1. Introduction & roles

This privacy policy provides insight into how Medtora ApS (hereinafter “Medtora”, “we”, “us” or “our”) processes personal data when you are a participant, company or other user of our platform or website.

We prioritize data protection and only process personal data in accordance with applicable legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Danish Data Protection Act.

Medtora can act in two roles:
• As a data processor, when we process personal data on behalf of companies that use our platform to collect and manage consent and other informations from participants or in relation to the employees, external profiles and Associated Companies.
• As a data controller, when we process information for our own purposes, such as using cookies, managing company accounts, support, statistics or communication with participants or  individual companies

Medtora ApS
CVR.: 38923439
Nyvej 9
4261 Dalmose
Danmark
Telefon: +45 93102032
E-mail: support@ medtora.com
Website: www.medtora.com

2. Purpose of processing and categories of personal data

We process personal data for the purpose of offering and operating the platform, including:

To enable companies to create and send consent statements and surveys and other things related to a project.

• To allow participants to give and withdraw consent
• To allow participants to answer surveys from the company to which the consent for the individual project was given
• To document, log and ensure correct handling of consents
• To provide support, ensure access control and protect against abuse
• To comply with our legal obligations under data protection legislation

We typically process the following categories of personal data:

About participants (individuals):

• Name
• Email address
• IP address and technical log data
• Time of giving and/or withdrawing consent
• Version number of consent statement
• Answering questionnaires targeted consent
• Version number of questionnaire
• Any information provided in a consent statement or survey (including sensitive information, if consent has been given)

Please note that participant data and other related data regarding a participant are only hosted on the company’s own SharePoint or Nextcloud environment.

About companies, employees, external profiles and associated companies:

• Name
• Email address
• Company name and CVR number
• Login information and user actions (audit logs)
• Billing information

Please note that External and associated companies only process sensitive information if explicit consent has been given in relation to each specifik project in accordance with GDPR Article 9(2)(a).

3. Recipients of personal data

We do not disclose personal information to others unless it is necessary to provide our services, comply with a legal obligation, or if consent has been given.

Personal data may be made available to the following categories of recipients:

• Companies that have created a consent declaration targeted at a specific project related to the individual participant, and who have received valid consent to process the information for this particular person
• Technical data processors that assist with operation, hosting, security and system support in relation to Medtora, including e.g. email providers and server hosting. All our data is hosted in Denmark
• The company’s own SharePoint or Nextcloud solution, which we connect directly to in order to ensure that encryption keys and confidential information are handled and stored internally at the data controller company. This significantly increases data security
• Public authorities, if we are legally obliged to provide information in accordance with applicable legislation

All data processors are subject to data processing agreements in accordance with the GDPR and may only process information on our instructions. They may not use the information for their own purposes.

4. Transfer to third countries

Medtora aims to process and store all personal data within the EU/EEA. Our platform is hosted on servers located in Denmark and is subject to Danish and European data protection legislation.

We only use data processors and systems that guarantee that data is processed in accordance with the GDPR.

We generally do not transfer personal data to unsafe third countries (countries outside the EU/EEA) unless it is necessary and a valid transfer basis has been established, e.g. by using the EU Commission’s Standard Contractual Clauses (SCCs).

If a specific company using Medtora chooses to integrate third-party systems outside the EU/EEA (e.g. Microsoft SharePoint, Nextcloud or any other cloud solutions), it is the company in question that is responsible for ensuring that the transfer is lawful and in accordance with the GDPR.

5. Security

We also prioritize security when it comes to the protection of personal data. We have established internal procedures and policies that ensure that we comply with the requirements of data protection legislation and implement appropriate technical and organizational security measures.

These measures are designed to protect the quality and integrity of the personal data we process on behalf of the companies that use our platform.

Medtora acts as a data processor in relation to the companies that use the solution. Therefore, a data processing agreement is concluded between us and the individual company, which regulates the processing of personal data and our obligations in relation to confidentiality, security and liability.

All data is processed under secure conditions and stored in Denmark at our hosting provider, Simply.com.

We continuously assess our security measures and adapt them in line with technological developments and applicable requirements.

6. Cookies

Medtora uses cookies to ensure functionality, improve user experience, compile statistics, target marketing and remember your preferences. The list shows the necessary cookies currently in use on the platform. You can change or revoke your consent at any time by clicking in the bottom right corner, where you will also find detailed information about the other cookie categories and their purposes.

7. Storage and deletion

We only retain personal data for as long as it is necessary to fulfill the purpose for which the data was collected, or as long as we are obliged to do so under applicable law or agreements with the data controller companies. When consent expires, is withdrawn or is no longer necessary, we as a data processor ensure that the associated information is deleted or anonymized in accordance with our instructions and the data processing agreement with the company in question.

For participants, this means:

• Consent log and associated information in relation to the individual project are stored for the period set by the company that obtained the consent
• Upon withdrawal of consent for the related project, information is marked as “withdrawn” and is no longer actively processed. However, storage may continue for up to 5 years after the purpose has ceased, unless other legislation, e.g. MDR, GCP or EHDS, requires longer storage or additional documentation and data security.
• Information can be deleted or anonymized automatically after a defined expiration date or manually upon instruction from the data controller

We do not delete information on our own without instructions from the data controller, unless this follows directly from legislation.

8. Your rights

As a registered person (participant, employee, external profile or associated company) you have rights under the General Data Protection Regulation (GDPR), including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object

As we act as a data processor on behalf of the companies that use our platform, you should generally contact the company that has requested your consent in relation to the individual project(s) to which you as a participant are affiliated if you wish to exercise your rights.

If you are unsure who to contact, or if you would like help exercising your rights, you are always welcome to contact us and we will be happy to help you forward your request to the appropriate data controller.

Contact:
Email: support@ medtora.com
If you believe that we are not processing your personal data in accordance with the law, you have the right to file a complaint with:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Telephone: 33 19 32 00
www.datatilsynet.dk

9. Links to other websites and use of social media

Our platform and website may contain links to other websites or integrated external resources. We are not responsible for the content of other organizations’ websites or their practices in relation to the processing of personal data. When you visit other websites, we recommend that you always read their privacy policies and other relevant policies.

We also use social media platforms such as LinkedIn, YouTube and Facebook to inform about our services and share relevant content. When you interact with our pages or posts on these platforms, we may process personal data such as your name, profile information and contact data depending on what you choose to publish.

The purpose of this processing is to improve our communication, understand the needs of users and create visibility for our solutions. The processing is based on our legitimate interest in marketing our company and interacting with potential customers and partners, cf. GDPR Article 6(1)(f).

Your rights: See point 8 for more information about your rights.

We recommend that you read the privacy policies of the social media platforms you use to understand how they collect and process personal data.

10. Changes to the Cookie- & Privacy Policy

We reserve the right to update and change our Cookie & Privacy Policy on an ongoing basis to reflect our processing of personal data, applicable legislation and any changes to our services or technological solutions.

In the event of significant changes, you will be informed directly via the platform.

The current version of the privacy policy will be available at: https://consent.guru/Cookie- og privatlivspolitik

We recommend that you regularly review the policy so that you are up to date on how we protect your personal information.

11. Contact

If you have any questions about this privacy policy, our processing of personal data or wish to exercise your rights, you are always welcome to contact us.

Medtora ApS
CVR.: 38923439
Nyvej 9
4261 Dalmose
Danmark
Telefon: +45 93102032
E-mail: support@ medtora.com
Website: www.medtora.com