This policy applies to Cellaviva AB and replaces any previously applicable policies within the group.
Cellaviva processes personal data as confidential and in accordance with the EU General Data Protection Regulation (GDPR). You may contact us or our Data Protection Officer at any time with questions or comments about our privacy protection by e-mail via kundtjanst@cellaviva.se or by letter to the address given on page 27, Cellaviva’s contact details.

This personal data policy describes:

• How Cellaviva collects and processes personal data (including “personal information”, “data” or “information”).
• The purpose of the processing, the duration of the processing, how the information is used and who has access to it.
• How your information is protected, what rights you have regarding your personal data and how to get in touch with us.

Cellaviva is a subsidiary of the company NextCell Pharma AB (corporate ID no.: 556965-8361), and NextCell Pharma is the data controller responsible for the processing of your personal data by us, which means that NextCell Pharma is responsible for the correct and secure pro¬cessing of your data in accordance with applicable legislation. NextCell Pharma and Cellaviva may disclose personal data to partners (data processors), but they are not authorised to process such data for other purposes than those of NextCell Pharma and Cellaviva, and only in accordance with our explicit instructions.

What information is collected from you

You can visit our websites or talk to a Cellaviva employee without telling us who you are. If you choose to provide us with your personal data, such as, but not limited to, your name, telephone number and certain health-related information, you expressly consent to us collecting and processing such data, as described in this personal data policy. This processing is necessary for us to be able to contact you or to help you further.

If you order any of our services, we ask for certain personal data in order to provide such services, including, but not lim¬ited to, your name, address, e-mail address, telephone number and personal ID number, as well as certain health-related information. For some services, this means information such as the expected date of birth or maternity clinic. Once you have placed an order, you are no longer anonymous to Cellaviva and you will receive an identification number from us.

When you contact us to request information from Cellaviva, we may ask for your name, e-mail address, expected date of birth and other information to help us assist you. Some information is a prerequisite in order for us to be able to assist you, while other information is optional. In addition, we may ask you for personal information on other occasions, includ¬ing, but not limited to: when you respond to a survey or when you participate in a competition or marketing promotion sponsored by Cellaviva; and when you report a problem with any of our websites or services. If you contact Cellaviva, we may keep a log of that correspondence.

When you recommend a friend or family member to order our services, who in turn enters your name in their order to provide you with a discount, Cellaviva may collect the information provided, such as your name.

Cellaviva also automatically collects information, which may include your domain name and IP address, but not your e-mail address. This information (“Website Usage Information”) may be aggregated to measure certain traffic patterns on our websites, such as the number of visits, average time spent on the website, pages viewed and so on.

 

Special categories of personal data

Cellaviva may process sensitive personal data (known as special categories of personal data) about you as a customer of ours. Sensitive personal data is such data deemed to merit special protection, as it is by nature particularly invasive of privacy, such as health information. As a general rule, sensitive personal data cannot be processed, but there are excep¬tions to the prohibition in those cases where processing is necessary. Cellaviva must process health information in order to provide our services to you as a customer and to ensure the quality and traceability of human tissues and cells in order to prevent the transmission of diseases. Based on this, Cellaviva has the right to process your health information even though it is considered sensitive personal data.

How is your information used

The use of your data is subject to the personal data policy in effect at the time of use.

The following apply:

• We may use your personal data internally for our activities, such as providing the services and products you request, responding to your enquiries and fulfilling our obligations to you under the general Terms and Conditions.
• We may use your personal data to send messages to you and to keep you updated about Cellaviva’s announcements.
• From time to time, we may use your personal information to send you important messages, such as communications about your client account with us. As this information is important for your interaction with Cellaviva, you cannot opt out from receiving these messages.
• We may use your personal data for invoicing purposes. Financial data including data on the assessment of credit-worthiness and payment history such as details of invoice amounts, payment methods, instalments and payment dates.
• If you participate in a lottery, competition or similar promotion, we may use the information you provide in order to administrate that programme and as otherwise specified in the rules of the lottery/competition
• We may use your personal information for internal purposes, such as auditing, data analysis and studies to improve Cellaviva’s products, services and customer communication.
• We may use personal data to help us develop, deliver and improve Cellaviva’s products, services, content and
• marketing.

 

Who can we share your information with?

We treat your personal data with the utmost care and your data is only used by us, by our affiliated companies, and by selected third parties that we entrust to help us conduct our business. Your personal data will not be transferred or sold to third parties for advertising purposes.

Cellaviva, its parent companies and their affiliates may share your personal information with each other and use it in ways that comply with this personal data policy.

We may disclose personally identifiable information that you have provided to us to the relevant healthcare provider whose information you have provided to us. In order to allow for possible care or treatment, should the need arise.

Cellaviva may disclose personal data to third parties in situations to fulfil Cellaviva’s undertaking to you as a customer or when this is a statutory or legal obligation. We may disclose your personal information to companies that provide services to Cellaviva, such as logistics companies for delivery of products to you, medical transportation to laboratories, special laboratory analyses, credit authorisations, customer service, order processing, fulfilment of orders, enquiries and custom¬er surveys, management and improvement of customer data and marketing assistance.Under the Section on the Processing of personal data in connection with stem cell banking with Cellaviva, on page 5, there is detailed information on how Cellaviva may share your personal data as a customer for stem cell banking with us. We only share your personal information if it is justifiable in order to perform or provide our services.

 

Where do we store your personal data?

Cellaviva endeavours to process your personal data within the EU/EEA. If we transfer your personal data to a non-EU/EEA country, we will enter into agreements and take other measures to protect your personal data in accordance with applicable legal requirements. An example may be if you, as a customer, request to have your Sample transferred to another tissue establishment, in a non-EU/EEA country.
The data that Cellaviva collects through your use of Cellaviva’s websites may be transferred to an IT provider in a non-EU/EEA country that hosts, develops and supports our websites.

 

Legal basis

For our processing of your personal data to be lawful, there must be a legal basis for it, i.e. it must be necessary for the fulfilment of an Agreement with you or the fulfilment of a legal obligation, e.g. under the Swedish Bookkeeping Act, or that you have given your consent or through a balancing of interests.

Our main purpose for collecting personal data is to fulfil or to draw up an Agreement with you to which you, as a customer, are a party. In order to enter into an agreement with us, you need to provide the personal data we request.

A legal obligation exists when Cellaviva is required to process personal data in accordance with the law or other provisions. An example of this is any processing that occurs in the course of Cellaviva’s bookkeeping, as we must comply with the Swedish Bookkeeping Act. As a tissue establishment, Cellaviva is required by the Swedish Act (2008:286) on Quality and Safety Standards for the Handling of Human Tissues and Cells, to ensure the quality and traceability of human tissues and cells in order to prevent the transmission of diseases. This means that we must keep a register of our activities, owners, donors and recipients, and of checks performed on human tissues and cells.

If you have given your consent for us to process your personal data for one or more specific purposes, the legal basis for the processing is your consent. You can withdraw your consent at any time. However, this does not apply to personal data we are obliged to store due to a legal obligation. Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out until the withdrawal.

A balancing of interests means that Cellaviva’s processing of your personal data is only permitted if Cellaviva’s interests in processing the personal data is considered to outweigh your privacy protection interests. Our legitimate interests may include, for example, identifying and regularly monitoring risks in our activities. Please note that you always have the right to object to the processing of your personal data based on a balancing of interests.

 

How long do we keep your personal data?

We keep your personal data only for the period necessary to fulfil the purposes for which it was collected or for as long as it is required by law or agreement or to protect Cellaviva’s legal interests, e.g. if legal proceedings are in progress. We are required by law to keep a register for 30 years, after data entry, or final use of the Sample.

Under the Section on the Handling of personal data in connection with stem cell banking at Cellaviva, on page 5, there is detailed information about how Cellaviva is obliged by law, ordinances and regulations to save your personal data as a customer for stem cell banking with us.

 

Your rights

You have statutory rights concerning your personal data and you have the possibility to request how it is processed and stored. Your rights may vary depending on the purpose for which we process your data. For example, we are required by law to keep data on the donation and procurement of tissues and cells for at least 30 years.

You have the right to request an extract from the register to find out what personal data we have about you. You have the right to request the rectification of inaccurate or incomplete personal data and the right to request erasure. In some cases, Cellaviva is unable to erase your personal data. This is because it is still necessary to process the data for the purpose for which it was collected. You can also object to or request restriction of the processing of your personal data. In some cases, you may have the right to have your data transferred.

Personal data relating to a customer who has cancelled their Agreement or withdrawn their consent or requested erasure but still has unpaid invoices will be stored by us until the account has been settled.

If you believe that we have incorrectly processed your personal data, please notify us as soon as possible by e-mail to kundtjanst@cellaviva.se. You can also submit complaints about our processing of personal data to the Swedish Authority for Privacy Protection; e-mail: imy@imy.se, postal address: Box 8114, 104 20 Stockholm, tel; +46 (0)8-657 61 00.

 

Processing of personal data in connection with stem cell banking at Cellaviva

As a tissue establishment, Cellaviva is obliged under §21 of the Swedish Act (2008:286) on Quality and Safety Standards for the Handling of Human Tissues and Cells, to keep a register of our activities, owners, donors and recipients of human tissues and cells, and checks performed on human tissues and cells. The register and collection of data is for the sole purpose of ensuring the quality and traceability of human tissues and cells in order to prevent the transmission of diseases. The register may be kept by automated processing. The data in the register shall be cleared 30 years after data entry or final use of the Sample.

 

We may process:

your client account data (client account data), may include any of the personal data on the Mother, other parent, Child or other person provided by you or collected from you in connection with your order for our Services and when entering into this Agreement. Examples include, but are not limited to, name, e-mail address, telephone number, address details, expect¬ed date of birth and planned maternity clinic. Client account data may be processed for the purpose of performing and pro¬viding the Services, and for communicating with you.

The legal basis for the processing is the fulfilment of the Agreement,
Consent and a balancing of interests. In other words, we process your client account data on the basis of your consent given when ordering our Service and signing this Agreement; based on a balancing of interests including, but not limited to, Cella¬viva’s legitimate interests to establish the identity of the Mother or registered address for communication purposes; and the fulfilment of this Agreement between you and us, entered into at your request;

your personal data provided by or collected from or about you in connection with our performance or provision of our Services (service data), including responding to this Agreement containing elements relating to the Mother’s and any other parent’s medical history, consent, and completion of the tests listed in the Schedule for the compulsory maternal blood test. This data may include special categories of data such as health and medical care information. The service data may be pro¬cessed for the purpose of performing and providing the Services. The legal basis for the processing is legal obligation, fulfil¬ment of the Agreement, Consent and a balancing of interests. In other words, we process your service data on the basis of a legal obligation where Cellaviva, as a tissue establishment, is obliged under the Swedish Act (2008:286) on Quality and Safety Standards for the Handling of Human Tissues and Cells, to ensure the quality and traceability of human tissues and cells in order to prevent the transmission of diseases; your consent given when ordering our Service and signing this Agreement; a balancing of interests where examples of, but not limited to, Cellaviva’s legitimate interests are to identify and regularly monitor risks in our activities; and the fulfilment of this Agreement between you and us, entered into at your request;

information relating to transactions, including the purchasing of products and/or services offered or marketed to you, which you enter into with us (transactional data). Transactional data may include your contact details, your credit card and account details, and transaction details. Transactional data may be processed for the purpose of providing the ordered products and/or services and keeping an accurate record of these transactions. The legal basis for the processing is legal obligation, fulfilment of the Agreement, and Consent. In other words, we process your transactional data on the basis of a legal obliga¬tion as Cellaviva must comply with the Swedish Bookkeeping Act in connection with bookkeeping; your consent given when ordering our Service and signing this Agreement; and the fulfilment of this Agreement between you and us, entered into at your request;

information contained in or relating to communications you send to us (correspondence and enquiry data). Correspondence and enquiry data may include the content of the communication. The correspondence and enquiry data can be processed for the purpose of communicating with the Mother, other parent, the Child or other person and for maintaining registers. The legal basis for the processing is the fulfilment of the Agreement, Consent and a balancing of interests. That is, we pro¬cess your correspondence and enquiry data based on your consent given when ordering our Service, using the form provid¬ed and signing this Agreement; based on a balancing of interests including, but not limited to, Cellaviva’s legitimate interests in administrating our contractual relationship with you and providing good service; and the fulfilment of this Agreement between you and us, entered into at your request;

any of the above categories of data where such processing is necessary for compliance with a legal obligation to which we are subject, or to protect your vital interests or the vital interests of another natural person.

You are responsible for the accuracy and truthfulness of any personal information that you provide to us and you guaran¬tee and ensure that all such information is true and correct at the time when it is provided. We reserve the right to request supporting documentation verifying such personal information if we deem it necessary. You must promptly notify us of any changes to such personal data.

We may share or transfer any of the categories of data listed above:

For specified purposes under section 8 of the Terms and Conditions of the Agreement, to healthcare providers, tissue establishments, analysis laboratories, biobanks or chief researchers in accordance with the Swedish National Board of Health and Welfare’s regulations SOSFS 2009:30;

to any of our group companies, which means our subsidiaries, our ultimate holding company and its subsidiaries, if it is justifiable for the purposes set out above;

to insurers and/or professional advisers in so far as justifiable in order to obtain and maintain insurance cover, manage risks, obtain professional advice and deal with legal disputes;

to our suppliers and/or subcontractors if it is justifiable to perform or provide our Services;

to the buyer of our business or company or any other person, firm or company to whom we transfer this Agreement; and

where such disclosure is necessary to comply with a legal obligation to which we are subject, or to protect your vital inter¬ests or the vital interests of another natural person.

If and to the extent that such disclosure or transfer takes place in or to any country outside the European Economic Area (EEA), we will ensure that such disclosure or transfer is protected by appropriate safeguards.

Personal data that we process for any purpose shall not be saved longer than is necessary for that purpose, provided that we may keep personal data if such retention is necessary to fulfil a legal obligation to which we are subject, or to protect your vital interests or the vital interests of another natural person.

Cellaviva undertakes not to disclose the above categories of data to third parties without consent or to use such infor¬mation beyond what is necessary for the fulfilment of this Agreement. Cellaviva’s undertaking under this Personal Data Policy does not apply to data that: (i) at the time of receipt was already known to the receiving Party; (ii) is or has become publicly available or known without Cellaviva having breached this undertaking; (iii) the receiving Party has duly received from a third Party that is not bound by the undertaking in relation to the counterparty; (iv) the Swedish Health and Social Care Inspectorate or other supervisory authority, or (v) it is incumbent on Cellaviva to make publicly available by court decision, government decision or otherwise according to legal provisions.

You can contact Cellaviva at any time to supplement any personal data that is incomplete, to correct any inaccurate data and to receive, free of charge, once a year, information about the personal data being processed. You can request the erasure of personal data in connection with the cessation of the Agreement, provided that applicable law allows Cellaviva to erase the data and that the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.

The Mother may withdraw her consent at any time under this Agreement as well as her consent for stem cell storage under section 6.4 of the Terms and Conditions. A withdrawal must be made in writing to Cellaviva. A withdrawal does not affect the lawfulness of the processing prior to the withdrawal of consent.

You can exercise any of your rights in relation to the above categories of data by notifying us in writing. Page 27 of this Agreement describes the different ways to contact us.

If the Child or Sample owner enters into a new Sample storage agreement with Cellaviva under section 6.6 of the Terms and Conditions, the Mother consents that her personal data in the above categories of data held by Cellaviva may contin¬ue to be processed by Cellaviva under the new storage agreement.

Cellaviva is responsible for compliance by its respective employees and consultants with the provisions set out herein and shall, by means of imposing a duty of confidentiality on them, or other appropriate measures, ensure compliance with the provisions of the Agreement.

Cellaviva’s obligations under this Personal Data Policy apply during the Agreement period and continue after the termination of the Agreement.