National Medicinal Product Catalogue (NMPC) - Privacy Notice

The Health Service Executive (HSE), through the National Medicinal Product Catalogue (NMPC) Service, is the Data Controller for the personal data processed in connection with the NMPC.

This Privacy Notice explains how and why we collect and use your personal data, how we keep it secure, who it may be shared with and what rights you have under data protection law.

This notice applies to individuals who:

• create an NMPC account
• apply for access to the Product Management Portal (PMP)
• submit, update or maintain medicinal product information
• submit queries or service requests or otherwise interact with the NMPC website or services

The HSE is committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Data Controller name

The Health Service Executive (HSE)

Data Controller address

Dr Steevens Hospital, Steevens Lane, Dublin 8 D08 W2A8

Data Protection Officer

dpo@hse.ie

To provide and administer the NMPC service, we collect and process a limited amount of personal data relating to users in their professional capacity.

The personal data we collect and reason for collecting the data includes:

• full name - to identify users and manage access to NMPC services
• work email address - to identify users, communicate with users and administer accounts
• organisation / company name - to verify an individual's association with an organisation
• job title - to identify users and assess access requirements
• work phone number - to contact users where necessary
• full work address including eircode - to verify organisational details where required
• IP address - to support system security, fraud prevention, technical support and website analytics

The HSE processes personal data for the operation and administration of the NMPC under Article 6(1)(e) GDPR, as the processing is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in the HSE.

Personal data is processed to:

• manage access to NMPC services
• verify user identities and organisational affiliations
• administer requests relating to medicinal product information
• communicate with users regarding submissions, updates and queries and ensure the secure and effective operation of the service.

Where cookies or similar technologies require consent, consent will be sought separately through the website cookie management tools.

We collect personal data directly from you when you:

• complete an account registration form
• apply for access to the Product Management Portal
• log in to NMPC services
• submit requests relating to medicinal product information
• submit queries through our website or support channels or access NMPC websites and services

IP address is collected automatically when you access NMPC services.

Under data protection law, you have a number of rights in relation to your personal data.

These include:

• right of access
• right to rectification
• right to restriction of processing
• right to object
• right to erasure (subject to legal and operational requirements)
• right to data portability (where applicable)
• right to lodge a complaint with the Data Protection Commission

Exercising these rights will not affect your ability to use the NMPC, unless the requested action prevents us from maintaining your user account or providing the service.

We use your information to:

• create and manage NMPC user accounts
• verify the identity and authority of organisations and individuals interacting with the service
• process requests for additions, amendments or removals of medicinal product information
• respond to user queries and support requests
• administer access permissions and security controls and maintain the quality, security and integrity of the NMPC service

We only use personal data for purposes that are compatible with the operation and management of the NMPC.

The NMPC may analyse information relating to system usage and user interactions to help us:

• improve the performance of the service
• understand how the service is being used
• identify technical issues
• improve user experience and support service planning and administration

Analytics information is primarily used in aggregated form and is not used to make decisions about individual users.

In some circumstances, we use trusted service providers to support the operation of the NMPC.

These service providers act on behalf of the HSE under contractual arrangements and may process personal data only for authorised purposes.

This includes:

• Dedalus, which provides system support and maintenance services
• Atlassian (JIRA Service Management), which supports service management functions; and Amazon Web Services (AWS), which provides hosting service

These organisations are contractually required to protect personal data and to process it only in accordance with our instructions and applicable data protection legislation.

The NMPC solution is hosted within the European Economic Area using Amazon Web Services infrastructure located in Ireland.

In limited circumstances, authorised Dedalus support staff located in Ireland and the United Kingdom may access personal data where necessary to provide support and maintenance services.

Where personal data is accessed in the United Kingdom, the transfer is protected by the European Commission's adequacy decision for the UK, which recognises that UK data protection law provides an equivalent level of protection to that required under GDPR.

We do not otherwise transfer your personal data outside the EEA.

We will only keep personal data for as long as necessary to fulfil the purposes described in this notice and in accordance with the HSE Records Retention Policy.

User account information will be retained while an individual remains an active NMPC user and there is a business need for the account to remain available.

User accounts are subject to periodic access reviews. Accounts that can no longer be verified as active or required may be deactivated and associated personal data deleted in accordance with HSE retention requirements.

Where access is removed, an audit record of the action is maintained.

If you have any questions about this Privacy Notice, how your personal data is processed by the NMPC, or how to exercise your data protection rights, you can contact the HSE National Data Protection Office:

HSE National Data Protection Officer
Dr Steevens Hospital,
Steevens Lane,
Dublin 8,
D08 W2A8

Email: dpo@hse.ie

You also have the right to make a complaint to the Data Protection Commission:

Data Protection Commission,
21 Fitzwilliam Square South,
Dublin 2,
D02 RD28

Website: dataprotection.ie

We may update this Privacy Notice from time to time to reflect changes to the NMPC service, applicable law or our processing activities.

The latest version will be published on the NMPC website.

Current version: Version 1.1
Published: July 2026