Privacy Statement for Advanced Cell Therapy Center

Person in charge

Production Manager Anita Laitinen, tel. +358 (0)29 300 1693

Purpose and grounds for processing

Cell therapy products are medicines with live cells, and they are always manufactured from a biological tissue. The tissue is collected either

1. from a voluntary, healthy donor or
2. from the patient. Manufacturing of cell therapy products is strictly regulated — it corresponds the regulations for pharmaceutical manufacturing.

Data is used to assess the eligibility to donate and to ensure the safety of both the donor and the patient as well as to fulfil statutory obligations. Data processing is based on cell therapy products manufacturing and on operating permits granted for tissue collection (national ATMP manufacturing permission, tissue establishment operating permit) as well as on the statutory obligation to retain the personal data of the donor and the recipient of the cell therapy product in order to ensure statutory traceability.

Data subject groups and personal data to be processed

1. Donor of tissues for cell therapy product manufacturing: name, personal identity code, address, phone number, e-mail address, sex, laboratory test results (such as virus screening tests), tissue type and blood group. When the Blood Service is in charge of the assessment of the donor’s eligibility, also the following data will be stored in the filing system: data concerning health provided by the person him/herself which has an impact on donation eligibility, such as illnesses, surgeries, medication, sexually transmitted diseases, sexual behaviour, travelling, illnesses of close relatives, medical procedure related to tissue collection, donation time and place, health-related follow-up information (to follow whether the donation has had a negative impact on the health of the donor).
2. Patients who have been treated with cell therapy products manufactured by the Advanced Cell Therapy Center: name, personal identity code, age, weight, diagnosis, treatment time, cell therapy product dosage information, potential adverse events.

Data usage and grounds for potential automated decision-making

Data is used to assess eligibility to donate and to ensure the safety of the donor as well as to fulfil statutory obligations. Only data that is necessary will be stored with limited access granted only to those who need to access and process the data in order to perform their duties. Data will not be used for automated decision-making.

Data sources

Regarding the product LY-MSC: Together with announcing their interest in donating tissue, donors of bone marrow tissue provide basic information concerning themselves and give their consent for contacting them in order to manufacture cell therapy products. As the donor selection procedure progresses, the donor will provide further information on his/her health condition. Some data is obtained from the laboratory tests carried out. The contact details of the donor are disclosed from the stem cell register with the donor’s consent.

Regarding other cell therapy products: Data concerning the patient and his/her close relatives may be disclosed by the treating doctors or hospital collection centres. Evaluation of donor eligibility and storing the tissue are not covered by the tissue establishment authorisation granted to the Blood Service.

Data disclosure and transfer, data recipients, access to data

The personnel collecting tissue (doctors and nurses authorised to perform the duty) are provided with personal and health-related data of the donor for identification and donation eligibility purposes. After tissue donation, the tissue and the donor’s blood samples are coded using batch numbers so that they cannot be connected to an individual person. Blood samples are delivered to laboratories using batch numbers only. Laboratory services are partially performed using subcontractors.

An exception to identification codes and batch labels of samples and products: with cell therapy products manufactured from the patient’s own tissue and with relative donations, we have a statutory obligation to label the products also with the personal identification codes of the patient and the donor. This way, we can ensure that the cell product is given to the right patient.

If the tissue donor is diagnosed with some disease to be reported under the Communicable Diseases Act, data will be disclosed to the National Infectious Diseases Register as required by the above-mentioned act. The data concerning the cell therapy recipient will not be disclosed outside the Blood Service.

Data transfers outside the EU/EEA

No data is transferred outside the EU or the EEA.

Data retention locations and periods (incl. server locations, if any)

Data is stored in electronic form in the Vernet library with a limited access (access is granted only to the personnel at the Advanced Cell Therapy Center and the Vernet administrator). No log data is recorded in the information system. Paper data is stored in a locked, fireproof archives. Data is retained for 30 years after providing the patients with the products. If a person has communicated his/her interest in donating tissue for cell therapy product manufacturing purposes, his/her contact details will be retained for five (5) years after such communication.

Informing data subjects

Donors will be informed about data processing and retention concerning them by delivering a website link to the privacy statement in connection with sending the donation information package and consent form. Furthermore, the privacy statement is available on the Blood Service website.

Procedures for dealing with data subject requests (inspecting data, rectification, restricting and objecting to processing, data portability, consent withdrawal)

Data subjects have the right to inspect (request for data form), rectify (request for rectification form) and withdraw their consent for data storing and processing in accordance with the VPU-YO-014 instructions. By way of derogation from the above-mentioned right to withdraw consent: if the tissue donated by the person wishing to withdraw consent has already been used for manufacturing a cell therapy product and this product has been given to a patient, the withdrawal is overruled by a statutory obligation (obligation to retain the personal data of the donor and the recipient in order to ensure the statutory traceability of transplants).

Risk assessment and data protection impact assessment

Risk and data protection impact assessments are conducted whenever procedures related to data storing and usage are changed (for instance in connection with the implementation of a new information system).

Measures implemented to protect data (operational control, training, guidance, NDAs, access control, information security, data encryption, pseudonymisation, anonymisation, etc.)

The processing of data at the Advanced Cell Therapy Center is restricted to those professionals whose duties so require. Access to data is restricted to those who need such access to carry out the duties for which they are employed. These persons are trained to use the information systems and to ensure data protection and information security. Printed documents are stored in locked cabinets or archives. Products and samples are identified using batch numbers, the connection of which to the donor’s identity can be found from the filing system managed by the Advanced Cell Therapy Center and from the original batch documentation.

Contracts related to the filing system

Separate contracts concerning cell therapy product deliveries have been concluded with nursing units. Regarding laboratory services delivered by subcontractors: separate contracts shall be concluded with the service providers.