Stem Cell Registry's Privacy Statement

The Stem Cell Registry is a personal data file maintained by the Finnish Red Cross (FRC) Blood Service.

Why is my data being collected?

Stem Cell Registry member

Based on tissue type information, a suitable stem cell donor is searched for a patient.
Stem Cell Registry membership is voluntary and based on consent.

Data subjects who have previously donated stem cells

The controller of the Stem Cell Registry has a legal*) obligation to maintain donors’ and recipients’ personal information in order to ensure the traceability of transplants.

*) Finnish Act of the Medical Use of Human Organs and Tissues (101/2001)

What data is collected on me?

All data subjects included in the Stem Cell Registry

Upon first joining the Stem Cell Registry, data subjects are asked to provide their name, personal identification number and contact information (address, telephone number and email address), in addition to which their blood group, tissue type and gender are recorded.
Data subjects who have been tested for their suitability as a donor for a specific patient will also have various health-related data (results of infection tests and information on any previous pregnancies and blood transfusions) on their file.

Data subjects who have previously donated stem cells:

Health-related data relevant to each data subject’s suitability as a donor
A sample from which DNA may be isolated or has been isolated.
Procedures related to the donation/collection of stem cells.
Information on personal injuries and/or property damage in connection with stem cell donation and documentation related to their claims handling.

How is my data obtained?

Stem Cell Registry member

The persons themselves give the information voluntarily when joining the Stem Cell Registry

Stem Cell Registry member who has donated stem cells

As the selection process progresses, from the persons themselves, from the examining doctor and from the laboratory and/or imaging results, and, where appropriate, from the parties that have taken care of the donor if the donor gives their consent.
Address details maintained by the Stem Cell Registry are updated through the address service of Posti or that of the Local Register Offices.
Donation information is received from the Collection Centre.
Information related to personal injuries or property damage are provided by the data subject or received from care units with the written consent of the data subject.

For what purposes are my personal data used?

All data subjects included in the Stem Cell Registry

Tissue type, blood group, CMV status, gender and age data are used to find a suitable stem cell donor for the patient.
Contact information is used for communication purposes and making contact.
Data subjects’ health information is used to assess their suitability for donation and to ensure the safety of both donors and patients.
The information on data subjects’ tissue type, blood group, CMV status, gender and year of birth is also used for research purposes and to improve the structure and performance of the Stem Cell Registry. In this case, we will remove all other personal information from the data.

Data subjects who have previously donated stem cells

Data subjects’ name, personal identification number, health-related suitability data and details of donations are needed to ensure statutory traceability.
A DNA sample from a stem cell donor may be needed to determine the patient’s state of health even at a later stage, and it will therefore be stored in the Blood Service’s laboratory for 30 years.
The number of donations, the type of donation and information on the age and gender distribution and tissue type factors of data subjects are used for statistics describing the operation of the registry. For data processing purposes, names, personal identification numbers and contact details will be deleted.

Can my personal data be shared with others besides the FRC Blood Service? If so, why and with whom?

All data subjects included in the Stem Cell Registry

Each new data subject who is entered into the data file is given a personal donor ID. The first sample that data subjects give upon joining the Stem Cell Registry and their donor ID are sent to a laboratory for tissue-typing and to establish their CMV status and blood group.
Each data subject’s donor ID, tissue type, CMV status, blood group, gender and year of birth are uploaded to an international central data repository, which can be accessed via both the Stem Cell Registry and its foreign counterparts to search for suitable stem cell donors for patients.
A blood sample is taken whenever a data subject’s suitability as a donor for a specific patient is assessed. The data subject’s name and personal identification number are disclosed for identification purposes to the person who takes the blood sample.

All data subjects included in the Stem Cell Registry who are undergoing additional or further testing or are about to donate their stem cells

When foreign registries are searching for suitable donors for their patients, information on data subjects’ tissue type, blood group, gender and year of birth and the results of infection tests are provided to the foreign stem cell registry.
If a data subject included in the Stem Cell Registry is chosen as a donor, a summary of the results of their pre-donation medical examination is also shared with the relevant foreign stem cell registry in addition to the data listed above.
For identification of the person, the donor’s name and personal identification number are given to the physician assessing the donor’s eligibility and to the Collection Centre staff.
The data are stored in the Orton Ltd and HUS patient databases.
The hospital where the patient is being treated is given the data subject’s donor ID as well as information on their tissue type, blood group, gender and year of birth, results of infection tests and any health-related data relevant to their suitability as a donor.
A DNA sample is delivered to the hospital treating the patient if the relevant stem cell donor’s DNA sample is required to determine the patient’s state of health.
If a data subject is injured in connection with a donation, details of the event are shared with the insurance company.
The database of the Stem Cell Registry is managed by Steiner Ltd.

Can my personal data be shared with parties outside of the EU?

The first sample that data subjects give upon joining the Stem Cell Registry and their donor ID are sent to a laboratory in the United States for tissue-typing and for establishing their CMV status and blood group.

In addition, information concerning the data subject’s tissue type, blood group, CMV status, age and gender is disclosed to the international central data repository, through which the information can also be viewed outside the EU.

How does the FRC Blood Service protect my personal data?

The first sample that data subjects give is always pseudonymised (identified by the donor ID only; never by the donor’s name or personal identification number). The samples are sent to be tested in a laboratory with which the FRC Blood Service has a written contract. The terms and conditions of agreement include information on agreed practices related to data protection, such as the obligation of professional secrecy, practices for information disclosure as well as practices for discarding samples and results.

As regards the information shared with the international central data repository, only the donor ID of potential donors is disclosed; never their name or personal identification number.

Data is only processed by those persons who need to process the data as a part of their work duties.

All individuals who process personal data are bound to secrecy.

The database is password-protected and can only be accessed by authorised members of staff. Only certain members of staff have the necessary account privileges to browse, enter, edit or delete data. The processing of data is restricted by our contracts with service providers. Hard copies of documents are kept in locked and access-controlled areas of FRC Blood Service’s premises and in locked filing cabinets.

Regular information security audits and risk analyses are carried out ensure the security of the information held in the data file and the procedures used to process the data. We use a tool for the continuous monitoring of access data and the reporting and investigation of incidents.

Can my personal data be used for profiling or automated decision-making?

No.

How long is my information kept?

All data subjects included in the Stem Cell Registry

Data subjects’ information is retained as long as they wish to be included in the Stem Cell Registry.
Any information that has been shared with the international central data repository (data subjects’ tissue type, blood group, CMV status, age and gender data) may remain accessible even after a data subject has been removed from the Stem Cell Registry.

Data subjects who have previously donated stem cells

Data are stored for at least 30 years after donation and up to 120 years after the birth of the recipient (patient) of the stem cell transplant**.
Any information that has been shared with the international central data repository (data subjects’ tissue type, blood group, CMV status, age and gender data) may remain accessible even after a data subject has been removed from the Stem Cell Registry.

Due to the Stem Cell Registry’s involvement in a global network of stem cell registries, it is possible for information that has been shared with the international central data repository (data subjects’ tissue type, blood group, CMV status, age and gender) to remain on file in other databases (such as in records of searches for suitable donors for a specific patient) even after a data subject has been removed from the Stem Cell Registry and the central data repository.

**) Act on the Status and Rights of Patients (17.8.1992/785) and Decree of the Ministry of Social Affairs and Health on Patient Documents (30.3.2009/298)

How can I review my data and rectify any inaccurate information?

Fill in, print and sign the information request form found on the Blood Service’s website and submit it to the Blood Service by mail or in person. The Blood Service will send an extract of the personal data concerning you contained in the filing system to you by mail.

You may request for rectification of inaccurate information in writing by using the rectification request form found on the Blood Service’s website. In case the request for rectification concerns your contact details, you may ask those to be rectified also by phone.

Can I request the erasure of my data or object to the use of my data?

Yes, you can, as long as you have not yet donated any stem cells.

Can I challenge the use of my personal data?

If you feel that the processing of your personal data is not lawful, you may lodge a complaint with the competent supervisory authority.

Contact information of the data file

The Finnish Red Cross Blood Service

Härkälenkki 13

FI-01730 Vantaa, Finland

Tel. +358 29 300 1010, kantasolurekisteri(at)veripalvelu.fi

Manager of the personal data file

Anne Arvola, Head of Stem Cell Services, tel. +358 29 300 1571