Privacy policy

Privacy Policy

>> Purpose of this procedure.

Laboratoires THEA respects the personal information of Site users in accordance with all applicable laws protecting personal data, including European Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as French Law No. 78-17 of 6 January 1978, as amended. Laboratoires THEA has implemented this personal data protection procedure to inform you about its practices regarding the collection, use and disclosure of personal data that you may provide when visiting the Site. Please ensure that you have read this Personal Data Protection Policy in its entirety before using or providing any information through the Site. By accessing the Site, you acknowledge that you have understood and accepted the terms and conditions of this Personal Data Protection Policy.

>> Information voluntarily provided by users.

Information required to identify or contact you constitutes personal data. Such personal data is necessary to enable you to access the information displayed and to receive additional information concerning the Site. When you access any interactive tool or service on the Site that requires personal data, you will be asked to voluntarily provide the required information. We will use your personal data in accordance with this Personal Data Protection Policy.

>> Use and disclosure of your personal data.

If you provide us with personal information such as your name, address, email address, telephone number or other personal data, you agree that we may contact you in order to respond to your request and, subsequently, where necessary, provide you with services or information that we believe may be of interest to you (the “Assigned Purpose”). You may opt out of this service at any time. Any personal information you provide to us will be used by Laboratoires THEA for the Assigned Purpose.

>> Security and quality of information.

Precautions are taken to protect your personal data submitted through this website and used in accordance with this Personal Data Protection Policy. In addition to technical safeguards, we also use physical controls and procedures to protect your personal data. However, we cannot guarantee complete security in the event that third parties attempt to circumvent our security measures or intercept transmissions over the Internet.

>> Internet server logs and IP addresses

The Site records usage data such as the source address from which a request to view a page originates (i.e. your IP address, your domain name), the date and time of your page-view request, the referring website (if any), and other parameters (e.g. search criteria) contained in your URL (Uniform Resource Locator). We use this data to better understand how the Site is used in general and to determine which parts of the Site are preferred by users (e.g. based on the number of visits to those parts). This information is recorded in archive files and used by Laboratoires THEA for statistical reporting purposes.

>> Law enforcement.

We may be required to disclose information concerning you to law enforcement authorities, courts or regulatory authorities. Laboratoires THEA will cooperate with and respond to such requests in accordance with applicable law and will take appropriate measures to ensure that the requesting party understands the sensitive nature of any personal data it may receive. We expressly reserve the right to cooperate with law enforcement authorities.

>> Access, corrections and other information.

You have the right, under applicable personal data protection legislation, to access your personal data in order to review, correct or delete it by contacting us at privacy.corporate@theapharma.com or by post at Laboratoires Thea, 12 rue Louis Blériot, Z.I. du Brézet, 63100 Clermont-Ferrand, France. If you wish to have your name removed from our database, no longer wish to receive information from us, or require additional information regarding this Personal Data Protection Policy, please send an email to privacy.corporate@theapharma.com or a letter to Laboratoires Thea, 12 rue Louis Blériot, Z.I. du Brézet, 63100 Clermont-Ferrand, France.

>> Specific provisions relating to the Human Resources section of the Site.

This Site enables you to view available job and internship opportunities. To apply or submit an unsolicited application, you will be redirected to the Group’s recruitment platform. Your data will then be processed by Laboratoires Théa as the data controller, under the conditions described in this policy.

The provision of personal data marked with an asterisk is mandatory. Consequently, failure to provide such data, or providing inaccurate or incomplete information, may compromise the proper processing of your application or may result in its rejection.

Such data is necessary to manage your application, contact you during the recruitment process, send you job advertisements, answer your questions and/or request additional information from you.

In accordance with the French Labour Code, we inform you that the recruitment process used by our company may include interviews and a personality questionnaire.

The results of this questionnaire will be provided to you upon request and will only be retained in your file if you are hired.

Our company may verify the qualifications and diplomas stated in CVs and collect professional references concerning candidates (internship supervisors, line managers, etc.).

Your personal data will only be disclosed to authorised Laboratoires THEA personnel. Your personal data will only be accessible and/or disclosed to other THEA Group companies outside the European Union if you have expressly consented to this as part of your application.

Your personal data will be retained for as long as necessary to manage your application and for a maximum period of 24 months from the last contact between Laboratoires THEA and you.

In accordance with European Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as the amended French “Data Protection Act” of 6 January 1978, you have the right to access, rectify and delete your personal data. If you wish to exercise these rights and obtain information concerning you, please contact Laboratoires Thea, 12 rue Louis Blériot, Z.I. du Brézet, 63100 Clermont-Ferrand, France, or email us at privacy.corporate@theapharma.com.

Information relating to processing activities carried out by Laboratoires THEA in connection with its business activities

Laboratoires THÉA undertakes to comply with applicable data protection laws. Personal data is processed by Laboratoires THÉA lawfully, fairly and transparently.

1. Purposes of personal data processing

Laboratoires THÉA collects personal data of data subjects for the following purposes:

Managing and monitoring sponsored or non-sponsored clinical studies;
Managing relationships with Key Opinion Leaders;
Providing medical and scientific information to internal teams;
Providing training to its partners;
Managing contractual relationships with various partners;
Auditing partners and investigator sites;
Assessing research conducted by potential partners;
Complying with its pharmacovigilance obligations;
Recruiting external service providers;
Selecting investigator sites;
Consulting regulatory authorities and managing regulatory submissions.

2. Personal data collected and retention period

Personal data collected

Categories of data subjects

Retention period

Pseudonymised health data

Patients participating in sponsored clinical studies or patients involved in partner innovations being evaluated

25 years from the end of the clinical study

For medical devices: 10 years from the end of the clinical investigation / placing on the market; 15 years from the end of the clinical investigation / placing on the market for implantable medical devices; or duration of the evaluation

Identification and contact details, CV

Key Opinion Leaders and their assistants

Duration of the contractual relationship, or three years if there is no contract

Identification data, financial information

Healthcare professionals or experts involved in clinical studies

25 years from the end of the clinical study

Identification data

Representatives of partner companies

Duration of the business relationship

Identification data, article, journal name, publication date, location

Authors of scientific literature

Current year

Identification data

Employees of partners

Duration of the training or the period necessary to establish contact

Identification data, publication, membership of third-party organisations, positions held

Congress presenters

Current year

Identification data and professional information (CV)

Candidates for external service provider positions

Duration of the recruitment process + 2 years if the person has consented to the creation of a CV database

Identification and contact details

Employees working within competent authorities

25 years from the end of the clinical trial

Identification and contact details

Brokers

25 years from the end of the clinical study

3. Legal basis for personal data processing

Laboratoires THÉA processes personal data on a specifically identified legal basis, namely:

Laboratoires THÉA’s legitimate interest in processing personal data;
Performance of a contract or pre-contractual measures;
Compliance with legal obligations;
Consent of the data subject (e.g. CV database).

Where Laboratoires THÉA processes sensitive data, it relies on the exception provided for in Article 9(2)(j) of the GDPR (processing necessary for scientific research purposes).

4. Laboratoires THÉA’s commitments

Laboratoires THÉA undertakes to:

process personal data solely for the purposes described above;
process personal data in accordance with applicable laws;
where personal data is transferred to a third country or an international organisation, inform the data subject in advance;
ensure the confidentiality of personal data by implementing all appropriate technical and organisational measures to (i) prevent unauthorised access to Personal Data, (ii) carry out identity and access controls through an authentication system and a password policy, (iii) implement an access rights management system, and (iv) implement processes and mechanisms enabling all actions performed on its information system to be traced and, in accordance with applicable regulations, to carry out reporting in the event of an incident affecting personal data;
ensure that persons authorised to process personal data undertake to respect confidentiality or are subject to a confidentiality obligation and receive the necessary training in personal data protection;
take into account, with regard to its tools, applications and services, the principles of data protection by design;
delete, anonymise or archive personal data at the end of the retention period.

5. Data processors / Personal data transfers

The data subject is informed that their personal data collected by Laboratoires THÉA is transferred to the data processors with whom Laboratoires THÉA has contractual relationships, solely for the purposes of carrying out the purposes mentioned above, provided that such third-party recipients of personal data are subject to regulations ensuring an appropriate and adequate level of protection as defined by EU Regulation 2016/679.

In the event that all or part of the personal data subject to processing is transferred to a third country, i.e. a country located outside the European Union or a country that does not provide a level of protection recognised as adequate under applicable law, or to an international organisation, the data controller undertakes to provide for the appropriate safeguards required under applicable law and to ensure that these safeguards are complied with by its data processors.

Under no circumstances does the data controller sell, rent or otherwise use personal data received for purposes other than those specified herein. The disclosure of personal data to third parties by the data controller is carried out solely for the purposes of performing the specified processing activities and to third parties acting as data processors under the conditions set out herein.

6. Exercise of data subjects’ rights

Laboratoires THÉA guarantees the data subject the following rights: the right of access, rectification, erasure and objection, the right to restriction of processing, the right to data portability, and the right not to be subject to an individual decision based solely on automated processing, including profiling.

The data subject may obtain a copy of their personal data upon written request addressed to Laboratoires THÉA.

By submitting a written request, the data subject may at any time request the correction or deletion of their personal data, subject to the rights of Laboratoires THÉA.

All requests must be submitted in writing to Laboratoires THÉA at the following email address: privacy.corporate@theapharma.com.

If the data subject believes that Laboratoires THÉA has not respected their rights regarding personal data protection, they may lodge a complaint with the CNIL.

7. Updates to the Privacy Policy

Laboratoires THÉA may update this Policy, which remains available on its website at all times.

Last modified: 11.08.2026