Your photo may then be distributed via our website or other channels for the promotion of the Joint Undertaking and/or the event in question. You may rescind your consent at any time, including in the case of photos in which you may appear incidentally, by contacting our Data Protection Officer: Data-Protection@ihi.europa.eu

1.4  - When you use our services, we process:

  • Identity information you provide us with, such as your first name and last name;
  • Contact details you provide us with, such as your e-mail address, postal address, country and (mobile) telephone number;
  • Any other personal data you provide us with.

1.5 - We receive most of your personal data directly from you. If we receive personal data about you from a third party, we will inform you about this or ask the third party to inform you about this.

1.6 - Our website provides links to third party sites. Since we do not control them, we encourage you to review their privacy policies. Also, each social media channel has its own policy on the way they process your personal data when you access their websites. For example, if you choose to watch one of our videos on YouTube, you will be asked for explicit consent to accept YouTube cookies; if you look at our Twitter activity on Twitter, you will be asked for explicit consent to accept Twitter cookies; the same applies for LinkedIn.

2. Why do we process your personal data and what is the legal basis for this?

2.1 - The purposes and legal bases justifying the processing operations carried out by IHI vary. Processing operations may be based on:

  • Your consent;
  • A contract or grant agreement with you, in order to perform that contract or in order to take steps prior to concluding a bilateral agreement with you;
  • A legal obligation we must comply with;
  • The public interest.

2.2 - Specific privacy policy statements are developed for each personal data processing operation carried out by IHI. Each privacy statement contains the following information:

  • The identity and contact details of the controller;
  • The contact details of the data protection officer;
  • what information is collected and for what purpose and the technical means the IMI2 JU collects personal information in order to fulfill a specific purpose, as well as the legal basis;
  • whom your information may be shared with, if applicable;
  • how you can access your information, verify its accuracy and, if necessary, correct it, delete it, restrict the processing or, where applicable, object to processing or to data portability;
  • in specific cases, you will also have the right to withdraw your consent;
  • how long your data is kept;
  • what security measures are taken to safeguard your information against possible misuse or unauthorised access;
  • whom to contact if you have queries or complaints.

2.3 - When you use our website, we set Europa Analytics cookies which allow us to measure and determine how you and other visitors use our websites. We require your prior consent for the use of these cookies. You can give your consent by clicking the appropriate button in the cookie banner. You can withdraw your consent at any time by deleting the cookies stored in your browser. You can find more information on how to do this on the websites of the respective browser manufacturers:

3. Whom do we share your personal data with?

3.1 - We may share your personal data with third parties, such as the European Commission. Third parties are allowed to process your personal data on our behalf on our explicit written instruction, only. We ensure that third parties are committed to observing the safety and integrity of your personal data.

3.2 - We may be legally obliged to share your personal data with competent law enforcement agents or representatives, judicial authorities, governmental agencies or bodies.

3.3 - We do not send your personal data in an identifiable manner to any other third party than the ones mentioned in Articles 3.1 and 3.2 without your explicit consent to do so. However, we may send anonymised data to other organisations that may use those data for improving our activities or services.

4. Where do we process your personal data?

In principle, we process your personal data within the European Economic Area (EEA). In order to process your personal data for the purposes outlined in Article 2 above, we may also transfer your personal data to third parties who process on our behalf outside the EEA. Each third party outside the EEA that processes your personal data will be bound to observe adequate safeguards with regard to the processing of your personal data.

5. What quality assurances can be expected?

5.1 - We do our utmost to process only those personal data which are necessary to achieve the purposes listed under Article 2 above.

5.2 - Your personal data are only processed for as long as needed to achieve the purposes listed under Article 2 above or until such time you withdraw your consent for processing them. We will delete your personal data when they are no longer necessary for the purposes outlined in Article 2 above, unless there is:

  • An overriding interest of the Joint Undertaking, or any other third party, in keeping your personal data identifiable, or;
  • A legal or regulatory obligation or a judicial or administrative order that prevents us from deleting them.

5.3 - We will take appropriate technical and organisational measures to keep your personal data safe from unauthorised access or theft as well as accidental loss, tampering or destruction. Access by our personnel or third parties’ personnel will only be on a need-to-know basis and be subject to strict confidentiality obligations.

6. What are your rights?

6.1 - You have the right to request access to all personal data processed by us pertaining to you.

6.2 - You have the right to rectification, i.e. to ask that any personal data pertaining to you that are inaccurate, be corrected.

6.3 - You have the right to withdraw your consent for processing of your personal data.

6.4 - You have the right to erasure, i.e. to request that personal data pertaining to you be deleted if these data are no longer required in the light of the purposes outlined in Article 2 above or if you withdraw your consent for processing them.

6.5 - You have the right to restriction instead of deletion, i.e. to request that we limit the processing of your personal data.

6.6 - You have the right to object to the processing of personal data if the processing by us is necessary for the performance of a task carried out in the public interest, unless if we demonstrate compelling legitimate grounds which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

6.7 - You have the right to data portability, i.e. to receive from us in a structured, commonly-used and machine-readable format all personal data you have provided to us if the processing is based on your consent or a contract with you and the processing is carried out by automated means.

6.8 - If you wish to submit a request to exercise one or more of the rights listed above, you can contact us by sending an e-mail to Data-Protection@ihi.europa.eu . An e-mail requesting to exercise a right will not be construed as consent with the processing of your personal data beyond what is required for handling your request.

6.9 - In accordance with Article 25 of Regulation (EU) 2018/1725, IHI may restrict certain data subject rights, as specified in the IMI2  internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data.

7. Specific privacy statements

7.1 - Download the Specific Service Privacy Statement for processing of personal data related to the IMI2 JU Pool of Patient Experts.

7.2 - Download the Specific Service Privacy Statement for processing of personal data related to events and newsletters

7.3 - Download the Data Protection Notice for Microsoft 365 guests

7.4 - Download the Privacy Statement for processing of personal data related to the IHI selection and recruitment of temporary agents (TA), contract agents (CA), seconded national experts (SNE) and trainees

7.5 - Download the Privacy Statement relating to the collection of ideas for identifying potential IHI JU topics

7.6 - Download the Privacy Statement relating to the IHI Patient Pool

7.7 - Download the Privacy Statement relating to the whistleblowing procedure in IHI JU

7.8 - Download the Privacy Statement relating to the management of personnel files

7.9 - Download the Privacy Statement relating to IHI Contributing Partners

7.10 - Download the Privacy Statement relating to the SOFIA tool

8. Public register of processing activities

IHI must keep a public register of processing activities pursuant to Article 31 (5) of Regulation (EU) 2018/1725.

Further information on the register may be requested from the Data Protection Officer - Data-Protection [AT] ihi.europa.eu.

Note regarding IMI and IHI

Some documents in this section are still marked as coming from the Innovative Medicines Initiative (IMI). The legislation creating IHI repeals the legislation creating IMI, and IHI is the legal and universal successor in respect of all contracts, including employment contracts and grant agreements, liabilities and acquired property of the Innovative Medicines Initiative 2 Joint Undertaking established by Regulation (EU) No 557/2014, which it replaces and succeeds.