Privacy Policy for patients

4. Which personal data does Cryos collect, for which purposes, according to which legal basis and for how long do we store it?

When you undergo an examination or treatment including creation of embryo(s) and/or transferring of such embryos

What personal data does Cryos collect and process?

In connection with examination or treatment of you as a patient, we collect and process a range of personal data about you and, when relevant, about your partner as well.

We collect and process general personal data, including your name, identification number, contact details (email, address and telephone number) and picture ID and, when relevant, data about gender, height and weight, smoking/alcohol habits, civil status, family and social relationships, employment situation, psychosocial factors and the result of your treatment.

Sensitive personal data that we collect and process about you include, e.g., data about race or ethnic origin, your sexuality, blood, urine and/or sperm samples (if you are a male), data about your physical and mental health, including medical record information, test and specimen results, scanning results, use of medicine, any previous attempts to become pregnant, information about your cycle and gynaecological history (if you are a female) etc. We also process your gametes (e.g., sperm, eggs) and/or your embryo(s).

In case of an adverse reaction or an adverse event, e.g., if a hereditary disease is diagnosed in the donor you have selected or if your child has a genetic disease, we will process such health information about you and your child, which we receive from either you or the health professional who contacts us. We will also process information about the hospital or clinic where you or your child have been treated. We also process general personal data about you and your child in the form of your names and birth dates and identification numbers if such data have been included in the reporting to us.

What is the purpose of Cryos’ collection and processing of personal data?

The main purpose of the processing is to register and manage you as a patient with Cryos and to be able to offer you the treatment agreed on, including doing a preliminary screening and examination or guidance and advice, if relevant. In connection with your treatment, it may become relevant to prescribe medicine, issue notes and/or medical reports for authorities, insurance companies and other health entities and to obtain and pass on summaries of your medical record etc.

If you receive treatment together with a partner, it may be relevant to obtain and process personal data about your partner. If the medical staff assesses that certain personal data concerning your partner is important to your treatment, such personal data about your partner may be recorded in your medical record with Cryos and vice versa.

Furthermore, the purpose is to be able to document treatment and to report the treatment and its result to clinical quality databases and mandatory registers (e.g., the IVF register) if required and to be able to analyse and report any adverse reactions or adverse events.

Cryos must also be able to ensure traceability from the donor to the recipient and vice versa when your treatment involves donor gametes.

What is the legal basis for Cryos’ collection and processing of personal data?

The legal basis for our collection and processing of personal data is the performance of the agreement on treatment concluded with you (Article 6(1)(b) of the General Data Protection Regulation) and your explicit consent (Article 9(2)(a) and 6(1)(a) of the General Data Protection Regulation).

In connection with your treatment, we have a legal obligation to collect and process certain data about you, your partner, if relevant, and the actual treatment, including an obligation to keep a medical record (Article 9(2)(h) and Article 6(1)(c) of the General Data Protection Regulation, cf. Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly sections 28, 31, 35-38 and 39 including the appendixes referred to herein.

Depending on your treatment, we have a legal obligation to report the treatment and its result to clinical quality databases and mandatory registers (e.g., the IVF register), and we must record the number of pregnancies once pregnancy has been established with donor gametes (Article 9(2)(h) and Article 6(1)(c) of the General Data Protection Regulation), cf. the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007). Data about the result of the treatment may also be collected for statistical and scientific purposes (Article 6(1)(e) of the General Data Protection Regulation).

The legal basis for our processing of your name, identification number and contact details is also observance of legal requirements to ensure unique identification of you and to ensure traceability (Article 9(2)(h) and Article 6(1)(c) of the General Data Protection Regulation, cf. section 28 of the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007).

In case of an adverse reaction or adverse event, the legal basis for our processing of your and possibly your child’s data is our legal obligation to process and disclose those data to, i.a., the health authorities (Article 9(2)(h) and (f) and Article 6(1)(c) of the General Data Protection Regulation, cf. section 31 of the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007).

How long does Cryos store your personal data?

In general, we will only store your personal data for as long as it is necessary for the purposes described above or as required pursuant to current legislation. Subsequently, your personal will be securely erased.

Below you can find specific information about the storage period for each category of data.

General personal data

General personal data such as, e.g., your name, identification number and contact details will be stored as long as you undergo treatment at Cryos and hereinafter for at least 30 years in order for us to comply with our record-keeping obligation and our obligation to ensure full traceability.

If you have received treatment with assisted reproduction, we will store all data that is necessary to ensure full traceability of the treatment for a minimum of 30 years after the clinical use, cf. the requirements in the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly section 28. If we have received names and contact details for third parties, e.g., relatives, your general practitioner or a contact at a clinic/hospital where you will receive future treatment, we will store those data as long as necessary to meet the purposes for which they were collected or as long as legislation requires for us to store the data (e.g., because of the traceability requirement).

Sensitive personal data

Sensitive personal data, including data about your health, will be stored as long as you receive treatment at Cryos and hereinafter for at least 30 years in order for us to comply with our record-keeping obligation and our obligation to ensure full traceability.

If you have received treatment with assisted reproduction, we will store all data that is necessary to ensure full traceability of the treatment for a minimum of 30 years after the clinical use, cf. the requirements in section 28 of the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007).

If, due to an adverse reaction or an adverse event, genetic data and health data have been obtained about you or your child, such data will be stored for a minimum of 30 years from the time of the processing of the data (cf. Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly sections 31).

If you have provided us with blood and urine samples in connection with your treatment, the samples will be destroyed once the necessary tests have been made, at the latest 7-14 days after the sample has been taken.

When you deposit gametes (e.g. sperm, eggs) for fertility preservation or embryos for future use in fertility treatment. Including shipment of gametes and/or embryos after the end of the deposit

What personal data does Cryos collect and process?

If you deposit your sperm or eggs to preserve your fertility, or if you deposit (surplus) embryos for future use in your fertility treatment, we store the gametes and/or embryos in order to comply with the agreement on storage or treatment entered into with you, including distribution or export if your gametes or embryos are to be shipped to another authorised third party after termination of the deposit. For the purpose of fulfilling the agreement, we collect and process your name and contact information (address, telephone number and e-mail), information about the reason for depositing, as well as information about what will happen to the gametes and/or embryos after depositing. If the gametes and/or embryos are to be distributed or exported, we collect information about the destination and the receiving party.
We also collect and process your identification number and a copy of your passport or driver’s license that contains your picture.

In addition, we handle the gametes and/or embryos and any test results if the gametes and/or embryos need to be analysed prior to deposit or shipment.
If depositing and/or distribution or export of your gametes and/or embryos results in payment, we process your payment information.

What is the purpose of Cryos’ collection and processing of personal data?

The purpose of processing your personal data is for us to fulfil the agreement entered into with you regarding deposit and/or distribution or export of your gametes and/or embryos, including settling any payment. The purpose is also for us to be able to get in contact with you, in regard to the deposit, e.g. due to lack of payment, prior to termination and/or in case of shipment, etc.

At the same time, the purpose of collecting and processing the information is that we can identify you and ensure traceability in connection with the deposit of the gametes and/or embryos and the subsequent use hereof in future fertility treatment.

What is the legal basis for Cryos’ collection and processing of personal data?

The legal basis for the processing of gametes and/or embryos and personal data is the performance of the agreement on storage, treatment or shipment concluded with you (Article 6(1)(b) of the General Data Protection Regulation) and your explicit consent (Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation).
The legal basis for processing your name, contact information and identification number is compliance with our legal obligation to ensure unique identification of you, as well as ensuring traceability (Article 6(1)(b) of the General Data Protection Regulation, cf. Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), section 28.

We will store bookkeeping information pursuant to the rules on documentation in Article 30 of the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978), which is applicable to Cryos. This data includes any information needed to document your payment.

How long does Cryos store your personal data?

We store the gametes and/or embryos in accordance with the agreement entered into between you and Cryos or as long as it is relevant to your treatment. The gametes and/or embryos are stored for a maximum of ten (10) years as per Article 29 of the Medically Assisted Reproduction Law 69(I)/2015.

We store the agreement and associated necessary information (e.g. test results) for at least 30 years after the end of the deposit, cf. the rules on traceability, cf. section 28 of the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007). This also includes any agreements and relevant information on shipment, if the gametes and/or embryos are distributed or exported at the end of the deposit.

Bookkeeping information is stored for six (6) years after the end of the financial year to which they refer pursuant to the rules on documentation in the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978), unless the tax authorities instruct us to do so for longer pursuant to the same provision.

When you have a sperm analysis done

What personal data does Cryos collect and process?

If you request Cryos to do a sperm analysis, we will process your personal data in the form of your contact information, i.e., your name, address, phone number and email address as well as purchase details and payment information. We will furthermore collect your identification number.

We will collect a sperm sample from you to determine the quality of the sperm, including volume, concentration of sperm cells and the amount of mobile sperm cells.

What is the purpose of Cryos’ collection and processing of personal data?

The purpose for collecting your contact information, purchase details and payment information is to manage our relationship with you and to comply with the agreement on purchase of a sperm analysis.

The purpose for collecting your identification number is to ensure compliance with the requirements laid down in legislation on ensuring identification of your identity.

What is the legal basis for Cryos’ collection and processing of personal data?

The legal basis for our processing of the sperm sample and the result of the analysis is your explicit consent, cf. Article 9(2)(a) and Article 6(1)(a) of the General Data Protection Regulation.

The legal basis for processing your personal data, including payment information, is our fulfilment of the agreement entered into with you regarding the sperm analysis (Article 6(1)(b) of the General Data Protection Regulation) and our obligation pursuant to the rules on documentation in Article 30 of the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978).

Our legal basis for processing of your identification number is our obligation to comply with the requirements cf. Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly sections 28, 31, 35-38, 39 and the Appendixes referred to therein).

How long does Cryos store your personal data?

The sperm sample will be destroyed as soon as we have analysed the quality of the sperm. We will store the result of the sperm analysis as well as your contact information for at least 30 years from the time you have received the result to ensure full traceability.

Bookkeeping information is stored for six (6) years after the end of the financial year to which they refer pursuant to the rules on documentation in the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978), unless the tax authorities instruct us to do so for longer pursuant to the same provision.

When you contact Cryos or enter into a contractual relationship with us

What personal data does Cryos collect and process?

If you contact Cryos or purchase a treatment or service from us, we collect and process your contact and identification information (name, address, email address, telephone number and date of birth), payment information, the specifications regarding your purchase, any information about which clinic/hospital or authorised healthcare professional you wish to have your order sent to, and where your (continuing) treatment will take place.

If you register as a user and access Cryos’ patient portal, we process information in the form of your username, as well as the information about your relationship with Cryos. Including health information, that appears in the patient portal.

If you request access to Cryos’ donor database in connection with the purchase of a treatment or service, we use your email address to send you a one-time password. You will receive a new password each time you request to access the donor database.

What is the purpose of Cryos’ collection and processing of personal data?

The personal data is collected and processed in order for us to handle the administration of our contractual relationship with you.

We collect and process your contact and payment information for the purpose of fulfilling the agreement on treatment or any additional service that you have entered into with us. If your purchase includes depositing and/or distribution or export of gametes and/or embryos, the purpose is also to be able to register, pack and ship the gametes and/or embryos.

We process your health information in order to comply with our record-keeping obligation and to be able to share relevant information about your treatment with you in an easy and accessible way.

The purpose of collecting and processing your contact and identification information is also to ensure unique identification of you, as well as to comply with the requirements cf. section 28 of the Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007).

What is the legal basis for Cryos’ collection and processing of personal data?

The legal basis for our processing of your contact and payment information is our fulfilment of the agreement entered into with you (Article 6(1)(b) of the General Data Protection Regulation) and our obligation pursuant to the rules on documentation in Article 30 of the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978).
When the purpose of processing is to ensure unambiguous identification and traceability, the legal basis is our compliance with a legal obligation (cf. Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007) and Article 6(1)(c) of the General Data Protection Regulation).

The legal basis for our processing of your health data is our legal obligation to keep patient records, cf. Standards of Quality and Safety of Human Tissues, Cells and Derivative Products Law of 2007 (Law 187(I)/2007), mainly sections 28, 31, 35-38, 39 and the appendixes referred to therein. The legal basis for displaying your information in the patient portal is our legitimate interest in being able to share relevant information with you in an easy and accessible way, cf. Article 6(1)(f) of the General Data Protection Regulation.

How long does Cryos store your personal data?

Cryos has a legal obligation to store all information necessary to ensure full traceability for a minimum of 30 years from treatment or, if donor gametes are included in the assisted reproduction treatment, from the latest distribution of gametes from the donor in question. For this purpose, the contact and identification information that Cryos deems necessary to ensure the statutory identification of you, as well as information about your purchase, is stored.

If you provide Cryos with your email address, when requesting a one-time password to access Cryos’ donor database, your email address and the password you receive will be deleted immediately after the password is sent.

Bookkeeping information is stored for six (6) years after the end of the financial year to which they refer pursuant to the rules on documentation in the Cypriot Assessment and Collection of Taxes Law of 1978 (L.4/1978), unless the tax authorities instruct us to do so for longer pursuant to the same provision.

Other data

We will only store data received by email from you as long as it is necessary and relevant for our advice to and treatment of you unless legislation or another legitimate reason required further storage. Other data is stored as long as it is necessary to fulfil the purpose for which it is collected.

If you, prior to processing, have contacted Cryos using the online contact form on our website, the information you have provided herein will be stored for up to 14 days, after which the contact form will be deleted. The information provided in the form will be transferred to your medical record at Cryos, if you are registered as a patient at Cryos.

If consent forms are signed in connection with treatment, these will be stored and processed for as long as they are relevant to a current treatment or in connection with later use of the gametes and/or embryos, e.g. after the death of a partner. For documentation purposes, the consent forms are stored for a minimum of 30 years from the time the gametes/embryos are used, distributed or destroyed.

When you use Cryos’ website, we collect information about the pages you visit. For this purpose, we use our own and third-party cookies to remember your settings, to optimize the website’s functions, to generate statistics and to target our marketing.
You can read more about our processing of personal data collected through the use of cookies in our cookie policy: Cookie Policy – Cryos IVF Clinic in Cyprus. Here you can also find information on how to withdraw your consent to the use of cookies, and you can find information on the storage period for the individual cookies.

WITHDRAWAL OF CONSENT

To the extent that Cryos’ processing of your personal data is based on consent, you can withdraw your consent at any time. You can do so by sending an email to dpo-cy@cryosinternational.com or by calling us at +357 2200 7656.

f you would like to withdraw your consent, please note the following:

A withdrawal of your consent does not affect the legality of Cryos’ processing of your data on the basis of your previously given consent until the point in time when such consent is withdrawn. If you withdraw your consent, this decision will not take effect until the time of withdrawal of your consent.

Withdrawal of your consent can only take place until that point in time when the processing covered by the consent is carried out. Therefore, you cannot withdraw your consent and stop the processing if the processing has already been done or completed.

A withdrawal of your consent will not affect Cryos’ processing of data that we are already processing or may further process based on a different legal basis, e.g., for the purpose of performing the agreement on treatment concluded between Cryos and you or for the purpose of observing our legal obligations for, e.g., record-keeping or ensuring traceability.

Whether withdrawal of consent means that your data is to be erased must therefore be determined according to the specific circumstances at the time on which your consent is withdrawn and also depends on the legal basis based on which we process your data.