Stem Cell Registry's Privacy Statement

Why is my data being collected?

Stem Cell Registry member:

• Based on information on tissue type, blood group, CMV status, age and gender, a suitable stem cell donor is searched for a patient.
• Stem Cell Registry membership is voluntary and based on consent.

Stem Cell Registry member who has donated stem cells:

• The controller of the Stem Cell Registry has a legal obligation to maintain donors’ and recipients’ personal information to ensure the traceability of transplants.

What data is collected on me?

Stem Cell Registry member:

• Upon first joining the Stem Cell Registry, data subjects are asked to provide their name, personal identification number and contact information (address, telephone number and email address), in addition to which their blood group, CMV status, tissue type and gender are recorded.
• Data subjects who have been tested for their suitability as a donor for a specific patient will also have various health-related data (results of infection tests and information on any previous pregnancies and blood transfusions) on their file.

Stem Cell Registry member who has donated stem cells:

• Health-related data relevant to each data subject’s suitability as a donor.
• A sample from which DNA may be isolated or has been isolated.
• Procedures related to the donation/collection of stem cells.
• Information on personal injuries and/or property damage in connection with stem cell donation and documentation related to their claims handling.

How is my data obtained?

Stem Cell Registry member:

• The person provides personal and contact information voluntarily when joining the Stem Cell Registry. Tissue type, blood group and CMV data are obtained from laboratory analysis of the accession sample.

Stem Cell Registry member who has donated stem cells:

• As the selection process progresses, from the person himself/herself, from the examining doctor and from the laboratory and/or imaging results, and, where appropriate, from the parties that have taken care of the donor if the donor gives consent.
• Address details maintained by the Stem Cell Registry are updated through the address service of Posti or the Local Register Offices.
• Donation information is received from the Collection Centre.
• Information related to personal injuries or property damage are provided by the data subject or received from care units with the written consent of the data subject.

For what purposes are my personal data used?

Stem Cell Registry member:

• Tissue type, blood group, CMV status, gender and age data are used to find a suitable stem cell donor for the patient.
• Contact information is used for communication purposes.
• Health information is used to assess donor suitability and to ensure the safety of the donor and the patient.
• The information on tissue type, blood group, CMV status, gender and year of birth is also used for research purposes to improve the structure and performance of the Stem Cell Registry. In this case, all other personal information will be removed from the data.

Stem Cell Registry member who has donated stem cells:

• Name, personal identification number, health-related suitability data and details of donations are needed to ensure statutory traceability.
• A DNA sample from a stem cell donor may be needed to determine the patient’s state of health even at a later stage, and it will therefore be stored in the Blood Service’s laboratory for 30 years.
• The number of donations, the type of donation and information on the age and gender distribution and tissue type of data subjects are used for statistics describing the operation of the registry. For data processing purposes, names, personal identification numbers and contact details will be deleted.

Can my personal data be shared with others besides the FRC Blood Service? If so, why and with whom?

Stem Cell Registry member:

• Each new data subject who is entered into the data file is given a personal donor ID. The sample that data subjects give upon joining the Stem Cell Registry with the donor ID is sent to a laboratory for tissue typing and to establish their CMV status and blood group.
• Each data subject’s donor ID, tissue type, CMV status, blood group, gender and year of birth are uploaded to an international WMDA (World Marrow Donor Association) Search&Match central data repository, which can be accessed via both the Stem Cell Registry and its foreign counterparts to search for suitable stem cell donors for patients.
• A blood sample is taken whenever a data subject’s suitability as a donor for a specific patient is assessed. The data subject’s name and personal identification number are disclosed for identification purposes to the person who takes the blood sample.
• The donor ID or sample number is provided to the laboratory carrying out the laboratory analysis.

All data subjects included in the Stem Cell Registry who are undergoing additional or further testing or are about to donate their stem cells:

• When foreign registries are searching for suitable donors for their patients, information on data subjects’ tissue type, blood group, gender and year of birth and the results of infection tests (CMV, HIV, HBV, HCV, TPHA) are provided to the foreign stem cell registry.
• If a data subject included in the Stem Cell Registry is chosen as a donor, a summary of the results of their pre-donation medical examination is also shared with the relevant foreign stem cell registry in addition to the data listed above.
• For identification of the person, the donor’s name and personal identification number are given to the physician assessing the donor’s eligibility and to the Collection Centre staff. The data are stored in the Orton Ltd and HUS patient databases.
• The hospital where the patient is being treated is given the data subject’s donor ID as well as information on their tissue type, blood group, gender and year of birth, results of infection tests and any health-related data relevant to their suitability as a donor.
• A DNA sample will be sent to the hospital treating the patient in case the sample from that stem cell donor is needed to determine the patient’s health status.
• If a data subject is injured in connection with a donation, details of the event are shared with the insurance company.
• The database of the Stem Cell Registry is managed by Steiner Ltd (steiner.cz).

Can my personal data be shared with parties outside of the EU?

• The accession sample labelled with the donor ID is sent to a laboratory in Germany or the United States for tissue typing, blood group typing and CMV testing.
• In addition, information on the data subject’s tissue type, blood group, CMV status, age and gender is disclosed to the WMDA central data repository, through which the information can be viewed by professionals also outside the EU.

How does the FRC Blood Service protect my personal data?

• The accession sample is always pseudonymised (identified by the donor ID only, never by the donor’s name or personal identification number).
• The samples are sent to be tested in a laboratory with which the Blood Service has a written contract. The terms and conditions of agreement include information on agreed practices related to data protection, such as the obligation of professional confidentiality, practices for information disclosure as well as practices for discarding samples and results.
• As regards the information shared with the WMDA central data repository, only the donor ID is disclosed, never their name or personal identification number.
• Data is processed only by those persons who need it for their work. All individuals who process the data are bound to confidentiality.
• The database is password-protected and can only be accessed by authorised members of the staff. Only certain members of staff have the necessary account privileges to browse, enter, edit or delete data. The processing of data is restricted by our contracts with service providers. Hard copies of documents are kept in locked and access-controlled areas of Blood Service premises and in locked filing cabinets.
• Register data and its use are part of regular security audits and risk analyses. There is an ongoing access data monitoring tool, and reporting and investigation of incidents.

Can my personal data be used for profiling or automated decision-making?

No.

How long is my information kept?

Stem Cell Registry member:

• The data is kept as long as the person is a member of the Stem Cell Registry.
• Data transmitted to the WMDA central data repository (tissue type, blood group, CMV status, age and gender) may still be visible after a data subject has been removed from the Stem Cell Registry.

Stem Cell Registry member who has donated stem cells:

• Data are stored for at least 30 years after donation ¹⁾ and up to 120 years after the birth of the recipient (patient) of the stem cell transplant. ²⁾
• Any information that has been shared with the WMDA central data repository (tissue type, blood group, CMV status, age and gender) may still be visible after a data subject has been removed from the Stem Cell Registry. These will also appear in the records of the patient who received the transfer.

Due to the registry’s involvement in a global network of stem cell registries, it is possible that information (tissue type, blood group, CMV status, age and gender) shared with the WMDA central data repository may still remain on file in other registries (e.g. in patient donor search data) even after it has been removed from the Stem Cell Registry and from the WMDA central data repository.

¹⁾ Act on the Medical Use of Human Organs, Tissues and Cells (101/2001)

²⁾ Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023)

How can I review my data and rectify any inaccurate information?

Fill in, print and sign the information request form found on the Blood Service website and submit it to the Blood Service by post or in person. The Blood Service will send an extract of your personal data in the registry to you by post.

You may request for rectification of inaccurate information in writing using the rectification request form available on the Blood Service website. You can also correct contact details by phone.

Can I request the erasure of my data or object to the use of my data?

Yes, you can, as long as you have not yet donated stem cells.

Due to the registry’s involvement in a global network of stem cell registries, it is possible that information (tissue type, blood group, CMV status, age and gender) shared with the WMDA central data repository may still remain on file in other registries (e.g. in patient donor search data) even after it has been removed from the Stem Cell Registry and from the WMDA central data repository.

Can I challenge the use of my personal data?

If you believe that the law has been infringed in the processing of your personal data, you can lodge a complaint with the supervisory authority.

Contact information of the data file

The Finnish Red Cross Blood Service
PO Box 2, FI-01731 Vantaa, Finland
Tel. +358 29 300 1010, kantasolurekisteri(at)veripalvelu.fi

Person responsible for the registry

Taina Jaatinen, Head of Stem Cell Registry, tel. +358 29 300 1628