Privacy Policy
Last updated: October 27th, 2026
This Privacy Policy explains how Orphidis Pharma Pte. Ltd. (UEN 202645932R), a company incorporated in Singapore with its registered office at 68 Circular Road, #02-01, Singapore 049422 (“Orphidis“, “we“, “us” or “our“), collects, uses, discloses and protects personal data in connection with the website www.orphidispharma.com (the “Website“) and our related business communications.
We are committed to complying with the Personal Data Protection Act 2012 of Singapore and its subsidiary legislation (the “PDPA“). Where other data protection laws also apply to our handling of your personal data (for example, for individuals in Switzerland, the European Economic Area or the United Kingdom), we will comply with those laws as well (see section 10).
The Website is intended for healthcare professionals, pharmaceutical and biotechnology companies, distributors and other business partners. It is not directed at patients or the general public.
By using the Website or providing personal data to us, you acknowledge that you have read this Privacy Policy and you consent to the collection, use and disclosure of your personal data as described in it. Please also read our Cookie Policy and our Website Terms of Use.
1. What personal data do we collect?
We only collect personal data that is reasonable and appropriate for the purposes set out in section 2. Depending on how you interact with us, this may include:
- Contact and enquiry data: your name, job title, organisation, professional email address, telephone number, country, and the content of any message you send us through the contact form, by email, by telephone or otherwise.
- Business partner data: information about representatives of our current and prospective partners (such as manufacturers, licensors, distributors, importers and service providers), including information needed for due diligence, compliance screening (for example, anti-bribery and sanctions checks) and contract management.
- Medical information, named-patient and safety data: where a healthcare professional contacts us with a medical enquiry, a named-patient (early access) request, a suspected adverse reaction or a product quality complaint, we collect the healthcare professional’s details and, where strictly necessary, limited information about the patient concerned (for example, initials, age or year of birth, sex, and relevant medical history and treatment). We ask that patient names and identification numbers are not provided. This information is health-related and is handled with additional safeguards and restricted access.
- Job applicant data: your CV and other information you provide when applying for a role with us.
- Technical data: your IP address, browser type and version, device type, operating system, pages viewed, referring website, and the date and time of your visit, collected through cookies and similar technologies. Please see our Cookie Policy for details.
We do not ask for NRIC, FIN or passport numbers through the Website. Please do not send us such numbers unless we specifically request them for a legally required purpose.
If you provide us with personal data about another person (for example, a colleague or a patient), you confirm that you have obtained that person’s consent, or are otherwise permitted by law, to disclose it to us for the purposes described in this Privacy Policy.
2. Why do we collect, use and disclose your personal data?
We collect, use and disclose personal data for the following purposes:
- (a) responding to your enquiries and requests;
- (b) evaluating, establishing and managing business relationships, including partnering, licensing and distribution arrangements, and carrying out related due diligence and compliance checks;
- (c) handling medical information enquiries and named-patient requests, and coordinating the supply of products through appropriately licensed channels;
- (d) pharmacovigilance and product quality: recording, assessing and reporting suspected adverse reactions and product complaints to the relevant manufacturers and health authorities, as required by law and by our agreements with manufacturers;
- (e) assessing job applications;
- (f) operating, securing, maintaining and improving the Website;
- (g) sending you corporate news and business updates where you have agreed to receive them (see section 3);
- (h) complying with our legal and regulatory obligations and responding to requests from regulators, courts and other public authorities;
- (i) establishing, exercising or defending legal claims; and
- (j) in connection with any proposed or actual restructuring, merger, sale or other business asset transaction involving Orphidis.
We rely on your consent (including consent deemed under the PDPA where you voluntarily provide your personal data for a purpose, or after we have notified you of a purpose and given you a reasonable opportunity to opt out), or on an exception under the PDPA that permits processing without consent. These exceptions include our legitimate interests (for example, pharmacovigilance, fraud prevention and compliance screening), business improvement purposes, and cases where processing is required or authorised by law. Where we rely on the legitimate interests exception, we have assessed that the benefit to the public or to us outweighs any likely adverse effect on you. You may contact our Data Protection Officer for more information about this assessment.
3. Business updates and marketing communications
We will only send you corporate news or business updates by email or other electronic means if you have agreed to receive them, or where permitted by law in the context of an existing business relationship. Every such message will include a simple way to unsubscribe, and we will give effect to your request within ten (10) business days. We comply with the Spam Control Act 2007 and the Do Not Call provisions of the PDPA where they apply.
We do not use the Website or our communications to advertise prescription-only medicines to the public.
4. Who do we share your personal data with?
We do not sell personal data. We only disclose personal data where necessary for the purposes set out in section 2, to:
- our directors, officers, employees and contractors, on a need-to-know basis;
- pharmaceutical manufacturers and marketing authorisation holders whose products we supply, in particular for pharmacovigilance, medical information and named-patient supply;
- licensed distributors, importers, wholesalers and logistics providers in the relevant markets;
- health and regulatory authorities, such as the Health Sciences Authority of Singapore and equivalent authorities in other countries;
- our professional advisers, such as lawyers, accountants, auditors, insurers and corporate secretarial service providers;
- our IT and other service providers, such as our website developer and host, email and cloud service providers and analytics providers;
- courts, law enforcement agencies and other public authorities where required or authorised by law; and
- prospective buyers, investors or merger partners and their advisers, in connection with a business asset transaction, subject to confidentiality obligations.
Our service providers process personal data on our behalf, only for the purposes for which we engage them, and we require them to protect it.
5. Transfers of personal data outside Singapore
Because we work with partners and service providers across Asia and elsewhere, your personal data may be transferred to, stored in or accessed from countries outside Singapore, including other countries in Asia, the United States, the European Union, the United Kingdom and Switzerland.
When we transfer personal data outside Singapore, we take reasonable steps to ensure that it continues to receive a standard of protection comparable to that under the PDPA, as required by the PDPA and the Personal Data Protection Regulations 2021.
6. How long do we keep your personal data?
We keep personal data only for as long as it is needed for the purposes for which it was collected, or as required for legal or business purposes. As a general guide:
- enquiries and general correspondence: up to five (5) years from our last contact with you;
- business partner and contract records: for the duration of the relationship and up to five (5) years afterwards, consistent with Singapore record-keeping requirements;
- pharmacovigilance and product quality records: for as long as required by applicable pharmacovigilance laws and our agreements with manufacturers, which may be considerably longer (in some cases for the life of the product and a number of years afterwards);
- job applications: up to twelve (12) months after the recruitment process ends, unless you agree to a longer period or you join us; and
- marketing preferences: until you unsubscribe, after which we keep a suppression record so that we do not contact you again.
Where legal claims, investigations or regulatory requirements require it, we may keep personal data for longer. When personal data is no longer needed, we securely delete it or anonymise it.
7. How do we protect your personal data?
We make reasonable security arrangements to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal, loss and similar risks. These include encryption of data in transit to and from the Website using TLS/HTTPS, access controls and multi-factor authentication for our systems, confidentiality obligations for our personnel, and due diligence on our service providers.
No method of transmission over the internet or of electronic storage is completely secure. If a data breach occurs, we will assess it promptly and, where required by the PDPA, notify the Personal Data Protection Commission and affected individuals.
8. Your rights
Subject to the conditions and exceptions in the PDPA, you may:
- request access to your personal data in our possession or under our control, and information about the ways in which it has been used or disclosed by us within the year before your request;
- request correction of any error or omission in your personal data;
- withdraw your consent to our collection, use or disclosure of your personal data at any time, by giving us reasonable notice. We will generally process your withdrawal within ten (10) business days and inform you of any likely consequences (for example, that we may no longer be able to respond to a request or continue a business relationship). Withdrawal does not affect processing that we are permitted or required to carry out without consent under the law; and
- once the data portability obligation under the PDPA is in force, request that we transmit certain of your personal data to another organisation, in accordance with the PDPA.
To exercise any of these rights, please contact our Data Protection Officer in writing using the details in section 13. We may need to verify your identity before acting on your request.
We will respond to access requests as soon as reasonably possible and in any case within thirty (30) days. If we are unable to do so within thirty (30) days, we will tell you in writing when we will be able to respond. We may charge a reasonable fee to cover the cost of responding to an access request; if so, we will give you a written estimate of the fee in advance. We will correct personal data as soon as practicable.
We may decline a request where the PDPA permits us to do so, for example where providing access would reveal personal data about another individual or confidential commercial information, or where the request is frivolous or vexatious. If we decline, we will tell you why, where we are permitted to do so.
If you are not satisfied with how we have handled your personal data or your request, please contact our Data Protection Officer first. You may also contact the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg).
9. Children
The Website is intended for professionals and is not directed at individuals under the age of eighteen (18). We do not knowingly collect personal data from children through the Website. If you believe that a child has provided personal data to us, please contact us and we will take appropriate steps to delete it.
10. Individuals in Switzerland, the EEA and the UK
If the Swiss Federal Act on Data Protection, the EU General Data Protection Regulation or the UK GDPR applies to our processing of your personal data, the following also applies:
- Orphidis is the controller of your personal data.
- We process your personal data on the basis of your consent, the performance of a contract with you or steps taken at your request before entering into one, compliance with our legal obligations, or our legitimate interests in operating our business (as described in section 2). Health data relating to pharmacovigilance is processed where necessary for reasons of public interest in the area of public health, including ensuring high standards of quality and safety of medicinal products.
- In addition to the rights in section 8, you may have the right to request erasure of your personal data, to restrict or object to its processing, and to data portability, subject to the conditions of the applicable law.
- Singapore is not currently recognised by the European Commission or the Swiss Federal Council as providing an adequate level of data protection. Where we receive personal data from these jurisdictions, we use appropriate safeguards such as standard contractual clauses approved for that purpose, or rely on a derogation permitted by law.
- You have the right to lodge a complaint with your local data protection authority (for example, the Federal Data Protection and Information Commissioner in Switzerland, the supervisory authority in your EU Member State, or the Information Commissioner’s Office in the UK).
11. Third-party websites
The Website may contain links to websites operated by third parties. We are not responsible for the content or the privacy practices of those websites. Please read the privacy policies of any third-party website you visit.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The updated version will be posted on the Website with a new “Last updated” date. Where changes are significant, we will take reasonable steps to bring them to your attention. Your continued use of the Website after an update means that you acknowledge the updated Privacy Policy.
13. Contact us
If you have any questions about this Privacy Policy, or wish to exercise your rights, please contact our Data Protection Officer:
Data Protection Officer
Orphidis Pharma Pte. Ltd.
68 Circular Road, #02-01, Singapore 049422
Email: contact@orphidispharma.com