Privacy policy regarding Aiforia Cloud service

Aiforia as a controller

Aiforia as a processor

Aiforia acts as a controller when Aiforia determines the purposes and means of processing personal data. These situations include the following:

Aiforia provides the Aiforia Cloud service to its clients and partners as a service provider, in which case Aiforia e.g., processes contact information and log data of Aiforia's customers' employees and other users of Aiforia Cloud solutions.

Aiforia uses the pathological tissue samples in order to train its AI models (neural network models).

Yes. Aiforia can be both a controller and a processor for the same data. This situation occurs when Aiforia first provides Aiforia Cloud service to a client who uses the service to process and diagnose its pathological tissue samples, in which case Aiforia acts as a data processor.
If Aiforia has the right to use such data collected by another controller for training its AI neural networks with the samples that the client uses in order to develop its AI model, Aiforia will in such a case act as a data controller for the same data.

Aiforia processes the personal data of its clients' and partners' employees and other personnel based on performance of the contract between Aiforia and its clients and on Aiforia's and third parties' legitimate interests.

The identified legitimate interests of Aiforia are the following:

• to enable and provide access and use of Aiforia Cloud service; and
• debugging and improving the software usability and performance.
  
  Furthermore, the identified legitimate interests of third parties', i.a., Aiforia's clients and partners are the following:
• providing their core services in a more effective manner; and
• providing the employees with necessary tools to carry out their duties.
  
  Aiforia processes the personal data of the patients and other test subjects whose tissue samples are diagnosed based on scientific research in the public interest.

Aiforia collects the personal data of its clients' and partners' employees and other personnel that include the following:

• Client name
• Contact information (name, phone number, email, job title, address of the client)
• Username and password
• User IP address
• User logs of user data and user actions data
• Information provided by the user, e.g., information filled in the free text form
• Information collected by cookies, e.g., IP addresses, site pages visited, site page visit times, browser type, operating system, website visited before entering Aiforia Cloud service. For more information on cookies, please see Cookies below.

Aiforia also receives the patients' and other test subjects' personal data that include the following:

• Pathological tissue samples
• Images of pathological tissue samples
• When data is collected from biobanks, Aiforia does receive some high-level information regarding e.g., cancer type, survival and treatment.

Aiforia receives the patients' and other test subjects' personal data that include the following:

• Pathological tissue samples
• Other information provided to Aiforia by the controller

Aiforia can access the data processed by the controller. Aiforia only accesses such data for maintenance and care purposes and only when requested by the client.

Aiforia receives pathological tissue samples from its clients or its partners. Furthermore, Aiforia can receive pathological tissue samples from commercial partners and biobanks.

Aiforia collects personal data of its clients' and partners' employees and other personnel directly from these persons themselves. Some data regarding the usage of the system, including log files, are based on the behaviour of the data subjects on Aiforia Cloud services.

Aiforia may share the personal data of its clients' and partners' employees and other personnel with external hosting services providers. These include, but are not limited to, the following:

• Microsoft

• Talenom

• Hubspot

• Google

• Amazon Web Services

We enter into a data processing agreement with every service provider who processes personal data on our behalf. In accordance with the data protection agreement, each service provider processes personal data only to the extent necessary for the provision of that service.

In addition, we may disclose your personal data to the extent permitted and obligated by existing legislation, including in connection with business transactions, unless you deny the disclosure of your personal data. We may also transfer or disclose personal data to authorities, where required to do so by applicable laws.

If Aiforia Technologies is involved in a corporate transaction, personal data may be disclosed to third parties in relation to such transaction in accordance with the applicable data protection laws.

We do not share the pathological tissue samples or images thereof with third parties.

Aiforia services can be integrated on its client's platform at the client's request. Unless otherwise agreed with the client, Aiforia services are generally built on top of Microsoft Azure, Amazon Web Services or Google Cloud platforms.

Such external hosting services are considered as data processors. We enter into a data processing agreement with every service provider who processes personal data on our behalf. In accordance with the data protection agreement, each service provider processes personal data only to the extent necessary for the provision of that service.

Personal data will be stored and processed during the term of Aiforia Cloud service contract, and also thereafter as long as there are legal grounds for the processing.

We delete the personal data of clients' and partners' employees when these persons do not continue working at their service in the respective entity.

Aiforia Cloud logs user data and user actions on the platform, in order to be compliant with applicable regulations for electronic records and electronic signatures. This is our quality policy and is a requirement for Aiforia Cloud clinical compliance. The user logs will be stored indefinitely due to legal requirements.

The deletion of personal data will be performed following Aiforia Technologies’ data erasure procedures.

We have taken and will maintain the necessary and appropriate technical and organizational measures to ensure the security of processing and to monitor the use of personal data, such as access control and rights, event logging, protection of hardware and files, physical access restrictions, encryption of sensitive data, pseudonymization, user guidelines and supervision. In addition, we have internal procedure for controlling non-conforming products and services, such as IT equipment or software components, at Aiforia.

The more specific instructions on how the technical and organizational data protection is organized is based on the instructions given by the controller of the data.

In case you suppose that your personal data derived from pathological tissues is or has been processed by using Aiforia Cloud services, e.g., in relation to diagnostic, please contact the health care service provider that has treated you. When it comes to pathological tissue samples, Aiforia does not get your personal information other than specified below and cannot identify you from the data Aiforia processes in general. We can only fulfil your rights as a data subject if we get additional information which we will request, as necessary. Without further information we are unable to identify you and therefore we cannot fully fulfil your rights. In other cases, and if we receive enough information in order to identify you, the following will apply.

When Aiforia acts as a controller, you as a data subject, have the following data protection rights towards us:

Right of access: You have the right to receive information from us whether we are processing your personal data. If your personal data is being processed, you may request a copy of your personal data that is being processed.

Right to rectification: You have the right to request that inaccurate or incomplete personal data relating to you be rectified or completed. This is provided, as a rule, free of charge.

Right to erasure ("right to be forgotten"): You have the right to request the erasure of your personal data in some cases without undue delay.

Right to restriction of processing: You can request us to restrict the processing of personal data concerning you when it is processed with your consent.

You may in some cases have the right to restrict the processing of your personal data.

Right to object: You may have the right to object to the processing of your personal data in some cases. If your personal data is processed for direct marketing, such as for newsletters, you always have the right to object to the processing of your personal data.

Right to data portability: To the extent that we process your personal data on the basis your consent and the processing is carried out automatically, you have the right obtain the personal data relating to yourself that you have provided to us in a structured, commonly used and machine-readable form, and the right to transmit this data to another controller.

Right to withdraw consent: You have the right at any time to withdraw your consent to the processing of personal data. Withdrawal of consent has no effect on the lawfulness of processing carried out prior to withdrawal.

Right not to be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the competent supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or place of the alleged infringement, if you consider that your personal data has been processed in violation of applicable data protection laws. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman, whose contact information is accessible through the following link: https://tietosuoja.fi/en/contact-information

In order to have more information about our Privacy policy, or if you wish to exercise any of the above-mentioned rights, you can contact our Service Desk.

All data subject rights requests will be forwarded to the controller when Aiforia acts as a data processor. You can also contact the controller in question directly in order to exercise your data subject rights when Aiforia acts as a processor.

In order to have more information of our Privacy policy, or if you wish to exercise any of the above-mentioned rights, you can contact our Service Desk.