Privacy Policy for patients

At Cryos, your privacy and personal data security is our top priority. It is important for us to ensure the best possible protection of your personal data and to ensure clarity and transparency regarding the different processing operations to which your personal data is subject.

In this Privacy Policy, you can find information about the following:

1. When does this Privacy Policy apply?
2. Who is the data controller for processing your personal data?
3. Our Data Protection Officer
4. Which personal data does Cryos collect, for which purposes, according to which legal basis and for how long do we store it?
5. To whom do we disclose your personal data?
6. What are your rights?
7. Who should you contact?
8. Guidelines for complaints
9. Amendments to the Privacy Policy

1. When does this Privacy Policy apply?

This Privacy Policy applies to Cryos' ("Cryos", "we" or "our) processing of personal data when you:

undergo an examination, are diagnosed or undergo treatment at Cryos.
as part of the treatment deposit gametes (e.g. sperm, eggs, fertilised eggs) and the subsequent use hereof
when you enter into a contractual relationship with Cryos (e.g. purchase and payment of a treatment, creation and access to our patient portal)

2. Who is the data controller for processing your personal data?

Cryos Clinic ApS, Company Registration Number 44 42 95 94, Grønnegade 80, st., DK-8000 Aarhus C, Denmark is the data controller for the processing of your personal data.

3. Our Data Protection Officer

If you have any questions as to how Cryos processes your personal data, you are always welcome to contact our Data Protection Officer at dpo@cryosinternational.com or by calling +45 8676 0699.

4. Which personal data does Cryos collect, for which purposes, according to which legal basis and for how long do we store it?

When you undergo an examination, are diagnosed or undergo treatment

What personal data does Cryos collect and process?
In connection with examination, diagnosing or treatment of you as a patient, we collect and process a range of personal data about you and, when relevant, about your partner as well.

We collect and process general personal data, including your name, identification number (CPR number), contact details (email, address and telephone number) and picture ID and, when relevant, data about gender, height and weight, smoking/alcohol habits, civil status, family and social relationships, employment situation, psychosocial factors and the result of your treatment.

Sensitive personal data that we collect and process about you include, e.g., data about race or ethnic origin, your sexuality, blood, urine and/or sperm samples (if you are a male), data about your physical and mental health, including medical record information, test and specimen results, scanning results, use of medicine, any previous attempts to become pregnant, information about your cycle and gynaecological history (if you are a female) etc. We also process your gametes (e.g., sperm, eggs, embryos).

In case of an adverse reaction or an adverse event, e.g., if a hereditary disease is diagnosed in the donor you have selected or if your child has a genetic disease, we will process such health information about you and your child, which we receive from either you or the health professional who contacts us. We will also process information about the hospital or clinic where you or your child have been treated. We also process general personal data about you and your child in the form of your names and birth dates and CPR numbers if such data have been included in the reporting to us.

What is the purpose of Cryos’ collection and processing of personal data?
The main purpose of the processing is to register and manage you as a patient with Cryos and to be able to offer you the treatment agreed on, including doing a preliminary screening and examination or guidance and advice, if relevant. In connection with your treatment, it may become relevant to prescribe medicine, issue notes and/or medical reports for authorities, insurance companies and other health entities and to obtain and pass on summaries of your medical record etc.

If the assessment is that you receive treatment together with a partner, it may be relevant to obtain and process personal data about your partner. If the assessment is that the data is important to your treatment, certain personal data about your partner may be recorded in your medical record with Cryos and vice versa.

Furthermore, the purpose is to be able to document treatment and to report the treatment and its result to clinical quality databases and mandatory registers (e.g., the IVF register) if required and to be able to analyse and report any adverse reactions or adverse events.

Cryos must also be able to ensure traceability from the donor to the recipient and vice versa when your treatment involves donor gametes.

What is the legal basis for Cryos’ collection and processing of personal data?
The legal basis for our collection and processing of personal data is the performance of the agreement on treatment concluded with you (Article 6(1)(b) of the General Data Protection Regulation) and your explicit consent (Section 15 of the Danish Health Act and Section 23 of the Danish Act on Assisted Reproduction).

In connection with your treatment, we have a legal obligation to collect and process certain data about you, your partner, if relevant, and the actual treatment, including an obligation to keep a medical record (Article 9(2)(b) and (h) and Article 6(1)(c) of the General Data Protection Regulation, cf. Part 6 of the Danish Authorisation Act and Section 10 of the Danish Executive Order on Record-Keeping and Section 6a of the Danish Act on Assisted Reproduction).

Depending on your treatment, we have a legal obligation to report the treatment and its result to clinical quality databases and mandatory registers (e.g., the IVF register), and we must record the number of pregnancies once pregnancy has been established with donor gametes (Article 9(2)(b) and (h) and Article 6(1)(c) of the General Data Protection Regulation), cf. Part 1 of the Danish Executive Order No. 1522 on the Reporting of IVF Treatment etc. and Section 17(1) of the Danish Executive Order No. 672 on Assisted Reproduction). Data about the result of the treatment may also be collected for statistical and scientific purposes (Article 6(1)(e) of the General Data Protection Regulation and section 10 of the Danish Data Protection Act).

The legal basis for our processing of your name, identification number (CPR number) and contact details is also observance of legal requirements to ensure unique identification of you and to ensure traceability (Section 11(2)(1) of the Danish Data Protection Act and Article 9(2)(b) and (h) and Article 6(1)(c) of the General Data Protection Regulation, cf. Section 10 and Part 4, and Schedule 4.B., of the Danish Executive Order on Human Tissue and Cells).

In case of an adverse reaction or adverse event, the legal basis for our processing of your and possibly your child's data is our legal obligation to process and disclose those data to, i.a., the health authorities (Article 9(2)(b), (h) and (f) and Article 6(1)(c) of the General Data Protection Regulation, cf. Part 6 of the Danish Tissue Act and Part 7 of the Executive Order on Human Tissue and Cells).

How long does Cryos store your personal data?
In general, we will only store your personal data for as long as it is necessary for the purposes described above or as required pursuant to current legislation. Subsequently, your personal will be securely erased.

Below you can find specific information about the storage period for each category of data.

General personal data

General personal data such as, e.g., your name, identification number (CPR number) and contact details will be stored as long as you undergo treatment at Cryos. We must store your general data for a minimum of 10 years if the data have been entered in your medical record (cf. the Executive Order on Record-Keeping).

If you have received treatment with assisted reproduction, we will store all data that is necessary to ensure full traceability for a minimum of 30 years after the clinical use, cf. the requirements in the Executive Order on Human Tissue and Cells in those regards (Section 10 and Part 4, cf. Schedule 4.B., of the Executive Order on Human Tissue and Cells).

If we have received names and contact details for third parties, e.g., relatives, your general practitioner or a contact at a clinic/hospital where you will receive future treatment, we will store those data as long as necessary to meet the purposes for which they were collected or as long as legislation requires for us to store the data (e.g., because of the traceability requirement).

Sensitive personal data

Sensitive personal data, including data about your health, will be stored as long as you receive treatment at Cryos. We must store your health information and other record information for a minimum of 10 years (cf. the Executive Order on Record-Keeping).

If you have received treatment with assisted reproduction, we will store all data that is necessary to ensure full traceability for a minimum of 30 years after the clinical use, cf. the requirements in the Executive Order on Human Tissue and Cells in those regards (Section 10 and Part 4, see Schedule 4.B., of the Executive Order on Human Tissue and Cells).

If, due to an adverse reaction or an adverse event, genetic data and health data have been obtained about you or your child, such data will be stored for a minimum of 30 years from the time of the processing of the data (cf. Part 5 of the Tissue Act and Parts 4 and 6 of the Executive Order on Human Tissue and Cells).

If you have provided us with blood and urine samples in connection with your treatment, the samples will be destroyed once the necessary tests have been made, at the latest 7-14 days after the sample has been taken.

When you, as part of the treatment, deposit gametes (e.g. sperm, eggs, fertilised eggs) and the subsequent use hereof

What personal data does Cryos collect and process?

If, as part of the treatment, or in the immediate continuation thereof, depositing of gametes (e.g. sperm, eggs, fertilised eggs) is required, we store the gametes in order to comply with the agreement on treatment entered into with you, including storage and/or distribution in the case of fertilised eggs. For the purpose of fulfilling the agreement, we collect and process your name and contact information (address, telephone number and e-mail), information about the reason for depositing, as well as information about what will happen to the gametes after depositing. In the case that fertilised eggs are to be distributed, we collect information about where they are to be distributed.

We also collect and process your CPR number, or if you do not have a CPR number, your ID number, and a copy of your passport or driver's license that contains your picture.

In addition, we handle the gametes and any test results if the gametes need to be analysed prior to deposit.

If depositing and/or distribution results in payment, we process your payment information.

What is the purpose of Cryos’ collection and processing of personal data?

The purpose of processing your personal data is for us to fulfill the agreement entered into with you regarding processing, including deposit and/or distribution in the case of fertilised eggs – including coming into contact with you, and being able to distribute the fertilised eggs to the clinic/healthcare professional designated by you.

At the same time, the purpose of collecting and processing the information is that we can identify you and ensure traceability in connection with the deposit and the subsequent steps.

What is the legal basis for Cryos’ collection and processing of personal data?

The legal basis for the processing of gametes and personal data is the performance of the agreement on treatment concluded with you, including storage and/or distribution, in the case of fertilised eggs (Article 6(1)(b) of the General Data Protection Regulation) and your explicit consent (Section 23 of the Act on Artificial Insemination and Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation).

The legal basis for processing your name, contact information, civil registration number and ID is compliance with our legal obligation to ensure unique identification of you, as well as ensuring traceability (section 11(2)(1) of the Data Protection Act and Article 6(1)(b) of the Data Protection Act, cf. chapter 5 of the Danish Tissue Act and chapters 4 and 6 of the Danish Tissue Executive Order on Tissue and Cells).

The legal basis for processing your payment information is the Danish Bookkeeping Act and the VAT Act.

How long does Cryos store your personal data?

We store the gametes in accordance with the agreement entered into between you and Cryos or as long as it is relevant to your treatment.

In addition, the rules on storage in the Danish Act on Assisted Reproduction apply.

We store the agreement and associated necessary information (e.g. test results) for at least 30 years after the end of the deposit, cf. the rules on traceability in the Danish tissue legislation.

Bookkeeping information is stored for up to 10 years from the end of the financial year in question, as required by the Danish Bookkeeping Act and the VAT Act.

When you enter into a contractual relationship with Cryos

What personal data does Cryos collect and process?

If you purchase a treatment or service from Cryos, we collect and process your contact and identification information (name, address, email address, telephone number and date of birth), payment information, the specifications regarding your purchase, any information about which clinic/hospital or authorised healthcare professional you wish to have your order sent to, and where your (continuing) treatment will take place.

If you register as a user and access Cryos' patient portal, we process information in the form of your username, as well as the information about your relationship with Cryos. Including health information, that appears in the patient portal.

If you request access to Cryos' donor database in connection with the purchase of a treatment or service, we use your email address to send a one-time password. You will receive a new password each time you request to access the donor database.

What is the purpose of Cryos’ collection and processing of personal data?

The personal data is collected and processed in order for us to handle the administration of our contractual relationship with you.

We collect and process your contact and payment information for the purpose of fulfilling the agreement on treatment or any additional service that you have entered into with us. If your purchase includes depositing and/or distribution of gametes, the purpose is also to be able to register, pack and ship the gametes.

We process your health information in order to comply with our record-keeping obligation and to be able to share relevant information about your treatment with you in an easy and accessible way.

The purpose of collecting and processing your contact and identification information is also to ensure unique identification of you, as well as to comply with the requirements of the Danish tissue legislation for traceability.

What is the legal basis for Cryos’ collection and processing of personal data?

The legal basis for our processing of your contact and payment information is our fulfillment of the agreement entered into with you (Article 6(1)(b) of the General Data Protection Regulation). When the purpose of processing is to ensure unambiguous identification and traceability, the legal basis is our compliance with a legal obligation (Chapter 5 of the Danish Tissue Act and Section 10 of the Danish Tissue Executive Order on Tissue and Cells and Chapter 4, cf. Appendix 4.B., and Article 6(1)(c) of the General Data Protection Regulation).

The legal basis for our processing of your health data is our legal obligation to keep patient records, cf. section 10 of the Danish Executive Order on Record Keeping. The legal basis for displaying your information in the patient portal is our legitimate interest in being able to share relevant information with you in an easy and accessible way, cf. Article 6(1)(f) of the General Data Protection Regulation.

How long does Cryos store your personal data?

Cryos has a legal obligation to store all information necessary to ensure full traceability for a minimum of 30 years from treatment or, if donor gametes are included in the assisted reproduction treatment, from the latest distribution of gametes from the donor in question.

For this purpose, the contact and identification information that Cryos deems necessary to ensure the statutory identification of you, as well as information about your purchase, is stored.

If you provide Cryos with your email address, when requesting a one-time password to access Cryos’ donor database, your email address and the password you receive, will be deleted immediately after receival.

Bookkeeping information is stored for up to 10 years from the end of the financial year in question, as required by the Danish Bookkeeping Act and the VAT Act.

Other data

We will only store data received by email from you as long as it is necessary and relevant for our advice to and treatment of you unless legislation or another factual reason necessitates further storage. Other data is stored as long as it is necessary to fulfil the purpose for which it is collected.

If you, prior to processing, have contacted Cryos using the online contact form on our website, the information you have provided herein will be stored for up to 14 days, after which the contact form will be deleted. The information provided in the form will be transferred to your medical record at Cryos, if you are registered as a patient at Cryos.

If consent forms are signed in connection with treatment, these will be stored and processed for as long as they are relevant to a current treatment or in connection with later use of the gametes, e.g. after the death of a partner. For documentation purposes, the consent forms are stored for a minimum of 30 years from the time the gametes are used, distributed or destroyed.

When you use Cryos' website, we collect information about the pages you visit. For this purpose, we use our own and third-party cookies to remember your settings, to optimize the website’s functions, to generate statistics and to target our marketing.

You can read more about our processing of personal data collected through the use of cookies in our cookie policy. Here you can also find information on how to withdraw your consent to the use of cookies, and you can find information on the storage period for the individual cookies.

WITHDRAWAL OF CONSENT

To the extent that Cryos' processing of your personal data is based on consent, you can withdraw your consent at any time. You can do so by sending an email to dpo@cryosinternational.com or by calling us at +45 8676 0699.

If you would like to withdraw your consent, please note the following:

A withdrawal of your consent does not affect the legality of Cryos' processing of your data on the basis of your previously given consent until the point in time when such consent is withdrawn. If you withdraw your consent, this decision will not take effect until the time of withdrawal of your consent.

Withdrawal of your consent can only take place until that point in time when the processing covered by the consent is carried out. Therefore, you cannot withdraw your consent and stop the processing if the processing has already been done or completed.

A withdrawal of your consent will not affect Cryos' processing of data that we are already processing or may further process based on a different legal basis, e.g., for the purpose of performing the agreement on treatment concluded between Cryos and you or for the purpose of observing our legal obligations for, e.g., record-keeping or ensuring traceability.

Whether withdrawal of consent means that your data is to be erased must therefore be determined according to the specific circumstances at the time on which your consent is withdrawn and also depends on the legal basis based on which we process your data.

5. To whom does Cryos disclose your personal data?

Your personal can only be accessed by staff employed with Cryos or other companies in the Cryos Group with a work-related need to access these data and who assists Cryos with, e.g,. storage of such data. Staff at Cryos and in the Cryos Group is subject to a duty of confidentiality.

To the extent necessary for the specific examination, diagnosing or treatment of you, your personal data may be disclosed and shared with recipients outside of Cryos and the Cryos Group.

Disclosure of data may, i.a., be to:

Other health professionals if necessary considering a current course of treatment or if you, as a patient, are to be referred to continued or different treatment, e.g., at your general practitioner or public health services. The legal basis for disclosure is the rules in Part 9 of the Health Act.
Fertility clinics, including clinics abroad, if you continue your treatment outside Cryos. The legal basis for disclosure is the agreement on treatment entered into with you and/or your consent, cf. Article 6(1)(b) and/or Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation.
Det Fælles Medicinkort (the Common Medication Card) (the Danish Health Data Authority (Sundhedsdatastyrelsen)) and pharmacies and the Danish Medicines Agency (Lægemiddelstyrelsen) if necessary to write prescriptions for medication. The legal basis for disclosure is the rules in Part 42 of the Health Act and Part 3 of the Danish Executive Order on Prescriptions and Dose Dispensing of Medication.
The Danish Patient Safety Authority (Styrelsen for Patientsikkerhed) in case of an adverse event or adverse reaction. The legal basis for disclosure is Part 6 of the Tissue Act and Part 7 of the Executive Order on Human Tissue and Cells.
Clinical quality databases and mandatory registers, e.g., the IVF register (the Danish Health Data Authority). The legal basis for disclosure is the rules in Part 1 of Executive Order No. 1522 on the Reporting of IVF Treatment etc. and Sections 195-196 of the Health Act as well as the Danish Executive Order on the Reporting to Approved Clinical Quality Databases and Disclosure of Data to the Danish Health Data Authority.
External laboratories and hospitals analysing blood and urine samples. The legal basis for disclosure is the guidelines on managing paraclinical examinations pursuant to the Authorisation Act.
Insurance companies or regional clearing houses if your treatment is to be fully or partially paid by your insurance or by public funds. The legal basis for disclosure is the agreement on payment of treatment concluded with you, see Article 6(1)(b) of the General Data Protection Regulation.
Insurance companies and relatives. Disclosure of data will only occur subject to prior consent from you, see Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation.
Your partner if the assessment is that you receive treatment together with your partner. Data about you that is relevant to your treatment may be listed in your partner's record and vice versa. The legal basis for disclosure is your prior consent, see Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation.

In addition to Cryos being allowed to disclose personal data to the above parties, Cryos may be the recipient of data from the very same parties if relevant to the specific treatment of you. If Cryos needs to obtain record information or the like from other health professionals, it will be subject to prior consent from you.

In certain cases, we will also share your personal data with third-party service providers (e.g., providers of marketing, IT or administrative services) who may process the data on behalf of Cryos for the purposes described in this Privacy Policy. These data processors have been instructed by us to process your personal data on our behalf and for the purposes specified by Cryos only. We only share your personal data if relevant and necessary to be able to provide the services listed in this Privacy Policy.

Cryos has concluded co-operation agreements, including data processing agreements, with our data processors. We put them under an obligation to process your personal data in confidence and to take the required technical and organisational security measures to prevent data from being accidentally or illegally destroyed, lost or deteriorated or to be disclosed to any unauthorised third party, misused or in any other way handled contrary to the rules specified in the General Data Protection Regulation.

Other information

In the event that Cryos no longer runs a tissue centre business, the personal data described above, including your gametes, which Cryos is obliged to store in order to ensure traceability, will be transferred to another tissue centre in accordance with the requirement specified in Section 11 of the Executive Order on Human Tissue and Cells.

Transfer to third countries

To the extent that your personal data are transferred to third countries, i.e., countries outside the EU/EEA, we will provide a sufficient level of protection for such transfer, e.g., by concluding EU standard contracts with the recipient of the data (cf. Article 46 of the General Data Protection Regulation). If a transfer to a third country is necessary for us to be able to comply with the agreement on treatment interred into with you, including storage and distribution in the case of fertilised eggs, such transfer is based on Article 49 of the General Data Protection Regulation.

When you use Cryos’ website

We will disclose information about your use of our website to our partners within social media, advertising partners and analysis partners, if you have consented to the use of Marketing cookies. Our partners may combine this data with other information you have provided to them or which they have collected from your use of their services. Please notice, that Cryos does not have influence on these partners’ processing of data. You can find a link to each of these partners’ privacy policy at the cookie declaration.

6. What are your rights?

You have certain rights in connection with Cryos' processing of data about you. These rights are described below:

You have a right to access data which Cryos is processing about you and to obtain access to certain additional information about how and why we process your personal data. This means that Cryos must provide a copy of the personal data we process about you.
You have the right to have any incorrect personal data about you corrected.
In certain situations, you have the right to have your data erased before that point in time when Cryos will erase them.
In certain situations, you have the right to have the processing of your data restricted. If you have the right to have the processing of your personal data restricted, Cryos may, going forward – except for storage – only process your data in special circumstances and for special purposes.
In certain situations, you have the right to object to Cryos' processing of your personal data.
In certain situations, you are entitled to receive your personal data in a structured, commonly used and machine-readable format and to have these personal data transferred from Cryos to a different data controller.

If you want to make use of such rights, please contact Cryos by email at dpo@cryosinternational.com or call us by phone at +45 8676 0699.

7. Who should you contact?

If you would like us to update, rectify or erase the personal data we have registered about you or if you have any questions to this Privacy Policy, please contact us here:

Cryos Clinic ApS
Central Business Reg. No. 44 42 95 94
Grønnegade 80, st.
DK-8000 Aarhus C
Phone: +45 8676 0699
Email: dpo@cryosinternational.com

We will quickly determine to which extent your request can be accommodated.

8. Guidelines for complaints

We hope that this Privacy Policy has provided you with the information you need.
If you disagree with the way in which we are processing your personal data or the purposes for which they are processed, please contact us or our Data Protection Officer. More information is available in section 3 of this Privacy Policy.
You can also submit a complaint to:

The Danish Data Protection Agency (Datatilsynet)
Carl Jacobsens Vej 35
DK-2500 Valby
Phone +45 33 19 32 00
email: dt@datatilsynet.dk

9. Amendments to the Privacy Policy

We reserve the right to amend this Privacy Policy due to significant changes in legislation, legal practice or our internal procedures.

Most recently updated on May 1st 2024