Pharma and life sciences
Data protection for pharma and life sciences – health data protected
Research, regulatory approval and drug safety work with health data – often across borders and with many partners. Espresso finds this data, shares it in pseudonymised form – including with AI tools –, checks stored AI data and deletes once the retention periods have expired.
What makes it challenging for pharma and life sciences
Health data
Studies and adverse event reports contain sensitive personal data.
International collaboration
Study sites, contract research and authorities in several countries – the FADP and the GDPR at the same time.
Long retention
Study and approval documents must be retained for a long time – after that, they need to be deleted cleanly.
AI in research and everyday work
Documents end up in AI tools – along with personal data that does not belong there.
How pharma and life sciences use Espresso
- Privacy Delivery Share in pseudonymised form Pseudonymise documents and texts before passing them to partners or to an AI; the mapping stays with you. Go to the module
- Data Discovery Finding health data in file storage Track down indications of health data in file storage, databases and Microsoft 365 – including in scanned documents. Go to the module
- AI Privacy Control Classifying AI tools Classify AI systems as approved, tolerated or prohibited and check the promised retention period against the findings. Go to the module
- Privacy Register Retention periods per data type Retention periods with justification and legal basis – and legal holds for inspections and proceedings. Go to the module
The framework for pharma and life sciences
Anyone researching with health data and monitoring medicines operates between data protection, research law and therapeutic products law.
| Rule | What it means |
|---|---|
| FADP and GDPR | Health data is sensitive personal data (Art. 5 let. c FADP, Art. 9 GDPR). |
| Human Research Act (HRA) | Framework for research involving people and health-related personal data in Switzerland. |
| Therapeutic products law | Obligations in regulatory approval and drug safety, for example when reporting adverse reactions. |
| Good practice (GxP) | Requirements for the traceability and integrity of data and systems. |
Overview without any claim to completeness; does not replace legal advice in individual cases. As of: 6 October 2026.
Getting started
Assessment with a focus on Copilot and AI
Shows within six weeks where health data is stored in Microsoft 365 and what AI tools can reach – with a report and recommendations.
Frequently asked questions
Does pseudonymised study data remain personal data?
For anyone who has the mapping, yes. For a recipient without the mapping, this may differ depending on the circumstances – the controller's obligations remain.
Can documents be protected before they are handed over to an AI?
Yes. Privacy Delivery pseudonymises PDF, Word and other formats before handover and puts the original values back into the response. Handoffs to prohibited AI systems are flagged.
Does Espresso recognise health data?
Data Discovery detects indications of sensitive categories, including health. Custom search patterns add study and subject numbers.
Does our data go to the vendor?
No. Espresso runs in the environment you choose: in your data centre, in your cloud or with an operating partner. Espresso never establishes a connection to the vendor of its own accord – no telemetry, no licence server, no access without your approval.
Related topics
- Share Pseudonymisation and anonymisation The difference, the legal consequences under the FADP and the GDPR, and when to use which method. Read more
- AI Microsoft Copilot and data protection Prompts, transcripts and shared storage: how organisations keep control of personal data with Copilot. Read more
- Find Finding personal data Where personal data is stored in file storage, databases and Microsoft 365 – and how to find it reliably. Read more
See Espresso in 30 minutes
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com