Privacy Statement
Effective Date: May 18, 2026
Introduction
This privacy statement applies to you if you are located in the European Union and the GDPR applies to the processing of your personal data.
Your privacy is of the utmost importance to us. We therefore comply with all relevant laws and regulations, including the General Data Protection Regulation (hereinafter: GDPR).
Your data is safe with us, and we will always handle it with care. In this privacy statement, we explain how Arbor Scientia uses the information we collect about you.
The information in this privacy statement applies to our emergency contacts, third parties, clients (including contact persons), suppliers (including contact persons), health care specialists, and business associates (including contact persons).
This privacy statement applies to Arbor Scientia, consisting of the following entities:
Arbor Scientia, Metis Medical Media and Sirona Medical Education.
If you have any questions or would like to know exactly what information we keep about you, please contact Arbor Scientia. You can find the contact details at the bottom of this privacy statement.
Processes
Below you will find a list of the processes that take place within our organization. For each process, we provide a brief description of its purpose,
along with the personal data processed during that process. You will also see which third parties may process your personal data.
Generic communication
Purpose: Arbor Scientia’s communication with third parties.
The legal basis ultimately depends on the situation and the purpose for which the personal data was originally collected. However, in general, we process this data based on our legitimate interest in conducting our normal business operations.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Communication (Correspondence) | Legitimate interest | For as long as is necessary for the communication in question | Microsoft, C3SD Inc., Google |
| Contact (Telephone number, Email address) | Legitimate interest | For as long as is necessary for the communication in question | Microsoft, C3SD Inc., Google |
| Name (Full Name) | Legitimate interest | For as long as is necessary for the communication in question | Microsoft, C3SD Inc., Google |
| Corporate (Company Name/employer, Position/role) | Legitimate interest | For as long as is necessary for the communication in question | Microsoft, C3SD Inc., Google |
Contract management
Purpose: Entering into agreements with clients or healthcare professionals.
When entering into an agreement, you have the option of physically signing it. You can then return it by fax. In addition, you have the choice of signing via e-signing. The agreement can be downloaded/uploaded via a secure link on the local server/SharePoint. You then sign the form by printing and scanning or a digital signature via PDF.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Address (Full address) | Contract fulfillment | 10 years After termination of agreement between ASG and requesting party | Adobe Inc., C3SD Inc., Corodata, Google, Microsoft, Dropbox, Inc. |
| Contact (Email address, Telephone number) | Contract fulfillment | 10 years After termination of agreement between ASG and requesting party | Adobe Inc., C3SD Inc., Corodata, Google, Microsoft, Dropbox, Inc. |
| Name (Full name) | Contract fulfillment | 10 years After termination of agreement between ASG and requesting party | Adobe Inc., C3SD Inc., Corodata, Google, Microsoft, Dropbox, Inc. |
Presence of healthcare professionals at events
Purpose: Recording the attendance and absence of healthcare professionals at events during a conference organized by a third party.
Clients of Arbor Scientia organize events at congresses. You can register for an event on the site of the congress organizer. At the event, Arbor Scientia scans the badges of the attending medical specialists. Subsequently, Arbor Scientia receives a list of all attendees from the organizer. In addition, Arbor Scientia sometimes receives a second list of the registrants. In this way, the attendance of the medical specialists is tracked. The attendance is then transmitted via email with an encrypted link to Arbor Scientia’s client.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Address (Full address) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft, C3SD Inc., Dropbox, Inc., Customer |
| Contact (Email address, Telephone number) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft, C3SD Inc., Dropbox, Inc., Customer |
| Contract/Agreement | Legitimate interest | As long as agreed upon with the client | Google, Microsoft, C3SD Inc., Dropbox, Inc., Customer |
| Congress event | Legitimate interest | As long as agreed upon with the client | Google, Microsoft, C3SD Inc., Dropbox, Inc., Customer |
| Corporate (Company name/employer, Categories of patients, Profession/specialty) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft, C3SD Inc., Dropbox, Inc., Customer |
| Name (Full name) | Legitimate interest | As long as agreed upon with the client | Google, Microsoft, C3SD Inc., Dropbox, Inc., Customer |
Contacting health care professionals
Purpose: Contacting healthcare professionals for various services.
Arbor Scientia can approach you for various services. For example, participating in an advisory board, giving a presentation, participating in a promotional video, etc.
If you wish to enter into a collaboration, you will receive an invitation by e-mail. This invitation will include which service is involved, the amount of days and whether it will be live or virtual.
If you indicate that you are not interested or that you are not available on that date, no further data will be requested. In that case, we will send only the initial email, and a response to your reply.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Contact (Email address, Telephone number) | Contract fulfillment | 7 years | Microsoft, C3SD Inc., Dropbox, Inc. |
| Address (Full address) | Contract fulfillment | 7 years | Microsoft, C3SD Inc., Dropbox, Inc. |
| Name (Full Name) | Contract fulfillment | 7 years | Microsoft, C3SD Inc., Dropbox, Inc. |
Travel healthcare professionals
Purpose: Arranging travel for a healthcare professional.
If we have entered into an agreement with you and you have to travel for the fulfillment, Arbor Scientia will arrange and book the travel. We occasionally also collect emergency contact details of other persons as shared by the healthcare professional, which is based in legitimate interest, so we can appropriately contact the emergency contact if an emergency occurs.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Contact (Telephone number) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc. |
| Name (Full Name) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc. |
| Travel (Booking number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Balboa Travel, Microsoft, C3SD Inc. |
| Communication (Correspondence) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | |
| Travel (Airport of arrival and/or departure, Flight number, Frequent flyer number, KTN/TSA Pre-check, Seat preference, Time of landing and/or departure) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Microsoft, C3SD Inc. |
| Age (Date of birth) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, Microsoft, C3SD Inc. |
| Contact (Telephone number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc. |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc. |
| Name (Full Name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Balboa Travel, SAP SE, Microsoft, C3SD Inc. |
Car service healthcare professional
Purpose: Arranging a car service for a healthcare professional.
If Arbor Scientia has arranged your travel and/or accommodation, Arbor Scientia then also arranges car service. This is done through the external partner Balboa Travel.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Travel (Airport of arrival and/or departure, Arrival and/or departure date and time , Flight number, Hotel, Time of landing and/or departure) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc., Balboa Travel |
| Contact (Telephone number) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc., Balboa Travel |
| Name (Full Name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc., Balboa Travel |
Accommodation for medical specialists
Purpose: Arranging accommodation for a medical specialist.
If we enter into an agreement with you and you need to travel for the performance, Arbor Scientia might assist with the arrangement and booking of the accommodation.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Contact (Telephone number, Email address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
| Name (Full Name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
| Travel (Accommodation preference(s)) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
| Travel (Hotel, Check-in and/or check-out date) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
| Age (Date of birth) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
| Financial (Rate) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Dropbox, Inc. |
Recordings and meeting summary
Purpose: Recording a conversation and summarizing a meeting.
Recordings are made of the meetings organized by Arbor Scientia. We always ask for your consent to make these recordings.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Corporate (Company name/employer, Position/role) | Consent | 7 years | Zoom Video Communications, Inc. , Microsoft, C3SD Inc., Dropbox, Inc., AV (Audio Visual) company, Ubiqus |
| Date & Time | Consent | 7 years | Zoom Video Communications, Inc. , Microsoft, C3SD Inc., Dropbox, Inc., AV (Audio Visual) company, Ubiqus |
| Communication (Conversation recording and notes) | Consent | 7 years | Zoom Video Communications, Inc. , Microsoft, C3SD Inc., Dropbox, Inc., AV (Audio Visual) company, Ubiqus |
| Name (Full Name) | Consent | 7 years | Zoom Video Communications, Inc. , Microsoft, C3SD Inc., Dropbox, Inc., AV (Audio Visual) company, Ubiqus |
Meals during meetings
Purpose: Providing meals during a meeting.
When we organize a meeting, we request various personal information regarding your meal preferences. We do this to ensure that we can provide everyone with an appropriate and suitable meal. We never pass this data on an individual level to external parties.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Background (Nationality) | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
| Background (Religion) | Consent | 7 years | Microsoft, C3SD Inc. |
| Address (Full address) | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
| Date & time | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
| Financial (Rate) | Legitimate interest | 7 years | Microsoft, C3SD Inc. |
| Health (Allergies, Dietary and eating requirements) | Consent | 7 years | Microsoft, C3SD Inc. |
| Identification numbers (NPI number) | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
| Location | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
| Name (Full Name) | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
| Signature | Legitimate interest | 7 years | Cvent, Microsoft, C3SD Inc. |
Compensation for medical specialists
Purpose: Paying compensation to medical specialists.
You may have incurred additional expenses. In order to pay out your compensation, Arbor Scientia must process the data below. In addition, by law, the various data must be kept for a longer period of time.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Financial (ABA, BIC/SWIFT, IBAN, Transactions) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Location | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Address (Full address) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Name (Full Name) | Contract fulfillment | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
DiSC reports
Purpose: Generating DiSC reports.
It is possible that, after consultation, we invite you to complete a DiSC profile. This profile helps provide better insight into one’s own communication style.
Creating such a profile is voluntary. To safeguard privacy as much as possible, we work with a process in which only we know which person is involved. The party preparing the report does not know which person it concerns.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Assessment (Date assessment, profile) | Consent | 7 years For legal purposes, the data is then stored for the customer for the duration of the contract. | Microsoft, C3SD Inc. |
| Name (Full Name) | Consent | 7 years For legal purposes, the data is then stored for the customer for the duration of the contract. | Microsoft, C3SD Inc. |
Meal costs
Purpose: Tracking and reporting to the client the meal expenses incurred by the medical specialists.
To create a record of how many people attended, how many meals were served and how much these meals cost, Arbor Scientia processes your data. This is because a record of which persons ate and the value of that transaction must be shared with the FDA.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Corporate (Company name/employer) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Financial (Method of payment, Rate) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Date & time | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Name (Full Name) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
| Location | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Google, Microsoft, C3SD Inc., Intuit Inc., Dropbox, Inc. |
Transfer of Value Reporting under the Sunshine Act
Purpose: Keep track for the client of which medical specialists attended a meeting and how much compensation these medical specialists received.
Arbor Scientia’s clients are required by the Sunshine Act to keep track of these expenses. At the conclusion of a meeting, Arbor Scientia will complete this for the client, in a form provided by the client.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Financial (Method of payment, Rate, Transactions) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Dropbox, Inc. |
| Identification numbers (License number) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Dropbox, Inc. |
| Work (Work performed) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Dropbox, Inc. |
| Address (Full address) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Dropbox, Inc. |
| Name (Full Name) | Legitimate interest | 7 years For legal recordkeeping purposes, thereafter the data will be kept for the client for the duration of the contract | Microsoft, C3SD Inc., Dropbox, Inc. |
Other data sharing
Purpose: Sharing data with third parties in a manner and/or for a purpose that is not currently anticipated.
This general process applies to the sharing of personal data with third parties for a purpose that is only incidental and/or not foreseen at the time of drafting this privacy statement.
Personal data may be shared with third parties if there is a legal obligation to do so. This could be, for example, if a government agency requests personal data from us based on a legal provision. But we may also share your personal data incidentally with third parties if there is a legitimate interest to do so.
Personal data will only be shared if there is a purpose that is compatible with the purposes for which the personal data were initially collected. Whether there is compatibility will always be strictly assessed.
Is there no compatible purpose? Then we may only share the personal data with third parties for another purpose if you have given your consent.
| What kind of data do we process? | Upon what grounds do we process this data? | How long do we retain this data for? | Recipients |
| Various | Legitimate interest |
Recipients
Above, we have listed the third parties that may be involved in the processing of your personal data for each process. Below you will find a complete overview of these parties, including their roles and contact information. This ensures that you always know where your personal data is being processed.
Some third parties may process your personal data outside the EU. In such cases, we always ensure that the appropriate (contractual) measures are in place, as required by the GDPR. An important part of this is that we implement so-called “appropriate safeguards.” You can read below what these are for each recipient.
| Recipient | Explanation | Recipient Details |
| Microsoft | Microsoft365 (M365) | 1 Microsoft Way Microsoft Building 9 WA 98052, Redmond United States of America Outside the E.E.R. Safeguards: Standard Contractual Clauses (United States of America) |
| Gmail | Amphitheatre Parkway 1600 CA 94043, Mountain View United States of America Outside the E.E.R. Safeguards: Standard Contractual Clauses (United States of America) | |
| AV (Audio Visual) company | Meeting recordings | Depending on the AV company |
| Ubiqus | Transcriptions | 61 Broadway Suite 1400 NY 10006, New York United States of America |
| Customer | Depending on the customer | |
| Balboa Travel | Logistical partner | 5414 Oberlin Drive Suite 300 CA 92121, San Diego United States of America |
| Cvent | Event software | 1765 Greensboro Station Place 7th Floor VA 22102, Tysons Corner United States of America Outside the E.E.R. Safeguards: Standard Contractual Clauses (United States of America) |
| Adobe Inc. | Digital signatures | 345 Park Avenue CA 95110-2704, San Jose United States of America Outside the E.E.R. Safeguards: Standard Contractual Clauses (United States of America) |
| Zoom Video Communications, Inc. | Teleconference services | 55 Almaden Blvd Suite 600 CA 95113, San Jose United States of America Outside the E.E.R. Safeguards: Standard Contractual Clauses (United States of America) |
| Intuit Inc. | QuickBooks | 2700 Coast Avenue CA 94043, Mountain View United States of America |
| SAP SE | SAP Concur | 601 108th Ave NE Suite 1000 WA 98004, Bellevue United States of America |
| C3SD Inc. | Managed Services Support for M365-infrastructure and devices | Tiger Run Ct. 3129 CA 92010, Carlsbad United States of America |
| Dropbox, Inc. | Dropbox storage | United States of America Outside the E.E.R. Safeguards: Standard Contractual Clauses (United States of America) |
Amendments to this Privacy Statement
If our organization or our processes change, this may affect how we process your personal data. We will always communicate this to you transparently. If necessary, we will update this privacy statement. You can see the effective date of this privacy statement at the top.
Your rights
When we process your personal data, you have certain rights. You can exercise these rights by submitting a request and specifying which right (or rights) you wish to exercise. To do so, please use the contact information provided at the bottom of this privacy statement.
Please make sure to clearly identify yourself so that we can be certain we are not modifying or deleting data belonging to the wrong person. The rights listed above depend on the legal basis on which we process your personal data.
It is also possible that, under certain circumstances, we may not be legally able to comply with your request. For example, if we are prohibited from doing so by law or by a competent authority. If possible, we will inform you of this when you submit your request.
In principle, we will comply with your request within 1 month. However, this period may be extended for reasons related to the specific rights of data subjects or the complexity of the request. If we extend this period, we will notify you in a timely manner.
You have the following rights:
Right of access
Would you like to know what personal data Arbor Scientia processes about you? If so, you can submit a request for access. We likely process multiple categories of your personal data and/or for multiple purposes. You may wish to access only a portion of this data. Therefore, please specify in your request exactly which information you would like to access.
Right to rectification
If it turns out that your personal data held by Arbor Scientia is incorrect, incomplete, or irrelevant, you may submit a request to have your data corrected or supplemented. You may request rectification if your personal data is inaccurate, incomplete, irrelevant to the purpose for which it was collected, or if we are using your data in a manner that you believe violates the law.
Right ‘to be forgotten’
In certain cases, you may ask Arbor Scientia to delete your personal data. However, we feel it is important to inform you that we may not be able to or permitted to delete all of your data. We will always inform you of this.
Right to data portability
You may exercise your right to data portability (the transferability of personal data) if Arbor Scientia processes your data because you have given your consent, or to fulfill a contract with you. Please note: this applies only to data that Arbor Scientia processes digitally, not to paper files.
Right to restriction of processing
In certain situations, an organization may no longer be permitted to use your personal data. However, the organization may not yet be able to delete the data. In such cases, the organization must temporarily stop using your data. This is known as the right to restrict processing. You can ask Arbor Scientia to restrict the processing of your data.
Right to object
You have the right to ask Arbor Scientia to stop using your personal data in two situations. This is known as the right to object. First, if we use your data for direct marketing. Second, you may object to the use of your personal data based on your specific circumstances.
Right to withdraw consent
Does Arbor Scientia process your personal data based on your consent? If so, you may withdraw your consent at any time. From that point on, we will no longer process your personal data—unless there is (also) another legal basis for processing your data.
Technical and organizational provisions
The security of personal data is of the utmost importance to us. To protect your privacy, we take the following measures, among others:
Technical provisions:
- Anti malware software
- Back-ups
- Logging
- Multi factor authentication
- Vulnerability management
- Cryptography
Organizational provisions:
- Acceptable use policy
- Disaster recovery plan
- Awareness training
Submitting a complaint
If you wish to file a complaint regarding the use of your personal data, please send an email to lleva@arborscientia.com. We will address every complaint internally and keep you informed of our progress.
In addition, you have the right to file a complaint with the supervisory authority at any time.
Contact details
If you have any questions or would like to know what personal data we have about you, please contact us. See the contact information below.
Arbor Scientia
5962 La Place Court Suite 290
CA 92008, Carlsbad
United States of America
E-mail address: lleva@arborscientia.com