PRIVACY STATEMENT
Effective date: November 6, 2023
Introduction
This privacy statement applies to you if you are located in the European Union and the GDPR applies to the processing of your personal data.
Your privacy is of the utmost importance to us. Therefore, we adhere to all relevant legislation
and regulation, according to the General Data Protection Act (hereafter referred to as the
GDPR).
This Privacy Statement outlines all the ways in which Arbor Scientia processes the information we know about you.
The information listed in this Privacy Statement pertains to our guests and interested parties.
This Privacy Statement applies to Arbor Scientia Group (ASG). Which comprises the following entities: Arbor Scientia, Metis Medical Media and Sirona Medical Education.
Should you have any further queries or wish to know the precise personal data we hold about you, please don’t hesitate to reach out to us. Our contact details are listed at the end of this Privacy Statement.
Processes
Below you will find the processes that occur within our organization. For each one we have listed the reasons for processing your personal data. The tables below show the personal data we process. Occasionally, we forward your personal data on to third parties that help us process your personal data. These third parties are also listed in the tables.
Generic communication
Purpose: Communication by Arbor Scientia with third parties and internal workforce communication.
In this Privacy Statement we endeavor to specify as accurately as possible why, when and how Arbor Scientia communicates. However, certain (exceptional) cases may arise that are hard to readily categorize under one of the outlined processes. In such an instance we adhere to the following guiding principles when processing personal data.
We process such data on the basis of our legitimate interest in carrying out standard business practices.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Communication (Correspondence) | Legitimate interest | For as long as is necessary for the communication in question | Google, Microsoft | |
| Contact (Email address, Telephone number) | Legitimate interest | For as long as is necessary for the communication in question | Google, Microsoft | |
| Corporate (Company name/employer, Position/role) | Legitimate interest | For as long as is necessary for the communication in question | Google, Microsoft | |
| Name (Full name) | Legitimate interest | For as long as is necessary for the communication in question | Google, Microsoft |
Contracts management
Purpose: Signing and managing contracts with third parties or medical specialists.
When entering into an agreement, you have the option of physically signing it. You can then return it by fax. In addition, you have the choice of signing via e-signing. The agreement can be downloaded/uploaded via a secure link on the local server/SharePoint. You then sign the form by printing and scanning or a digital signature via PDF.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Contract fulfillment | 10 years After termination of agreement between ASG and requesting party | Adobe, Google, Iron Mountain, Microsoft | |
| Contact (Email address, Telephone number) | Contract fulfillment | 10 years After termination of agreement between ASG and requesting party | Adobe, Google, Iron Mountain, Microsoft | |
| Name (Full name) | Contract fulfillment | 10 years After termination of agreement between ASG and requesting party | Adobe, Google, Iron Mountain, Microsoft |
Attendance of medical specialists at events
Purpose: To record medical specialists present and absent at events at a congress organized by a third party.
Clients of Arbor Scientia organize events at congresses. You can register for an event on the site of the congress organizer. At the event, Arbor Scientia scans the badges of the attending medical specialists. Subsequently, Arbor Scientia receives a list of all attendees from the organizer. In addition, Arbor Scientia sometimes receives a second list of the registrants. In this way, the attendance of the medical specialists is tracked. The attendance is then transmitted via email with an encrypted link to Arbor Scientia’s client.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft | |
| Contact (Email address, Telephone number) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft | |
| Contract/Agreement | Legitimate interest | As long as agreed upon with the client | Google, Microsoft | |
| Congress event | Legitimate interest | As long as agreed upon with the client | Google, Microsoft | |
| Corporate (Company name/employer, Categories of patients, Profession/specialty) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft | |
| Name (Full name) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft |
Approaching medical specialists
Purpose: Approaching medical specialists for various services.
Arbor Scientia can approach you for various services. For example, participating in an advisory board, giving a presentation, participating in a promotional video, etc.
If you wish to enter into a collaboration, you will receive an invitation by e-mail. This invitation will include which service is involved, the amount of days and whether it will be live or virtual.
If you indicate that you are not interested or that you are not available on that date, no further data will be requested. In that case, we will send only the initial email, and a response to your reply.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Contract fulfillment | 7 years | Microsoft | |
| Contact (Email address, Telephone number) | Contract fulfillment | 7 years | Microsoft | |
| Name (Full name) | Contract fulfillment | 7 years | Microsoft |
Travel (Medical specialist)
Purpose: Arranging travel for a medical specialist.
If we have entered into an agreement with you and you have to travel for the fulfillment, Arbor Scientia will arrange and book the travel.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Age (Date of birth) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Microsoft | |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Communication (Correspondence) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | ||
| Contact (Email address, Fax, Telephone number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Name (Full name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Google, Microsoft | |
| Travel (Arrival and/or departure date, Booking number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Google, Microsoft | |
| Travel (Airport of arrival and/or departure, Flight number, Frequent flyer number, KTN/TSA Pre-check, Seat preference, Time of landing and/or departure) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Microsoft |
Car service (Medical specialist)
Purpose: Arranging car service for a medical specialist.
If Arbor Scientia has arranged your travel and/or accommodation, Arbor Scientia then also arranges car service. This is done through the external partner Balboa Travel.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Contact (Telephone number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Google, Microsoft | |
| Date & time (Pick up date & time) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Google, Microsoft | |
| Name (Full name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Google, Microsoft | |
| Travel (Airport of arrival and/or departure, Arrival and/or departure date, Flight number, Hotel, Time of landing and/or departure) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Google, Microsoft |
Accommodation (Medical specialist)
Purpose: Arranging an accommodation for a medical specialist.
If we enter into an agreement with you and you need to travel for the performance, Arbor Scientia might assist with the arrangement and booking of the accommodation.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Age (Date of birth) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft | |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Communication (Correspondence) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | ||
| Contact (Email address, Fax, Telephone number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft | |
| Financial (Rate) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft | |
| Name (Full name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Hotel, Microsoft | |
| Travel (Accommodation preference(s)) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Hotel, Microsoft | |
| Travel (Hotel, Check-in and/or check-out date) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft |
Call recording and summary meeting.
Purpose: Making a recording and summary of a meeting.
Recordings are made of the meetings organized by Arbor Scientia. We always ask for your consent to make these recordings.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Communication (Conversation notes) | Consent | 7 years | Microsoft, Ubiqus | |
| Communication (Conversation recording) | Consent | 7 years | AV (Audio Visual) Company, Microsoft, Ubiqus, Zoom Video Communications | |
| Corporate (Company name/employer, Position/role) | Consent | 7 years | AV (Audio Visual) Company, Microsoft, Ubiqus, Zoom Video Communications | |
| Date & time | Consent | 7 years | AV (Audio Visual) Company, Microsoft, Ubiqus, Zoom Video Communications | |
| Name (Full name) | Consent | 7 years | AV (Audio Visual) Company, Microsoft, Ubiqus, Zoom Video Communications |
Meals at meetings
Purpose: To provide a meal during a meeting.
When we organize a meeting, we request various personal information regarding your meal preferences. We do this to ensure that we can provide everyone with an appropriate and suitable meal. We never pass this data on an individual level to external parties.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Cvent, Iron Mountain, Microsoft, | |
| Background (Nationality) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Background (Religion) | Consent | 7 years | Microsoft | |
| Date & time | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Cvent, Iron Mountain, Microsoft | |
| Financial (Rate) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Health (Allergies, Dietary and eating requirements) | Consent | 7 years | Microsoft | |
| Identification numbers (NPI number) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Cvent, Iron Mountain, Microsoft | |
| Location | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Cvent, Iron Mountain, Microsoft | |
| Name (Full name) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Cvent, Iron Mountain, Microsoft | |
| Signature | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Cvent, Iron Mountain, Microsoft |
Compensation of medical specialists
Purpose: The payment of compensation to medical specialists.
You may have incurred additional expenses. In order to pay out your compensation, Arbor Scientia must process the data below. In addition, by law, the various data must be kept for a longer period of time.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | California Bank and Trust, Google, Intuit, Microsoft | |
| Financial (ABA, BIC/SWIFT, IBAN, Transactions) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | California Bank and Trust, Intuit, Google, Microsoft | |
| Location | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Intuit, Microsoft | |
| Name (Full name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | California Bank and Trust, Google, Intuit, Microsoft |
Reimbursement of medical specialists
Purpose: The payment of reimbursement to medical specialists.
In order to disburse your reimbursement, Arbor Scientia must process the data below.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft | |
| Corporate (Company name/employer) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft | |
| Date & time | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft | |
| Financial (Bank, Routing number, Transactions) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | California Bank and Trust, Intuit, Microsoft | |
| Financial (Account number, Rate) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft | |
| Identification numbers (License number, NPI number, SSN) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft | |
| Location | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft | |
| Name (Full name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | California Bank and Trust, Intuit, Microsoft | |
| Tax information (Company registration number, Tax number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Intuit, Microsoft |
Meal Costs
Purpose: To track the meal costs incurred for the medical specialists and communicate this to our client.
To create a record of how many people attended, how many meals were served and how much these meals cost, Arbor Scientia processes your data. This is because a record of which persons ate and the value of that transaction must be shared with the FDA.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Corporate (Company name/employer) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Intuit, Microsoft | |
| Date & time | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Intuit, Microsoft | |
| Financial (Method of payment, Rate) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Intuit, Microsoft | |
| Location | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Intuit, Microsoft | |
| Name (Full name) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Intuit, Microsoft |
Transfer of Value Reporting under the Sunshine Act
Purpose: To track for the client which medical specialists participated in a meeting and how much value these medical specialists received.
Arbor Scientia’s clients are required by the Sunshine Act to keep track of these expenses. At the conclusion of a meeting, Arbor Scientia will complete this for the client, in a form provided by the client.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Address (Full address) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Financial (Method of payment, Rate, Transactions) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Identification numbers (License number) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Location | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Name (Full name) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft | |
| Work (Work performed) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft |
Other data sharing
Purpose: The sharing of data with third parties in a manner and/or for a purpose not currently foreseen.
This general process applies to the sharing of personal data with third parties for a purpose that is only incidental and/or not foreseen at the time of drafting this privacy statement.
Personal data may be shared with third parties if there is a legal obligation to do so. This could be, for example, if a government agency requests personal data from us based on a legal provision. But we may also share your personal data incidentally with third parties if there is a legitimate interest to do so.
Personal data will only be shared if there is a purpose that is compatible with the purposes for which the personal data were initially collected. Whether there is compatibility will always be strictly assessed.
Is there no compatible purpose? Then we may only share the personal data with third parties for another purpose if you have given your consent.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients | |
| Various | Legitimate interest |
Recipients
Above we listed the third parties that may potentially process your personal data too. We call these third parties ‘recipients’. The table below lists all of these recipients. We have also stated what they do, plus their contact details. In this way you always know where your personal data is being processed.
Occasionally a recipient outside the EU will process your personal data. Rest assured, caveats are attached. The GDPR mandates us to take specific pre-determined steps in such an instance. Which, of course, we do. Below we have outlined the steps we take.
| Recipient | Explanation | Recipient details | |
| Microsoft | Supplier Office365 | Microsoft Corporation One Microsoft Way Redmond, WA 98052-6399 United States Outside the E.E.A. Safeguards: Standard Contractual Clauses (United States of America) | |
| Supplier Gmail | Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043 United States | ||
| AV (Audio Visual) company | Conversation recordings | Depending on the AV company | |
| Ubiqus | Transcription | Ubiqus Reporting Inc.61 Broadway Suite 1400New York, NY 10006 United States | |
| California Bank and Trust | Banking institution | Zions Bancorporation N.A.11622 El Camino Real Suite 200San Diego, CA 92130United States | |
| Hotel | Accommodations | Depending on the hotel | |
| Balboa Travel | Logistic partner | Balboa Travel 5414 Oberlin Drive Suite 300San Diego, CA 92121United States | |
| Intuit | Supplier QuickBooks | Inuit Inc.2700 Coast AvenueMountain View, CA 94043United States | |
| Iron Mountain | Archiving | Iron Mountian Information Management LLC1 Federal StreetBoston, MA 02110United States Outside the E.E.A. Safeguards: Standard Contractual Clauses (United States of America) | |
| Cvent | Event software | Cvent Inc.1765 Greensboro Station Place 7th FloorTysons Corner, VA 22102United States Outside the E.E.A. Safeguards: Standard Contractual Clauses (United States of America) | |
| Adobe | Digital signing | Adobe Inc.345 Park AvenueSan Jose, CA 95110-2704United States Outside the E.E.A. Safeguards: Standard Contractual Clauses (United States of America) | |
| Zoom Video Communications | Teleconference service | Zoom Video Communications Inc. 55 Almaden Blvd Suite 600San Jose, CA 95113United States Outside the E.E.A. Safeguards: Standard Contractual Clauses (United States of America) |
Amendments to this Privacy Statement
Arbor Scientia is a dynamic organization. This may impact your personal data. For instance, we may start processing more of your personal data or for different purposes. However, we will always provide advance notice. We do so by making amendments to this Privacy Statement. Would you like to know when this Privacy Statement comes into effect? If you go right to the top of this statement, you’ll see the start date listed.
Your rights
If we process your personal data, you in turn are entitled to certain rights. Would you like to exercise these rights? If so, please get in touch with us, stating the right(s) you wish to exercise. Our contact details are listed at the end of this Privacy Statement.
Please clearly state your name. This will ensure we don’t mistakenly adjust or delete data for another person. It may be the case that we aren’t able or authorized to carry out your request. This depends on a number of issues, which we will of course always notify you of.
As a rule, we will carry out your request within 1 month. Occasionally, this may unfortunately take longer. In this instance, we will notify you and explain why we need more time.
You are entitled to the following rights:
Right of access
Would you like to know what kind of personal data Arbor Scientia processes about you? If so, you can submit your right to inspect this data. It’s more than likely that we process different categories of your personal data or for several purposes. You may only wish to inspect some of the data that has been processed. Please therefore clearly state exactly what it is you wish to inspect.
Right to rectification
Is your personal data held by Arbor Scientia inaccurate, incomplete, or irrelevant? If so, you can submit a request to have your data changed or supplemented. You can request rectification if your personal data is inaccurate, incomplete, or irrelevant to the purpose for which it was collated or if we use your personal data in such a way that you believe contravenes legislation.
Right to erasure
You can ask us to erase your personal data. However, we would like to stress that we most likely won’t be able or authorized to erase all of your personal data. We will, however, always keep you notified in this instance.
Right to data portability
If Arbor Scientia processes your personal data, you can exercise your right to data portability (transmission of personal data), as you have provided your consent to do so or in order to perform a contract entered into with you. Please note: this only applies to data that we process digitally, so it does not apply to hard copies.
Right to restrict processing
In certain circumstances, an organization may no longer use your personal data, but it can’t yet erase the data either. In such an instance, the organization must temporarily cease using your personal data. This is known as the right to restrict processing. You can ask us to limit the processing of your personal data.
Right to object
There are two situations in which you can ask Arbor Scientia to cease using your personal data. This is known as the right to object. Firstly, you can object to the use of your personal data if we use your personal data for direct marketing purposes. Secondly, you can object to the use of your personal data based on your specific individual situation.
Right to revoke consent
Does Arbor Scientia process your personal data based on your consent? If so, you can revoke your consent at any given time. We will no longer process your personal data from that moment on, unless other reasons for processing your personal data prevail.
Technical and organizational provisions
We deem personal data security to be paramount. We take the following steps to safeguard your privacy:
Technical provisions:
- Anti-malware software
- Backups (automatic)
- Backups at another location
- Logging of usage
- Multifactor authentication
- Periodic security updates
- Encryption database
- Encryption during transmission
Organizational provisions:
- Policy regarding acceptable use
- Business continuity policy
- Plans for disaster recovery
- Protocol at end of employment
- Staff training (upon employment)
- Password policy
Submitting a complaint
If you wish to submit a complaint about the use of your personal data, please email: customerservice@arborscientia.com. We will address any complaint internally and communicate this further with you.
In addition, you have the right to file a complaint with the competent lead supervisory authority at any time.
Contact details
Should you have any questions or wish to know what personal data we hold about you, please get in touch with us. The contact details are listed below.
Arbor Scientia
5962 La Place Court, Suite 290
Carlsbad, CA 92008
United States
E-mail address: lleva@arborscientia.com
You can also get in touch with our EU representative. The contact details are listed below.
Complite
Bredaseweg 185
4872 LA Etten-Leur
The Netherlands
E-mail address: support@complite.nl
