Source: http://medtrace.dk/privacy-policy/
Timestamp: 2019-04-20 20:31:41+00:00

Document:
MedTrace is not obligated to designate a Data Protection officer, cf. Article 37 (1) GDPR, and has chosen not to appoint a Data Protection Officer.
Please note: Not all the information listed in a “Category of personal data” will necessarily be processed on the data subject in the corresponding “category of data subject”. In some circumstances, only some of the categories of personal data will be processed on the relevant data subject.
MedTrace’s legitimate interest in delivering the website, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
Cookies are based on consent, cf. The Executive Order on Cookies (in Danish: Cookie-bekendtgørelsen) section 3.
MedTrace’s legitimate interest in being able to communicate with the data subjects in the CRM-system, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
MedTrace’s legitimate interest in providing relevant data subjects with updates about the development in the company by sending invitations and news updates, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
Collection and transfer of copies of passport, CPR-number for the use of booking travels are based on consent, cf. art. 6 (1) (a) GDPR, cf. The Data Protection Act section 6.
Transfer of ordinary personal data for the use of booking travels are based in MedTrace’s legitimate interest in providing this service, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
MedTrace’s legitimate interest in being able to communicate with contracting partners and research partners, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
MedTrace’s legitimate interest in being able to communicate with a next of kin of an employee, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
MedTrace’s legitimate interest in being able to communicate with members of board of directors, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
Collection and processing of and financial information is necessary for the performance of a contract, cf. art. 6 (1)(b) GDPR, cf. The Data Protection Act section 12.
Collection and processing of CPR-number and tax information is processed for administration of compensation and reporting to the tax authority, cf. The Data Protection Act section 11 (2) no. 1 and 2, cf. art. 87 GDPR.
Collection and processing of photos are based on consent, cf. art. 6 (1)(a), cf. The Data Protection Act section 6.
MedTrace’s legitimate interest in being able to communicate with shareholders, investors and loan providers, cf. art. 6 (1) (f) GDPR, cf. The Data Protection Act section 6 (1).
MedTrace uses a Data Processor, a “Contract Research Organization”, to perform the clinical trials. MedTrace will have no access to the information on the clinical trial subjects but seeing as MedTrace is the sponsor of the clinical trials, MedTrace is considered the Controller and thereby responsible for the protection of data.
Collection and processing is based on consent, cf. art. 6 (1) (a) and art. 9 (2) (a) GDPR, cf. The Data Protection Act section 6 (1) and section 7 (1).
Transfer of your personal data is based on consent, cf. art. 6 (1) (a) and art. 9 (2) (a) GDPR, cf. The Data Protection Act section 6 (1) and section 7 (1).
You can withdraw your consent to MedTrace’s processing of your personal data at any time. You can withdraw your consent by contacting us using the contact information provided above.
The lawfulness of the processing and transfer based on your consent before your withdrawal is not affected if you choose to withdraw your consent. If you choose to withdraw your consent it will thus first have effect from this point of time.
The personal data we process on you is primarily provided directly from you or from your unit. In some cases, the information is provided from your employer or from public authorities such as tax authorities.
In most circumstances when we collect personal data directly from you, you provide us with the information voluntarily or in order to enter into or to fulfill the requirements of a contract with us. In some circumstances, you are obligated to provide the information to us, e.g. your personal identity/social security-number for reporting to the tax authorities.
The consequence of not providing the personal data, as listed above, is that we cannot address the purposes mentioned above. Thus, we cannot make the website available to you, we cannot communicate with you, we cannot comply with our obligations as your contracting party and cannot comply with our obligations towards public authorities.
MedTrace uses Data Processors to host personal data and to support our use of systems.
In relation to clinical trial subjects, MedTrace uses a Data Processor, Cardiovascular Clinical Studies located in Boston, USA, to manage the clinical trials (a “Contract Research Organizations” or “CRO”). The CRO will in many cases also use processors (e.g. “Principal Investigators”).
In some cases, MedTrace transfers personal data to Data processors, to the MedTrace website, to public authorities or to external legal advisors and accountants.
In some situations, MedTrace transfers personal data to countries outside of the EU/EEA countries, currently to the US. We transfer information to the US, because MedTrace has a US based department of MedTrace, MedTrace Pharma, Inc (US). In relation to clinical trials, MedTrace will transfer personal data to and from the US as the trials will take place in the US.
The Commission of the European Union has not made a decision on the legality of the practice on data protection in the US or the EU-US Privacy Shield. In most cases, transfers will be based on your consent, based on the necessity for the performance of a contract between you and MedTrace or based on the necessity for the performance of a contract in your interest between MedTrace and another natural or legal person, cf. art. 49 (1) (a), (b) and (c) GDPR.
Next of kin to MedTrace employees: We delete your personal data when the employee resigns.
Clinical trial subjects: Via our Data Processor, the CRO, we indirectly store personal data on you as long as necessary in order to address the purpose to which your personal data was collected. When determining how long we will store your personal data, we will consider (a) compliance with requirements to documentation according to legislation and (b) our opportunity to establish, determine or defend a legal claim.
According to GPDR, you have the following rights (on those conditions and with the exceptions that follows from the regulation). If you wish to exercise any of the above-mentioned rights, you will need to contact us using the contact details provided above.

References: art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 87
 art. 6
 art. 6
 art. 6
 art. 9
 art. 6
 art. 9
 art. 49