Privacy Policy

1. Introduction

InnoCon Medical needs to gather and use certain information about individuals.

These can include employees, test subjects, and other people the company has a relationship with or may need to contact.

In general, InnoCon Medical only processes personal data for specific purposes, where legitimate interests are present. Only personal data that is relevant and necessary to fulfil the specified purpose is processed, and the personal data is deleted when it is no longer required.

This policy describes how InnoCon Medical:

• Complies with the General Data Protection Regulation and follows good practice
• Protects the rights of employees, test subjects and other partners
• Is open about how the company stores and processes personal data
• Protects personal data from the risk of data breach

2. Contact information on the data controller

InnoCon Medical is the data controller and is responsible for ensuring that personal data is processed in compliance with the regulation.

Contact information:

Address: Lyngvej 1, 9000 Aalborg
CVR: 38635794
Telephone: +45 9398 7033
Email: contact@innoconmedical.dk
Website: www.innoconmedical.com
Contact person: Dianna Mærsk Knudsen

3. Purpose of data processing

InnoCon Medical is processing data for specific purposes based on the following legal grounds:

• Processing is necessary for the performance of a contract (employee contract), Article 6, 1(b)
• Processing is necessary for compliance with legal obligation (employees, test subjects), Article 6, 1(c)
• The data subject has given consent to the processing (e.g., test subjects in clinical studies, cookie tracking), Article 6, 1(a)
• Processing is necessary for legitimate interests pursued by InnoCon Medical (e.g., marketing, SoMe activity, internal documentation), Article 6, 1(f)

Purposes of processing:

1. Employees:
   • a. Administration of employment
   • b. Fulfilment of law (employer obligations)
   • c. Promotion of the company on websites
2. Test subjects:
   • a. Administration of study
   • b. Fulfilment of law
   • c. Assessment of test results
3. Marketing:
   • a. Promotion of the company and its activities via digital channels such as the website, LinkedIn, and other platforms, including the sharing of relevant content on third-party platforms.
   • b. Analysis of communication and visitor interactions to improve visibility, website functionality, and user experience, with the aim of making content and services more relevant and accessible.
   • c. Planning and development of future initiatives, such as targeted campaigns, newsletters, or product-related communications, based on consent or legitimate interest, where applicable.

4. Personal data categories

InnoCon Medical is processing the following personal data:

1. Employees:
   • a. Personal data: Data regarding employment for administration, this includes:
     • i. CPR number, name, address, position, employment, education, CV
     • ii. Salary, banking data, paychecks, tax rates, pension
     • iii. Sick leave, parental leave
     • iv. Correspondence between employee and manager of specific circumstantial contents, disciplinary warnings, etc.
   • b. Special categories of personal data:
     • i. Portrait photos

Besides this, personal data from potential applicants is processed occasionally. Data is limited to CV and contact information on the applicant.

2. Test subjects:
   • a. Personal data: Contact information, this includes:
     • i. Name, address, telephone, email
     • ii. Data required for the specific study, e.g., anatomical data, physiological signals, number and types of genital piercings
   • b. Special categories of personal data:
     • i. Data required for the specific study, e.g., health data and race/ethnicity

3. Visitors on the InnoCon Medical website:
   • a. Technical and usage data collected via analytics tools, including, for example:
     • i. Page views, session duration, bounce rate
     • ii. Browser type, device type, operating system, screen size
     • iii. Geographic region (e.g., country), and referrer source (e.g., search engine)

   • This data is collected in anonymized or pseudonymized form and does not include direct identifiers such as name, email, or IP address. For detailed information on the cookies and tracking technologies used on our website, please see InnoCon Medical’s Cookie Policy.

   • b. Personal data provided directly by visitors via website forms (e.g., name, email address, phone number, message content). Such data is collected with the visitor’s consent and used only for the stated purpose (e.g., answering inquiries, sending newsletters, or recruitment for studies).

4. Visitors on InnoCon Medical’s SoMe platforms:
   • a. Data may be collected on SoMe platforms by the respective providers in accordance with their own privacy and cookie policies.

5. Transfer of personal data

InnoCon Medical is transferring personal data on employees for the fulfilment of employer obligations (e.g., to tax authorities).

Personal data collected directly by InnoCon Medical from test subjects (e.g., for user panels) is not transferred to third parties.

InnoCon Medical does not transfer personal data from the website or SoMe visitors to third parties.

6. Origin of personal data

In general, personal data processed within InnoCon Medical originates from the data subject.

For employee administration, personal data is also retrieved from public authorities, e.g., tax authorities.

7. Data storage and erasure

Employees/applicants:

• Personal data on applicants is deleted at latest 2 years after termination of recruitment case.
• Personal data on former employees is deleted 5 years after termination of employee case to fulfil Danish accounting laws; however, the following data is kept for compliance with documentation retention requirements related to medical devices (~ at least 15 years after the last device has been placed on the market): name, position, employment, education, and CV.

Test subjects:

• Personal data on test subjects is anonymized/pseudonymized and thereby not possible/difficult to track back to individual test subject. Personal data that makes it possible to identify a test subject is deleted no later than 18 months after termination of the project for which the data is needed.

Visitors on website and SoMe platforms:

• Visitor data collected via analytics tools is stored for a period defined by the platform in use and is only processed in anonymized or aggregated form. Individual identification is not possible. See cookie and privacy policy of the website and respective platforms for further information.
• InnoCon Medical retains personal data only for as long as necessary to fulfil the purpose for which it was collected or to meet applicable legal or regulatory obligations (section 3). For more detailed information about our data retention practices, please contact InnoCon Medical using the contact information provided above.

8. Consent

When possible, InnoCon Medical will process personal data on legitimate interest or another legal basis rather than consent. InnoCon Medical only relies on consent from data subjects when it is necessary for processing of personal data according to the purposes described above, e.g., test subjects in studies.

If InnoCon Medical asks for your consent, your consent is voluntary and can be withdrawn at any time by contacting InnoCon Medical.

If you choose to withdraw your consent, it does not affect the legality of InnoCon Medical’s processing of your personal data based on your prior consent and until the date of withdrawal. If you withdraw your consent, it will therefore not be effective until this date.

9. Rights of data subject

According to the regulation, you have some fundamental rights as a data subject, in relation to InnoCon Medical's processing of your personal data:

1. Right to be informed, about whether personal data concerning you is processed within InnoCon Medical.
2. Right of access, to the personal data InnoCon Medical is processing on you.
3. Right to rectification, if the personal data that InnoCon Medical is processing is inaccurate.
4. Right to erasure, of your personal data that InnoCon Medical is processing, when there is no longer legitimate interests for retaining the data.
5. Right to restriction of processing, if the data is contested to be inaccurate or no longer needed, or the processing is unlawful or you have objected to processing.
6. Right to data portability, so your personal data can be transmitted in a structured, commonly used format to another controller.
7. Right to object, to InnoCon Medical’s processing of personal data concerning you.

You can make use of your rights, including objecting to the processing of InnoCon Medical of personal data concerning you, by contacting InnoCon Medical, using the contact information above.

If you contact InnoCon Medical with a request regarding, e.g., rectification or erasure of your personal data, InnoCon Medical will assess if the conditions are met, and in that case, implement the rectification or erasure as soon as possible.

10. Complaint authority

You have the right to lodge a complaint to the data protection authority if you are unsatisfied with the way InnoCon Medical is processing your personal data. In Denmark, the relevant authority is Datatilsynet (datatilsynet.dk).

11. Revision of Privacy Policy

InnoCon Medical reserves the right to revise this Privacy Policy.

Most recent update to the Privacy Policy: 2025-10-30.